§ DORA · Article 38
DORA Article 38: Obligations, Deadlines & Penalties
At a glance
Article 38 of the DORA imposes 6 obligations on Lead Overseer, critical ICT third-party service provider. At least one obligation carries an explicit compliance deadline. Non-compliance may result in administrative fines or other penalties.
§ Obligations
All obligations under Article 38
Obligation 1
Officials and other persons authorised by the Lead Overseer must exercise their investigation powers upon production of a written authorisation specifying the subject matter and purpose of the investigation.
Regulation (EU) 2022/2554, Article 38, Article 38
- Obligated entity
-
Lead Overseer
- Action required
-
produce
- Deadline
-
—
- Penalty
-
—
Obligation 2
The written authorisation for investigation must indicate the periodic penalty payments provided for in Article 35(6) where required records or answers are not provided or are incomplete.
Regulation (EU) 2022/2554, Article 38, Article 38
- Obligated entity
-
Lead Overseer
- Action required
-
indicate
- Deadline
-
—
- Penalty
-
—
Obligation 3
Representatives of critical ICT third-party service providers are required to submit to investigations on the basis of a decision of the Lead Overseer.
Regulation (EU) 2022/2554, Article 38, Article 38
- Obligated entity
-
critical ICT third-party service provider
- Action required
-
submit
- Deadline
-
—
- Penalty
-
periodic penalty payments provided for in Article 35(6)
Obligation 4
The decision to investigate must specify the subject matter and purpose of the investigation, the periodic penalty payments, the legal remedies available, and the right to have the decision reviewed by the Court of Justice.
Regulation (EU) 2022/2554, Article 38, Article 38
- Obligated entity
-
Lead Overseer
- Action required
-
specify
- Deadline
-
—
- Penalty
-
—
Obligation 5
The Lead Overseer shall inform competent authorities of the financial entities using the ICT services of the critical ICT third-party service provider of the envisaged investigation and the identity of the authorised persons in good time before the start of the investigation.
Regulation (EU) 2022/2554, Article 38, Article 38
- Obligated entity
-
Lead Overseer
- Action required
-
inform
- Deadline
-
in good time before the start of the investigation
- Penalty
-
—
Obligation 6
The Lead Overseer shall communicate to the JON all information transmitted to competent authorities pursuant to the first subparagraph of paragraph 5.
Regulation (EU) 2022/2554, Article 38, Article 38
- Obligated entity
-
Lead Overseer
- Action required
-
communicate
- Deadline
-
—
- Penalty
-
—
§ Frequently asked
Questions about Article 38
Who must comply with Article 38 of the DORA?
+
Lead Overseer, critical ICT third-party service provider.
What does Article 38 of the DORA require?
+
produce indicate submit
What is the compliance deadline for DORA Article 38?
+
in good time before the start of the investigation
What are the penalties for non-compliance with DORA Article 38?
+
periodic penalty payments provided for in Article 35(6)