§ DORA · Article 40

DORA Article 40: Obligations, Deadlines & Penalties

Regulation (EU) 2022/2554, Article 40 · All obligations · DORA

At a glance

Article 40 of the DORA imposes 5 obligations on Lead Overseer. At least one obligation carries an explicit compliance deadline.

§ Obligations

All obligations under Article 40

Obligation 1

The Lead Overseer shall be assisted by a joint examination team established for each critical ICT third-party service provider when conducting oversight activities. Regulation (EU) 2022/2554, Article 40, Article 40

Obligated entity: Lead Overseer
Action required: establish
Deadline: —
Penalty: —

Obligation 2

The joint examination team shall be composed of staff members from the ESAs, relevant competent authorities, and optionally national competent authorities, with expertise in ICT matters and operational risk. Regulation (EU) 2022/2554, Article 40, Article 40

Obligated entity: Lead Overseer
Action required: compose
Deadline: —
Penalty: —

Obligation 3

The joint examination team shall work under the coordination of a designated Lead Overseer staff member (the ‘Lead Overseer coordinator’). Regulation (EU) 2022/2554, Article 40, Article 40

Obligated entity: Lead Overseer
Action required: coordinate
Deadline: —
Penalty: —

Obligation 4

Within 3 months of the completion of an investigation or inspection, the Lead Overseer, after consulting the Oversight Forum, shall adopt recommendations to be addressed to the critical ICT third-party service provider. Regulation (EU) 2022/2554, Article 40, Article 40

Obligated entity: Lead Overseer
Action required: adopt
Deadline: 3 months of the completion of an investigation or inspection
Penalty: —

Obligation 5

The recommendations shall be immediately communicated to the critical ICT third-party service provider and to the competent authorities of the financial entities to which it provides ICT services. Regulation (EU) 2022/2554, Article 40, Article 40

Obligated entity: Lead Overseer
Action required: communicate
Deadline: immediately
Penalty: —

§ Frequently asked

Questions about Article 40

Who must comply with Article 40 of the DORA? +

Lead Overseer.

What does Article 40 of the DORA require? +

establish compose coordinate

What is the compliance deadline for DORA Article 40? +

3 months of the completion of an investigation or inspection; immediately

Need a cross-border briefing on DORA Article 40?

Search Fontvera ↵

All EU obligation pages · All DORA articles