- within Finance and Banking, Environment and Law Department Performance topic(s)
- in United States
The European Supervisory Authorities (EBA, EIOPA, and ESMA – collectively, the ESAs) have published the list of designated critical ICT third-party providers (CTPPs) under the EU Digital Operational Resilience Act (DORA).
Designated CTPPs
The list comprises 19 companies that deliver a wide range of ICT services - from core infrastructure to business and data services - to financial entities of all types and sizes across the EU. The ESAs describe these providers as playing a "pivotal role within the financial ecosystem."
Designation process
The designation process followed the methodology set out in Article 31 of DORA:
- Data collection: the ESAs gathered information from the Registers of Information maintained by financial entities, detailing their contractual arrangements for ICT services.
- Criticality assessment: in cooperation with EU competent authorities across banking, insurance and pensions, and securities and markets, the ESAs conducted a detailed assessment of each provider's systemic importance, its role in supporting critical or important functions for financial entities and the substitutability of its services.
Next steps
The designation will not come as a surprise to the CTPPs, as they were informed in advance and had a right to be heard during the process. The ESAs will continue to engage with these providers as part of upcoming examination activities.
UK developments
This development offers insight into the types of providers that could be designated by HM Treasury (under s312L of the Financial Services and Markets Act 2000) as a "critical third party" (CTP) under the similar new UK CTP regime. No CTPs have been designated yet.
Last week, the House of Commons Treasury Select Committee published a letter from HM Treasury responding to questions about the regime that were raised by the committee during a recent evidence session.
HM Treasury confirmed that:
- no designation decisions have been taken yet;
- initial designations are expected within the next 12 months; and
- once designations are made, the associated regulations will be published and the names of designated CTPs will appear on the government's website.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
