DORA Critical ICT Third-Party Providers Guide

DORA became applicable on 17 January 2025, applying across EU financial services: credit institutions, investment firms, insurance undertakings, payment institutions, and others listed in Article 2. Its third-party chapter reflects a regulatory judgement that concentration risk in a small number of dominant ICT providers, particularly hyperscale cloud platforms, poses a systemic threat that firm-level due diligence alone cannot address.

The critical CTPP designation mechanism is the legislative response to that concentration risk. Rather than relying solely on financial entities to oversee their own suppliers, DORA empowers the ESAs to supervise designated providers directly. This creates obligations that run in two directions: designated providers are accountable to ESA lead overseers, and financial entities using those providers must structure their relationships in ways that make ESA oversight practicable.

In November 2025, the ESAs published the first official list of 19 designated critical ICT TPPs, covering major cloud infrastructure providers, core banking platforms, and specialist financial technology firms. For financial entities relying on designated providers, the practical question is whether existing contracts and governance structures meet the heightened scrutiny that designation brings.

Article 31 of DORA sets out the framework for designating ICT third-party providers as critical. The designation is the product of a structured assessment process coordinated by the Joint Oversight Network (JON) and the Oversight Forum, the bodies established under Article 32 to coordinate ESA oversight activities across EBA, EIOPA, and ESMA.

The Designation Criteria

The ESAs assess potential critical ICT TPPs against criteria set out in Article 31(2). Assessment covers the systemic impact that a failure or operational disruption of the ICT TPP would have on the financial entities it serves, the systemic character or importance of those financial entities, the degree to which they rely on the provider for critical or important functions, and the degree of substitutability.

Substitutability is the criterion with the most practical weight. A provider serving a large proportion of systemically important institutions with few credible alternatives represents the clearest case for designation. Hyperscale cloud providers, major core banking platforms, and dominant data analytics providers have been widely discussed as likely candidates in ESA consultations, and the November 2025 designation list confirmed several of these.

How Designation Is Triggered

One ESA acts as lead overseer for each designated critical ICT TPP, assigned based on the financial sector where the provider has its predominant use. Once the assessment is complete and designation confirmed, the relevant ESA formally notifies the ICT TPP. From that point, the provider is subject to the oversight framework set out in Articles 33 to 35, which includes the right to request information, conduct general investigations, and carry out on-site inspections. Financial entities should monitor ESA oversight publications for updates to the designated CTPP list, which is published and updated annually.

Designation leaves the services a critical ICT TPP provides unchanged. It imposes significant oversight obligations and rights of access that have direct implications for how financial entities structure their contracts with those providers.

ESA Audit and Information Rights

Under Article 35, the lead overseer has the right to request all information and documentation relevant to the services the critical ICT TPP provides to financial entities, conduct general investigations including interviews with personnel, and carry out on-site inspections at the premises of the critical ICT TPP with reasonable notice. These rights extend to material subcontractors that the critical ICT TPP itself relies on for services delivered to financial entities. For financial entities, this means their contractual arrangements with critical ICT TPPs must include provisions that do not obstruct these rights of access.

Oversight Recommendations and Compliance Consequences

The lead overseer can issue recommendations to critical ICT TPPs under Article 35(1)(d). Where a critical ICT TPP fails to comply with information requests, investigations, or required remediation actions under Article 35(1)(a)-(c), the Lead Overseer may impose periodic penalty payments of up to 1% of the critical ICT TPP's average daily worldwide turnover, applied daily for up to six months under Article 35(6)-(8). Recommendations issued under Article 35(1)(d) carry significant commercial and reputational weight; non-compliance with the information and remediation obligations that flow from oversight activities triggers the financial penalty regime.

Under Article 42, where a financial entity fails to adequately address risks identified in lead overseer recommendations, competent authorities can require the financial entity to temporarily or permanently suspend use of the critical ICT TPP's services, or to terminate the contractual arrangement entirely, as a measure of last resort. This is a significant operational risk for any firm heavily dependent on a designated CTPP without a tested exit plan.

For enterprises using critical ICT TPPs, DORA creates obligations that sit alongside and reinforce the general third-party risk management framework. Three governance areas demand particular attention.

Contractual Obligations Under Article 30

Article 30 sets out the mandatory minimum content for contracts between financial entities and ICT third-party providers. These requirements apply to all material ICT service agreements, and they take on heightened compliance significance when the provider is subject to ESA oversight. The contract must be the mechanism through which the financial entity can demonstrate its governance obligations are enforceable. The mandatory provisions are set out in the Article 30 checklist below.

Ongoing Monitoring and Internal Escalation

Financial entities must maintain continuous monitoring of critical ICT TPP performance against contractual service levels and ICT risk indicators. Article 28 requires that the monitoring framework is integrated into the entity's broader Third-Party risk management function, with clear escalation paths to the management body when material risks are identified.

For multi-entity groups or financial entities operating across multiple jurisdictions, the monitoring architecture must account for the fact that a single critical ICT TPP relationship may serve multiple legal entities simultaneously, each with their own regulatory obligations and competent authority. Central governance functions should maintain a consolidated view of critical ICT TPP exposure across the group.

Register of Information and Exit Planning

Under Article 28(3), financial entities are required to maintain a register of information covering all contractual arrangements with ICT third-party providers. For critical ICT TPPs, this register must be granular enough to support supervisory review. Significant institutions feed the register into supervisory reporting, and competent authorities can request it at any point.

Exit planning is a specific obligation under Article 28. Financial entities must develop and maintain documented exit strategies for critical ICT dependencies, including the capacity to migrate to alternative providers without unacceptable operational disruption. Where a designated critical ICT TPP has no near-term substitute, exit strategy documentation must address that constraint honestly and set out the risk management controls in place during the dependency period. Exit strategies must be tested as a genuine operational process, in addition to being formally documented.

DORA Article 30 has a two-tier structure. Article 30(2) sets out nine provisions that apply to all ICT third-party contractual arrangements. Article 30(3) sets out six additional provisions that apply specifically to contracts supporting critical or important functions. Legal and procurement teams should review both tiers against any material ICT third-party contract, and apply the full Article 30(3) requirements to any contract supporting a critical or important function.

Article 30(2): Provisions Applicable to All ICT Third-Party Contracts

Article 30(3): Additional Provisions for Contracts Supporting Critical or Important Functions

Article 30(3) provisions apply to all contracts between financial entities and ICT third-party providers that support critical or important functions, regardless of whether the provider is formally designated as a critical ICT TPP under Article 31. For designated critical ICT TPPs, both tiers apply in full.

For designated critical ICT TPPs, contracts must additionally include explicit provisions enabling ESA Lead Overseer access, documentation requests, and cooperation with oversight activities. This obligation derives from Article 35 and applies only where the provider has been formally designated as a critical ICT TPP by the ESAs.

The DORA oversight framework acknowledges a practical limitation: a financial entity cannot exit a critical ICT dependency simply because the provider has been designated. The regulatory response is governance: demonstrable oversight in the absence of a viable near-term exit. Enterprises must be able to demonstrate that critical ICT TPP dependencies are visible to the management body, that contractual protections are current against the Article 30 checklist, that ongoing monitoring generates substantive risk intelligence beyond SLA dashboards, and that exit strategy documentation is genuine and tested.

The ESA oversight framework operates in parallel with financial entity obligations, alongside them rather than as a substitute. Designation of a provider as critical does not discharge the financial entity's duty to govern that relationship. It intensifies supervisory scrutiny of whether that governance is adequate. Supervisory scrutiny of Register of Information quality and third-party governance is expected to intensify through the 2026 supervisory cycle, as competent authorities move from implementation assessment to active compliance examination.