ict third-party service provider

DORA aims to minimize risks from digital transformation, but implementing its complex requirements remains a hurdle for many financial enitites. Further interpretation guidance and practical tools are urgently needed.

The current draft of the lacking regulatory technical standards (RTS) for DORA still contains some ambiguities, particularly regarding the classification of financial entities as ICT third-party service providers. EIOPA has now issued interpretation notes to reduce these ambiguities. There has also been movement on the subject of RTS for subcontracting. An overview.

DORA places new demands on the digital resilience of financial companies, while the distinction between financial and ICT services raises questions in detail. Clear principles for interpreting the regulations are urgently needed to create legal certainty for the industry.