DORA gives the three European Supervisory Authorities direct oversight of the cloud, data and software providers that EU finance depends on most, which means a designated provider now answers to an EU Lead Overseer as well as to its customers. This guide explains how critical ICT third-party providers (CTPPs) are designated, who oversees them, what oversight involves (information requests, investigations, inspections and recommendations), what it costs, how a provider can opt in, and what changes for the financial entities that use them. It is written for risk, compliance and security leads at ICT providers serving EU financial entities, and for third-party risk teams at banks, insurers and investment firms. It builds on the DORA Guide and does not repeat the financial-entity obligations. Status line: checked on 27 October 2026 against the ESAs' DORA oversight pages, the ESAs oversight guide of 15 July 2025 and the 18 February 2025 designation roadmap. This guide is not legal advice.
Key takeaways
- Designation is by the ESAs: EBA, EIOPA and ESMA designate CTPPs under Article 31 of DORA, through the Joint Committee on a recommendation of the Oversight Forum, using criteria in Delegated Regulation (EU) 2024/1502.
- One Lead Overseer per CTPP: the ESA responsible for the financial entities holding the largest share of total assets among the provider's customers leads, supported by a Joint Examination Team (JET) under Article 40.
- Recommendations, not fines, are the main tool: recommendations are non-binding, but a CTPP has 60 calendar days to say whether it will follow them, and a refusal without adequate reasons can be disclosed publicly under Article 42(2).
- The last resort hits customers: competent authorities may, as a measure of last resort, require a financial entity to suspend or terminate its use of a CTPP's service.
- Customers stay accountable: the ESAs say oversight complements rather than replaces financial entities' own ICT third-party risk duties.
Scope: who and what is covered
The ESAs describe the oversight framework as addressing potential systemic and concentration risks from the financial sector's reliance on a small number of ICT providers. A CTPP is an ICT third-party service provider designated as critical by the ESAs.
Designation criteria
The ESAs oversight guide groups the criteria into four domains and assesses 11 criteria, six quantitative and five qualitative, in a two-step process applied mainly to financial entities' registers of information:
| Domain | What it measures | Main data source |
|---|---|---|
| Systemic impact | Effect on the stability, continuity or quality of financial services if the provider failed | Registers of information plus other information |
| Systemic character of the relying financial entities | Whether the provider's customers are themselves systemically important | Registers and supervisory data |
| Reliance for critical or important functions | How far customers depend on the provider for functions they classify as critical or important | Registers of information |
| Substitutability | How hard it is to migrate to another provider or bring the service in-house | Registers and other information |
The register of information is therefore the raw material for designation. See the DORA ICT Third-Party Risk and Register of Information Guide.
Who does what
| Body | Role |
|---|---|
| Joint Committee of the ESAs | Formally designates CTPPs on the Oversight Forum's recommendation |
| Oversight Forum | Recommends designations and supports consistent oversight; members declare interests |
| Lead Overseer (one ESA) | Runs oversight of each CTPP; the ESAs say they work "as one team" through a joint directorate |
| Joint Examination Team | ESA and competent authority staff, coordinated by an LO coordinator, doing day-to-day work; NIS authorities may join voluntarily |
| National competent authorities | Follow up with the financial entities that use the CTPP, including the last-resort suspension or termination measure |
Key obligations
For a designated provider, the ESAs oversight guide describes these duties:
- Cooperate in good faith with the overseers.
- Maintain a coordination point: group CTPPs designate one EU-established legal person as the coordination point, with adequate staff, authority, financial resources and premises. Non-EU CTPPs must establish an EU subsidiary.
- Answer information requests: simple requests (Article 37) carry no financial penalty for missed deadlines; requests made by decision do.
- Support general investigations (Article 38) opened by decision and written authorisation, including examination of records and summoning representatives.
- Allow inspections (Article 39), which can include on-site access to premises, systems and data.
- Respond to recommendations: submit evidence of impacts on non-financial customers and mitigation proposals within 30 days where relevant, then notify within 60 calendar days whether it will follow each recommendation or give a reasoned explanation.
- Deliver remediation: provide a remediation plan and interim or final progress reports when asked.
- Pay oversight fees that fully cover the Lead Overseer's expenditure, calculated using turnover data (Delegated Regulation (EU) 2024/1505).
- Notify management structure changes within the group.
What the Lead Overseer assesses
The guide says the Lead Overseer assesses whether the CTPP has rules, procedures and arrangements to manage the ICT risk it may pose to financial entities. Recommendations follow investigations and inspections within three months and are tied to specific findings. Expect scrutiny of identity and access management for the provider's own administrators, segregation between customer tenants, incident handling, subcontracting chains and resilience testing.
The legal instruments behind oversight
| Instrument | What it governs | DORA basis |
|---|---|---|
| Commission Delegated Regulation (EU) 2024/1502 | Criteria for designating ICT third-party service providers as critical | Article 31(8) |
| Commission Delegated Regulation (EU) 2024/1505 | Oversight fees charged by the Lead Overseer, including the fixed opt-in fee | Article 43(2) |
| Delegated Regulation (EU) 2025/295 (RTS) | Harmonised conditions for conducting oversight activities, including opt-in applications | Article 41 |
| Delegated Regulation (EU) 2025/420 (RTS) | Composition and tasks of the Joint Examination Team | Article 41(1)(c) |
| Joint Guidelines JC-GL-2024-36 | Cooperation and information exchange between the ESAs and competent authorities on oversight | Article 32(7) |
| ESAs decision of 8 November 2024 (updated 29 January 2025) | Information competent authorities report to the ESAs for designation | Designation process |
| ESAs DORA oversight guide (15 July 2025) | Non-binding explanation of how oversight is run in practice | Oversight framework |
Read the delegated regulations alongside the guide: the guide is explanatory, while the delegated acts and DORA itself are binding. Providers outside the EU should note that the ESAs have published an equivalence assessment for the UK FCA and PRA and a memorandum of understanding with the UK authorities, which matters for providers overseen in both jurisdictions.
Timeline and current status
| Date | Milestone |
|---|---|
| 8 November 2024 (updated 29 January 2025) | ESAs decision on information competent authorities report for CTPP designation |
| 17 January 2025 | DORA date recorded by EUR-Lex for the regulation |
| 18 February 2025 | ESAs publish roadmap towards designation |
| 30 April 2025 | Competent authorities submit registers of information to the ESAs |
| By July 2025 (roadmap target) | Providers notified of critical classification, followed by a six-week window to object with a reasoned statement |
| 15 July 2025 | ESAs publish the DORA oversight guide |
| 2025 (roadmap target) | Designation and start of oversight engagement |
| Annually | The ESAs publish and update the list of CTPPs (Article 31(8), as described by ESMA) |
Check the current list on the ESAs' websites rather than relying on press reports, because the list is updated annually. Each year the overseers run an oversight risk assessment, prepare an individual annual oversight plan per CTPP shared with the provider, and maintain a three-year multi-annual plan.
Opting in
A provider that has not been designated can ask to be (Article 31(11) DORA and Delegated Regulation (EU) 2025/295). It submits a reasoned application using the ESAs' opt-in form, pays a fixed opt-in fee of EUR 50,000 under Article 4(3) of Delegated Regulation (EU) 2024/1505, and the ESAs reply within six months of formal receipt. Group applications cover the ICT services provided by the group as a whole, and non-EU entities apply in English. Providers usually weigh the commercial value of being seen as overseen against fees and inspection exposure.
Enforcement and penalties
- Periodic penalty payments: the ESAs guide confirms that periodic penalty payments under Article 35(6) to (11) may be imposed for non-compliance, for example with a decision-based information request or inspection. Check the regulation text for amounts and duration.
- Public disclosure: where a CTPP does not follow a recommendation and its explanation is insufficient, DORA requires the overseers to disclose the CTPP's identity and the type and nature of the non-compliance (Article 42(2), as summarised in the guide).
- Customer-side measures: competent authorities assess the impact on financial entities, may issue warnings, and as a last resort may require a financial entity to suspend or terminate use of the service. Opposing an inspection can lead to the same outcome.
The practical sanction is commercial: a public notice or a supervisor-driven exit plan reaches every financial customer.
What it means for AI agents and non-human identities
The oversight framework does not mention machine identities, but the risks it targets are concentrated in them. A CTPP's own control plane runs on privileged service principals, deployment pipelines and support tooling with access to many customer tenants, and the customer side integrates through API keys, OAuth clients and federated workload identities.
- For CTPPs: expect the Lead Overseer to ask how provider-side privileged and automated access to customer environments is granted, logged and revoked, including AI-assisted operations tools. See the Privileged Access Management Guide.
- For financial entities: the register of information records which functions depend on which provider; add the machine credentials that bind each integration so that a suspension or exit order can be executed. See the Third-Party Concentration Risk Guide.
- For both: AI agents operating across a CTPP's services should have unique identities, owners and scoped permissions, because a recommendation about access governance will apply to them too. See the Agent Identity and Access Guide.
Compliance steps
For ICT providers that are, or may be, designated
- Estimate exposure: list EU financial customers and the functions they rely on you for; assume your customers' registers already describe you.
- Prepare the objection case: if notified, you have six weeks to submit a reasoned statement with supporting information.
- Stand up the coordination point in an EU legal entity with authority and resources, and a single regulatory evidence function.
- Build an evidence library mapped to the Lead Overseer's assessment areas: ICT risk management, access control, incident management, subcontracting, testing and exit support.
- Rehearse an inspection including on-site access and data requests.
- Set up a recommendations workflow that can produce a 60-day response and a remediation plan.
For financial entities using a CTPP
- Flag CTPP status in the register of information and in vendor risk tiers.
- Keep doing your own due diligence; oversight does not replace it.
- Track public notices and recommendations affecting your CTPPs.
- Maintain tested exit and substitution plans for critical or important functions, including the credential and data steps.
Decision guidance
| Situation | Option A | Option B |
|---|---|---|
| Provider near the thresholds | Opt in: EUR 50,000 fee and oversight, in exchange for a recognised status | Stay out: lower cost, but customers still push DORA contract terms onto you |
| Recommendation you disagree with | Follow it with a remediation plan | Give a reasoned explanation within 60 days, accepting the risk of public disclosure if found insufficient |
| Financial entity with high CTPP concentration | Multi-provider architecture for critical functions | Single provider with tested exit plan and contractual exit support |
Framework mapping and metrics
| Activity | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Supplier criticality and concentration | GV.SC-04 | SR-6 |
| Supplier oversight across the relationship | GV.SC-07 | SA-9 |
| Exit and termination planning | GV.SC-10 | CP-2, SA-9 |
- Recommendations answered within 60 days (provider, target 100%).
- Open remediation items past their committed date.
- Critical functions on a CTPP with a tested exit plan (financial entity).
- Provider-side privileged and machine access paths to customer tenants with logging and owner.
Common failure patterns
- Treating designation as a customer issue: providers that wait for notification lose the six-week objection window to evidence gathering.
- Thin registers: financial entities filing incomplete registers distort the designation data and their own concentration view.
- Assuming oversight equals assurance: customers dropping their own diligence once a provider is designated, which the ESAs say oversight does not replace.
- Exit plans without identity steps: plans that move data but forget to revoke the provider's credentials and integrations. The Third-Party Concentration Risk Guide covers the July 2024 outage lessons.
Practitioner checklist
- Confirm whether your organisation, or a key provider, is on the current ESAs CTPP list.
- Identify the Lead Overseer and coordination point for each relevant CTPP.
- Providers: build the evidence library and a 60-day recommendation response process.
- Providers: decide deliberately on opt-in using the EUR 50,000 fee and six-month assessment.
- Financial entities: mark CTPP status in the register of information.
- Financial entities: test exit plans, including revoking machine credentials.
- Monitor ESAs publications for public notices and list updates.
- Map provider-side privileged and automated access into customer tenants.
- Read Delegated Regulations 2024/1502, 2024/1505, 2025/295 and 2025/420 alongside the ESAs guide before any oversight engagement.
Standards and references
- EIOPA (for the ESAs): DORA oversight
- ESAs: Guide on oversight activities under DORA
- ESAs: Roadmap towards the designation of CTPPs under DORA
- ESMA: DORA oversight
- ESMA: Digital Operational Resilience Act
- EIOPA: Digital Operational Resilience Act
- EUR-Lex: Regulation (EU) 2022/2554 (DORA)
Related NHI Mgmt Group resources: DORA Guide · DORA ICT Third-Party Risk and Register of Information Guide · Third-Party Concentration Risk Guide · DORA and NIS2 Overlap Mapping Guide. This guide summarises the DORA oversight framework for critical ICT third-party providers and is not legal advice.