Art.31 Designation of critical ICT third-party service providers

The ESAs, through the Joint Committee, designate which ICT third-party service providers are critical, according to systemic impact, the importance of the institutions relying on them, reliance for critical or important functions and substitutability, and publish the list yearly; each designated provider gets a Lead Overseer and must tell the financial entities it serves of its designation. Designation does not cover financial entities that supply ICT services to other financial entities, providers under oversight supporting Article 127(2) TFEU tasks, intra-group providers, or providers serving only entities active in a single Member State (Art. 31(8)). For financial entities the duty is to track which of their providers are designated and reflect it in third-party risk management; a designated provider established in a third country may be used only if it has set up a Union subsidiary within 12 months of designation (Art. 31(12)).

Source: DORA (Regulation (EU) 2022/2554), Art.31. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.

Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.