DORA critical ICT third-party providers: what designation changes for you
The European Supervisory Authorities (ESAs) designate critical ICT third-party service providers, and the first list of 19 providers was published on 18 November 2025. If your bank, insurer, payment institution or ICT provider relies on one of these firms, a designation does not transfer your DORA obligations to the provider. You still own your ICT risk management, your register of information entries, your contracts and your exit plans. What changes is who supervises the provider's own ICT risk management, and that is the ESAs and their Lead Overseers, not your competent authority.
The practical answer depends on two questions. First, is the provider on the list? Second, does your entity use its services to support critical or important functions? Only a provider on the list is overseen under the Section II regime, and the reliance question determines how closely your own third-party risk process must scrutinize that dependency. Because the designation and its effect on your supervision sit with your competent authority, confirm the treatment for each relevant provider with that authority before you change contract terms or concentration risk assessments. Ask in writing which provider names your authority considers in scope and how it expects you to reflect oversight outcomes in your records.
Roles matter here. The ESAs and the Lead Overseers assess providers, issue recommendations and can request information, but they do not decide what your institution must do for its own controls. Your organization keeps ownership of its DORA controls and its decisions on whether to continue, restrict or exit a service. An implementation partner can help assemble the register entries, contract evidence and exit documentation that show how you reflect a provider's status, but it cannot issue a determination on the provider or on your compliance. Any statement about a provider's designation should be checked against the ESAs' published list and against your authority's guidance.
How the ESAs decide which providers are critical
Designation rests on four criteria in Article 31(2) and a two-step quantitative test in Delegated Regulation (EU) 2024/1502. The cards below follow the path from the criteria to the final decision, which is the part financial entities most often misread when they assess their own ICT providers.
Systemic impact of a failure
The first criterion asks how far a disruption at the provider would spread across the financial sector. Assessors look at the provider's services as a whole, not only the contracts individual firms hold. For a customer, the practical question is whether your provider also serves a large share of the market you operate in, because a failure there would reach your operations through other institutions too. Confirm which of your providers already appear in the published list.
Systemic importance of dependent entities
The second criterion looks at who relies on the provider. A provider serving systemically important financial entities scores higher than one serving a few small firms, even when the service is identical. This means designation depends on the provider's customer base across the EU, so the same cloud or software service can be assessed differently for different providers of the same product. Ask your provider how its client mix is reported to the register of information.
Reliance for critical or important functions
The third criterion asks whether financial entities depend on the provider for functions that are critical or important, meaning functions whose disruption would materially impair compliance, financial performance or the continuity of services. Reliance is judged from the entities' own registers of information, so a provider that is embedded in payments, settlement or core banking processes is more likely to be caught. For your own register, identify which ICT services support these functions and record them accurately.
Substitutability of the provider
The fourth criterion asks how difficult it would be for financial entities to replace the provider. Limited alternatives, proprietary dependencies, and costly or slow migration all raise the risk that a failure becomes systemic. Substitutability is therefore a question about lock-in and exit, not about the provider's size. Financial entities should test whether their exit plans for each critical service are realistic, since the same weaknesses will count against the provider in the ESAs' assessment.
Two-step quantitative test
Delegated Regulation (EU) 2024/1502 sets a two-step test. In step 1, a provider qualifies on systemic impact if its services supporting critical or important functions reach at least 10 % of both the number and the total assets of financial entities in at least one DORA category. Step 2 applies further assessment to providers that pass step 1. Providers and their customers should check how the thresholds are measured, because the test counts both entities and assets in each category.
Joint Committee decision and reasoned statements
The ESAs act through their Joint Committee, on the recommendation of the Oversight Forum. Before final decisions, the ESAs notify each provider, which may submit a reasoned statement contesting the proposed outcome. The ESAs used register of information data and a criticality assessment with national competent authorities for the first list, published on 18 November 2025. Providers that receive notice should prepare a documented response, and financial entities should monitor the yearly update of the list under Article 31(9).
Oversight of a critical provider, from notice to recommendation
The sequence runs from the ESAs' designation decision to a Lead Overseer's recommendation, with each phase producing a record that shows how the provider's ICT risk is being examined. Financial entity customers see the effects through the provider's answers, the oversight plan and any follow-up that reaches them.
Assess providers against the designation criteria
The ESAs, working through their Joint Committee on recommendation from the Oversight Forum, test candidate providers against the four criteria in Article 31(2): systemic impact of a failure, systemic importance of the financial entities relying on the provider, reliance for critical or important functions, and substitutability. The two-step quantitative test in Delegated Regulation (EU) 2024/1502 feeds the systemic impact assessment. The ESAs draw on registers of information and a criticality assessment with national competent authorities. The output is a list of candidate providers that moves to notification.
Notify the provider and receive its reasoned statement
Before final decisions, each candidate provider is notified and may submit a reasoned statement setting out why it should not be designated or why the assessment is wrong. The ESAs consider that statement before adopting the designation. The output is a final designation decision recorded on the ESA list. For the first list, the ESAs published 19 designated providers on 18 November 2025, and that list is the reference point for later updates.
Appoint the Lead Overseer for the provider
Each designated provider is assigned to one Lead Overseer: the EBA, EIOPA or ESMA, depending on which financial sectors rely on it most. The Lead Overseer becomes the single point of contact for the provider's oversight. Financial entity customers should confirm which ESA leads the provider they use, since that ESA's published materials are the place to follow its oversight activity. The output is a named Lead Overseer for each provider.
Adopt the annual individual oversight plan
The Lead Overseer assesses the provider's ICT risk management in the areas listed in Article 33(3) and adopts an annual individual oversight plan under Article 33(4). A joint examination team of ESA and national competent authority staff, under Article 40, supports the work. The plan sets out what the Lead Overseer will examine during the year. The output is a written annual plan for each designated provider, which is the basis for every later information request, investigation and inspection.
Request information and run investigations
Under Article 35(1), the Lead Overseer can request information from the provider, conduct general investigations and carry out on-site inspections. Providers should expect requests tied to the annual plan and should prepare evidence in advance, including risk management documentation, subcontracting arrangements and incident records. Non-compliance with these requests leads to the periodic penalty payments described in Article 35(6) to (8). The output is a body of evidence and findings held by the Lead Overseer.
Issue recommendations to the provider
Where findings call for change, the Lead Overseer issues recommendations under Article 35(1). These can include a recommendation to refrain from certain subcontracting with third-country providers. The provider must state within 60 calendar days whether it will follow them, as required by Article 42(1). The output is the provider's written response, which the Lead Overseer uses to decide the next step.
Inform financial entities and manage residual risk
Competent authorities must tell financial entities about risks identified in recommendations to critical providers, under Article 42(3). As a last resort, under Article 42(6), a competent authority may require an entity to suspend or terminate use of a provider's service. Entities should keep their exit plans and register entries current so they can act on these notices. The output is a documented assessment in the entity's third-party risk file showing how it responded.
Refresh the designation list each year
The ESAs must update the list of critical providers each year under Article 31(9), so the sequence restarts with the assessment of candidates and the review of existing designations. The Commission's review due by 17 January 2028 covers the designation criteria and the third-country subsidiary regime under Article 58(1). Financial entities should confirm the current list in the ESA publications before relying on it. The output is an updated list and a fresh cycle of oversight planning.
Who pays for designation and oversight, and what recurs
This table separates the costs that fall on a designated critical provider from the costs that fall on the financial entities that use it. Read the payer column first, then the recurring column, to see which costs repeat each year and which depend on the provider's own conduct.
| Cost component | Who pays | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Annual oversight fee | The critical provider, paid to the Lead Overseer's authority | Recurring, paid in a single instalment each year | Scaled to the provider's applicable turnover, with a minimum of EUR 50 000 under Delegated Regulation (EU) 2024/1505. Costs are split equally among providers on the first list. |
| Periodic penalty payments | The critical provider, only if it fails to respond or report | Recurring while non-compliance continues, imposed daily for up to six months | Up to 1 % of average daily worldwide turnover in the preceding business year under Article 35(6) to (8). Timely answers to information requests and remediation reports keep this at zero. |
| Remediation of Lead Overseer recommendations | The critical provider | Mostly one-time per recommendation, with ongoing monitoring | Depends on the scope of each recommendation, including any advice on third-country subcontracting under Article 35(1). The provider must state within 60 calendar days whether it will follow them (Article 42(1)). |
| Register of information updates | The financial entity | Recurring, with updates as arrangements change | Number of ICT services that support critical or important functions, and how often subcontracting chains change. Providers' identifier data quality affects the effort. |
| Exit plan creation and testing | The financial entity | One-time build, then recurring testing | Complexity of the service, data portability, and how dependent the entity is on one provider. Concentration on a designated provider often raises the effort. |
| Contract review against DORA clauses | The financial entity | One-time for existing contracts, recurring at renewal and on material change | Number of contracts, whether the provider is non-EU, and whether a Union subsidiary is needed under Article 31(12). Ask the provider which contract amendments it already offers. |
| Monitoring of provider designation and oversight outcomes | The financial entity | Recurring, tied to the yearly list update under Article 31(9) | Frequency of list changes and the number of critical providers in the entity's supply chain. Assign an owner who tracks the list and any supervisory notices. |
| Preparation of this work by an implementation partner | The financial entity or the provider, under a written scope | Usually one-time for the project, with optional recurring support | Written scope, number of systems and contracts in view, and the evidence already held. DeployOpen does not publish prices. A quote follows from the agreed scope, so confirm deliverables, timelines and what is excluded before signing. |
Why the first list is a moving target for your planning
The November 2025 list is a starting point, not a settled register. Under Article 31(9), the ESAs must update the list of critical ICT third-party service providers every year, so a provider can be added or removed after the first designation. Build a review step into your third-party risk process that checks each ESA update against your register of information, and record which providers are on the list at the date of each review. Confirm the current list directly from the ESAs rather than relying on a copy you saved earlier.
Article 31(12) also changes the planning picture for providers established outside the EU. A financial entity may use a critical provider established in a third country only if that provider sets up a Union subsidiary within 12 months of designation. If your architecture depends on a designated provider whose contracting entity sits outside the EU, make the subsidiary timeline a dated item in your exit and continuity planning, and ask the provider in writing how and when it will meet the requirement.
The rules themselves may also move. The Commission must review DORA by 17 January 2028 under Article 58(1), and that review covers the designation criteria and the third-country subsidiary regime. Treat the 2028 review as a point where your assumptions about which providers are critical could change. As a last resort under Article 42(6), a competent authority can require a financial entity to suspend or terminate use of a provider's service, so keep tested exit plans for critical functions that do not depend on any single designated provider.
What designation means for each party
A designation does not transfer DORA obligations away from financial entities. They remain responsible for their own ICT risk management and for the third-party arrangements they choose. What changes is the information flow. When a Lead Overseer addresses recommendations to a critical provider, competent authorities must tell the financial entities affected about the risks those recommendations identify. As a last resort, a competent authority may require an entity to suspend or terminate use of the provider's service. Entities should plan for both outcomes before they happen.
- Risk information from competent authorities: Expect notice of risks identified in recommendations to a provider you use, and assess how each risk touches your important functions.
- Last-resort suspension: Keep a documented plan for moving critical services to an alternative or a reduced service model if a suspension or termination is required.
- Exit plans: Maintain tested exit strategies for each designated provider, covering data return, migration and timing.
- Register entries: Keep the register of information current for every arrangement with a designated provider, including subcontracting chains.
- Contract review: Check that contracts let you act quickly on supervisory notices and that the provider must share oversight outcomes.
Ask your competent authority how it will communicate recommendations and which contacts it will use.
A designated provider is overseen directly by the ESAs, not by national authorities. Each provider is assigned a Lead Overseer from the EBA, EIOPA or ESMA, which assesses its ICT risk management and adopts an annual individual oversight plan. A joint examination team of ESA and national staff supports that work. The Lead Overseer can request information, carry out investigations and on-site inspections, and issue recommendations, and the provider must state within 60 calendar days whether it will follow them.
- Lead Overseer supervision: Expect information requests, investigations and on-site inspections under an annual oversight plan.
- Oversight fees: Annual fees cover the Lead Overseers' costs. Under Delegated Regulation (EU) 2024/1505, they are scaled to applicable turnover with a minimum of EUR 50 000, were split equally among providers on the first list, and are paid in a single instalment.
- Recommendations: Respond within 60 calendar days, including on third-country subcontracting where recommended.
- Periodic penalty payments: Non-compliance with information requests, investigations, inspections or remediation reporting can lead to daily penalties of up to 1 % of average daily worldwide turnover in the preceding business year, for up to six months.
- Third-country providers: A provider established outside the Union must set up a Union subsidiary within 12 months of designation to remain usable by financial entities.
Confirm with the Lead Overseer how oversight plans and examination timetables will be shared with your organization.
Being absent from the first list does not place a provider outside DORA. Non-designated ICT providers remain bound through the contract clauses that financial entities must impose under the ICT third-party risk rules. Their services may also appear in customers' registers of information, and competent authorities can assess how those arrangements affect a customer's risk. The designation process itself is annual, so a provider's position can change.
- Contractual obligations: Customers must include the mandatory clauses in agreements, which pass DORA requirements down to the provider.
- Register visibility: Your services may be recorded in customers' registers, which supervisors use to judge concentration and dependency risk.
- Annual review: The ESAs update the list each year, so monitor it rather than assume a fixed status.
- Subcontracting: Your own subcontractors may be relevant to a customer's assessment, so keep their details accurate.
- Customer requests: Expect questionnaires and evidence requests from financial entities that must document each provider.
Confirm your position, and whether any service you supply could bring you into scope, with the competent authority for your customers' sector.
What financial entities should check before relying on a designated provider
A designation changes what a provider's services mean for your own DORA file, but it does not transfer any obligation away from you. The checks below cover status, dependency mapping, establishment, exit, contract rights and monitoring, and each one should leave a dated record that a named owner signs off.
Confirm status at each yearly update
The ESAs must update the list of critical providers every year, so a provider's status can change between reviews. Check the provider against the current published list each time it is updated and record the date and version you checked. Confirm the provider is the legal entity you contract with, since designations name specific legal entities. Evidence is a dated screenshot or saved copy of the list entry in the third-party file, signed off by the head of ICT risk or the third-party risk owner.
Map dependent functions in the register
Identify every critical or important function that relies on the designated provider, directly or through a subcontractor, and record each link in the register of information. Include the services involved, the locations where they are provided and data is processed, and any subcontracting chain. An incomplete mapping weakens your reporting to the competent authority and your view of concentration risk. Evidence is the register extract and a function-to-service map, signed off by the function owner for each business line and the ICT risk function.
Check establishment and Union subsidiary timing
Where a critical provider is established in a third country, you may use it only if the provider sets up a Union subsidiary within 12 months of designation. Establish which entity provides the service, where it is established, and whether the 12-month window has been met or is still running. If a subsidiary is not in place by the deadline, the reliance decision needs escalation and a contingency plan. Evidence is a written establishment assessment with dates, signed off by legal counsel and the executive accountable for outsourcing.
Review exit plan and substitution options
A designation does not remove the need for a tested exit plan. Document how the function would move to another provider or to in-house operation, the data and configuration that must be returned, the time needed, and the points where the service would stop. Consider how many other providers could realistically take over the function and what that depends on. Evidence is the exit plan, its test record and a substitution assessment, signed off by the business owner of the function and the head of operational resilience.
Confirm contracts support recommendation handling
Competent authorities must inform financial entities of risks identified in recommendations addressed to critical providers, and as a last resort may require suspension or termination of a service. Your contract and internal procedures must let you receive that information, assess it and act on it quickly. Check notice periods, information rights and termination triggers, and confirm who in your organization receives supervisory messages. Evidence is the contract clause review and an escalation procedure, signed off by the general counsel and the chief risk officer.
Name a monitoring owner
Designation creates new information flows, including oversight plans, recommendations and changes to the provider's status, and these need a single accountable owner. Name the person who tracks the list, the provider's responses to recommendations and any changes to subcontracting or locations, and set a review cadence. Without a named owner, updates often reach people who cannot act on them. Evidence is a role description, the monitoring log and periodic reports to the management body, signed off by the management body or the delegated risk committee.
Questions buyers ask about critical provider designation
Can a financial entity request that a provider be designated critical, or change that designation?
No. A financial entity cannot request or reverse a designation. The ESAs designate critical ICT third-party service providers through their Joint Committee, on recommendation from the Oversight Forum, using the four criteria in Article 31(2): systemic impact of a failure, systemic importance of the entities relying on the provider, reliance for critical or important functions, and substitutability. Financial entities contribute indirectly, because the ESAs collected data from their registers of information and a criticality assessment was run with national competent authorities. A provider can submit a reasoned statement before a final decision, and the list is updated yearly under Article 31(9). If your organization believes a provider's position has changed, record that view in your own third-party risk file and raise it with your competent authority, which does not decide designations but does feed into the process.
Does a provider's designation transfer our own DORA obligations to the ESAs?
No. Designation places oversight of the provider's ICT risk management with a Lead Overseer, but your organization keeps its own obligations under Chapters II to V of DORA. You still own the register of information entry for each contract, your ICT third-party risk strategy, due diligence, contract clauses, exit planning and incident reporting. Designation also does not remove the dependency analysis you must perform for critical or important functions. Where a critical provider is established in a third country, Article 31(12) allows you to use it only if the provider sets up a Union subsidiary within 12 months of designation, so that condition belongs in your own monitoring. Confirm with your competent authority how it expects you to evidence this ongoing responsibility.
Who pays the annual oversight fee for a critical provider?
The critical provider pays the oversight fee, not the financial entities that use it. Delegated Regulation (EU) 2024/1505 sets annual fees to cover the Lead Overseers' costs. The fees are scaled to the provider's applicable turnover, with a minimum of EUR 50 000, were split equally among providers on the first list, and are paid in a single instalment. Customers do not receive an invoice for this fee, but the cost can surface in provider pricing and contract renewals, so ask your provider how it treats oversight costs in its commercial terms. Your own costs for managing a designated provider, such as monitoring its oversight outcomes, updating your register and reviewing exit plans, are internal or consultant effort and depend on your contract portfolio.
Can we monitor a critical provider's oversight in house, or do we need outside help?
You can do it in house. Nothing in DORA requires a financial entity to hire a consultant to follow designation or oversight, and most of the work is document review and decision-making. The tasks are to track the ESAs' annual list updates, read the Lead Overseer's recommendations when they are shared with customers, assess what any recommendation means for your services, and update your third-party risk documentation. Outside help is typically used for gap analysis against the RTS, drafting exit plans, or testing whether your systems can switch providers. Any partner you engage prepares your evidence and analysis, but only your competent authority supervises your compliance, and no auditor or consultant can certify it.
How long does a critical provider review take, and what does it need from our team?
The time depends on how many critical provider relationships you hold and how deeply your register is already built. The supplied facts give no duration for your internal review, so confirm the scope with your competent authority and your own risk function. Effort is driven by the number of ICT contracts that support critical or important functions, the quality of your register of information data, and whether your exit plans have been tested. The team usually needs a third-party risk lead, an IT architect who understands the dependency, legal input on contract clauses, and an information security owner to review incidents. Schedule the review around the ESAs' yearly list updates so that your register reflects the latest designation.
What happens if a critical provider does not follow a Lead Overseer's recommendation?
The provider has 60 calendar days to say whether it will follow the recommendation under Article 42(1). If it refuses or does not act, the Lead Overseer can use its enforcement powers, including periodic penalty payments of up to 1 % of the provider's average daily worldwide turnover in the preceding business year, imposed daily for up to six months under Article 35(6) to (8). As a last resort, competent authorities may require financial entities to suspend or terminate use of the service under Article 42(6). Competent authorities must first inform financial entities of the risks identified in recommendations under Article 42(3), so watch for that notice and be ready to test your exit plan.
Can DeployOpen influence whether a provider is designated critical?
No. DeployOpen has no role in designation or oversight decisions, which belong only to the ESAs, the Lead Overseers and the competent authorities. DeployOpen plans, implements, integrates and documents self-hosted open-source platforms inside a client's own infrastructure, and it prepares systems and evidence for compliance assessments. Where a client's dependency on a designated provider is the concern, DeployOpen can help assess whether a self-hosted alternative or a second deployment is feasible within the client's environment, and can document the result for the client's own third-party risk file. Scope and deliverables are agreed in writing before work starts, and a quote follows from that scope.
How DeployOpen prepares your evidence for critical provider reviews
DeployOpen works with the organization that owns the controls, preparing the systems, documentation and evidence that a critical ICT third-party provider or its customers may need during oversight. We implement and document self-hosted open-source platforms inside the client's own infrastructure, but we do not issue reports, attestations or designations, which remain with the ESAs and independent assessors.
How we scope
- Scope is agreed in writing before work starts, naming the platforms, environments and services covered.
- The written scope states which ICT services, providers and evidence types are included and which are excluded.
- Engagements are fixed-scope, and ongoing support can be added later as a retainer once the scope is agreed.
How we build
- We prepare configuration, logging and access records for the self-hosted platforms within the agreed scope.
- Security testing of applications, APIs and infrastructure is run against the agreed scope and findings are tracked.
- Controls and documentation are aligned with the ICT risk and third-party requirements the client must demonstrate.
How we hand over
- Deliverables include documentation, configuration baselines and evidence packs mapped to the agreed scope.
- Each deliverable is handed over with the owner, date and status of open items recorded for the client's own review.
- Clients or their independent assessors decide what is shared with a provider, supervisor or Lead Overseer.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
- Evidence is refreshed when platforms are upgraded, backed up or changed, so records stay current.
- Ask any partner to confirm in writing which recurring activities are included and how changes to scope are priced.
Sources and further reading
- Regulation (EU) 2022/2554 (DORA), Articles 31 to 44 ↗
- Commission Delegated Regulation (EU) 2024/1502 ↗
- Commission Delegated Regulation (EU) 2024/1505 ↗
- European Supervisory Authorities designate critical ICT third-party providers (18 November 2025) ↗
- List of designated critical ICT third-party service providers (18 November 2025) ↗
