Article 31 DORA designation of critical ICT providers

What Article 31 DORA designation means for an ICT provider

If your firm provides ICT services to banks, insurers or payment institutions, you may be designated as a critical ICT third-party service provider under Article 31 of DORA. Designation is the decision by the European Supervisory Authorities (EBA, EIOPA and ESMA), acting through their Joint Committee on the recommendation of the Oversight Forum, that a provider is critical for the financial sector. Once designated, the provider is placed under direct EU oversight by a Lead Overseer, one of the ESAs appointed for that provider. The ESAs make this decision, not the provider, and no certificate or attestation is issued. Designation is a supervisory status, so your organization should plan on the basis that it may arrive without warning.

The purpose is to contain systemic risk. A single cloud platform, software vendor or data services firm can serve a large share of the EU financial system, so a failure at that provider could disrupt many regulated entities at once. Article 31(2) bases the decision on four criteria: the systemic impact if the provider failed, the systemic importance of the financial entities that rely on it (including G-SIIs and O-SIIs), the reliance of those entities on the provider for critical or important functions, and the degree of substitutability. Delegated Regulation (EU) 2024/1502 specifies how these criteria are applied, and it is the document to read before estimating your exposure.

Timing is hard to plan for because the provider does not control it. The ESAs assess providers, notify the assessment, and then the provider has 6 weeks to submit a reasoned statement. The Lead Overseer may request further information, which must be provided within 30 calendar days of receipt, and oversight begins no later than one month after the designation is notified. The provider must also inform its financial entity clients. Your practical steps are to confirm which of your services would count as supporting critical or important functions for your clients, to keep your user and dependency records current, and to agree in advance who within your organization handles regulator requests and client notifications. Confirm the current procedure and dates directly with the ESAs' published materials.

Which providers and entities the designation rules reach

Article 31 reaches a narrow set of ICT providers, but the test depends on who relies on them and where they are established. The four groups below show who is in scope, who is carved out, and where the work changes for each.

ICT providers open to assessment

Any ICT third-party service provider can be assessed by the ESAs for designation, and the Article 31(2) criteria look at systemic impact if the provider failed, the systemic importance of its financial entity clients, reliance for critical or important functions, and substitutability. Check whether your provider already appears on the published list of designated providers and whether its services sit at the core of your own critical or important functions. A provider that is not designated still stays inside your own third-party risk process.

Financial entities that rely on them

The designation logic starts from reliance. The ESAs weigh how systemically important the financial entities using a provider are, including G-SIIs and O-SIIs, and which of their functions depend on it. Map each ICT service you buy to the critical or important function it supports, and record which providers sit behind those functions. Those dependencies are what the Lead Overseer will look at when it assesses concentration and systemic exposure.

Providers carved out under Article 31(8)

Article 31(8) removes four groups from designation: financial entities providing ICT services to other financial entities, providers under Eurosystem oversight frameworks, intra-group ICT providers, and providers serving only financial entities active in a single member state. A carve-out does not remove your duties as a financial entity. You still need contractual terms, due diligence and exit planning. Confirm with the relevant authority which group your provider falls into before you assume it is excluded.

Third-country providers and the subsidiary rule

A designated provider established outside the Union falls under Article 31(12). Financial entities may use it only if it sets up an EU subsidiary within 12 months of designation. Check where the contracting entity sits, where data is processed and whether any subcontractor is third-country based. Ask providers for a dated plan for the subsidiary and confirm how that plan affects service continuity and your exit options.

Scoping decisions that change the work

Two questions decide how much work follows. First, does the service support a critical or important function of your organization? If yes, the contract, exit plan and register entries need the stricter treatment. Second, is the provider on the designated list or a candidate for it? Record both answers in your third-party register and revisit them when the ESAs publish the yearly list or update it. Document the reasoning so an assessor can follow it.

How the four designation criteria are weighed

Article 31(2) of DORA bases designation of a critical ICT third-party service provider on four criteria: the systemic impact the provider's failure would have, the systemic importance of the financial entities that rely on it (including G-SIIs and O-SIIs), the provider's reliance for critical or important functions, and the degree of substitutability. The ESAs must consider all four together rather than treating any single one as decisive, so a provider that scores high on user importance but can be replaced quickly may still raise a different picture from one that is hard to substitute but serves few systemically important users. No single criterion settles the outcome. The ESAs do not publish a formula for combining them in the Regulation itself, so readers should not assume a points-based method exists unless the ESAs or Delegated Regulation (EU) 2024/1502 describes one. Read that delegated act directly on EUR-Lex to see how each criterion is specified.

Some of the evidence that feeds these criteria sits with the provider, and some sits with its financial entity customers. A provider can document its own service footprint: which financial entities use which services, how many depend on them for critical or important functions, and what subcontracting chains sit behind them. It can also document substitutability: whether a client could move to another provider, how long that would take, what data portability looks like, and what exit or migration support exists. Providers should confirm with their lead overseer or the ESAs which data requests they can expect and in what format, since the assessment process and its information requests are set out in the Regulation and the delegated act rather than in this page. Customers' own registers of information, which financial entities must maintain, are another input the provider should understand before any assessment starts.

For an organization deciding whether it or a provider it relies on is likely to be in scope, the practical step is to map each candidate service against all four criteria in writing before the ESAs' next list. Record the service's role in critical or important functions, the number and systemic weight of dependent financial entities, the realistic time and cost to substitute it, and the failure scenarios that would affect users. Treat this as an internal analysis that informs a conversation with the ESAs and counsel, not as a designation outcome. The ESAs have indicated through the designation process that providers may submit a reasoned statement after notification, so keep documentation that supports each claim about reliance and substitutability in a form that can be shared on request.

What a provider does in the weeks after notification

Once a provider is notified of its designation assessment, it works through a fixed sequence of deadlines. Each step produces a dated record that the provider can later show to the Lead Overseer and to its financial entity clients.

Read the assessment and confirm its facts
The provider's legal and compliance leads read the notified assessment line by line and check each fact about its services, group structure, EU presence and client base against their own records. Any inaccuracy is logged with the supporting evidence so it can be addressed in the reasoned statement. This step is complete when the team holds a signed fact check that marks each point as confirmed or disputed, names the person who checked it and records the date of the check.
Prepare the reasoned statement within six weeks
Under Article 31(5), the provider has six weeks from notification of the assessment to submit a reasoned statement. The statement responds to the assessment against the criteria in Article 31(2), sets out any factual corrections from the fact check and gives the reasons for the provider's position. Senior management approves the text before submission. The output is a dated reasoned statement submitted inside the six-week window, with the submission receipt kept on file.
Track and answer additional information requests
The Lead Overseer may ask for additional information, and the provider then has 30 calendar days from receipt of the request to respond. Route each request to a named owner on the day it arrives, record the receipt date and calculate the 30-day deadline from that date. The output is a response file containing a cover letter, the requested documents indexed against each question and a dated record of what was sent and how. Confirm with the ESAs how they want responses transmitted.
Prepare for oversight to begin
Oversight starts no later than one month after notification of the designation, so readiness work runs alongside the statement and any information requests. Name a single point of contact, confirm which staff can speak for security, continuity, governance and incident reporting, and assemble the documents an oversight team is likely to ask for. The output is an oversight readiness pack with a document index, a named owner for each domain and a dated record of who was briefed.
Inform each financial entity client
Article 31(5) requires the provider to inform its financial entity clients of its designation. Start from the contract register and the client list, confirm which clients rely on the provider's services, and prepare a notice that states the designation and the date of the notice. The output is an updated client notice list showing who was notified, through which channel and on what date, with a copy of each notice kept on file.
Keep one register of every deadline
Consolidate every date that follows from the notification into one register: the six-week statement deadline, any 30-day information request deadlines, the oversight start date and the client notice dates. Review the register with legal and compliance at a cadence agreed internally, and update the status of each item as it closes. The output is a single dated register showing the status of each deadline and the evidence that closed it, which the provider can produce if the ESAs ask how a deadline was met.

How the ESAs test a provider against the criteria

This table maps each designation question under Article 31 to what the ESAs examine, the evidence a provider can supply and the gaps that commonly come up. Read it as a preparation checklist, and confirm with the ESAs which formats and data they accept before submitting anything.

Designation question	What the ESAs examine	Evidence the provider can supply	Common findings
Systemic impact if the provider failed	The effect on financial stability, the number and type of financial entities depending on the provider, and how far disruption would spread across markets	Customer and entity counts by sector and country, service dependency maps, and documented impact analyses for outage scenarios	Impact figures based on contract counts only, with no view of how dependencies cascade through other providers
Reliance by financial entities on critical or important functions	Whether users rely on the provider for critical or important functions, as those functions are defined in DORA	Lists of services mapped to user functions, with the contract types and service levels that apply to each	Services described by technology rather than by the function they support, which makes reliance hard to judge
G-SII and O-SII exposure of users	The systemic importance of the financial entities that use the provider, including global and other systemically important institutions	Anonymized or aggregated user breakdowns that the provider can verify, and how those breakdowns were produced	Exposure estimated from market reputation rather than from verifiable user records
Substitutability, including data portability and exit	How hard it would be for users to move to another provider, covering data formats, migration tooling, lock-in terms and time needed	Documented exit and portability procedures, tested migration reports, data export formats and known dependencies on proprietary features	Exit plans that were never tested, or portability claims that depend on the provider's own tools
Exclusion test: financial entities serving other financial entities	Whether the provider is itself a financial entity that supplies ICT services to other financial entities, which Article 31(8) excludes	Legal entity status, licensing and the list of financial entities receiving ICT services from the provider	Group structures where the contracting entity and the service provider are unclear
Exclusion test: intra-group and Eurosystem-overseen providers	Whether the provider is an ICT intra-group provider or falls under a Eurosystem oversight framework	Group structure documents, and evidence of any Eurosystem oversight arrangement	Affiliated entities providing services across the group that were not declared as intra-group
Exclusion test: single member state scope	Whether the provider serves only financial entities active in one member state, which Article 31(8) also excludes	Client location data by member state and the list of entities served	Client bases that appear domestic but include cross-border users, which can change the outcome

Who does what in a designation: provider, client, ESA and partner

A provider that receives an assessment from the ESAs owns the facts that assessment rests on: its service footprint, its client base, its subcontracting chains and its own systems. It files the reasoned statement and carries the notices to its clients. Preparing these records is usually outsourced in part, but the provider signs and answers for them.

Service facts: Keep accurate records of which services it provides to financial entities, where they run and which subcontractors support them.
Reasoned statement: Submit the reasoned statement within 6 weeks of notification of the assessment, the window set by Article 31(5).
Additional information: Answer any request for further information within 30 calendar days of receiving it.
Client notices: Inform its financial entity clients of the designation, as Article 31(5) requires.
Oversight readiness: Be ready for oversight to start no later than one month after notification of designation.

Check whether your governance records would let you meet these windows if the notice arrived tomorrow.

What preparing for designation costs and who pays

This table compares the main cost components of preparing for designation as a critical ICT third-party service provider, who pays for each, whether it is one-time or recurring, and what drives it up or down. Only the EUR 50 000 opt-in fee has a supplied figure, so use the remaining rows to frame questions for the ESAs and your own advisers.

Cost component	One-time or recurring	What drives it	How to keep it down
Opt-in application fee (Delegated Regulation (EU) 2024/1505)	One-time, non-refundable	Fixed at EUR 50 000 for providers applying for designation under Article 31(11); payable whether or not designation follows	Confirm eligibility and readiness before applying, since the fee is not refunded
Internal legal and regulatory staff time	One-time for the assessment response, then recurring	Volume of ESA information requests, the six-week window for a reasoned statement, and the number of EU financial entity clients affected	Assign a named owner and pre-build the reasoned statement from existing compliance records
Evidence preparation by engineering and security teams	One-time build, then recurring refresh	Scope of services provided to financial entities, depth of existing documentation, and the 30-day window for additional information	Reuse evidence already produced for client audits and keep it current rather than rebuilding it per request
External legal or regulatory counsel	Recurring during designation and oversight	Number of jurisdictions involved, complexity of the reasoned statement, and questions on Article 31(8) exclusions	Scope counsel work to specific questions and agree rates and hours in writing before starting
Union subsidiary for third-country providers (Article 31(12))	One-time setup, then recurring running costs	Legal entity formation, local governance and staffing, and the 12-month window after designation	Ask whether an existing EU entity can serve, and plan the timeline early to meet the deadline
Ongoing oversight cooperation	Recurring once oversight starts	Lead Overseer information requests and inspections, which begin no later than one month after designation notification	Maintain an oversight-ready evidence library and a single point of contact for the Lead Overseer
Client notification and contract updates	One-time, then recurring as clients change	Number of financial entity clients that must be informed under Article 31(5)	Use a standard notification template and map clients to their contracts in advance

Questions providers and financial entities ask about Article 31 designation

Can a provider be designated as critical without applying for it?

Yes. Under Article 31, the ESAs, through the Joint Committee and on recommendation from the Oversight Forum, can designate a critical ICT third-party service provider on their own assessment, based on the four criteria in Article 31(2): systemic impact if the provider failed, the systemic importance of the entities relying on it, reliance for critical or important functions, and the degree of substitutability. Applying is only the route for providers that want designation, and it is a separate track covered under the voluntary opt-in question below. A provider that receives a notice of assessment should therefore treat it as a formal regulatory step, not an optional request, and prepare its response promptly.

What does the six-week window for a reasoned statement mean in practice?

It means the provider has 6 weeks after notification of the assessment to submit a reasoned statement disputing or qualifying the ESAs' view. Because the clock starts at notification, the work has to be ready before the notice arrives: the provider needs a named owner, a legal review route and evidence on its systemic footprint, substitutability and client dependencies. The Lead Overseer may also ask for further information, which must be provided within 30 calendar days of the request. Providers should also know that oversight starts no later than one month after notification of designation, so the response window and the onboarding plan overlap and should be run together.

Must a non-EU critical provider open an EU subsidiary, and within what time?

Only if financial entities in the EU are to keep using it. Under Article 31(12), a financial entity may use a critical provider established in a third country only if that provider establishes a subsidiary in the Union within 12 months of its designation. Until then, the rule shapes contract planning: financial entities need to know which of their ICT services depend on a non-EU provider, how exit would work if the subsidiary is not created, and what the provider has committed to in writing. Legal counsel should confirm how the subsidiary requirement applies to each service and each group entity.

Is the EUR 50 000 opt-in fee refundable?

No. The opt-in fee of EUR 50 000 is set by Delegated Regulation (EU) 2024/1505 and is non-refundable, which means a provider that applies to be designated pays it whether or not the application succeeds. Providers should budget it as a sunk, one-time cost of the application route and weigh it against the commercial value of designation. The fee is the regulator's charge and does not cover legal, technical or evidence-preparation work, which is paid separately to advisers, auditors or internal teams. Ask any adviser to price its work as a separate line from the regulatory fee.

How long can an opt-in decision take?

Article 31(11) sets a decision timeframe of 6 months for applications from providers that want to be designated. The period is a ceiling on the ESAs' decision, not a guaranteed date, and the time the provider spends answering requests for information is part of how long the process runs. Plan around the full 6-month window, prepare the application file in advance and confirm with the ESAs how their clock treats information requests. Providers should also expect the list to be updated yearly, which affects when a decision becomes visible to clients.

What should a financial entity do when its ICT provider is on the list?

Start by confirming which of its contracts rely on that provider, which functions those contracts support and whether any of them are critical or important. Designation means the provider is overseen directly by a Lead Overseer, which does not transfer the financial entity's own obligations. The entity still owns its third-party risk strategy, its register of information, its due diligence, its audit planning and its exit plans under Articles 28 to 30. It should also ask the provider how it will inform clients of oversight outcomes, since the provider must inform its financial entity clients once designation is notified, and should record that response in its third-party file.

Can DeployOpen or another partner make the designation decision?

No. Designation is made by the ESAs, acting through the Joint Committee, and only they issue the list. DeployOpen is an implementation partner, so it can prepare systems, documentation and evidence that a provider or financial entity uses in its own file, but it cannot decide, certify or confirm that any provider is or is not designated. Any statement about a provider's status should be checked against the ESAs' published list and the provider's own notices, and legal counsel should review the regulatory position before a contract or application relies on it.

How much internal effort does designation work need?

The effort depends on how many services the provider runs for financial entities, how much of its evidence is already documented and how many teams must answer requests. The main internal roles are legal and regulatory affairs for the reasoned statement, security and resilience teams for the technical evidence, and client management for notices to financial entities. Costs are mostly staff time and advisory fees, which recur while the oversight relationship runs. Ask any adviser for a written, fixed scope that lists the workstreams, the roles it expects from your team and the deliverables it will prepare before work starts.

Where providers and clients fall short on designation readiness

Designation under Article 31 can move quickly once the ESAs notify a provider, so the gaps that matter are the ones that slow a response. The cards below cover the records, notices and planning that providers and their financial entity clients should have ready before a designation decision arrives.

No current view of client functions

A provider often cannot say which client functions its services support, or which of them are critical or important. Article 31(2) ties designation to reliance for critical or important functions, so this mapping is the evidence the ESAs will look at first. Check that each service has a named owner, an up-to-date list of client functions it supports, and a review date that follows contract changes.

No record of clients to notify

Under Article 31(5), a designated provider must inform its financial entity clients. Many providers hold contract records but no single list that shows which clients use which services, who the contact is, and how notice would reach them. Confirm that the list is kept current, that notice routes are tested, and that someone is accountable for sending the notice on time.

Reasoned statement drafted too late

Article 31(5) gives the provider 6 weeks after notification of the assessment to submit a reasoned statement. Teams that start drafting only after the clock begins usually miss facts that need legal, technical or commercial sign-off. Prepare a standing draft that explains the provider's services, its substitutability and its operational footprint, and rehearse who approves what within the window.

Third-country providers without a subsidiary plan

Article 31(12) lets financial entities use a critical provider established in a third country only if it sets up a subsidiary in the Union within 12 months of designation. Providers without an EU entity, or with one that lacks the mandate to operate the service, face a structural gap. Ask for a documented plan covering legal form, staffing, data location, contracting authority and the date by which each step must be complete.

Listing treated as due diligence

Inclusion on the list of designated providers does not replace a financial entity's own assessment of an ICT service. Clients that rely on a designation as proof of resilience may skip the concentration, exit and audit checks that Articles 28 to 30 require. Confirm that each contract still records the client's own risk assessment, exit plan and audit rights, and that these are reviewed when designation status changes.

Oversight start not planned

Oversight begins no later than one month after notification of designation, and the Lead Overseer may request further information within 30 calendar days. Providers that have not named an oversight contact, assembled their governance documents and set up a process for information requests can fall behind before the first examination. Agree internal owners, document locations and response routes now, so requests can be answered within the set deadlines.

How DeployOpen works on this

DeployOpen does not decide whether a provider is designated, and it does not issue any assessment outcome. For a provider that expects to be assessed under Article 31, DeployOpen prepares the systems, controls and evidence that the provider's own team and the ESAs' assessment will rely on, within a fixed scope agreed in writing before work starts.

How we scope

Engagements are fixed-scope, with the systems, services and evidence areas agreed in writing before any work begins.
We confirm which ICT services a provider delivers to financial entities and which of those would be in front of the Article 31 criteria.
The written scope names who owns each control, so the provider's accountable staff know what they are responsible for during readiness.

How we build

We map the provider's service inventory, dependencies and subcontracting chains to the information an assessment would request.
We build or configure self-hosted open-source platforms inside the provider's own infrastructure to produce logs, inventories and records.
We test the resulting evidence trail against the written scope, and we record gaps for the provider to decide how to close them.

How we hand over

Deliverables include system documentation, control descriptions, evidence collection procedures and a gap register with named owners.
Runbooks explain how the provider's staff produce each evidence item on request, without relying on DeployOpen after handover.
We walk the provider's team through the handover package so they can answer information requests within the deadlines the regulation sets.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work closes.
Retainer scope, response expectations and fees are confirmed in writing; ask for them in the quote rather than assuming a standard package.
Any independent assessment, reasoned statement or designation decision comes from the competent authorities and ESAs, not from DeployOpen.

Article 31 Designation of critical ICT third-party service providers