What Delegated Regulation 2024/1502 asks for critical provider designation
Delegated Regulation (EU) 2024/1502 asks the European Supervisory Authorities to designate an ICT third-party provider as critical only after running it through a two-step test: a quantitative share test first, then qualitative sub-criteria. If you are an ICT provider, this regulation decides whether your services will be overseen directly by the ESAs as Lead Overseers. If you are a financial entity, it shapes how concentrated your dependence on a few providers may become. The regulation was adopted on 22 February 2024 under the empowerment in DORA Article 31(6) and published in the Official Journal on 30 May 2024. Step 1 is a systemic impact test. Under Article 2(4), a provider passes it where its services supporting critical or important functions reach at least 10 % of both the number and the total assets of financial entities in at least one category listed in DORA Article 2(1). Only providers that pass every step 1 sub-criterion move on to step 2, where the ESAs weigh the systemic character of the entities relying on the provider, the criticality of the functions supported, degree of substitutability, the intensity of impact from discontinuing the services, and dependence on the same subcontractors (sub-criteria 1.3 and 1.4). Article 7 applied sub-criterion 1.4 from 16 January 2025. Article 6 lists the information sources the ESAs use, so providers should expect questions drawn from registers and supervisory data. The risk the rules address is concentration: many financial entities depending on the same few providers, or on the same subcontractors beneath them, so that one failure spreads across the sector. The difficulty is data. Counting entities and assets across categories requires figures that no single provider holds, and subcontractor dependence has to be traced several layers down. Financial entities should confirm with their providers which services support critical or important functions and which subcontractors sit underneath them, and ICT providers should start assembling that customer and subcontractor map before a designation request arrives.
Which providers and dependencies the designation test reaches
Designation under Delegated Regulation (EU) 2024/1502 turns on what is counted before any criterion is scored. The decisions below set the population of providers, entities and dependencies that the step 1 and step 2 tests will examine, so they should be settled early and in writing. Confirm each one with the competent authority or the ESAs before relying on it.
Providers serving critical or important functions
The step 1 test looks at services that support critical or important functions, so the first task is mapping which ICT services feed those functions in your own organization or in the client base you serve. Record the function, the provider, and the service that supports it. A provider that serves only non-critical functions may fall outside the test in practice, but confirm how the ESAs read that boundary for your sector.
Financial entity categories counted in Article 2(1)
The 10 % share test is applied within at least one category of financial entity listed in Article 2(1), so the category choice changes the denominator. Credit institutions, insurers, payment institutions and other categories each have their own counts and asset totals. Document which categories you use for your analysis and ask the ESAs how they will treat providers that serve several categories at once.
Group and intra-group dependencies
Where several financial entities in one group rely on the same provider, the group structure can change how many entities a provider reaches. Map which group entities use the service directly and which receive it through a parent or shared service company. Confirm with the competent authority how group-level arrangements are counted before you assume a single contract represents one dependency.
Subcontractor chains
Step 2 considers a provider's dependence on the same subcontractors, so a shared cloud region, data center or software component can link otherwise separate providers. Trace the subcontracting chain for each critical service, including hosting and managed operations. Ask providers to disclose their material subcontractors and confirm with the authority how subcontracting depth is assessed.
Services that may or may not count as ICT services
Not every purchased service is an ICT service in the sense DORA uses, and borderline cases such as consulting, data feeds, or licensed software with vendor support need a documented position. Decide how each service is classified and why, since that decision determines whether a provider enters the designation analysis. Confirm the classification with the competent authority for any service where the answer is unclear.
How the step 1 and step 2 tests work in practice
Step 1 is the gate. The ESAs first check whether a provider meets all step 1 sub-criteria, and only providers that do move to the step 2 assessment. The systemic impact test in Article 2(4) asks whether the provider's services that support critical or important functions reach at least 10 % of the financial entities in a category listed in DORA Article 2(1), measured by both the number of entities and their total assets. The test needs to be met in only one category, so a provider serving a concentrated segment of the market can pass even if its reach across the whole sector is smaller.
- Two measures: the share must reach 10 % on the number of entities and on their total assets.
- One category is enough: the test is applied category by category, so one qualifying category is sufficient.
- Critical or important functions only: the count covers services that support those functions, not every service a provider sells.
- Shared denominators: the calculation depends on how financial entities are counted within each category, so confirm the basis the ESAs apply.
For your own arrangements, identify which providers support critical or important functions and which financial entity categories they serve, so you can judge whether a provider is likely to reach step 2.
Providers that pass step 1 are assessed against the step 2 sub-criteria. Article 3 addresses the systemic character of the financial entities that rely on the provider. The question is less about the provider's own size and more about how many financial entities depend on it, how deeply they depend on it, and how far that dependence spreads across the financial sector. A provider that many institutions use for important activities presents shared exposure that a single failure could amplify.
- Breadth of reliance: how many financial entities use the provider's services.
- Depth of reliance: whether those entities use the services for critical or important functions.
- Shared exposure: whether many entities depend on the same provider at the same time.
- Sector spread: whether the reliance covers several financial entity categories or sits in one.
Before relying on these labels, read Article 3 in the Regulation and confirm the exact factors it lists, since the wording determines what evidence the ESAs will look for.
Articles 4 and 5 turn to the functions the provider supports and how easily they could be replaced. Article 4 concerns the criticality or importance of the functions supported by the provider's services. Article 5 concerns the degree of substitutability, which asks how practical it would be for financial entities to move to another provider or bring the service in-house. Together they test whether a failure would cause serious harm to the functions that financial entities depend on, and whether those entities could recover without the provider.
- Function impact: the consequences for the critical or important functions if the service stopped or degraded.
- Alternatives in the market: whether other providers could deliver the same service at similar scope.
- Switching effort: the time, data migration and integration work needed to move to a substitute.
- Specialization: whether the service depends on proprietary technology or skills that few providers offer.
When you assess a provider, document the function it supports, the realistic exit path, and the evidence behind any claim that the service is easy to replace, because substitutability is a judgment the ESAs test rather than assume.
Two step 2 sub-criteria focus on what happens when a service stops and who else is involved in delivering it. Sub-criterion 1.3 covers the intensity of the impact of discontinuing the provider's services. Sub-criterion 1.4 covers the provider's dependence on the same subcontractors. Under Article 7, sub-criterion 1.4 applied from 16 January 2025, so the subcontracting picture that matters is the one that existed from that date onward, not only the one that exists when a designation decision is made.
- Discontinuation intensity: how quickly and how severely financial entities would be affected if the provider's services ended.
- Shared subcontractors: whether the provider relies on subcontractors that other critical providers also use.
- Concentration beneath the surface: a single cloud or infrastructure supplier can sit under several providers, so the risk can be hidden one layer down.
- Timing: subcontracting chains change, so the evidence should show the arrangement as it stood from 16 January 2025 and as it stands now.
Ask each critical or important provider to map its subcontracting chain and confirm which subcontractors it shares with other providers in your ICT estate.
Article 6 lists the information sources the ESAs use to carry out the assessment. The assessment is a documentary and analytical exercise, so the data that financial entities and providers already hold, and how consistently they report it, carries weight. Designation is also not the end of the process. Once a provider is designated as critical, it becomes subject to the oversight framework in DORA Articles 31 to 44, where the ESAs act as Lead Overseers. The Regulation itself is the authoritative source for the full list in Article 6, and the delegated regulation should be read alongside it.
- Read the full list: Article 6 sets out the sources in full, and this page does not reproduce them.
- Consistent data: figures reported for the register of information and other submissions should match what providers say about their own services.
- Provider preparation: ask critical providers what information they are prepared to supply and how they hold it.
- Follow-on obligations: designation brings oversight, so plan for information requests and recommendations from the Lead Overseer.
Confirm the current text of Article 6 in the EUR-Lex copy of Delegated Regulation (EU) 2024/1502 and check which of your providers the ESAs are likely to assess.
How the ESAs and competent authorities test a provider against the criteria
This table compares each stage of the designation assessment under Delegated Regulation (EU) 2024/1502, with the evidence the ESAs typically need and the findings that tend to hold a provider back. Read it as a checklist for preparing data before the ESAs ask for it, since the step 1 share test depends on counts and asset figures that many providers do not hold in a usable form.
| Test stage | Evidence the ESAs are likely to request | Common findings to prepare for |
|---|---|---|
| Financial entity counts and assets (step 1, Article 2(4)) | Per-client counts of financial entities in each Article 2(1) category, and their total assets, for services supporting critical or important functions | Client data is held by contract rather than by entity category, so the 10 % share cannot be computed cleanly |
| Mapping of services to critical or important functions | Service catalogue linked to the functions each client relies on, with the financial entity's own classification where available | Services are mapped to generic product lines, not to the functions they actually support |
| Systemic character of relying entities (Article 3) | Evidence of which relying entities are systemic and how the provider's services reach them | Concentration among a few large clients is not recorded, so the systemic link is understated |
| Substitutability (Article 5) | Documented exit options, portability of data and workloads, and realistic time needed to move to another provider | Substitutability is asserted in general terms without tested migration paths or named alternatives |
| Subcontractor chains (step 2, sub-criteria 1.4) | Current list of material subcontractors and shared subcontractors with other providers, with their locations and roles | Fourth-party dependencies on cloud or hosting providers are missing from the register |
| Discontinuation impact (step 2, sub-criterion 1.3) | Analysis of what happens to supported functions if services stop, including timeframes and affected entities | Impact is described as low without quantifying disruption to critical or important functions |
Preparing a provider for a designation assessment
This sequence lets an ICT third-party provider assemble the evidence the ESAs will test against the step 1 share test and the step 2 qualitative sub-criteria under Delegated Regulation (EU) 2024/1502. Each step ends with a named output that feeds the next, so the final information file can be checked against the Article 6 sources.
Map customer dependencies by entity category
Start by listing every financial entity that receives services from the provider and the category each one falls under in DORA Article 2(1). Record which of those services support critical or important functions, since only those services count toward the step 1 test. The provider's contract and service management teams should own this list, checked against customer records. The step closes with a register of customers grouped by category, with each service flagged as supporting or not supporting a critical or important function.
Build the step 1 share estimate
For each category, calculate the share of financial entities that rely on the provider's critical or important services, measured by both number of entities and total assets. Compare each result against the 10 % threshold in Article 2(4). The calculation needs an agreed source for the entity count and asset totals, which the provider should confirm with the ESAs' published data or the competent authorities' registers before relying on it. The step closes with a worksheet showing each category, both percentages and the source used for each denominator.
Document the systemic character of the dependency
Using the factors in Articles 3 to 5, describe how the entities relying on the provider are systemic, how critical or important the functions they support are, and how far those functions could be substituted. Note the number of customers, the dependency each one has, and any functions with no practical alternative in the market. Compliance, risk and commercial leads should review the narrative so that it matches the customer data from earlier steps. The step closes with a systemic character memo linked to the dependency map.
Assess substitutability and exit options
For the step 2 sub-criteria on the intensity of impact from discontinuing services, document how a customer would move the affected function to another provider or bring it in-house. Describe the exit plans, data return arrangements, transition periods the provider can support, and any technical lock-in such as proprietary formats or closed interfaces. Engineering and legal teams should test these statements against recent contracts and runbooks. The step closes with a substitutability assessment that states, for each service, which exit options are documented and which remain untested.
Map subcontractors and shared dependencies
List every subcontractor that supports the services in scope, including the underlying cloud, hosting, network and software suppliers. Identify where the provider depends on the same subcontractor as other providers, since sub-criterion 1.4 applies from 16 January 2025 under Article 7 and examines this shared dependence. Procurement and security teams should maintain this map and confirm each entry against signed contracts. The step closes with a subcontractor chain map showing which services each subcontractor supports and where concentration exists.
Assemble the information file against Article 6
Gather the information the ESAs can use under Article 6, organized by source, so that every claim in the earlier outputs can be traced to a record. Include contracts, service descriptions, customer data, subcontractor records and any reports the provider already holds. Confirm with counsel which items can be shared and in what form. The step closes with an indexed information file where each figure and statement points to a named source, ready for internal sign-off before any submission.
Run an internal review before submission
Before the provider responds to any ESA request, a reviewer who did not prepare the file should test each figure against its source and confirm that the narrative matches the data. The reviewer should check the share calculation, the substitutability statements and the subcontractor map for gaps or inconsistencies. Management should approve the file and record who signed off. The step closes with a signed review record and a list of open questions to resolve with the ESAs or the competent authority.
Evidence that supports a designation file
A designation file under Delegated Regulation (EU) 2024/1502 is only as credible as the evidence behind each claim about reach, substitutability and dependence. The artifacts below connect the step 1 share test to the step 2 qualitative sub-criteria, and each one needs an owner and a refresh trigger.
Customer dependency register
A dated register listing each financial entity that receives services from the provider, the category it falls under in Article 2(1) of DORA, and whether each service supports a critical or important function. Step 1 compares these counts and asset totals against the 10 % threshold in Article 2(4) of the delegated regulation, so the register must be reproducible from source contracts. Refresh it whenever a customer onboards, exits or changes its function classification, and record who approved each change.
Service-to-function mapping
A table linking each ICT service the provider delivers to the critical or important functions it supports at the customer end. This mapping drives the criticality analysis in Article 4 of the delegated regulation, so a service that looks generic may still carry high weight once a customer's function is considered. Check the mapping against customer contracts and update it whenever a service is added, bundled or repriced.
Substitutability and exit analysis
A written assessment of how quickly customers could move to an alternative provider or bring the service in-house, including data portability, interface compatibility and the time an exit would take. Article 5 of the delegated regulation requires the ESAs to weigh substitutability, so this analysis must describe real constraints such as proprietary formats or certification needs, not assumptions. Retest the exit assumptions after major platform changes and whenever a credible alternative appears in the market.
Subcontractor dependency map
A map of the provider's material subcontractors, the services each one supplies, and the customers whose services depend on the same subcontractor. Step 2 sub-criterion 1.4 covers dependence on the same subcontractors, and Article 7 applied that sub-criterion from 16 January 2025, so this map must be current on that basis. Refresh it on every subcontracting change and reconcile it with the contractual subcontracting chain.
Impact-of-discontinuation assessment
A scenario analysis of what happens to customers' critical or important functions if the provider's services stop, covering affected entities, duration of disruption and knock-on effects across markets. This supports the intensity-of-impact sub-criterion (1.3) in step 2. Document the assumptions, the people who reviewed them and the date of the last review, and rerun the scenarios when the customer base or service footprint changes materially.
Dated evidence log
An index that records each artifact in this file, its version, its owner, the source data used and the date it was last verified. Article 6 of the delegated regulation lists the information sources the ESAs use, so the log should show which of the provider's own records feed each figure. Keep prior versions so you can show what changed between submissions, and confirm with the competent authority how it expects updates to be delivered.
What preparing for designation costs in money and effort
This table breaks down the cost components of preparing for a critical provider designation assessment under Delegated Regulation (EU) 2024/1502, showing who is paid for each, whether it is one-time or recurring, and what drives it up. Read it as a checklist for scoping quotes, and note that any ESA oversight fee amounts must be confirmed from the separate fee regulation, Delegated Regulation (EU) 2024/1505.
| Cost component | Who is paid or who carries the effort | One-time or recurring | What drives it and what to request in a quote |
|---|---|---|---|
| Legal and regulatory analysis | Internal legal and compliance staff, sometimes external counsel | One-time, then periodic review | Scope of EU financial entity customers and the two-step test. Ask the partner to state which sub-criteria the analysis covers and what it excludes. |
| Customer and entity footprint mapping | Internal account and sales teams, plus implementation partner analysts | One-time, refreshed as the customer base changes | Number of financial entity customers and the categories they fall into under Article 2(1). Request a written method for counting customers and assets. |
| Subcontractor data collection | Internal procurement and vendor management, subcontractors' own teams | Recurring with each subcontracting change | Depth of the subcontractor chain and how many providers share the same dependencies (sub-criteria 1.4). Ask who collects subcontractor data and how often it is refreshed. |
| Register and mapping tooling | Software licensing, hosting, or self-hosted open-source deployment and integration effort | Setup is one-time, operation is recurring | Number of arrangements to record and the link to the register of information. Confirm which data fields the tooling holds and who maintains the mapping. |
| Evidence preparation for step 2 | Service owners, architects, and resilience staff | One-time per assessment cycle | Number of critical or important functions supported and the substitutability evidence required. Ask for a list of evidence items tied to each sub-criterion. |
| External review and assurance | Independent reviewers or assessors engaged by the organization | Recurring at review points | Depth of review and the number of services in scope. Ask whether the reviewer is independent of the implementation work and what the review excludes. |
| ESA oversight fees (if designated) | Payable to the ESAs under the separate fee regulation | Recurring | Fee amounts are set in Delegated Regulation (EU) 2024/1505, not in this regulation. Confirm the current figures and deadlines from that source before budgeting. |
| Ongoing upkeep through the oversight cycle | Internal provider management team, implementation partner for retainer work | Recurring | Frequency of information requests from the Lead Overseer and any recommendation follow-up. Ask for a fixed-scope upkeep plan with named deliverables. |
Why the criteria matter for financial entities that rely on providers
Designation moves oversight of a critical provider to the ESAs, but it does not remove your own duties. Once the ESAs designate an ICT third-party provider as critical, the EU oversight framework in Articles 31 to 44 of DORA applies to that provider, and a Lead Overseer supervises it directly. Financial entities that use the provider still own their ICT third-party risk under Chapter V, Section I. You remain responsible for the register of information, for ex-ante risk assessment and due diligence before you contract, for contract terms, for monitoring the service, and for an exit strategy that works if the provider fails. Designation gives you a second line of supervisory attention on the provider, not a transfer of accountability. Treat the designation outcome as an input to your own third-party file, and do not drop provider-specific analysis because a provider has been designated.
Because the criteria decide which providers reach that oversight regime, they also shape the risk picture you are managing. Under Delegated Regulation (EU) 2024/1502, the step 1 share test and the step 2 qualitative sub-criteria determine whether a provider supporting your critical or important functions is in scope. Check which of your providers would likely meet the step 1 threshold, and map the subcontractors those providers depend on, since sub-criterion 1.4 on shared subcontractors applied from 16 January 2025. Ask each critical provider whether it has received a designation request or information request from the ESAs, and record the answer in your register and risk assessment.
The Regulation requires the Commission to review DORA and report by 17 January 2028, and that review expressly covers the criteria for designating critical ICT third-party providers. Do not assume the criteria in 2024/1502 are fixed. Assign an owner to monitor the review and any amending instrument, and set a point in your third-party governance calendar to re-test which providers fall within scope. Confirm the current status of the review through the Official Journal and the ESA publications before you rely on any threshold in a board paper or contract clause.
Who owns the designation file and what can be outsourced
The provider remains the party that must answer the designation questions. Under the regulation, the ESAs assess a provider against the step 1 and step 2 sub-criteria using information the provider supplies and information from other sources, so the provider's own records, service descriptions and dependency data form the core of the file. Responsibility sits with the provider's management, legal, compliance and service delivery leads, who must confirm that what is submitted is accurate and current.
- Service inventory: Identify which services support critical or important functions for financial entities, and record where each one is delivered.
- Client and entity figures: Hold the counts and asset data needed to check the 10 % share test for each category of financial entity.
- Subcontractor dependencies: Document which subcontractors the same services rely on, including the sub-criterion on shared subcontractors.
- Legal positions: Decide how the provider reads ambiguous criteria and what it is prepared to state on its behalf.
- Customer confidentiality: Decide which client-specific data may be disclosed, and under what terms, before any outside party sees it.
Before any outside party touches the file, confirm with your own counsel which of these decisions you will keep in-house.
An implementation partner can prepare the systems, data extracts and evidence that the provider uses to build its file. DeployOpen's role in this kind of work is to plan, prepare and document the technical and operational evidence inside the client's own infrastructure. It does not decide designation, does not issue any report or attestation, and does not give legal opinions on the criteria.
- Data preparation: Extract, clean and reconcile service, hosting and dependency data from the systems where it lives.
- Mapping: Map internal services and subcontracting chains to the sub-criteria in a traceable working document.
- Evidence assembly: Gather configuration records, architecture diagrams and logs that support statements the provider has chosen to make.
- Document control: Version the working files, track sources and record who approved each figure.
- Scope agreement: Work from a written scope that names the deliverables and the points where the provider's legal team takes over.
Confirm in writing that the partner will not sign, submit or represent the provider in any communication with the ESAs or a competent authority.
The ESAs decide whether a provider is designated as critical. The Lead Overseer structure then applies to designated providers. Independent auditors and certification bodies play no part in designation, because DORA sets no certification scheme for this process. The designation outcome comes from the ESAs' own assessment, which uses the two-step approach set out in the regulation and the information sources listed in its Article 6.
- Designation decision: The ESAs, acting through their Joint Committee structures, decide which providers meet the criteria.
- Information requests: The ESAs may request information from providers and rely on other sources they are permitted to use.
- No certificate: Nothing issued in this process is a certificate or audit report that a provider can present as an independent certification.
- Ongoing oversight: Designated providers then fall under the oversight framework, which carries its own information and fee obligations.
- Contact route: Use the ESA or the competent authority channels for questions about the process, and confirm the current procedure there.
Check the current designation procedure with the relevant ESA before relying on any timeline or step.
Independent assurance is a separate question from designation. An external auditor or assessor can test whether a provider's internal controls around its designation data are operating as the provider describes, but that work informs the provider's own confidence and any contractual assurance it gives its customers. It does not replace the ESA assessment and does not produce a designation.
- Scope of testing: Agree in advance whether the auditor will test data accuracy, control design or both.
- Report type: Confirm what the auditor will issue and whether it will be shared with clients or regulators.
- Independence: Keep the auditor separate from the team that prepared the evidence.
- Limits: Expect the report to cover only the scope agreed, not the designation outcome.
- Cost drivers: Scope breadth, the number of services tested and the volume of evidence determine effort, and these should appear in any quote.
Before commissioning assurance, ask the auditor to state in writing what its report can and cannot be used to show.
Where providers and customers usually fall short
Designation under Delegated Regulation (EU) 2024/1502 turns on numbers and dependencies that many firms never record in one place. The gaps below cluster around the step 1 share test and the step 2 qualitative sub-criteria, and each one is fixed by a specific check before the ESAs or a customer asks for the figures.
Unknown customer counts by category
Providers often know how many customers they serve but not how many of those are financial entities in each Article 2(1) category, or which of them use the service for critical or important functions. The step 1 test is applied per category, so a blended total can hide a category that crosses the threshold. Action: build a customer register tagged by entity category and by whether the service supports a critical or important function, then reconcile it against contract records each quarter.
Missing asset data for the share test
The 10 % test compares both the number of customers and their total assets, so a provider that tracks only contract counts cannot show whether it meets the test. Asset figures are often held by customers, not the provider, and many contracts do not require them to be shared. Action: agree in writing which asset and entity data the provider may request, and record the date and source of every figure used in the assessment.
Untracked subcontractors
Step 2 looks at how far the provider depends on the same subcontractors as other providers, and sub-criterion 1.4 has applied since 16 January 2025. Subcontractor lists frequently live in procurement files rather than in a current dependency map, and sub-tier providers are often missing entirely. Action: maintain a subcontractor map down to the hosting, support and tooling layers, with the services each one supports and the date it was last verified.
Unclear substitutability
Assessors weigh how easily a service could be replaced, and providers often answer with general statements about market alternatives. Replacement depends on data portability, exit assistance, the skills available at the customer, and how long migration would take in practice. Action: document, for each critical or important service, the realistic exit path, the data it would need to move, and the customers whose migration would be hardest, then test one scenario against the documented plan.
Stale dependency records
Dependency data supplied to the ESAs or to a customer is only useful if it reflects current contracts, services and sub-tier arrangements. A record compiled for one application cycle can be out of date within months after a merger, a new cloud region or a change of subcontractor. Action: set a named owner for the dependency record, a review trigger tied to contract changes, and a dated sign-off that shows when it was last checked against source systems.
Weak information sources
Article 6 of the Regulation lists the information sources the ESAs use, and a provider that cannot show where its figures came from weakens its own submission. Figures drawn from marketing material, estimates or unreconciled spreadsheets are hard to defend in a supervisory review. Action: map each data point to its source system and owner, and keep the extract that supports it so the figure can be reproduced on request.
Questions about cost, effort and outside help
How much effort does preparing for critical provider designation take?
No duration is set in the regulation, so the effort depends on your own footprint. The main drivers are how many financial entities you serve, how many of your ICT services support critical or important functions at those entities, how deep your subcontracting chain runs, and how quickly you can produce consistent data about each service. A provider with a small, well-documented customer base and clear contract records will move faster than one whose customer and service data sits across several business units. Ask any advisor to break the estimate into data collection, analysis of the two-step criteria, and documentation, and to state which assumptions they made about your customer base.
Can an ICT provider prepare for designation without outside help?
Yes. The provider owns its data, contracts and answers, so an internal team with legal, compliance, finance and engineering input can prepare the case. Outside help is most useful where the work requires cross-checking customer counts and asset totals against the categories in DORA Article 2(1), mapping subcontractor dependencies, or testing whether your documentation holds up under review. Whichever route you choose, a named internal owner should sign off every figure, because the designation decision rests on the information the ESAs receive from you and from the sources listed in Article 6.
What does designation preparation need from a provider's customers?
The step 1 systemic impact test looks at services supporting critical or important functions and whether they reach at least 10 % of both the number and the total assets of financial entities in at least one Article 2(1) category. To answer it accurately, a provider needs to know, for each category, how many customers it serves and what share of sector assets those customers hold. Some of that information may come from customers, through contract records, registers of information or direct confirmation. Agree early with your customers what data you will request, how it will be handled, and which figures they can confirm themselves.
Does DeployOpen issue a designation decision or a compliance report?
No. DeployOpen does not issue designation decisions, reports, attestations or certifications. The European Supervisory Authorities make the designation decision. DeployOpen can plan, implement and document the systems, records and evidence a provider uses to answer the criteria, and it works under a written, fixed scope agreed before work starts. Where an independent assessment is needed, an independent auditor or assessor issues the report. Confirm the division of roles in writing before engaging any firm, including any firm offering designation support.
What drives the cost of designation preparation?
No fee for designation preparation is supplied here, so ask for a written quote that separates the components. Internal costs include staff time for data gathering, legal review and sign-off. External costs depend on scope: data analysis, documentation support, and any independent assessment you commission. Most of the spend is one-time for the initial case, while data refreshes and monitoring recur. Costs rise with the number of customer categories, subcontractors and services in scope. After designation, ESA oversight fees apply under Delegated Regulation (EU) 2024/1505, which sets a turnover-based formula and a EUR 50 000 minimum, so include those in long-term budgeting.
What could the 2028 DORA review change for designation criteria?
Article 58(1) of DORA requires the Commission to review the Regulation and report to the European Parliament and the Council by 17 January 2028. The review covers, among other things, the criteria for designating critical ICT third-party providers. The outcome is not known, so no change should be assumed. Practically, design your evidence so the underlying data, such as service inventories, customer counts and subcontractor records, can be reused under different criteria. Track the review and reassess your position when the report is published.
Why does the two-step test matter for preparation planning?
The ESAs first check whether a provider meets all step 1 sub-criteria, and only then assess providers that pass against the step 2 sub-criteria before designation. For planning, this means the step 1 systemic impact data is the first thing to get right, because it determines whether step 2 analysis applies at all. Step 2 covers the intensity of the impact of discontinuing your services and your dependence on the same subcontractors, with Article 7 applying sub-criterion 1.4 from 16 January 2025. Read the full text in Delegated Regulation (EU) 2024/1502, EUR-Lex before setting the workplan.
How DeployOpen prepares systems and evidence for this requirement
DeployOpen works on the preparation side of a designation assessment, not the assessment itself. Scope, deliverables and timelines for any engagement are agreed in writing before work starts, so a provider or a financial entity knows in advance which systems, records and data sets will be assembled. For a provider preparing to respond to the ESAs' information requests under Delegated Regulation (EU) 2024/1502, that can mean organizing customer and service records so the share of financial entities and total assets reached by its services can be documented. It can also mean mapping which services support critical or important functions and which subcontractors those services depend on. The client decides what the numbers mean and what to submit.
Preparation happens inside the client's own infrastructure, whether that is their cloud accounts, data centers or air-gapped networks. DeployOpen does not take custody of client data for this work. Where evidence is extracted from self-hosted open-source platforms, the extraction, retention and access controls are set up in the client's environment and documented in the agreed deliverables. Before scoping, confirm with counsel and your competent authority which records you must hold and for how long, because the ESAs' information sources and assessment steps are defined in the regulation and its supporting guidance.
DeployOpen does not issue assessments, designations or attestations. Only the ESAs decide whether a provider is designated as critical, and only an independent party issues any report a client may rely on. Ongoing support, periodic evidence refreshes and re-checks after changes in services or subcontracting are available as a retainer, which suits providers whose footprint in the financial sector changes over time. Ask any implementation partner to confirm in writing which artifacts they will produce and which decisions remain with your organization.
