DORA – Managing of ICT third-party risk

Financial entities will already be requested to submit the full register of information when DORA begins to apply.

This register will also be required to be submitted to the FMA on an annual basis thereafter.

Article 3(22) DORA defines a critical function as follows:

“a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;”

If the subsidiary itself falls within DORA’s scope of application (Article 2 DORA), then all rules apply shall apply to the same extent. Where aspects of the ICT service are for example are outsourced to the parent undertaking (or vice versa) then this triggers it being captured and treated as an internal ICT service provider.

Yes. See also the question “Which service providers support critical or important functions?”

From the FMA’s perspective a risk-based approach is necessary when classifying which service providers support critical or important functions. In line with ESA Q&A 2750 when classifying a service provider, the issue is relevant about whether the disruption of the system or service provider would materially impair the affected function(s) – especially regarding continuity and security.

According to Article 4 (2) DORA the principle of proportionality applies for Chapter III and IV, as where are Chapter V Section I, where stipulated in the relevant rules contained therein. Regarding Article 30(2) (i) DORA, reference is made to Article 13 (6) DORA regarding the participation of ICT third-party service providers in the ICT security awareness programmes and digital operational resilience training. It stipulates that financial entities must include ICT third-party service providers as appropriate in their relevant training programmes. With regard to this rule, financial entities are therefore required to assess the appropriateness of the inclusion of ICT third-party service providers.

In Annex III of the Specification of the Register of Information, consulting contracts are stated as a separate category (explained as ‘Provision of intellectual/ICT expertise services’). Such contracts would also need to be included in this context, provided that a clear link to ICT systems exists.

Where it is clearly apparent from the contract that certain minimum contents of the contract pursuant to Article 30 (2) DORA are not applicable, then these must not be included as separate points in the contract (e.g. omission of the clause about the place of data processing where it is determined that no data is transferred to the consultant).

Where a large amount of these minimum contents appear not to be applicable, this might also form an indication that the specific service is not related to Information and communication technologies (ICT systems).

Here it is necessary to consider how the open source software is obtained. Where other services are linked to it, such as for example ongoing support, advice or similar services, then an ICT service as defined in DORA may exist. If in an extreme case only open source code is obtained, e.g. from a repository, and then used within the entity, then no such service would exist; irrespective this other provisions in DORA (for example ICT systems acquisition, development, and maintenance) may apply accordingly.

Article 30 (3) (e) (ii) DORA states that the contractual agreements on the usage of ICT services to support critical or important functions cover the right to monitor the ICT third-party service provider’s service on a continual basis, including the right to agree on alternative assurance levels if other clients’ rights are affected.

This paragraph must be read in conjunction with Article 30 (3) (e) (i) DORA:

“(i) unrestricted rights of access, inspection and audit by the financial entity, or an appointed third party, and by the competent authority, and the right to take copies of relevant documentation on-site if they are critical to the operations of the ICT third-party service provider, the effective exercise of which is not impeded or limited by other contractual arrangements or implementation policies;

ii) the right to agree on alternative assurance levels if other clients’ rights are affected;”

Therefore: in the event that ‘traditional’ audit rights would encroach on the rights of other clients of the service provider due to the specific situation in question, alternative ways may be agreed upon to monitor the service provider’s service.

In relation to the filling of the register of information, the question also arises about whether there is a materiality limit regarding the “supporting” of critical functions. This question has been asked to the ESAs through the Q&A process. There is no specific time frame in this regard, but clarification is expected at European level on this issue.

The assessment and the depth of the assessment is required to take place in a risk-based approach and from the point of view of proportionality. The Regulatory Technical Standards to specify the elements which a financial entity needs to determine and assess when subcontracting ICT services supporting critical or important functions (Article 30(5) DORA) contains more detailed rules.

While certifications may be taken into account when assessing the suitability of a service provider as a source of information, they are not however a substitute for a service provider assessment.

As stated in the response to the previous question, a certification may not be considered as a substitute for assessing the service provider, and similar a certification may not replace the ongoing (re-)auditing of the service provider. The frequency of ongoing reviews of service providers depends on their criticality and therefore is to be assessed on a case-by-case basis.