DORA: the first critical ICT providers are designated
The ESAs designated 19 critical ICT third-party providers under DORA, now under direct EU oversight. What it means for financial entities and suppliers.
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied to banks, insurers, investment firms, payment institutions and other financial entities since 17 January 2025. Its oversight of the largest technology suppliers is now in operation.
19 providers under direct EU oversight
On 18 November 2025 the three European Supervisory Authorities (EBA, EIOPA and ESMA) published the first list of critical ICT third-party service providers (CTPPs). The 19 designated providers include large cloud, data centre, telecom, consulting and financial data companies, among them Amazon Web Services EMEA, Google Cloud EMEA, Microsoft Ireland Operations, Oracle Nederland, SAP SE, Deutsche Telekom, Orange, Equinix, Capgemini, Accenture and IBM.
The ESAs based the designation on the registers of information that financial entities keep about their ICT contracts, followed by a criticality assessment with national authorities. Designated providers now have a Lead Overseer that can request information, carry out inspections and issue recommendations. The list is updated every year.
Registers of information: every year
Financial entities keep a register of all their ICT third-party arrangements. From 2026, national authorities report these registers to the ESAs by 31 March each year, with 31 December of the previous year as the reference date. National authorities set their own, earlier deadlines for the entities they supervise.
What it means
- For financial entities: oversight of a CTPP does not take over your own responsibility. You still manage ICT third-party risk yourself: contracts with the clauses of Article 30, exit strategies, and a complete and accurate register.
- For ICT suppliers that are not on the list, including smaller SaaS providers: expect DORA clauses in contracts, questions about subcontractors and locations, and requests for exit and incident support. Being ready with clear answers shortens procurement.
More on the supplier side: DORA for ICT third-party and SaaS providers.
Sources
- Regulation (EU) 2022/2554 (DORA)
- EBA: The European Supervisory Authorities designate critical ICT third-party providers under DORA (18 November 2025)
- ESMA: List of designated critical ICT third-party service providers
- EBA: Preparations for reporting of DORA registers of information
For information only, not legal advice. Last updated 19 October 2026.
Also available in: Nederlands, Italiano, Deutsch, Français, Español, Polski, Português, Română, Čeština, Slovenčina, Dansk, Svenska, Norsk bokmål