EU RTS on subcontracting ICT services supporting critical or important functions under DORA published in OJ

Commission Delegated Regulation (EU) 2025/532 has been published in the Official Journal of the European Union. The Delegated Regulation supplements the Digital Operational Resilience Act (DORA) with regard to regulatory technical standards (RTS) specifying the elements that a financial entity has to determine and assess when subcontracting information and communication technology (ICT) services supporting critical or important functions.

The RTS cover:

• Proportionality and the application of the requirements within groups.
• Due diligence and risk assessment obligations that apply to financial entities when they use sub-contractors that support critical or important functions.
• Requirements relating to the conditions under which ICT services supporting critical or important functions may be sub-contracted and the terms of the contractual arrangements between the financial entity and the ICT third-party service provider.
• What happens when material changes are made to sub-contracting arrangements of ICT services supporting critical or important functions.
• The financial entity's right to terminate the contract with the ICT third-party service provider in certain situations.

The Delegated Regulation enters into force on 22 July.

Return to main website.