European Commission adopts RTS on the elements to assess when subcontracting certain ICT services under DORA

The European Commission has adopted a Delegated Regulation supplementing Regulation 2022/2554 on digital operational resilience for the financial sector (DORA) with regard to regulatory technical standards specifying the elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions. Articles 1 and 2 establish the rules on proportionality and group application. Article 3 sets out rules on due diligence and risk assessment regarding the use of subcontractors supporting critical or important functions. Article 4 establishes the description and the conditions under which ICT services supporting a critical or important function may be subcontracted. Articles 5 and 6 contain the rules on material changes to subcontracting arrangements of ICT service supporting critical or important functions and the provisions on the termination of the contractual arrangement. The Delegated Regulation will enter into force 20 days after its publication in the Official Journal of the EU.

Return to main website.