{"id":47878,"date":"2025-04-15T08:55:51","date_gmt":"2025-04-15T08:55:51","guid":{"rendered":"https:\/\/my.legal500.com\/developments\/?post_type=press_releases&p=47878"},"modified":"2025-04-15T08:56:03","modified_gmt":"2025-04-15T08:56:03","slug":"definition-of-ict-services-under-dora-new-forms-for-ict-third-party-arrangements-ict-outsourcing-arrangements","status":"publish","type":"press_releases","link":"https:\/\/my.legal500.com\/developments\/press-releases\/definition-of-ict-services-under-dora-new-forms-for-ict-third-party-arrangements-ict-outsourcing-arrangements\/","title":{"rendered":"Definition of \u201cICT services\u201d under DORA | New forms for ICT-third party arrangements \/ ICT outsourcing arrangements"},"content":{"rendered":"
    \n
  1. Clarification on definition of \u201cICT services\u201d<\/strong><\/li>\n<\/ol>\n

    The CSSF would like to draw the attention of all supervised entities to the ESAs\u00a0joint Q&As<\/a>\u00a0answer to the question\u00a0DORA030<\/a>\u00a0on what types of services should be considered \u201cICT services\u201d based on the definition of DORA Article 3(21).<\/strong><\/p>\n

    <\/p>\n

    The answer provided by the European Commission confirmed that the definition of \u201cICT services\u201d intentionally maintains a broad scope and provides further clarifications. We strongly recommend supervised entities to review the Commissions answer in detail as it may concern them, either as an entity in scope of DORA or as a service provider of entities in scope of DORA.<\/p>\n

    Furthermore, we would like to clarify that\u00a0financial services<\/strong>\u00a0provided by professionals of the financial sector\u00a0other than<\/strong>\u00a0those covered by\u00a0Articles 29-3 to 29-6 of the Law of the Financial Sector of 5 April 1993<\/a>\u00a0are\u00a0not to be considered<\/strong>\u00a0an ICT service within the meaning of DORA. On the contrary,\u00a0services offered by professionals of the financial sector which are covered by Articles 29-3 to 29-6 of the LFS, considering the nature of these services, must be considered as an ICT service in the meaning of DORA Article 3(21) in all cases<\/strong>, even though they are provided by a regulated financial entity.<\/p>\n

      \n
    1. Notification of an ICT third-party arrangement supporting a critical or important function under DORA regulation<\/strong><\/li>\n<\/ol>\n

      Today the CSSF published a new notification form for financial entities subject to DORA1<\/sup>\u00a0to notify the CSSF, according to Article 28(3) of DORA, in a timely manner about (a) any planned contractual arrangement regarding the use of ICT services supporting critical or important functions as well as when (b) a function has become critical or important.<\/p>\n

      In the case (a) mentioned above, the prior notification shall be done by the Financial Entity as early as possible before the planned implementation date of the ICT third-party arrangement but, in any case, at least three (3) months or one (1) month (when resorting to a Luxembourg support PFS) before this date. In the case (b) mentioned above, the notification shall be done by the Financial Entity without undue delay.<\/p>\n

      This form shall be used as of today for the submissions of notifications. In order not to penalise entities that are well advanced in the preparation of a notification based on the previous form, financial entities may introduce notifications using the previous form during a transitional period until 10 May 2025. After this date only notifications received with the new form will be considered as notified in line with the instructions and forms available in accordance with sub-chapter 2.1 of Circular CSSF 25\/882 on requirements on the use of ICT third-party services for Financial Entities subject to the Digital Operational Resilience Act (DORA).<\/p>\n

      The CSSF would like to remind financial entities of the following, which was already published in the\u00a0communiqu\u00e9 of 5 December 2024<\/a>:<\/p>\n

        \n
      1. Previously notified\u00a0ICT outsourcing arrangements under Circular CSSF 22\/806\u00a0are\u00a0not required to be re-submitted in the context of DORA<\/strong>.<\/li>\n
      2. Contractual arrangements on the use of ICT services already in place prior to 17 January 2025 and which have not been notified under Circular CSSF 22\/806\u00a0because they do not qualify as a critical or important ICT outsourcing under the circular<\/strong>,\u00a0are also not required to be submitted as notifications\u00a0to the CSSF<\/strong>, however they need to be listed in the Register of Information.<\/li>\n<\/ol>\n