ESAs Release Guide On DORA Oversight Of Critical Third-party Providers

On 15 July 2025, the European Supervisory Authorities (ESAs) published a guide on oversight activities under the Digital Operational Resilience Act (DORA), providing practical insights into how they will oversee ICT third-party service providers designated as critical under DORA.

Objectives of DORA oversight framework

While Competent Authorities (CAs) continue to supervise the digital and operational risk of their in-scope financial entities (FEs), the ESAs are responsible for overseeing third-party ICT service providers whose failure or disruption could significantly impact the financial sector's ability to function, or whose services are essential to the financial system as a whole (critical third-party ICT service providers, referred to as CTPPs). The oversight framework for CTPPs is designed to complement the supervision of FEs' ICT risk by CAs, allowing close collaboration between the ESAs and CAs.