FIG Top 5 At 5 - 06/02/2025

1. European Commission rejects draft RTS on sub-contracting ICT services supporting functions under DORA

On 31 January 2025, the European Commission ("Commission") published a letter(dated 21 January 2025) that it had sent to the Joint Committee of the European Supervisory Authorities ("ESAs") ("Letter"). In the Letter, the Commission rejects the draft RTS that the ESAs submitted, which specifies the elements a financial entity needs to determine and assess when sub-contracting ICT services supporting critical or important functions under Article 30(5) of DORA.

The Commission notes that the draft RTS specifies the conditions and the criteria to be taken into account by financial entities when sub-contracting ICT services supporting critical or important functions throughout the lifecycle of contractual arrangements between financial entities and ICT third-party service providers. In particular, financial entities are required to assess the risks associated with