DORA: Drafting And Reviewing ICT Services Agreements

In 2023, as part of the preparations for the application of DORA and the establishment of this oversight framework, the European Supervisory Authorities (ESAs) jointly started conducting a high-level exercise identifying and mapping ICT third party service providers (hereinafter "ICTPs"), with a focus on concentration and substitutability of service provision. This collection of data was the first of its kind, covering contractual arrangements for many types of entities across the financial sector.

The report identified that most ICTPs serve only a small number of EU financial entities, though some of these entities may play a significant role in the financial system. The most popular ICTPs also typically provide services supporting the largest number of critical or important financial functions, which suggests that the market is highly concentrated despite the high number of ICTPs identified and the number of ICT services provided. The ICT services supporting most