European Supervisory Authorities Reveal First CTPPs Under DORA

The European Supervisory Authorities (EBA, EIOPA, and ESMA – collectively, the ESAs) have published the list of designated critical ICT third-party providers (CTPPs) under the EU Digital Operational Resilience Act (DORA).

Designated CTPPs

The list comprises 19 companies that deliver a wide range of ICT services - from core infrastructure to business and data services - to financial entities of all types and sizes across the EU. The ESAs describe these providers as playing a "pivotal role within the financial ecosystem."

Designation process

The designation process followed the methodology set out in Article 31 of DORA:

1. Data collection: the ESAs gathered information from the Registers of Information maintained by financial entities, detailing their contractual arrangements for ICT services.