The European Supervisory Authorities designate critical ICT third-party providers under the Digital Operational Resilience Act

What happened

On 18 November 2025 the European Banking Authority, European Insurance and Occupational Pensions Authority and European Securities and Markets Authority released a list of designated critical ICT third‑party providers (CTPPs) under DORA. The designation follows a three‑step process: data collection from registers, a criticality assessment with national competent authorities, and a right‑to‑be‑heard for providers. The ESAs will now oversee these CTPPs to ensure they have adequate risk‑management and governance frameworks. Ongoing examinations are planned to monitor compliance across the EU financial sector.

Why it matters

Financial firms must verify that any ICT vendor on the new list meets DORA‑required risk‑management standards, or risk heightened supervisory scrutiny. Providers should ready documentation for ESA examinations.

Business impact

Expect increased audit activity and possible remediation costs for firms relying on listed providers, as oversight may affect service contracts and continuity planning.

Checklist

• Map all ICT vendors against the published CTPP listHigh priority

  Identify any contracts with providers now designated as critical under DORA.

• Review and strengthen vendor risk‑management frameworksHigh priority

  Ensure governance, incident response, and continuity plans meet ESA oversight expectations.

• Prepare documentation for ESA examinationsMedium priority

  Compile contracts, risk assessments, and governance policies for each designated provider.

Who reported it

Discussion