Joint ESAs Discussion on DORA - criteria for critical ICT third-party service providers (CTPPs) and oversight fees

The European Supervisory Authorities (EBA, EIOPA and ESMA - ESAs) today published a joint Discussion Paper seeking stakeholders’ input on aspects of the Digital Operational Resilience Act (DORA). This Discussion Paper follows the European Commission’s request for technical advice on the criteria for critical ICT third-party providers (CTPPs) and the oversight fees to be levied on them. Interested stakeholders are invited to provide their input by 23 June 2023.

The Discussion Paper is separated into two parts:

• Proposals covering the criteria to be considered by the ESAs when assessing the critical nature of ICT third-party service providers, in particular, a number of relevant quantitative and qualitative indicators for each of the criticality criteria, along with the necessary information to construct such indicators.
• Proposals in relation to the amount of the fees levied on CTPPs and the way in which they are to be paid, in particular the types of expenditure that shall be covered by fees as well as the appropriate method, basis and information for determining the applicable turnover of the CTPPs, which will form the basis of fee calculation. The ESAs are also seeking input on the fee calculation method and other practical issues regarding the payment of fees.

Consultation process

Comments to this Discussion Paper may be sent to the ESAs via EUSurvey no later than 23 June 2023.

Stakeholders who are not in a position to respond to all questions are encouraged to provide partial responses. All contributions received will be published following the end of the consultation period, unless requested otherwise.

Next steps

The feedback collected in this consultation will inform the technical advice that the ESAs will deliver to the European Commission by 30 September 2023.