Search for Q&As

Enquirers can use various factors to search for a Q&A:

  • These include searching by the Q&A ID; legal reference, date submitted, technical standard / guideline, or by keyword if known.
  • Searches can be extended to more than one legal act, topic, technical standard or guidelines by making multiple selections (i.e. pressing 'Ctrl' on your keyboard, and selecting the relevant ones from the drop-down lists by left mouse-click).

Disclaimer:

Q&As refer to the provisions in force on the day of their publication. The EBA does not systematically review published Q&As following the amendment of legislative acts. Users of the Q&A tool should therefore check the date of publication of the Q&A and whether the provisions referred to in the answer remain the same.

Please note that the Q&As related to the supervisory benchmarking exercises have been moved to the dedicated handbook page. You can submit Q&As on this topic here.

Final Q&As Q&As under review Rejected Q&As Archived Q&As All Q&As

List of Q&A's

Grace period for existing contractual arrangements in the register of information

As stated in Regulation (EU) No 2022/2554 (DORA) Article 28, paragraph 3 - As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers. Is there a grace period for the existing contractual arrangements, or does all the information have to be collected and recorded in the register of information before the regulatory deadline in January 2025? 

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2024_6991
  • Topic: ICT third-party risk management
  • Date of submission:
  • Published as Rejected Q&A: 05/11/2024

Request for Clarification on Article 28(3) of Regulation (EU) 2022/2554

I am reaching out for clarification regarding a specific provision in the Digital Operational Resilience Act (DORA) – particularly the third paragraph of Article 28. The provision in question stipulates: "As part of their ICT risk management framework, financial entities shall maintain, and keep updated at entity level as well as at sub-consolidated and consolidated levels, a register of information related to all contractual arrangements on the use of ICT services provided by third-party ICT service providers." Similarly, DORA provides in its article 28(2): "The strategy on ICT third-party risk shall include a policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers and shall apply on an individual basis and, where relevant, on a sub-consolidated and consolidated basis". Overall, how should we understand the phrases “where relevant” and “where applicable” in DORA and its policy products when addressing different levels of entities? we seek your confirmation on whether our client is really obligated to maintain both for its specific entity and at the group level:  The register of information related to all contractual arrangements on the use of ICT services provided by third-party ICT service providers. The strategy on ICT third-party risk and (or?) the policy on the use of ICT services supporting critical or important functions.  Could you also confirm that whenever the phrases "where relevant" and "where applicable" appear in the presence of corporate group, the latter must each time implement the requirement at the level of the entity, at the sub-consolidated level and at the consolidated level? 

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2023_6950
  • Topic: ICT risk management
  • Date of submission:
  • Published as Rejected Q&A: 19/07/2024

DORA Regulation & Applicability to Third-Country Branches

Is Regulation (EU) 2022/2554 (DORA) applicable to third-country branches that are licensed in our country (EU country) as Credit Institutions?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2023_6876
  • Topic: Other DORA topics
  • Date of submission:
  • Published as Rejected Q&A: 18/02/2025