--- title: "Article 38 — General investigations" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554" shortTitle: "Article 38 — General investigations" instrument_type: level1_regulation authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Regulation (EU) 2022/2554" instrument: dora celex: "32022R2554" regulation: DORA regulation-full: "Regulation (EU) 2022/2554" article: 38 status: in_force text_version: "Regulation (EU) 2022/2554, OJ L 333, 27.12.2022" source_url: "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng" check_status: matched verified: true last_checked: 2026-11-09 --- *In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)* 1. In order to carry out its duties under this Regulation, the [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer), assisted by the joint examination team referred to in [Article 40(1)](40.md), may, where necessary, conduct investigations of [critical ICT third-party service providers](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider). 2. The [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer) shall have the power to: **(a)** examine records, data, procedures and any other material relevant to the execution of its tasks, irrespective of the medium on which they are stored; **(b)** take or obtain certified copies of, or extracts from, such records, data, documented procedures and any other material; **(c)** summon representatives of the [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider) for oral or written explanations on facts or documents relating to the subject matter and purpose of the investigation and to record the answers; **(d)** interview any other natural or legal person who consents to be interviewed for the purpose of collecting information relating to the subject matter of an investigation; **(e)** request records of telephone and data traffic. 3. The officials and other persons authorised by the [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer) for the purposes of the investigation referred to in paragraph 1 shall exercise their powers upon production of a written authorisation specifying the subject matter and purpose of the investigation. That authorisation shall also indicate the periodic penalty payments provided for in [Article 35(6)](35.md) where the production of the required records, data, documented procedures or any other material, or the answers to questions asked to representatives of the [ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/ict-third-party-service-provider) are not provided or are incomplete. 4. The representatives of the [critical ICT third-party service providers](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider) are required to submit to the investigations on the basis of a decision of the [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer). The decision shall specify the subject matter and purpose of the investigation, the periodic penalty payments provided for in [Article 35(6)](35.md), the legal remedies available under Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, and the right to have the decision reviewed by the Court of Justice. 5. In good time before the start of the investigation, the [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer) shall inform competent authorities of the financial entities using the [ICT services](https://www.headlesslaw.com/definitions/dora/ict-services) of that [critical ICT third-party service provider](https://www.headlesslaw.com/definitions/dora/critical-ict-third-party-service-provider) of the envisaged investigation and of the identity of the authorised persons. The [Lead Overseer](https://www.headlesslaw.com/definitions/dora/lead-overseer) shall communicate to the JON all information transmitted pursuant to the first subparagraph. *** [Chapter V — Managing of ICT third-party risk](../chapters/v.md) › Section II — Oversight Framework of critical ICT third-party service providers · [← Article 37](37.md) · [Article 39 →](39.md)