{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2025-08-08","gaps":[],"covered":["EBA Q&A 2024_7089 — Q&A — Identification of ICT Service Providers [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers","title":"EBA Q&A 2024_7089 — Q&A — Identification of ICT Service Providers [Final Q&A]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 8 August 2025","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7089","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"bc4cfa7dce56b6e9","change_date":null,"nearest_versions":["2025-08-08"],"first_text_date":null,"correction_applies":false,"versions":["2025-08-08"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers/versions/2025-08-08","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers/versions/2025-08-08/rev/bc4cfa7dce56b6e9","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers/relations","source_line":"Answer prepared by the Joint ESAs, published in the EBA Q&A tool · not legislation · published 8 Aug 2025 [Final Q&A]","attribution":{"prepared_by":"Joint ESAs","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2025-08-08","question_submitted_on":"2024-05-20","locators":{"published_on":"EBA Q&A register entry 2024_7089, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2024_7089, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7089","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers.md","body_sha256":"87d2ee7d036bc18a2c189f9396802dff5adc63ff2670cb28f14290e1fa471a3d"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2024_7089 — Q&A — Identification of ICT Service Providers [Final Q&A]\"\nshortTitle: \"EBA Q&A 2024_7089 — Q&A — Identification of ICT Service Providers [Final Q&A]\"\nanswer_id: EBA_QA_2024_7089\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"DORA\"\ndora_level3: true\nmica_level2: false\nlegal_basis: \"Article 28(3) DORA\"\ndate: 8 August 2025\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7089\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 8 August 2025\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7089\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"Joint ESAs\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the Joint ESAs Q&A\"\n    locator: \"EBA Q&A register entry 2024_7089, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2025-08-08\"\n  question_submitted_on: \"2024-05-20\"\n  locators:\n    published_on: \"EBA Q&A register entry 2024_7089, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2024_7089, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer prepared by the Joint ESAs, published in the EBA Q&A tool · not legislation · published 8 Aug 2025 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 8 August 2025 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7089)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2024_7089 — Q&A — Identification of ICT Service Providers \\[Final Q&A\\] |\n| **Prepared by** | Joint ESAs |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2024_7089 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 8 August 2025; question submitted 20 May 2024 |\n| **Legal basis** | [Article 28(3)](https://www.headlesslaw.com/dora/articles/28) DORA |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Identification of ICT Service Providers**\n\n### Question\n\nCan the ESAs confirm there is no expectation to capture within the Register of Information the ICT subcontractors of non-ICT service providers?\n\n### Background\n\nRecital 7 of the ITS suggests financial entities should consider whether non-ICT service providers are relying on ICT services. If so, it is understood that for the purposes of the Register of Information such providers may be treated as an ICT provider. This would see their ICT subcontractors listed in the Register, provided they effectively underpinned services supporting critical or important functions.\n\n***\n\n### Answer\n\nWhere the direct third-party service provider of a financial entity does not provide an ICT service, the service falls outside of the scope of the DORA register of information. In case the said third-party service provider uses ICT services for the fulfilment of its contracted services through the use of ICT subcontractors, those remain outside the scope of the register of information (DORA Article 28.3). Therefore, such use of ICT services through ICT subcontractors does not need to be documented in the DORA register of information.\n\nFinancial entities are still required to comply with any relevant requirements under other applicable financial legislation, for instance, the EBA Guidelines.\n\nIt should be stressed that in case the financial entity considers, as part of its risk assessment, that the ICT service provided by the ICT subcontractor supports a critical or important function or material parts thereof to an extent that it could be requalified as equivalent to an ICT service provided directly to the financial entity, the DORA Chapter V requirements will apply.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7089)\n\n## Related Level 1 articles\n\n- [Article 28 — General principles](../../../articles/28.md)\n"}