<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2025-08-08","gaps":[],"covered":["EBA Q&A 2024_7089 — Q&A — Identification of ICT Service Providers [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers","title":"EBA Q&A 2024_7089 — Q&A — Identification of ICT Service Providers [Final Q&A]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 8 August 2025","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7089","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"bc4cfa7dce56b6e9","change_date":null,"nearest_versions":["2025-08-08"],"first_text_date":null,"correction_applies":false,"versions":["2025-08-08"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers/versions/2025-08-08","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers/versions/2025-08-08/rev/bc4cfa7dce56b6e9","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2024-7089-identification-of-ict-service-providers/relations","source_line":"Answer prepared by the Joint ESAs, published in the EBA Q&A tool · not legislation · published 8 Aug 2025 [Final Q&A]","attribution":{"prepared_by":"Joint ESAs","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2025-08-08","question_submitted_on":"2024-05-20","locators":{"published_on":"EBA Q&A register entry 2024_7089, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2024_7089, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2024_7089 — Q&A — Identification of ICT Service Providers [Final Q&A]"
shortTitle: "EBA Q&A 2024_7089 — Q&A — Identification of ICT Service Providers [Final Q&A]"
answer_id: EBA_QA_2024_7089
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "DORA"
dora_level3: true
mica_level2: false
legal_basis: "Article 28(3) DORA"
date: 8 August 2025
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7089
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 8 August 2025"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7089"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "Joint ESAs"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the Joint ESAs Q&A"
    locator: "EBA Q&A register entry 2024_7089, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2025-08-08"
  question_submitted_on: "2024-05-20"
  locators:
    published_on: "EBA Q&A register entry 2024_7089, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2024_7089, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer prepared by the Joint ESAs, published in the EBA Q&A tool · not legislation · published 8 Aug 2025 [Final Q&A]**

*Final Q&A · EBA Q&A register, 8 August 2025 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7089)*

| | |
|---|---|
| **Full title** | EBA Q&A 2024_7089 — Q&A — Identification of ICT Service Providers \[Final Q&A\] |
| **Prepared by** | Joint ESAs |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2024_7089 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 8 August 2025; question submitted 20 May 2024 |
| **Legal basis** | [Article 28(3)](https://www.headlesslaw.com/dora/articles/28) DORA |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Identification of ICT Service Providers**

### Question

Can the ESAs confirm there is no expectation to capture within the Register of Information the ICT subcontractors of non-ICT service providers?

### Background

Recital 7 of the ITS suggests financial entities should consider whether non-ICT service providers are relying on ICT services. If so, it is understood that for the purposes of the Register of Information such providers may be treated as an ICT provider. This would see their ICT subcontractors listed in the Register, provided they effectively underpinned services supporting critical or important functions.

***

### Answer

Where the direct third-party service provider of a financial entity does not provide an ICT service, the service falls outside of the scope of the DORA register of information. In case the said third-party service provider uses ICT services for the fulfilment of its contracted services through the use of ICT subcontractors, those remain outside the scope of the register of information (DORA Article 28.3). Therefore, such use of ICT services through ICT subcontractors does not need to be documented in the DORA register of information.

Financial entities are still required to comply with any relevant requirements under other applicable financial legislation, for instance, the EBA Guidelines.

It should be stressed that in case the financial entity considers, as part of its risk assessment, that the ICT service provided by the ICT subcontractor supports a critical or important function or material parts thereof to an extent that it could be requalified as equivalent to an ICT service provided directly to the financial entity, the DORA Chapter V requirements will apply.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7089)

## Related Level 1 articles

- [Article 28 — General principles](../../../articles/28.md)