{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2025-09-04","gaps":[],"covered":["EBA Q&A 2025_7468 — Q&A — ANNUAL REPORT ON NEW ARRANGEMENTS ON THE USE [Rejected question] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/eba/eba-qa-2025-7468-annual-report-on-new-arrangements-on-the-use-of-ict-services","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7468-annual-report-on-new-arrangements-on-the-use-of-ict-services","title":"EBA Q&A 2025_7468 — Q&A — ANNUAL REPORT ON NEW ARRANGEMENTS ON THE USE [Rejected question]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/eba/eba-qa-2025-7468-annual-report-on-new-arrangements-on-the-use-of-ict-services","status":"rejected question","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 4 September 2025","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7468","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"dd973a60028a88da","change_date":null,"nearest_versions":["2025-09-04"],"first_text_date":null,"correction_applies":false,"versions":["2025-09-04"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7468-annual-report-on-new-arrangements-on-the-use-of-ict-services/versions/2025-09-04","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7468-annual-report-on-new-arrangements-on-the-use-of-ict-services/versions/2025-09-04/rev/dd973a60028a88da","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7468-annual-report-on-new-arrangements-on-the-use-of-ict-services/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/eba/eba-qa-2025-7468-annual-report-on-new-arrangements-on-the-use-of-ict-services/relations","source_line":"Question published in the EBA Q&A tool · no answer · not legislation · published 4 Sep 2025 [Rejected question]","attribution":{"prepared_by":"not stated in the document","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_question","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2025-09-04","question_submitted_on":"2025-05-27","locators":{"published_on":"EBA Q&A register entry 2025_7468, field 'Rejected publishing date'","question_submitted_on":"EBA Q&A register entry 2025_7468, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7468","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/dora/level-3/q-and-a/eba/eba-qa-2025-7468-annual-report-on-new-arrangements-on-the-use-of-ict-services.md","body_sha256":"924d34110a1278828331428e6de489ef055b5b84a41549cce6d8af328f40a231"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2025_7468 — Q&A — ANNUAL REPORT ON NEW ARRANGEMENTS ON THE USE [Rejected question]\"\nshortTitle: \"EBA Q&A 2025_7468 — Q&A — ANNUAL REPORT ON NEW ARRANGEMENTS ON THE USE [Rejected question]\"\nanswer_id: EBA_QA_2025_7468\nstatus: \"Rejected question\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: withdrawn\nregulation: \"DORA\"\ndora_level3: true\nmica_level2: false\nlegal_basis: \"Article 28(3) DORA\"\ndate: 4 September 2025\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7468\nlifecycle: \"Rejected question\"\ntext_version: \"EBA Q&A register, 4 September 2025\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7468\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"not stated in the document\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Consultancy firm\"\n    locator: \"EBA Q&A register entry 2025_7468: no answer; the register names only the 'Type of submitter'\"\ndocument_type: \"qa_question\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2025-09-04\"\n  question_submitted_on: \"2025-05-27\"\n  locators:\n    published_on: \"EBA Q&A register entry 2025_7468, field 'Rejected publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2025_7468, field 'Submission date'\"\nlifecycle_label: \"Rejected question\"\n---\n\n**Question published in the EBA Q&A tool · no answer · not legislation · published 4 Sep 2025 [Rejected question]**\n\n*Rejected question · EBA Q&A register, 4 September 2025 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7468)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2025_7468 — Q&A — ANNUAL REPORT ON NEW ARRANGEMENTS ON THE USE \\[Rejected question\\] |\n| **Prepared by** | Not stated in the document |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2025_7468 |\n| **Document type** | Q&A |\n| **Legal nature** | No answer · not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 4 September 2025; question submitted 27 May 2025 |\n| **Legal basis** | [Article 28(3)](https://www.headlesslaw.com/dora/articles/28) DORA |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**ANNUAL REPORT ON NEW ARRANGEMENTS ON THE USE OF ICT SERVICES**\n\n### Question\n\nPursuant to the provisions of Chapter V, Section I, Article 28, Paragraph 3, of the DORA Regulation, which states:\n\n“Financial entities shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided.,”\n\nwe kindly request clarification on whether this provision requires a separate and specific communication in addition to the Register of Information, or whether the communication of such data is already fulfilled through the annual submission of the same Register, constituting a single compliance obligation.\n\nIn the event that a separate communication is required in addition to the annual submission of the Register of Information, we kindly request clarification on the meaning of the term \"categories of third-party ICT service providers\" as mentioned in Chapter V, Section I, Article 28, Paragraph 3 of the DORA Regulation.\n\n### Background\n\nArticle 28(3) specifies the obligation to report annually the number of new agreements with ICT suppliers, their categories, the type of contracts and the ICT services provided.\n\nHowever, some questions of interpretation remain open, including:\n\nThe nature of the reporting: it is unclear whether this obligation should be considered a separate fulfilment from the annual submission of the Register of Information, which already includes details on ICT suppliers and contracts.\n\nFor example, if a financial entity enters into 10 new ICT contracts with different suppliers in a year, these contracts will be included in the Register of Information. It remains to be clarified whether separate reporting is also required and, if so, how to correctly categorise suppliers.\n\nThe definition of \"categories of third-party ICT service providers\": the Regulation does not specify whether this term refers to standardised classifications (e.g. cloud providers, data centres, cybersecurity) or to criteria defined independently by financial entities, and no further evidence was found on this.\n\nFor example, in the case where a financial entity enters into a new contract with a cloud provider for the storage of critical data, the question arises as to which category should be used to classify this provider, whether generically \"cloud provider\" or another category not explicitly defined.\n\n***\n\n### Answer\n\nThis question has been rejected because the matter it refers to is answered in Q&A DORA 170 (EBA 2025\\_7309).\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7468)\n\n## Related Level 1 articles\n\n- [Article 28 — General principles](../../../articles/28.md)\n"}