<!-- headlesslaw {"release":{"id":"c89ff15ec1240a456b40735def079beeda55a0c372be7f3da154287997367ecf","published":"2026-11-02T04:02:35Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2024-02-12","gaps":[],"covered":["ESMA Q&A 2107 — Q&A — Application of DORA for outsourced critical services [Answer Published] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"c89ff15ec1240a456b40735def079beeda55a0c372be7f3da154287997367ecf","release_published":"2026-11-02T04:02:35Z","checked_at":"2026-10-26","checked_against":"the ESMA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/esma/esma-qa-2107-application-of-dora-for-outsourced-critical-services-that","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2107-application-of-dora-for-outsourced-critical-services-that","title":"ESMA Q&A 2107 — Q&A — Application of DORA for outsourced critical services [Answer Published]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/esma/esma-qa-2107-application-of-dora-for-outsourced-critical-services-that","status":"answer published","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"ESMA Q&A register, 12 February 2024","check":{"against":"the ESMA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.esma.europa.eu/publications-data/questions-answers/2107","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"dddabb0916a26a5a","change_date":null,"nearest_versions":["2024-02-12"],"first_text_date":null,"correction_applies":false,"versions":["2024-02-12"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2107-application-of-dora-for-outsourced-critical-services-that/versions/2024-02-12","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2107-application-of-dora-for-outsourced-critical-services-that/versions/2024-02-12/rev/dddabb0916a26a5a","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2107-application-of-dora-for-outsourced-critical-services-that/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2107-application-of-dora-for-outsourced-critical-services-that/relations","source_line":"Answer by ESMA, published in its Q&A tool · not legislation · published 12 Feb 2024 [Answer Published]","attribution":{"prepared_by":"ESMA","published_by":"ESMA","published_in":"ESMA Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2024-02-12","question_submitted_on":"2024-02-12","locators":{"published_on":"ESMA Q&A Excel export ESMA_QA_2107, column 'Esma responses', date line","question_submitted_on":"ESMA Q&A Excel export ESMA_QA_2107, column 'Date of submission'"}},"adoption":null}}} -->
---
title: "ESMA Q&A 2107 — Q&A — Application of DORA for outsourced critical services [Answer Published]"
shortTitle: "ESMA Q&A 2107 — Q&A — Application of DORA for outsourced critical services [Answer Published]"
answer_id: ESMA_QA_2107
topic: "ICT third-party risk management"
status: "Answer Published"
type: qa
instrument_type: qa
authority: ESMA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "DORA"
dora_level3: true
mica_level2: false
legal_basis: "DORA"
date: 12 February 2024
source_link: https://www.esma.europa.eu/publications-data/questions-answers/2107
lifecycle: "Answer Published"
text_version: "ESMA Q&A register, 12 February 2024"
source_url: "https://www.esma.europa.eu/publications-data/questions-answers/2107"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the ESMA publication"
source:
  prepared_by: "ESMA"
  published_by: "ESMA"
  published_in: "ESMA Q&A tool"
  evidence:
    prepared_by: "ESMA Answer"
    locator: "ESMA Q&A entry ESMA_QA_2107: field 'ESMA Answer', no 'Answer provided by' line"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2024-02-12"
  question_submitted_on: "2024-02-12"
  locators:
    published_on: "ESMA Q&A Excel export ESMA_QA_2107, column 'Esma responses', date line"
    question_submitted_on: "ESMA Q&A Excel export ESMA_QA_2107, column 'Date of submission'"
lifecycle_label: "Answer Published"
---

**Answer by ESMA, published in its Q&A tool · not legislation · published 12 Feb 2024 [Answer Published]**

*Answer Published · ESMA Q&A register, 12 February 2024 · Checked against the ESMA publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/publications-data/questions-answers/2107)*

| | |
|---|---|
| **Full title** | ESMA Q&A 2107 — Q&A — Application of DORA for outsourced critical services \[Answer Published\] |
| **Prepared by** | ESMA |
| **Published by** | ESMA, in the ESMA Q&A tool |
| **Reference** | ESMA_QA_2107 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 12 February 2024; question submitted 12 February 2024 |
| **Legal basis** | DORA |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the ESMA publication |

**Application of DORA for outsourced critical services that are not ICT**

### Question

My questions relate to the scenario where a UK financial services firm, or an offshore financial services firm (e.g. in Guernsey), provides services to an EU financial services firm.

For example, in the scenario where an EU financial services firm outsourced its fund management to a UK asset management firm to manage a fund. Would the EU firm be expected to have sought reassurance from the UK fund manager that the UK firm is also compliant with DORA?

Thanks in advance for your help.

***

### Answer

A financial entity in the EU is subject to DORA and must ensure it operates DORA-compliant, which includes their third-party relationships.

Therefore, it follows that if an EU financial entity makes use of a non-EU third-party provider for a function or activity, independently of whether this function is considered as critical or important or not by the financial entity and this service provider in turn makes use of ICT services to support its function or activity, the responsibility to ensure the operational resilience of the function or activity that has been entrusted to the non-EU third-party provider remains with the financial entity.

The EU financial entity is expected to validate that the non-EU third-party provider does not prevent it to be compliant with DORA.

***

**Source:** [ESMA original document](https://www.esma.europa.eu/publications-data/questions-answers/2107)