--- title: "ESMA Q&A 2159 — Q&A — Intragroup ICT service providers consideration [Question Rejected]" shortTitle: "ESMA Q&A 2159 — Q&A — Intragroup ICT service providers consideration [Question Rejected]" answer_id: ESMA_QA_2159 topic: "ICT risk management" status: "Question Rejected" type: qa instrument_type: qa authority: ESMA binding: false binding_character: non_binding legal_status: withdrawn regulation: "DORA" dora_level3: true mica_level2: false legal_basis: "Art.1(i) of the ‘Draft RTS to specify the elements that a financial entity needs to determine and assess when subcontracting ICT services supporting critical or important functions’, as mandated by Article 30(5) of Regulation (EU) 2022/2554" date: 18 April 2024 source_link: https://www.esma.europa.eu/publications-data/questions-answers/2159 lifecycle: "Question Rejected" text_version: "ESMA Q&A register, 18 April 2024" source_url: "https://www.esma.europa.eu/publications-data/questions-answers/2159" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the ESMA publication" source: prepared_by: "not stated in the document" published_by: "ESMA" published_in: "ESMA Q&A tool" evidence: prepared_by: "ESMA_QA_2159" locator: "ESMA Q&A entry ESMA_QA_2159: no answer; no author named" document_type: "qa_question" legal_nature: "not_legislation" addressees: "not stated in the document" dates: question_submitted_on: "2024-04-18" locators: question_submitted_on: "ESMA Q&A Excel export ESMA_QA_2159, column 'Date of submission'" lifecycle_label: "Question Rejected" --- **Question published in the ESMA Q&A tool · no answer · not legislation [Question Rejected]** *Question Rejected · ESMA Q&A register, 18 April 2024 · Checked against the ESMA publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/publications-data/questions-answers/2159)* | | | |---|---| | **Full title** | ESMA Q&A 2159 — Q&A — Intragroup ICT service providers consideration \[Question Rejected\] | | **Prepared by** | Not stated in the document | | **Published by** | ESMA, in the ESMA Q&A tool | | **Reference** | ESMA_QA_2159 | | **Document type** | Q&A | | **Legal nature** | No answer · not legislation | | **Addressees** | Not stated in the document | | **Dates** | Question submitted 18 April 2024 | | **Legal basis** | Art.1(i) of the ‘Draft RTS to specify the elements that a financial entity needs to determine and assess when subcontracting ICT services supporting critical or important functions’, as mandated by Article 30(5) of Regulation (EU) 2022/2554 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the ESMA publication | **Intragroup ICT service providers consideration regarding the preliminary assessment of ICT concentration risk.** ### Question When conducting the preliminary assessment of potential ICT concentration risk associated with an ICT service provider, as stipulated in Regulation 2022/2054 and its corresponding draft RTS on subcontracting ICT services supporting critical or important functions, what treatment should be applied to ICT intra-group service providers? In other words, are financial entities (FEs) required to consider this concentration risk for ICT intra-group service providers? Alternatively, would the exemption outlined in Regulation 2022/2054 article 31.8(iii) apply, thereby meaning that this risk should not be considered for intra-group service providers? REGIS-TR SA seeks further clarification on this matter, given that the DORA Regulation establishes that - ‘While intra-group provision of ICT services entails specific risks and benefits, it should not be automatically considered less risky than the provision of ICT services by providers outside of a financial group and should therefore be subject to the same regulatory framework. However, when ICT services are provided from within the same financial group, financial entities might have a higher level of control over intra-group providers, which ought to be taken into account in the overall risk assessment’. Similarly, article 28.4(c) states that - ‘Before entering into a contractual arrangement on the use of ICT services, financial entities shall: (c) identify and assess all relevant risks in relation to the contractual arrangement, including the possibility that such contractual arrangement may contribute to reinforcing ICT concentration risk as referred to in Article 29’. Furthermore, the aforementioned article 29 covers the considerations and risks to take into account in relation to ICT service providers supporting critical or important functions, when performing the preliminary assessment of ICT concentration risk. Additionally, the draft RTS on ‘the elements which a financial entity needs to determine and assess when subcontracting ICT services supporting critical or important functions’ also explains that - ‘ICT intragroup subcontractors, including the ones fully or collectively owned by financial entities within the same institutional protection scheme, providing ICT services supporting critical or important functions should be considered as ICT third-party services providers. Intragroup ICT subcontracting should not be treated differently from subcontracting outside of the group. The risks posed by those ICT intragroup subcontractors may be different but the requirements applicable to them are the same in accordance with Regulation (EU) 2022/2054. When the use of ICT subcontractors is permitted, then those also include ICT intragroup subcontractors’, thereby making no distinction between intra-group and external service providers. Due to these reasons, we are uncertain about whether the exemption outlined in Regulation 2022/2054 article 31.8(iii) would apply; or if exposure to a ICT intragroup service providers should also be considered during the preliminary assessment of ICT concentration risk. *** **Source:** [ESMA original document](https://www.esma.europa.eu/publications-data/questions-answers/2159)