{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2024-12-17","gaps":[],"covered":["ESMA Q&A 2378 — Q&A — Article 3(28) and EU Subcontractors [Answer Published] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the ESMA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors","title":"ESMA Q&A 2378 — Q&A — Article 3(28) and EU Subcontractors [Answer Published]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors","status":"answer published","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"ESMA Q&A register, 17 December 2024","check":{"against":"the ESMA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.esma.europa.eu/publications-data/questions-answers/2378","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"3c250d3d900229e5","change_date":null,"nearest_versions":["2024-12-17"],"first_text_date":null,"correction_applies":false,"versions":["2024-12-17"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors/versions/2024-12-17","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors/versions/2024-12-17/rev/3c250d3d900229e5","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors/relations","source_line":"Answer by ESMA, published in its Q&A tool · not legislation · published 17 Dec 2024 [Answer Published]","attribution":{"prepared_by":"ESMA","published_by":"ESMA","published_in":"ESMA Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2024-12-17","question_submitted_on":"2024-12-17","locators":{"published_on":"ESMA Q&A Excel export ESMA_QA_2378, column 'Esma responses', date line","question_submitted_on":"ESMA Q&A Excel export ESMA_QA_2378, column 'Date of submission'"}},"adoption":null}},"provenance":{"official_url":"https://www.esma.europa.eu/publications-data/questions-answers/2378","check":{"result":"matched","checked_at":"2026-10-26","against":"the ESMA publication"},"repo_path":"spaces/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors.md","body_sha256":"8739d071aa200732060a9eb82918cc4f68a3204bd6c4d4615517f431ba26a7f8"},"units":[],"markdown":"---\ntitle: \"ESMA Q&A 2378 — Q&A — Article 3(28) and EU Subcontractors [Answer Published]\"\nshortTitle: \"ESMA Q&A 2378 — Q&A — Article 3(28) and EU Subcontractors [Answer Published]\"\nanswer_id: ESMA_QA_2378\ntopic: \"Digital operational resilience testing\"\nstatus: \"Answer Published\"\ntype: qa\ninstrument_type: qa\nauthority: ESMA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"DORA\"\ndora_level3: true\nmica_level2: false\nlegal_basis: \"DORA\"\ndate: 17 December 2024\nsource_link: https://www.esma.europa.eu/publications-data/questions-answers/2378\nlifecycle: \"Answer Published\"\ntext_version: \"ESMA Q&A register, 17 December 2024\"\nsource_url: \"https://www.esma.europa.eu/publications-data/questions-answers/2378\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the ESMA publication\"\nsource:\n  prepared_by: \"ESMA\"\n  published_by: \"ESMA\"\n  published_in: \"ESMA Q&A tool\"\n  evidence:\n    prepared_by: \"ESMA Answer\"\n    locator: \"ESMA Q&A entry ESMA_QA_2378: field 'ESMA Answer', no 'Answer provided by' line\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2024-12-17\"\n  question_submitted_on: \"2024-12-17\"\n  locators:\n    published_on: \"ESMA Q&A Excel export ESMA_QA_2378, column 'Esma responses', date line\"\n    question_submitted_on: \"ESMA Q&A Excel export ESMA_QA_2378, column 'Date of submission'\"\nlifecycle_label: \"Answer Published\"\n---\n\n**Answer by ESMA, published in its Q&A tool · not legislation · published 17 Dec 2024 [Answer Published]**\n\n*Answer Published · ESMA Q&A register, 17 December 2024 · Checked against the ESMA publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/publications-data/questions-answers/2378)*\n\n| | |\n|---|---|\n| **Full title** | ESMA Q&A 2378 — Q&A — Article 3(28) and EU Subcontractors \\[Answer Published\\] |\n| **Prepared by** | ESMA |\n| **Published by** | ESMA, in the ESMA Q&A tool |\n| **Reference** | ESMA_QA_2378 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 17 December 2024; question submitted 17 December 2024 |\n| **Legal basis** | DORA |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the ESMA publication |\n\n**Article 3(28) and EU Subcontractors**\n\n### Question\n\nDORA Article 3(28) excludes natural persons from the definition of 3rd country subcontractors, does the same apply to EU Subcontractors?\n\n***\n\n### Answer\n\nArticle 3(28) clearly carves out natural persons from the definition of 3rd country subcontractors. This does however not infer that natural persons are not included in the scope of EU subcontractors.\n\nThe ITS on the Register of Information clearly indicates that (i) subcontractors may be individuals acting in business capacity (Article 3(6)) and (ii) in Part 2, tables on instructions, line B\\_05.01.0070). It is clarified that ICT third party service providers may be either legal persons or individuals acting on business capacity.\n\nWhen we look at [Article 29(2)](../../../articles/29.md) of DORA, we can infer that the relevant subcontractors are anyway ICT third party service providers. Hence, other than in the case of the third-country subcontractors, the ITS on registers has clarified that EU ICT subcontractors may be individuals.\n\n***\n\n**Source:** [ESMA original document](https://www.esma.europa.eu/publications-data/questions-answers/2378)\n"}