<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2024-12-17","gaps":[],"covered":["ESMA Q&A 2378 — Q&A — Article 3(28) and EU Subcontractors [Answer Published] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the ESMA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors","title":"ESMA Q&A 2378 — Q&A — Article 3(28) and EU Subcontractors [Answer Published]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors","status":"answer published","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"ESMA Q&A register, 17 December 2024","check":{"against":"the ESMA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.esma.europa.eu/publications-data/questions-answers/2378","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"3c250d3d900229e5","change_date":null,"nearest_versions":["2024-12-17"],"first_text_date":null,"correction_applies":false,"versions":["2024-12-17"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors/versions/2024-12-17","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors/versions/2024-12-17/rev/3c250d3d900229e5","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2378-article-3-28-and-eu-subcontractors/relations","source_line":"Answer by ESMA, published in its Q&A tool · not legislation · published 17 Dec 2024 [Answer Published]","attribution":{"prepared_by":"ESMA","published_by":"ESMA","published_in":"ESMA Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2024-12-17","question_submitted_on":"2024-12-17","locators":{"published_on":"ESMA Q&A Excel export ESMA_QA_2378, column 'Esma responses', date line","question_submitted_on":"ESMA Q&A Excel export ESMA_QA_2378, column 'Date of submission'"}},"adoption":null}}} -->
---
title: "ESMA Q&A 2378 — Q&A — Article 3(28) and EU Subcontractors [Answer Published]"
shortTitle: "ESMA Q&A 2378 — Q&A — Article 3(28) and EU Subcontractors [Answer Published]"
answer_id: ESMA_QA_2378
topic: "Digital operational resilience testing"
status: "Answer Published"
type: qa
instrument_type: qa
authority: ESMA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "DORA"
dora_level3: true
mica_level2: false
legal_basis: "DORA"
date: 17 December 2024
source_link: https://www.esma.europa.eu/publications-data/questions-answers/2378
lifecycle: "Answer Published"
text_version: "ESMA Q&A register, 17 December 2024"
source_url: "https://www.esma.europa.eu/publications-data/questions-answers/2378"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the ESMA publication"
source:
  prepared_by: "ESMA"
  published_by: "ESMA"
  published_in: "ESMA Q&A tool"
  evidence:
    prepared_by: "ESMA Answer"
    locator: "ESMA Q&A entry ESMA_QA_2378: field 'ESMA Answer', no 'Answer provided by' line"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2024-12-17"
  question_submitted_on: "2024-12-17"
  locators:
    published_on: "ESMA Q&A Excel export ESMA_QA_2378, column 'Esma responses', date line"
    question_submitted_on: "ESMA Q&A Excel export ESMA_QA_2378, column 'Date of submission'"
lifecycle_label: "Answer Published"
---

**Answer by ESMA, published in its Q&A tool · not legislation · published 17 Dec 2024 [Answer Published]**

*Answer Published · ESMA Q&A register, 17 December 2024 · Checked against the ESMA publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/publications-data/questions-answers/2378)*

| | |
|---|---|
| **Full title** | ESMA Q&A 2378 — Q&A — Article 3(28) and EU Subcontractors \[Answer Published\] |
| **Prepared by** | ESMA |
| **Published by** | ESMA, in the ESMA Q&A tool |
| **Reference** | ESMA_QA_2378 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 17 December 2024; question submitted 17 December 2024 |
| **Legal basis** | DORA |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the ESMA publication |

**Article 3(28) and EU Subcontractors**

### Question

DORA Article 3(28) excludes natural persons from the definition of 3rd country subcontractors, does the same apply to EU Subcontractors?

***

### Answer

Article 3(28) clearly carves out natural persons from the definition of 3rd country subcontractors. This does however not infer that natural persons are not included in the scope of EU subcontractors.

The ITS on the Register of Information clearly indicates that (i) subcontractors may be individuals acting in business capacity (Article 3(6)) and (ii) in Part 2, tables on instructions, line B\_05.01.0070). It is clarified that ICT third party service providers may be either legal persons or individuals acting on business capacity.

When we look at [Article 29(2)](../../../articles/29.md) of DORA, we can infer that the relevant subcontractors are anyway ICT third party service providers. Hence, other than in the case of the third-country subcontractors, the ITS on registers has clarified that EU ICT subcontractors may be individuals.

***

**Source:** [ESMA original document](https://www.esma.europa.eu/publications-data/questions-answers/2378)