--- title: "ESMA Q&A 2447 — Q&A — direct agreements between AIF and ICT service provider [Answer Published]" shortTitle: "ESMA Q&A 2447 — Q&A — direct agreements between AIF and ICT service provider [Answer Published]" answer_id: ESMA_QA_2447 topic: "ICT third-party risk management" status: "Answer Published" type: qa instrument_type: qa authority: ESMA binding: false binding_character: non_binding legal_status: in_force regulation: "DORA" dora_level3: true mica_level2: false legal_basis: "DORA" date: 26 February 2025 source_link: https://www.esma.europa.eu/publications-data/questions-answers/2447 lifecycle: "Answer Published" text_version: "ESMA Q&A register, 26 February 2025" source_url: "https://www.esma.europa.eu/publications-data/questions-answers/2447" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the ESMA publication" source: prepared_by: "ESMA" published_by: "ESMA" published_in: "ESMA Q&A tool" evidence: prepared_by: "ESMA Answer" locator: "ESMA Q&A entry ESMA_QA_2447: field 'ESMA Answer', no 'Answer provided by' line" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2025-02-26" question_submitted_on: "2025-02-26" locators: published_on: "ESMA Q&A Excel export ESMA_QA_2447, column 'Esma responses', date line" question_submitted_on: "ESMA Q&A Excel export ESMA_QA_2447, column 'Date of submission'" lifecycle_label: "Answer Published" --- **Answer by ESMA, published in its Q&A tool · not legislation · published 26 Feb 2025 [Answer Published]** *Answer Published · ESMA Q&A register, 26 February 2025 · Checked against the ESMA publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/publications-data/questions-answers/2447)* | | | |---|---| | **Full title** | ESMA Q&A 2447 — Q&A — direct agreements between AIF and ICT service provider \[Answer Published\] | | **Prepared by** | ESMA | | **Published by** | ESMA, in the ESMA Q&A tool | | **Reference** | ESMA_QA_2447 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 26 February 2025; question submitted 26 February 2025 | | **Legal basis** | DORA | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the ESMA publication | **direct agreements between AIF and ICT service provider** ### Question According to [article 2](../../../articles/2.md) par 1 of DORA AIFM is in scope of DORA, AIF is not defined as financial entity. There are situations when agreement is concluded directly between AIF and ICT service provider. It is obvious that the agreement in such situation should contain elements listed in [article 30](../../../articles/30.md) of DORA and the risk assessment should be performed by AIFM. But shall such agreement also be: - included in the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers according to article 28 par 3 and - notified to competent authority in a timely manner prior of the conclusion of the agreement if the agreement supports critical or important functions? *** ### Answer DORA applies to managers of alternative investment funds according to [Article 2](../../../articles/2.md), point (k) of DORA. Therefore, to the extent that ICT systems of an AIF are needed for the AIFM to comply with its obligations under AIFMD and DORA those systems should be covered. Hence, in general, contracts that are signed by the AIFM, no matter if for the AIFM or on behalf of the AIF, or are signed directly by the AIF should comply with DORA requirements and should be included in the register of information and be notified to competent authorities in a timely manner prior of the conclusion of the agreement, if the agreement supports critical or important functions. *** **Source:** [ESMA original document](https://www.esma.europa.eu/publications-data/questions-answers/2447)