{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2023-09-29","gaps":[],"covered":["ESA/2023/23 — Advice — CTPP designation criteria and oversight fees [published] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the ESAs publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/reports-and-advice/esa-2023-23-technical-advice-ctpp-criteria-and-fees","url":"https://www.headlesslaw.com/dora/level-3/reports-and-advice/esa-2023-23-technical-advice-ctpp-criteria-and-fees","title":"ESA/2023/23 — Advice — CTPP designation criteria and oversight fees [published]","family":"l3","work_id":"spaces/dora/level-3/reports-and-advice/esa-2023-23-technical-advice-ctpp-criteria-and-fees","status":"published","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"joint publication","check":{"against":"the ESAs publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.esma.europa.eu/document/joint-esas-technical-advice-two-ec-delegated-acts-under-digital-operational-resilience-act","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"525ef5379cb87abe","change_date":null,"nearest_versions":["2023-09-29"],"first_text_date":"2023-09-29","correction_applies":false,"versions":["2023-09-29"],"version_url":"https://www.headlesslaw.com/dora/level-3/reports-and-advice/esa-2023-23-technical-advice-ctpp-criteria-and-fees/versions/2023-09-29","revision_url":"https://www.headlesslaw.com/dora/level-3/reports-and-advice/esa-2023-23-technical-advice-ctpp-criteria-and-fees/versions/2023-09-29/rev/525ef5379cb87abe","versions_url":"https://www.headlesslaw.com/dora/level-3/reports-and-advice/esa-2023-23-technical-advice-ctpp-criteria-and-fees/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/reports-and-advice/esa-2023-23-technical-advice-ctpp-criteria-and-fees/relations","source_line":"Technical advice by the Joint Committee of the ESAs · not legislation · dated 29 Sep 2023 [published]","attribution":{"prepared_by":"Joint Committee of the ESAs","published_by":"ESMA","published_in":null,"document_type":"technical_advice","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"document_date":"2023-09-29","locators":{"document_date":"PDF page 1: \"29 September 2023\""}},"adoption":null}},"provenance":{"official_url":"https://www.esma.europa.eu/document/joint-esas-technical-advice-two-ec-delegated-acts-under-digital-operational-resilience-act","check":{"result":"matched","checked_at":"2026-10-26","against":"the ESAs publication"},"repo_path":"spaces/dora/level-3/reports-and-advice/esa-2023-23-technical-advice-ctpp-criteria-and-fees.md","body_sha256":"ae8f23755d67d2aabad8afbfa0d58dc33779d217e038b8776e5d5ec8943a7626"},"units":[],"markdown":"---\ntitle: \"ESA/2023/23 — Advice — CTPP designation criteria and oversight fees [published]\"\nshortTitle: \"ESA/2023/23 — Advice — CTPP designation criteria and oversight fees [published]\"\ntype: advice\ninstrument_type: advice\nauthority: joint\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: DORA\ndora_level3: true\nmica_level2: false\nreference: \"ESA 2023 23\"\nlegal_basis: \"Articles 31 and 43 DORA\"\ndate: 29 September 2023\nsource_link: \"https://www.esma.europa.eu/document/joint-esas-technical-advice-two-ec-delegated-acts-under-digital-operational-resilience-act\"\nsource_pdf: \"https://www.esma.europa.eu/sites/default/files/2023-09/Joint-ESAs__response_to_the_Call_for_advice_on_the_designation_criteria_and_fees_for_the_DORA_oversight_framework_final.pdf\"\nlifecycle: \"published\"\ntext_version: \"joint publication\"\nsource_url: \"https://www.esma.europa.eu/document/joint-esas-technical-advice-two-ec-delegated-acts-under-digital-operational-resilience-act\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the ESAs publication\"\nsource:\n  prepared_by: \"Joint Committee of the ESAs\"\n  published_by: \"ESMA\"\n  evidence:\n    prepared_by: \"ESA 2023 23\"\n    locator: \"PDF page 1 (https://www.esma.europa.eu/sites/default/files/2023-09/Joint-ESAs__response_to_the_Call_for_advice_on_the_designation_criteria_and_fees_for_the_DORA_oversight_framework_final.pdf)\"\ndocument_type: \"technical_advice\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  document_date: \"2023-09-29\"\n  locators:\n    document_date: \"PDF page 1: \\\"29 September 2023\\\"\"\nlifecycle_label: \"published\"\n---\n\n**Technical advice by the Joint Committee of the ESAs · not legislation · dated 29 Sep 2023 [published]**\n\n*Published · joint publication · Checked against the ESAs publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/document/joint-esas-technical-advice-two-ec-delegated-acts-under-digital-operational-resilience-act)*\n\n| | |\n|---|---|\n| **Full title** | ESA/2023/23 — Advice — CTPP designation criteria and oversight fees \\[published\\] |\n| **Prepared by** | Joint Committee of the ESAs |\n| **Published by** | ESMA |\n| **Reference** | ESA 2023 23 |\n| **Document type** | Advice |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Dated 29 September 2023 |\n| **Legal basis** | Articles 31 and 43 DORA |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the ESAs publication |\n\nESA 2023 23\n\n29 September 2023\n\n## Joint European Supervisory Authorities’ Technical Advice\n\nto the European Commission’s December 2022 Call for Advice on two delegated acts specifying further criteria for critical ICT third-party service providers (CTPPs) and determining oversight fees levied on such providers, under [Articles 31](../../articles/31.md) and [43](../../articles/43.md) of Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operation resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011\n\n## Abbreviations\n\nBCBS Basel Committee on Banking Supervision CfA Call for Advice (C)TPP (Critical) ICT Third-Party Provider DP Discussion Paper DORA Digital Operational Resilience Act EBA European Banking Authority Commission European Commission EIOPA European Insurance and Occupational Pensions Authority ESAs European Supervisory Authorities ESMA European Securities and Markets Authority EU European Union FE Financial entity FMI Financial Market Infrastructure FSB Financial Stability Board G-SII Globally Systemically Important Institution IAIS International Association of Insurance Supervisors ICT Information and Communication Technology ICT TPP ICT third-party service provider IOSCO International Organization of Securities Commissions JC Joint Committee of the ESAs JET Joint Examination Team JON Joint Oversight Network LEI Legal Entity Identifier LFS Legislative Financial Statement\n\n## NCA National Competent Authority O-SII Other Systemically Important Institution\n\n## Executive Summary\n\nIn light of the two delegated acts envisaged in the Regulation on Digital Operational Resilience for the Financial Sector (\"DORA\"), the European Commission has requested the ESAs’ technical advice to further specify the criteria for critical ICT third-party service providers (CTPPs) and determine the fees levied on such providers[^1]. This report sets out the advice of the ESAs in response to this request.\n\nThe first part of the report proposes a number of relevant quantitative and qualitative indicators for each of the criticality criteria, along with the necessary information to build up and interpret such indicators. Moreover, a number of minimum relevance thresholds are proposed for the quantitative indicators, where possible and applicable. These minimum relevance thresholds should not be understood as triggers of criticality but a minimum requirement above which the criticality assessment could be carried out. Details of the designation procedure as well as the related methodology are explicitly excluded from this report and shall be defined no later than six months after the adoption of the delegated act by the Commission[^2], also in the context of the implementation of the oversight framework.\n\nThe second part of the report proposes the necessary types of expenditure that shall be covered by oversight fees, the appropriate method, basis and available information for determining the applicable turnover of the CTPPs (which will form the basis of fee calculation) as well as the method of fee calculation and other practical issues regarding the payment of fees. In addition, a proposed financial contribution for voluntary opt-in requests is included in the report.\n\nFrom 26 May to 23 June 2023, the ESAs have widely consulted market participants, publishing a discussion paper on their draft advice to the European Commission. In total, the ESAs received 41 responses from various stakeholders (please refer to the annex for the detailed feedback statement). Regarding the criticality criteria, the ESAs clarified further their proposals (in particular as regards to the holistic nature of the criticality assessment and the outcomes of the joint-ESAs high-level exercise on TPPs’ landscape), increased the role of critical or important functions in the assessment and further streamlined the proposed set of indicators. Regarding the oversight fees, the ESAs have partially adapted their advice by proposing to define the scope of the applicable turnover on a narrower basis. Overall, market participants expressed support to the proposals related to the other issues (methods of calculation of the fees, payment issues and treatment of the opt-in application), while requesting further clarity on some points.\n\nThe ESAs remain at the disposal of the European Commission, including for the provision of further information that could support the European Commission in preparing the two delegated acts this technical advice is related to.\n\n## Introduction\n\n## Background and rationale\n\n1\\. On 27 December 2022, Regulation (EU) 2022/2554 of the European Parliament and the Council of 14 December 2022 on the Digital Operational resilience of the Financial Sector (DORA) has been published in the Official Journal of the European Union. It entered into force on 16 January 2023 and will apply from 17 January 2025. The DORA Regulation is accompanied by the Directive (EU) 2022/2556 amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital operational resilience for the financial sector.\n\n2\\. The DORA will create a comprehensive framework addressing various core components of the digital operational resilience of financial entities. It will enhance the overall conduct of ICT risk management, establish testing rules for ICT systems, increase financial supervisors’ awareness of cyber risks through an EU harmonized incident reporting scheme and introduce Union oversight to oversee financial entities’ dependency on critical ICT third-party service providers (CTPPs). The overall objective is to strengthen and align the digital operational resilience across the different Union financial areas.\n\n3\\. To address potential systemic and concentration risks posed by the financial sectors’ reliance on a small number of ICT TPPs, the DORA introduces a Union oversight framework for providers deemed critical. As Lead Overseers, each of the three European Supervisory Authorities (EBA, EIOPA and ESMA) will have the power to monitor on a pan-European scale the activity of CTPPs in the context of the ICT services they provide to financial entities in the scope of the DORA.\n\n4\\. In accordance with [Article 31(1)](../../articles/31.md)(a) of the DORA, an ICT TPP that is considered critical to the stability and integrity of the Union financial system, will be designated by the ESAs (through the Joint Committee) as a CTPP, excluding the four categories of providers listed in Article 31(8[^3]). In assessing criticality, the ESAs, upon recommendation from the Oversight Forum, will take into account the criteria set out in the DORA. These criteria will be further specified by a Commission delegated act.\n\n## Article 31(2):\n\n“2. The designation referred to in paragraph 1, point (a), shall be based on all of the following criteria in relation to ICT services provided by the ICT third-party service provider:\n\n(a) the systemic impact on the stability, continuity or quality of the provision of financial services in the event that the relevant ICT third-party service provider would face a large scale operational failure to provide its services, taking into account the number of financial entities and the total value of assets of financial entities to which the relevant ICT third-party service provider provides services;\n\n(b) the systemic character or importance of the financial entities that rely on the relevant ICT third-party service provider, assessed in accordance with the following parameters:\n\n(i) the number of global systemically important institutions (G-SIIs) or other systemically important institutions (O-SIIs) that rely on the respective ICT third-party service provider;\n\n(ii) the interdependence between the G-SIIs or O-SIIs referred to in point (i) and other financial entities, including situations where the G-SIIs or O-SIIs provide financial infrastructure services to other financial entities;\n\n(c) the reliance of financial entities on the services provided by the relevant ICT third-party service provider in relation to critical or important functions of financial entities that ultimately involve the same ICT third-party service provider, irrespective of whether financial entities rely on those services directly or indirectly, through subcontracting arrangements;\n\n(d) the degree of substitutability of the ICT third-party service provider, taking into account the following parameters:\n\n(i) the lack of real alternatives, even partial, due to the limited number of ICT third-party service providers active on a specific market, or the market share of the relevant ICT third-party service provider, or the technical complexity or sophistication involved, including in relation to any proprietary technology, or the specific features of the ICT third-party service provider’s organisation or activity; (ii) difficulties in relation to partially or fully migrating the relevant data and workloads from the relevant ICT thirdparty service provider to another ICT third-party service provider, due either to significant financial costs, time or other resources that the migration process may entail, or to increased ICT risk or other operational risks to which the financial entity may be exposed through such migration.”\n\n## Article 31(6):\n\n* “6. The Commission is empowered to adopt a delegated act in accordance with Article 57 to supplement this Regulation by specifying further the criteria referred to in paragraph 2 of this Article, by 17 July 2024.”\n\n## Article 31(8):\n\n* “8. The designation referred to in paragraph 1, point (a), shall not apply to the following:\n\n(i) financial entities providing ICT services to other financial entities;\n\n(ii) ICT third-party service providers that are subject to oversight frameworks established for the purposes of supporting the tasks referred to in Article 127(2) of the Treaty on the Functioning of the European Union;\n\n(iii) ICT intra-group service providers;\n\n(iv) ICT third-party service providers providing ICT services solely in one Member State to financial entities that are only active in that Member State.”\n\n5\\. In accordance with [Article 43](../../articles/43.md) of the DORA, the Lead Overseers[^4] will charge fees to ICT TPPs designated as critical, and those fees shall cover all the expenditure incurred by the Lead Overseers in relation to the conduct of oversight tasks. The Lead Overseers will charge fees based on the DORA provisions, including the delegated act to be adopted by the Commission. The amount of the fees and the way in which they are to be paid by CTPPs will be further specified in the aforementioned delegated act.\n\n## Article 43:\n\n* “1. The Lead Overseer shall, in accordance with the delegated act referred to in paragraph 2 of this Article, charge critical ICT third-party service providers fees that fully cover the Lead Overseer’s necessary expenditure in relation to the conduct of oversight tasks pursuant to this Regulation, including the reimbursement of any costs which may be incurred as a result of work carried out by the joint examination team referred to in Article 40, as well as the costs of advice provided by the independent experts as referred to in Article 32(4), second subparagraph, in relation to matters falling under the remit of direct oversight activities.\n\nThe amount of a fee charged to a critical ICT third-party service provider shall cover all costs derived from the execution of the duties set out in this Section and shall be proportionate to its turnover.\n\n2\\. The Commission is empowered to adopt a delegated act in accordance with Article 57 to supplement this Regulation by determining the amount of the fees and the way in which they are to be paid by 17 July 2024.”\n\n6\\. In light of the above, on 21 December 2022, the ESAs received a request from the Commission to provide technical advice to assist the latter on the possible content of these delegated acts.\n\n7\\. The call for technical advice addresses the need for further details aimed at shaping-up the designation criteria. The input sought refers to several specific sets of indicators of a qualitative and quantitative nature, for each of the criteria, minimum thresholds triggering such indicators (if applicable in the case of qualitative indicators), and, more extensively, background information deemed relevant by the ESAs to help in the build-up of indicators.\n\n8\\. It also addresses some of the elements which are needed in the specification of the amount of fees, as well as the way and method(s) in which such fees are to be paid. In providing their advice, the ESAs are invited to draw on relevant experiences from both national supervisors and ESMA (when setting supervisory fees for financial institutions).\n\n## Joint advice on criticality criteria\n\n## Introduction\n\n9\\. Relying on third-party services, including outsourcing, is not a new phenomenon in the financial sector. Financial entities have always cooperated with other financial and non-financial companies[^5]. This has been subject to EU regulatory requirements and supervision for a long time for most of the entities in scope of the DORA, including through effective governance and risk management requirements and outsourcing provisions.\n\n10\\. However, technological developments and digitalisation are increasing the extent and ways by which financial entities rely on third parties within the value chain. Indeed, financial entities are increasingly relying on technology and data services provided by third parties for their digital transformation—a trend that has accelerated in response to the COVID-19 pandemic[^6].\n\n11\\. The ESAs also observe growing interactions between incumbent financial entities and technology firms/ICT providers through a variety of co-operation models, e.g., partnerships, joint ventures, outsourcing and sub-outsourcing, or mergers and acquisitions.\n\n12\\. These developments are creating new opportunities for consumers and businesses. Outsourcing to technology firms allows financial entities to focus on their core services, which brings flexibility and efficiency gains. Yet, these developments also bring new risks and regulatory/supervisory challenges. The growing reliance of financial entities on tech companies may create risks to financial stability, e.g., if the same small number of companies are being used by many firms across the financial sector and in particular if ICT services provided by these companies support critical or important functions. As already noted, amongst others, in the BCBS Principles of Operational Resilience[^7], until recently, some of the most predominant operational risks resulted from vulnerabilities related to the rapid adoption of and increased dependency on technology infrastructure for the provision of financial services and intermediation, as well as the sector’s growing reliance on technology-based services provided by third-parties.\n\n13\\. The Commission invited the ESAs to specify the designation criteria for CTPPs. In particular, the Commission is requesting sets of indicators of a qualitative and quantitative nature for each of the four criteria set out in [Article 31(2)](../../articles/31.md) of the DORA, which should be accompanied by minimum thresholds triggering such indicators (if applicable in the case of qualitative indicators). Moreover, the Commission invited the ESAs to convey any information necessary to build up and (if needed) to correctly read/interpret such indicators as well as to reflect on the frequency of reviewing the respective delegated acts to reflect related developments.\n\n14\\. The proposed indicators based on the criteria set out in [Article 31(2)](../../articles/31.md) of the DORA should have the following key characteristics:\n\na. Available: usable/underlying data available;\n\nb. Measurable: quantifiable/assessment can be summarised in a short paragraph (for qualitative criteria);\n\nc. Relevant: directly linked to the topic with immediate applicability;\n\nd. Specific: well defined, clear, and unambiguous; and\n\ne. Timely: up to date, considering latest technological developments which are likely to have a significant impact on TPPs’ criticality.\n\n15\\. According to [Article 31(3)](../../articles/31.md) of the DORA, where an ICT TPP belongs to a group, the criteria must be considered in relation to the ICT services provided by the group as a whole.\n\n16\\. With regard to the proposed minimum thresholds for certain indicators it is noted that these are described in the CfA as being related to the potential to trigger the relevant indicators. As no criticality determination methodology is being put forward at this stage[^8], such indicators must be considered as related to relevance triggers rather than criticality triggers. Hence, these minimum relevance thresholds should be understood as a minimum requirement above which the criticality assessment could be carried out. How the indicators will be assessed within the overall determination methodology will be considered at a later stage. It should be noted that the calibration of the related data obtained from the joint ESAs high-level exercise on ICT TPPs (2022 exercise) has been taken into account, where relevant, for the determination of the proposed minimum relevance thresholds.\n\n17\\. Moreover, the request of the Commission highlights that the ESAs should not be confined in their reflections to elements that they consider should be addressed by the delegated acts themselves and that their proposal should ensure cross-sectoral consistency. The majority of the proposed indicators are expected to be informed by the data to be provided by financial entities (falling under the scope of the DORA) via their registers of information as per [Article 28(3)](../../articles/28.md) of the DORA. At this stage, the report proposes indicators that are considered appropriate to designate the CTPPs consistently with [Article 31(1)](../../articles/31.md) of the DORA. Such constructive approach is also applied for the metrics used in the indicators, and the ESAs have tried to define indicators allowing a balanced coverage of all the sub-sectors of the financial sector. Additional data sources other than the registers of information have been investigated by the ESAs and are identified in this report, where applicable.\n\n18\\. Lastly, the ESAs were also invited to reflect on the frequency of reviewing the respective delegated acts to reflect related developments. In this regard, it is considered appropriate to ensure consistency with the review clause in [Article 58](../../articles/58.md) of the DORA and hence to perform a review on the need for potential amendments in the respective delegated acts every 3 years. This could ensure alignment with market developments and experiences gained by the ESAs, which is particularly relevant as this designation exercise is an entirely new task to the ESAs and significant experience is expected to be gained over time. Moreover, such a review frequency could facilitate an adequate timespan to assess the effectiveness of the criticality indicators as well as the performance of the oversight activities.\n\n## Indicative process for criticality assessment\n\n19\\. Taking into account the criteria set out in [Article 31(2)](../../articles/31.md) of the DORA, and in line with the request that “the advice should \\[...\\] consider minimum threshold(s) \\[...\\] which would need to be considered for designation subject to a further qualitative assessment \\[...\\]”, the ESAs propose the following two-step indicator-based approach to perform a holistic criticality assessment as envisaged in [Article 31(2)](../../articles/31.md) of DORA:\n\n![Figure printed as an image in the official text — page 12](../../.gitbook/assets/dora-l3-esa-2023-23-technical-advice-ctpp-criteria-and-fees-image-1.png)\n\nStep 1: ‘Assessing ICT TPPs against a set of minimum relevance thresholds (step 1)’\n\n20\\. The ESAs propose as Step 1 the assessment of ICT TPPs, which provide ICT services to financial entities under the scope of DORA, against six quantitative indicators, alongside respective minimum relevance thresholds[^9]. The quantitative indicators will be considered holistically[^10] rather than sequentially to allow a comprehrensive assessment and reflecting all the criticality criteria.\n\n21\\. The data to assess these indicators will be sourced mainly by the registers of information maintained by financial entities under the scope of the DORA as well as existing available data from the ESAs and the competent authorities. Material ICT subcontractors[^11] will be also taken into account to allow a comprehensive assessment of potential systemic impact on the EU financial sector. It is important to note that the extent of subcontractors’ assessment is subject to the final ITS on the register of information under [Article 28(9)](../../articles/28.md) of the DORA.\n\n22\\. The outcome of step 1 will indicate the ICT TPPs which could proceed to further assessment (step 2). In particular, ICT TPPs that exceed a certain number of minimum relevance thresholds across the six indicators could be subject to a further assessment (step 2). It is important to iterate that step 1 indicators should be considered holistically as they aim to take into account the dimension and nature of the financial sector’s reliance on such ICT TPPs.\n\n## Step 2: ‘Further assessment of ICT TPPs (step 2)’\n\n23\\. The ESAs propose in step 2, the number of ICT TPPs resulting from step 1 to undergo a further assessment based on five additional indicators as presented further below in the document.\n\n24\\. These step 2 indicators, which are also of qualitative nature and therefore do not come with minimum relevance thresholds, should allow the ESAs to identify the relevant providers to be considered as CTPPs at Union level taking into account evidence-based aspects. The step 2 indicators should be seen as complementary to the step 1 indicators, allowing for a more granular assessment of the ICT TPPs that could potentially be considered as critical according to step 1.\n\n25\\. The outcome of the application of the step 1 and step 2 indicators, subject also to a holistic/collective assessment, will be a proposed list of CTPPs to the Oversight Forum, which provides a respective recommendation to the ESAs Joint Committee.\n\n26\\. As mentioned above, the details on the collective application of steps 1 and 2 are out of scope of this report, however, the ESAs consider it appropriate to develop a methodology in this regard, also proposed by the market participants in the context of the public consultation. The finalisation of this methodology should follow no later than six months after the adoption of the related delegated act by the Commission and in the context of the implementation of the oversight framework[^12].\n\n## Related issues\n\n27\\. If an assessed ICT TPP belongs to a group, the criticality criteria shall be considered in relation to the ICT services provided by the group as a whole in line with Article 31(3) of the DORA. As a follow-up to some questions during the public consultation, it is important to note that information regarding the group assessment will be mainly sourced via the registers of information maintained by financial entities under the scope of the DORA. For designation purposes, this information could be supplemented by publicly available information such as LEI databases.\n\n28\\. It is important to note that material subcontractors should be appropriately captured during the criticality assessment, hence to be considered across all the indicators. The data on subcontractors will be sourced mainly by the registers of information as well as by information directly provided by CTPPs (available only after first concrete experiences with designated CTPPs). The assessment of material ICT subcontractors[^13] could allow a comprehensive assessment of potential systemic impact on the EU financial sector. It is important to note that the extent of subcontractors’ assessment would be subject to the final ITS on the register of information under Article 28(9) of the DORA. In light of Article 3(28) of the DORA, an ICT subcontractor established in a third country is considered a legal person that has entered into a contractual arrangement with an ICT TPP for the provision of ICT services to financial entities supervised by the competent authorities identified in Article 46 of the DORA.\n\n29\\. All financial entities, ICT TPPs, including ICT intra-group providers, which meet the conditions set out by Article 31(8) of the DORA[^14], will be excluded from the designation process, i.e. the step 1 and step 2 indicators set out in this document will not be applied on those ICT TPPs.\n\n30\\. Furthermore, the ESAs propose the list of designated CTPPs to be stable, to the extent possible, over time in order to manage threshold effects[^15]. This was also supported by the market participants during the public consultation. While the Discussion Paper proposed the application of a certain threshold for the Lead Overseer to consider proceeding to a roll off phase of the CTPP from the list of CTPPs, mixed views were expressed during the public consultation. To this end, the ESAs propose to perform a holistic assessment in case a CTPP does not meet the minimum thresholds for a consecutive number of years and to decide accordingly a potential exit from the list of CTPPs, in consultation with the Oversight Forum, also taking into account the status of pending recommendations addressed to that CTPP. It should be also noted that planned or undertaken events impacting the CTPPs (e.g. mergers,\n\n* divestments etc.) would be reflected in the annual update of the list of CTPPs as per Article 31(9) of the DORA.\n\n31\\. The ESAs have also explored the possiblity of taking into account the list of essential or important entities under NIS2[^16] and CER[^17] to the extent that certain ICT TPPs have been designated as ‘essential or important entities’ at national level. However, given the horizontal nature of those directives, the wider scope of the DORA when it comes to the financial sector, as well as in line with feedback received from the market participants, the ESAs propose not to consider this element for the purpose of the DORA criticiality assessment.\n\n32\\. It is also essential to note that the assessment of the proposed indicators is subject to the availability of data as these have been identified per each indicator. In case of inadequate, insufficient, timely unavailable or incomplete data and as also recommended by the market participants during the public consultation, the ESAs propose , to the extent possible, to rely on existing available data or seek industry input, and to apply expert judgement in order to meet their obligation as per Article 31 of the DORA. Having said that, and given the high dependency of the proposed set of indicators on the registers of information (the primary data source to perform the criticality assessment), in case the Delegated Act will specify the type and source of data to be used by the ESAs for the criticality assessment, the ESAs propose the Commission enables the ESAs to also use alternative data sources for the performance of the criticality assessment as a complementary source of information and to mitigate cases where render the use of registers of information may not be possible. This can reduce potential disruptions in the performance of the criticality assessment that may arise in particular during the first years of application of the registers of information and facilitate timely conduct of the oversight cycle.\n\n33\\. Without prejudice to paragraph 32, the ESAs propose the set of indicators as proposed in this document should also be used for the assessment of the opt-in requests according to Article 31(11) of the DORA.\n\n## Criterion 1: impact on provision of financial services\n\n## Criterion 1:\n\n“The systemic impact on the stability, continuity, or quality of the provision of financial services in the event that an ICT TPP would face a large-scale operational failure to provide its services, taking into account the number of financial entities and the total value of assets of financial entities to which the ICT TPP provides services.”\n\n## Introduction\n\n34\\. If an ICT TPP fails or is no longer able to provide its services, including in the case of severe business disruption caused by external events, this may cause systemic risks to the financial markets, which can have a negative impact on the stability, continuity, and quality of the provision of financial services.\n\n35\\. This is particularly relevant for such market segments, which are dominated by a small number of highly dominant service providers. In particular, if the ICT services provided are highly standardised, allowing the respective ICT TPPs to provide their services to a large number of different clients in an automated manner.\n\n36\\. For this reason, it is of paramount importance to have a clear view on the extent and nature of impact which a large-scale operational failure of an ICT TPP would have on financial entities, which rely on services provided by an ICT TPP, and on the financial system. This should not only consider the total number of financial entities, which use services provided by an ICT TPP, but also the size of the respective financial entities, their systemic importance and interconnectedness, as well as the importance of the services provided by an ICT TPP on financial entities’ provision of financial services taking into account stability, continuity as well as quality considerations.\n\n37\\. It should be further noted that in their feedback to the public consultation, market participants noted the importance of considering the criticality of the functions supported by the ICT TPPs, which is highly relevant both in the case of a large-scale operational failure and the provision of such ICT services by the same ICT TPP.\n\n38\\. These aspects are addressed by criterion 1 and 3 as set out by Article 31(2)(a) and (c) of the DORA and further specified in the below list of indicators.\n\n## List of step 1 indicators\n\nIndicator 1.1 Number of financial entities directly or indirectly relying on ICT services provided by the same ICT TPP where these support critical or important functions (per type of financial entity and in percentage terms)\n\n## Notes:\n\n* The objective of this indicator is to capture ICT TPPs’ pan-European footprint by assessing how many financial entities rely on ICT services provided by the same ICT TPPs. The idea is that the more financial entities rely on ICT services provided by the same ICT TPP where these support critical or important functions, the higher the impact on the stability, continuity, or quality of the provision of financial services in the event that the ICT TPP would face a large-scale operational failure to provide its services.\n* This indicator aims to cover both criteria 1 and 3 (as per Article 31(2)(a) and (c) of the DORA) given the overlap on criticality of the functions supported by an ICT TPP. This is supported by the feedback from the public consultation to put more emphasis on ICT services supporting critical or important functions of financial entities and also to keep the indicators simple and avoid overlaps.\n* For each ICT TPP, the result of this indicator is calculated by dividing the number of financial entities relying on ICT services of this ICT TPP that support critical or important functions by the total number of EU financial entities falling under the scope of the DORA (also per type of financial entity).\n* Critical or important functions are identified by financial entities under the scope of the DORA in the registers of information[^18].\n* This includes material subcontractors as reported in the registers of information[^19]. In particular, if subcontractors belong to a group, the indicator will be assessed in relation to the ICT services provided by the group as a whole.\n* As noted during the public consultation, this indicator should be considered in conjunction with the other indicators while leveraging on existing available data.\n* In relation to the minimum relevance threshold, it is noted that feedback from the public consultation was that the proposed 10% is rather low. Nevertheless, no relevant data was provided to support a higher threshold. The magnitude of excess of this threshold would be considered during the assessment to ensure the appropriate coverage of potentially ‘critical’ characterisitcs.\n* 10% or more of total number of financial entities in the EU (total and/or per type of financial entity[^20]).\n\n## Minimum relevance threshold\n\n## Key data sources\n\n* Registers of Information[^21]\n* Publicly available data (e.g. LEI database)\n\n## Indicator 1.2\n\nShare of financial entities directly or indirectly relying on ICT services provided by the same ICT TPP where these support critical or important functions, measured by the total value of assets of financial entities or an equivalent metric (per type of financial entity and in percentage terms)\n\n## Notes:\n\n* The objective of this indicator is to capture ICT TPPs’ pan-European footprint by assessing the share of financial entities relying on ICT services provided by the same ICT TPP. The idea is that the higher the share of financial entities relying on ICT services provided by the same ICT TPP where these support critical or important functions (in terms of total value of assets or an equivalent metric), the higher the ICT TPP’s level of criticality for the EU financial sector.\n* This indicator aims to cover both criteria 1 and 3 (as per Article 31(2)(a) and (c) of the DORA) given the overlap on criticality of the functions supported by an ICT TPP. This is supported by the feedback from the public consultation, to put more emphasis on ICT services supporting critical or important functions of financial entities and also to keep the indicators simple with no overlaps.\n* For each ICT TPP, the result of this indicator is calculated by dividing the total value of assets/equivalent metric of financial entities relying on ICT services of this ICT TPP that support critical or important functions by the total value of assets/equivalent metric of all EU financial entities falling under the scope of the DORA (per type of financial entity).\n* The reference to the ‘total value of assets’ is referred to in Article 31(2)(a) of the DORA. However, this metric might not be representative for all types of financial entities subject to the DORA to measure their systemic impact on the stability, continuity, or quality of the provision of the financial services they provide. Hence, from that point of view, it is proposed to take into account an equivalent metric for financial entities for which the ‘total value of assets’ is not considered representative e.g. ‘assets under management’ or ‘premiums collected’. For this reason, it is considered important to define for each type of financial entity covered by the DORA the most relevant underlying basis. Please see Annex V of the Consultation Paper on Draft Implementing Technical Standards to establish the templates composing the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT TPPs as mandated by the DORA[^22].\n* This includes material subcontractors as reported in the registers of information[^23]. In particular, if subcontractors belong to a group, the indicator will be assessed in relation to the ICT services provided by the group as a whole.\n* As noted during the public consultation, this indicator should be considered in conjunction with the other indicators while leveraging on existing available data.\n* In relation to the minimum relevance threshold, it is noted that feedback from the public consultation was that the proposed 10% is rather low. Nevertheless, no relevant data was provided to support a higher threshold. The magnitude of excess of this threshold would be considered during the assessment to ensure the appropriate coverage of potentially ‘critical’ characterisitcs.\n* 10% or more of total value of assets/equivalent metric of financial entities in the EU (per type of financial entity[^24]).\n\n## Minimum relevance threshold\n\n## Key data sources\n\n* Registers of Information\n* Publicly available data (e.g. LEI database)\n\n## List of step 2 indicators\n\n## Indicator 1.3\n\nShare of financial entities for which the impact of discontinuing the ICT services provided by the same ICT TPP would be assessed as ‘high’ on the activities and operations of those financial entities (per type of financial entity and in percentage terms)\n\n## Notes:\n\n* The objective of this indicator is to capture the impact of a discontinuation of ICT services provided by the same ICT TPP on financial entities. The idea is that the higher the share of financial entities that are highly impacted by a discontinuation of ICT services provided by the same ICT TPP, the higher the respective ICT TPP’s level of criticality for the EU financial sector. This will be mainly based on the financial entity’s assessment.\n* For each ICT TPP, the result of this indicator is calculated by dividing the total value of assets/equivalent metric of financial entities reporting that the discontinuation of ICT services provided by the same ICT TPP have a high impact on their activities and operations by the total value of assets/equivalent metric of all EU financial entities falling under the scope of the DORA (per type of financial entity).This includes material subcontractors as reported in the registers of information[^25]. In particular, if subcontractors belong to a group, the indicator will be assessed in relation to the ICT services provided by the group as a whole.\n\n## Key data sources\n\n* Registers of Information\n* Other information available to the ESAs (e.g. findings from supervisory activities)\n\nIndicator 1.4 Number of designated CTPPs relying on the same subcontractors to directly or indirectly provide ICT services to financial entities supporting critical or important functions (in absolute terms)\n\n## Notes:\n\n* The objective of this indicator is to identify the critical subcontractors in the EU financial system. The idea is that the more CTPPs rely on the same subcontractors to provide ICT services to financial entities supporting critical or important functions, the more important those subcontractors are for the EU financial sector and might have to be designated as a CTPP themselves.\n* It should be noted that in scope of this indicator are not only rank 1 providers, but all providers in the subcontracting chain. Focus should be on subcontractors of ICT services supporting critical or important functions or material parts thereof (‘material subcontractors’). To acquire a clear and precise overview of ICT service supply chains, a reporting template on subcontracting arrangements by the CTPPs (see Article 41(1)(b) of the DORA) as well as complementary information through the registers of information are expected to be taken into account[^26].\n* The application of this indicator is likely to be challenging at the start of the designation exercise due to limited availability of relevant data. This implies that this indicator can only be applied after some first experiences with designated CTPPs, i.e., it will not be used for the designation of the first group of CTPPs.\n* Indicators listed below for criterion 4 will be used on a complementary basis to inform this indicator.\n\n## Key data sources\n\n* Reporting template for CTPPs to provide information on their subscontracting arrangements\n* Registers of Information\n\n## Criterion 2: importance of financial entities\n\n## Criterion 2:\n\n“The systemic character or importance of the financial entities that rely on the relevant ICT third-party service provider, assessed in accordance with the following parameters:\n\ni. the number of global systemically important institutions (G-SIIs) or other systemically important institutions (O-SIIs) that rely on the respective ICT third-party service provider;\n\nii. the interdependence between the G-SIIs or O-SIIs referred to in point (i) and other financial entities, including situations where the G-SIIs or O-SIIs provide financial infrastructure services to other financial entities.”\n\n## Introduction\n\n39\\. As recent financial crises have revealed, financial entities could either be “too big to fail” or “too interconnected to fail”.\n\n40\\. Various international organisations have developed standards to address this shortcoming, such as the G20, the Basel Committee on Banking Supervision (BCBS), the International Association of Insurance Supervisors (IAIS), the International Organization of Securities Commissions (IOSCO), or the Financial Stability Board (FSB).\n\n41\\. Financial entities have been characterised as systemically important if their distress or disorderly failure is likely to cause significant disruption to the financial system and economic activity due to their size, complexity and systemic interconnectedness. A failure of such systemically important financial entities could seriously damage the stability of the financial system due to spillover effects to other financial entities and to private and institutional investors. The negative externalities of a failure of a systemically important financial entity would also inflict damage on the real economy through multiple channels.\n\n42\\. Criterion 2 of Article 31(2)(b) of the DORA takes this consideration into account by referring to the systemic character or importance of the financial entities that rely on ICT services provided by an ICT TPP and by making specific reference to financial entities being designated as G-SIIs and O-SIIs.\n\n## List of step 1 indicators\n\nIndicator 2.1 Number of G-SIIs and O-SIIs (credit institutions only) directly or indirectly relying on ICT services provided by the same ICT TPP where these support critical or important functions (in absolute terms) Notes:\n\n* The objective of this indicator is to capture ICT TPPs’ pan-European footprint by assessing the number of G-SIIs and O-SIIs (credit institutions only) receiving ICT services provided by the same ICT TPPs. The idea is that the more financial entities classified as G-SIIs and O-SIIs rely on ICT services provided by the same ICT TPP, where these support critical or important functions, the higher the ICT TPP’s level of criticality for the EU financial sector.\n* It should be noted that the lists of G-SIIs[^27]/O-SIIs[^28] on which this indicator would rely refer to credit institutions, thus not covering all the financial entities falling under the scope of the DORA.\n* This includes material subcontractors as reported in the registers of information[^29]. In particular, if subcontractors belong to a group, the indicator will be assessed in relation to the ICT services provided by the group as a whole.\n* At least 1 G-SII; OR\n* at least 3 O-SIIs; OR\n* at least 1 O-SII with an O-SII score above 3,000[^30].\n\n## Minimum relevance threshold\n\n## Key data sources\n\n* Registers of Information\n* List of Globally Systemically Important Institutions (G-SIIs)\n* List of Other Systemically Important Institutions, including scores (O-SIIs)\n* Publicly available data (e.g. LEI database)\n\nIndicator 2.2 Number of financial entities, identified as systemic by competent authorities, other than G-SIIs and O-SIIs (other than credit institutions), directly or indirectly relying on ICT services provided by the same ICT TPP where these support critical or important functions (in absolute terms)\n\n## Notes:\n\n* The text in Article 31(2)(b) of the DORA for criterion 2 refers to G-SIIs and O-SIIs for which a respective publicly available list applies only to credit institutions. Therefore, indicator 2.2 aims at capturing the reliance of other types of financial entities, which are ‘systemic’ and not included in a publicly available list of credit institutions identified as G-SIIs or O-SIIs, considered as other types of G-SIIs/O-SIIs for the purpose of this indicator.\n* The objective of indicator 2.2 is to capture ICT TPPs' pan-European footprint by assessing the number of systemic financial entities relying on ICT services provided by the same ICT TPP. The idea is that the more financial entities identified as ‘systemic’ rely on ICT services provided by the same ICT TPP where these support critical or important functions, the higher the ICT TPP’s level of criticality for the EU financial sector.\n* Indicator 2.2 refers to ‘financial entities identified as systemic’ based on supervisory expert judgment. This does not imply ‘publicly identified’ or proposing the establishment of lists of systemically important financial entities (like e.g., list of G-SIIs) or developing a methodology on how such an assessment should be performed. Relevant competent authorities would be best placed to provide such indications based on expert judgement which would be performed only for the purposes of this process. The DORA already gives a hint on such aspect in Recital (56), which states that some financial entities play “a systemic role” (for example, payments, banking, and clearing and settlement) while “other subsectors” can be considered less systemically important (for example, small asset managers and credit rating agencies).\n* This includes material subcontractors as reported in the registers of information[^31]. In particular, if subcontractors belong to a group, the indicator will be assessed in relation to the ICT services provided by the group as a whole.\n* At least 1 Financial Market Infrastructure (DORA Article 2(1)(g), (h), (i)\n\n## Minimum relevance threshold\n\n* and (j)) identified as ’systemic’ by competent authorities; OR\n* At least 3 financial entities (other than credit institutions and FMIs) identified as ’systemic’ by competent authorities.\n\n## Key data sources\n\n* Registers of Information\n* ‘Systemic’ financial entities per Member State as identified by the CAs\n* Publicly available data (e.g. LEI database)\n* Other information available to the ESAs[^32]\n\n## List of step 2 indicators\n\n## Indicator 2.3\n\nLevel of interdependence between G-SIIs or O-SIIs and other financial entities, including where G-SIIs or O-SIIs provide financial infrastructure services to other financial entities, relying on ICT services provided by the same ICT TPP\n\n## Notes:\n\n* The objective of this indicator is to capture interconnectedness within the EU financial sector, and subsequently identify altogether the ‘interconnected’ financial entities that rely on ICT services from the same ICT TPP. The idea is that the stronger the interdependencies are between systemic financial entities relying on ICT services provided by the same ICT TPP and other financial entities, the higher the ICT TPP’s level of criticality for the EU financial sector.\n* Article 31(2)(b)(ii) of the DORA specifically refers to the “interdependence between G-SIIs/O-SIIs and other financial entities”. However, as also revealed via the public consultation, it is highly challenging and complicated to obtain concrete and representative data to measure this appropriately covering the EU financial sector.\n* While this criterion appeared to primarily assess the degree of technological interdependence between G-SIIs/O-SIIs and financial entities, it is concluded this is highly complex/difficult from a technical/operational exposure point of view due to unavailable concrete and representative data.\n\nTo overcome this issue, the ESAs have put significant efforts into identifying an alternative approach and to measure/assess this criterion using as a proxy the potential financial interdependence among the finance sector, leveraging on existing available data such as COREP data (large exposures and concentration of funding both intra- and cross-sectoral), resolution data (intermediaries of Financial Market Infrastructures) reinsurance data or EMIR data. However, it is concluded the available data is not sufficiently representative and hence not suited as basis for the assessment of interdependencies between G-SIIs and O-SIIs and other financial entities. Moreover, large parts of the available financial data that could be used as a proxy would not capture interdependencies with all the financial sector. Acknowledging the data limitations in terms of completeness, comprehensiveness, availability and representativeness, this indicator will be considered, to the extent possible, in the holistic/comprehensive assessment. This could be further analysed in the context of the relevant methodology.\n\n## Key data sources\n\n* Other information available to the ESAs (e.g. findings from supervisory activities)\n\n## Criterion 3: critical or important functions\n\n## Criterion 3:\n\n“The reliance of financial entities on the services provided by the relevant ICT third-party service provider in relation to critical or important functions of financial entities that ultimately involve the same ICT third-party service provider, irrespective of whether financial entities rely on those services directly or indirectly, through subcontracting arrangements.”\n\n## Introduction\n\n43\\. Relying on ICT services provided by ICT TPPs to perform critical or important functions creates specific risks for financial entities and should be subject to appropriate oversight. It can have a strong impact on financial entities’ risk profiles.\n\n44\\. Article 3(22) of the DORA defines a ‘critical or important function’ as a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law.\n\n45\\. As stated in recital 70 of the DORA, the definition of ‘critical or important function’ under DORA encompasses the ‘critical functions’ as defined in Article 2(1), point (35) of the Bank Recovery and Resolution Directive[^33].\n\n46\\. Reference to ‘critical or important functions’ is also made in the criteria for designation of CTPPs. Article 31(2)(c) of the DORA states that a designation shall be based, amongst others, on the level of financial entities’ reliance on services provided by an ICT TPP in relation to critical or important functions of those financial entities that involve the same ICT TPP. In this respect it must not make a difference whether financial entities directly or indirectly (via subcontracting arrangements) rely on these services provided by an ICT TPP.\n\n## List of step 1 indicators\n\n47\\. The extent to which an ICT service provided by an ICT TPP supports critical or important functions at the level of the financial entity is considered a vital element of the criticality assessment in general and can be considered a starting point of this exercise. Due to the proposed holistic nature of the criticality assessment and as also recommended by the market participants during the public consultation, it is proposed to integrate this important dimension of criticality in all step 1 indicators and not have distinct indicators on ‘critical or important functions’ under criterion 3. Instead, criterion 3 is composed of just one step 2 indicator, which is focused on the level of criticality of the ICT services themselves that are provided by ICT TPPs to their financial entity clients under the scope of the DORA.\n\n## List of step 2 indicator\n\n## Indicator 3.1\n\nLevel of inherent criticality of ICT services directly or indirectly provided to financial entities by the same ICT TPP\n\n## Notes:\n\n* The objective of this indicator is to capture the inherent criticality of ICT services provided to financial entities by the same ICT TPP. This is considered an important piece of information to further assess an ICT TPP’s level of criticality for the EU financial sector.\n* This indicator could build up on a list of different types of ICT services provided to EU financial entities as defined in Annex IV of the Consultation Paper on Draft ITS on the register of information[^34], assessing the inherent criticality these ICT services may entail. Such assessment is not planned to be disclosed. It is clarified that this indicator will be agnostic to the functions these ICT services support i.e. the inherent criticality of ICT services will not take into account the type of financial entities’ functions supported by these ICT services.\n* This includes ICT services provided by material subcontractors as reported in the registers of information[^35]. In particular, if subcontractors belong to a group, the indicator will be assessed in relation to the ICT services provided by the group as a whole.\n\n## Key data sources\n\n* Registers of Information\n* Expert judgement\n* Publicly available data (e.g. LEI database)\n* Other information available to the ESAs\n\n## Criterion 4: degree of substitutability\n\n## Criterion 4:\n\n“The degree of substitutability of the ICT third-party service provider, taking into account the following parameters:\n\ni. the lack of real alternatives, even partial, due to the limited number of ICT TPPs active on a specific market, or the market share of the relevant ICT TPPs, or the technical complexity or sophistication involved, including in relation to any proprietary technology, or the specific features of the ICT TPP’s organisation or activity;\n\nii. difficulties in relation to partially or fully migrating the relevant data and workloads from the relevant ICT TPP to another ICT TPP, due either to significant financial costs, time or other resources that the migration process may entail, or to increased ICT risk or other operational risks to which the financial entity may be exposed through such migration.”\n\n## Introduction\n\n48\\. Systemic risk can materialise if a sufficiently large number of financial entities (or a single systemically important financial entity) is dependent on one or a small number of ICT TPPs for the provision of critical ICT services that are impossible or very difficult to substitute in a cost-efficient and quality manner and in an appropriate timeframe, for instance due to limitations in the capacity or ability of alternative ICT TPPs or other solutions.\n\n49\\. A major disruption, outage, or failure at one of these ICT TPPs could create a single point of failure with potential adverse consequences for financial stability and/or the safety and soundness of multiple financial entities.\n\n50\\. The ultimate impact would depend on the specific ICT services being provided, the criticality and substitutability of those services, and the mitigation plans in place by financial entities and the ICT TPPs in question.\n\n51\\. Criterion 4 of Article 31(2)(d) of the DORA takes account of this reasoning as it refers to the “degree of substitutability of the ICT third-party service provider”, the “lack of real alternatives” as well as the “difficulties in relation to \\[...\\] migrating the relevant data and workloads from the relevant ICT third- party service provider to another ICT third-party service provider”.\n\n## List of step 1 indicators\n\nIndicator 4.1 Share of financial entities reporting that no alternative ICT TPPs are available or have the required ability and/or capacity to (fully or partially) provide the same ICT services supporting critical or important functions as directly or indirectly provided by the existing ICT TPP, measured by the total number of financial entities (total) and by the total value of assets of financial entities or an equivalent metric[^36] (per type of financial entity and in percentage terms)\n\n## Notes:\n\n* The objective of this indicator is to capture the level of substitutability of an ICT TPP. The idea is that the more difficult it is to substitute an ICT TPP, the higher the ICT TPP’s level of criticality for the EU financial sector.\n* Substitutability is not only understood as the availability of alternative providers, but also takes into account the ability and/or capacity of alternative providers to perform the same ICT services as the original ICT TPP.\n* This includes material subcontractors as reported in the registers of information[^37]. In particular, if subcontractors belong to a group, the indicator will be assessed in relation to the ICT services provided by the group as a whole.\n* 10% or more of total value of assets/equivalent metric per type of financial entity in the EU; OR\n* 10% or more of total number of financial entities in the EU.\n\n## Minimum relevance threshold\n\n## Key data sources\n\n* Registers of Information\n* Publicly available data (e.g. LEI database)\n* Other information available to the ESAs\n\n## Indicator 4.2\n\nShare of financial entities reporting that it is highly complex/difficult to migrate or reintegrate ICT services directly or indirectly provided by an ICT TPP to support critical or important functions, measured by the total number of financial entities (total) and by the total value of assets[^38] of financial entities (per type of financial entity and in percentage terms)\n\n## Notes:\n\n* The objective of this indicator is to capture the level of difficulty of migrating or reintegrating ICT services provided by an ICT TPP. The idea is that the more difficult it is to migrate or reintegrate ICT services, the higher the ICT TPP’s level of criticality for the EU financial sector.\n* This includes material subcontractors as reported in the registers of information[^39]. In particular, if subcontractors belong to a group, the indicator will be assessed in relation to the ICT services provided by the group as a whole.\n* 10% or more of total value of assets/equivalent metric of financial entities in the EU; OR\n* 10% or more of total number of financial entities in the EU.\n\n## Minimum relevance threshold\n\n## Key data sources\n\n* Registers of Information\n* Publicly available data (e.g. LEI database)\n* Other information available to the ESAs\n\n## List of step 2 indicators\n\nIndicator 4.3 Market share of ICT TPPs directly or indirectly providing ICT services to financial entities (measured by the total number of financial entities and if available, by the annual expenses or estimated costs/budget of the contractual arrangements[^40] (per type of ICT service and in percentage terms)\n\n## Notes:\n\n* The objective of this indicator is to capture ICT TPPs’ pan-European footprint per type of ICT service[^41] by assessing the market shares of ICT TPPs. The idea is that the higher the market share of an ICT TPP (per type of ICT service), the higher the potential dependency to the respective ICT TPP.\n* For each ICT TPP, the result of this indicator is calculated by dividing the total number of financial entities relying on ICT services provided by the same ICT TPP by the total number of EU financial entities relying on ICT services of ICT TPPs (per type of ICT service). This can be also assessed by dividing – per type of ICT service - the total annual expenses or estimated costs/budget of all contractual arrangements, which an ICT TPP has in place with EU financial entities falling under the scope of the DORA, by the total annual expenses or estimated costs/budget of all contractual arrangements, which all ICT TPPs have in place for the same type of ICT service. It is acknowledged that the use of annual expenses/estimate costs as a basis to assess TPPs’ market share will be subject to sufficient, complete and consistent data from the financial entities.\n* This indicator also captures ‘market density’ which refers to the concentration of ICT service providers within a specific market area (number of competitors). It provides insights into the level of competition and the saturation of providers offering the same ICT services. Higher market density indicates a larger number of ICT TPPs providing the same ICT services.\n* This includes material subcontractors as reported in the registers of information[^42]. In particular, if subcontractors belong to a group, the indicator will be assessed in relation to the ICT services provided by the group as a whole.\n\n## Key data sources\n\n* Registers of Information\n* Other information available to the ESAs\n\n## Joint advice on oversight fees\n\n## Introduction\n\n52\\. Once designated as critical, TPPs will have to pay oversight fees to their Lead Overseer to cover the costs related to the oversight tasks. Neither the amount of these fees nor the way the CTPPs will have to pay them are defined at Level 1. However the aim of such fees is specified in Article 43 of the DORA.\n\n53\\. Indeed, such fees will be the single way to fund the oversight activities of the ESAs, given that pursuant to Article 43(1) of the DORA the fees charged to designated CTPPs shall “fully cover the Lead Overseer’s necessary expenditure in relation to the conduct of oversight tasks pursuant to this Regulation including the reimbursement of any costs which may be incurred as a result of work carried out by the JET”. Article 43(1) second subparagraph of the DORA further requires that the amount of fees charged to CTPPs “shall cover all costs derived from the execution of the duties” under the DORA.\n\n54\\. Recital (96) of the DORA also explains that fees will be charged to fully fund oversight activities, but not to cover ESA’s “costs for the implementation of dedicated ICT systems supporting the upcoming oversight, since dedicated ICT systems would need to be developed and deployed beforehand” (funded from Union and national competent authorities’ contributions) consistently with the Legislative Financial Statement (LFS) on the DORA. The ESAs’ technical advice is thus consistent with this clear delimitation of fees to be levied upon CTPPs. However, it is also important to highlight that the identified overall amount of incurred expenditure in the LFS cannot be considered as comprehensive, given the number of elements that cannot be anticipated in the short term and which may impact the expenditure of the Lead Overseers (the number of designated CTPPs, the intensity, frequency and nature of oversight activities, the involvement of competent authorities, the use of independent experts, etc.). Hence, it is of the highest importance for the ESAs and involved competent authorities in the JETs to have the necessary flexibility to estimate their incurred expenditure, including the possibility to reassess the fees which need to be levied upon CTPPs to cover the oversight tasks under the DORA from one year to another. The functioning of the future Oversight framework will particularly rely on the means the involved authorities will have to perform the different oversight activities foreseen by the DORA.\n\n55\\. During the public consultation, market participants invited the ESAs to clarify how the CTPPs will be informed of the calculation of their respective share of the oversight fees. In line with the applicable financial rules, the total overall aggregated amount of the yearly oversight fees charged from CTPPs will be published in the EU Official Journal and on the websites of the ESAs by the end of Q1 each year. When providing the debit note to the CTPPs, such total overall aggregated amount of the yearly oversight fees will be provided by the Lead Overseer to each CTPP, but it will not provide individual information about the applicable turnover of the other\n\n56\\. While preparing this technical advice, the ESAs faced several challenges. The main one is the lack of actual information on the future CTPPs (number, size, group structure, etc), given that their designation will take place after the publication of the related delegated act. The ability of the ESAs to anticipate which TPPs will be designated as critical is limited as the criticality criteria are yet to be determined. Therefore, the ESAs are of the opinion that the method of calculation of the oversight fees should be adaptable to the annual designation process of CTPPs, while being proportionate to the turnover of the future CTPPs, in line with Article 43(1) of the DORA. Consistently with the specification of the request of the Commission, the method proposed by the ESAs is inspired by the experience of national supervisors and ESMA when setting supervisory fees for financial institutions.\n\n57\\. During the public consultation, the ESAs have taken the opportunity to seek feedback from relevant stakeholders on ICT services, in particular on the relevant information that should be taken into account to define the scope of the applicable turnover that will be used to calculate the oversight fees.\n\n58\\. Moreover, the ESAs also considered the fact that some CTPPs might be designated on the basis of opt-in voluntary requests based on Article 31(11) of the DORA. The tasks related to the assessment of such applications cannot be funded by the oversight fees paid by other designated CTPPs. Hence, the ESAs have taken the opportunity of the public consultation to seek feedback from relevant stakeholders on the best way to fund such tasks.\n\n59\\. Lastly, the ESAs were also invited to reflect on the frequency of reviewing the respective delegated acts to reflect related developments. In this regard, it is considered appropriate to ensure consistency with the review clause in the DORA Article 58 and hence to perform a review on the need for potential amendments in the respective delegated acts every 3 years. This could faciliate adequate planning and stability in the calculation, charge and collection of oversight fees.\n\n## Scope of the oversight fees: estimated expenditure and applicable turnover\n\n## Scope of the estimated oversight expenditure\n\n60\\. The specific rules on fees which are set out in sectoral (L1) legislation, as well as in relevant delegated (Level 2) acts[^43]  rely on the principle of full-cost recovery, which establishes that the fees should cover:\n\n* o the total estimate of all direct and indirect expenditure necessary for the targeted/defined tasks performed by ESAs (so staff resources directly involved in the defined tasks, but also the costs of the horizontal services i.e., operational and administrative support necessary for fulfilling defined tasks);\n* o the total estimate of direct and indirect expenditure for the reimbursement of competent authorities involving staff and operational resources to provide assistance to ESAs.\n\n61\\. For instance, for financial entities under its direct supervision, ESMA uses the Activity Based Management (ABM) model based on an activity breakdown allowing to identify the main expenditures categories: i.e. (i) direct activities (ii) horizontal services supporting the execution of the direct activities.\n\n62\\. Based on the LFS of the DORA, oversight expenditure will cover staff expenditure, infrastructure and operating expenditure. Based on the assumption of an equal sharing of the overall expenditures among the three ESAs and on current understanding of implementation timelines, each of the ESAs is estimated to incur at least €693,000 for the first year (i.e., 2025), €2,553,000 for 2026 and €2,683,000 in 2027.\n\n63\\. The ESAs are of the view that such estimated costs in the LFS are underestimated given that they do not cover all identified oversight tasks. There is for instance no reference to additional costs generated by the use of independent experts, or by the involvement of the competent authorities. In addition, such assessment is subject to the effective start of the oversight activities.\n\nHence, the ESAs propose the Delegated Act to clarify that the related expenditure of at least the following oversight activities identified in the DORA Level 1 will be funded by the oversight fees:\n\n* Expenditures related to the designation of the CTPPs (including the appointment of the relevant Lead Overseer);\n* Expenditures related to the conduct of the oversight;\n* Expenditures related to the follow-up of the recommendations issued by the Lead Overseers;\n* Expenditures related to the governance of the Oversight.\n\nThe Delegated Act should also specify that the expenditures related to the activities performed by the CAs to participate to the oversight of CTPPs are also part of the oversight expenditures.\n\nIn addition, it should specify such expenditures will cover both direct and indirect costs related to oversight activities.\n\nIn order to clarify this proposal, for each category, illustrative examples are provided below based on what the ESAs can identify at this early stage of the process. However, the ESAs do not advocate for such a level of detail in the Delegated Act. Indeed, this list is not exhaustive, and does not prevent the inclusion of any other expenditure to the extent it falls under the remit of oversight activities.\n\n(i) Designation of CTPPs, such as the expenditure related to the treatment and assessment of the collected data and the designation (through the JC upon Oversight Forum (OF[^44]) recommendation) of the CTPPs[^45], or to the appointment of the respective Lead Overseer (LO), based on Article 31(1) of the DORA.\n\nWhile performed by the ESAs and not by the Lead Overseers stricto sensu, these assessments are the starting points for the oversight mechanism to apply. From that point of view, such activities, which are based on article 31 of the DORA, are considered as costs which derive from the execution of the duties set out in section II of Chapter V of the DORA, referred to in article 43 of the DORA. Furthermore, the principle of full cost recovery implies that the related costs should be covered in full by a fee levied upon on the designated CTPPs. Therefore, the ESAs are of the opinion that this assessment should be covered by the oversight fees paid by CTPPs.\n\n(ii) Conduct of the oversight, such as the expenditure related to the organization, coordination and performance of on-site inspections, general investigations and other off-site activities (e.g. preparation of related decisions and exchanges with CTPPs), or the advice provided by the independent experts in relation to matters falling under the remit of direct oversight activities.\n\nSuch expenditures are expected to represent the biggest share of the overall oversight expenditures.\n\n(iii) Follow-up of the recommendations issued by the LO, such as expenditure related to the treatment of the notifications of the CTPPs of their intention to follow the recommendations, and the communication with the relevant competent authorities.\n\n(iv) Governance of the Oversight, such as the expenditure related to the functioning of the JON for coordination among Lead Overseers in the preparatory stages and the conduct of oversight.\n\n## Definition of the applicable turnover of the CTPPs\n\n64\\. To determine the appropriate method, basis and available information for considering the “applicable turnover” of the CTPP in fee calculations, the ESAs have identified five issues to solve: (i) the data available, and the timeliness of its availability, (ii) the ability to have accounting information only for ICT services in the scope of the DORA, (iii) the ability to identify the geographical distribution of the turnover, (iv) the profile of the customers of the CTPPs, and (v) the criticality of the functions supported by ICT services. Most of these issues are highly dependent on the first one (data availability). In any case, the defined scope of the applicable turnover should be consistent with the criticality criteria and with the CTPPs designation process.\n\n65\\. With regard to the data available to determine the applicable turnover, the existing delegated acts on fees[^46] are using as a basis the revenues generated as they appear in the audited accounts of the supervised or overseen entity.\n\n66\\. In addition, audited accounts are generally not made available immediately at the end of the calendar year. However, it is essential for the ESAs to be able to calculate the applicable fees for overseen entities and to send the related invoice as soon as possible every year.\n\nTherefore, to ensure the availability of relevant information for all CTPPs and allow ESAs to calculate applicable fees within appropriate deadlines, it is proposed to refer, in the Delegated Act, to the certified revenues in the audited accounts of the CTPPs of the year (n-2) as being the information used to prepare the applicable turnover that will be sent to the ESAs to calculate the oversight fee for a given year (n). CTPPs are assumed to be well established companies at the time they will be designated as such and it is expected that they will always be able to provide audited accounts for the year (n-2). In addition, in order to ensure an equal treatment of all CTPPs and consistent identification of applicable turnover, such certified audited financial statement representing the applicable turnover of the CTPPs should be prepared according to IFRS or equivalent local GAAP.\n\n67\\. The methodology to determine the scope of the applicable turnover proposed in this technical advice aims at ensuring an equal treatment of all potential CTPPs. In their responses to the public consultation, several market participants made various suggestions to tailor such applicable turnover on a limited scope of revenues (from clients of the financial sectors, from critical services etc). However, overall, such proposals were not aligned and there was no consensus neither on the capability of all potential CTPPs to provide an ad hoc dedicated applicable turnover in an identical manner to the ESAs, nor on the ability of independent auditors to audit and certify such ad hoc applicable turnover.\n\n68\\. With regard to the scope of revenues of the CTPPs to be taken into account, it is challenging to determine the applicable turnover based on the ICT services as defined in DORA in Article\n\n3(21[^47]) given that such definition is not complemented by a list of ICT services from which it would be possible to identify the generated revenues. Without additional specification (on such list of ICT services), there is no guarantee of an harmonised approach by all CTPPs to define their revenues generated by such ICT services. During the public consultation, market participants invited the ESAs to clarify the list of ICT services before determining the applicable turnover, in order to only take into account the revenues generated from the provision of such services in the applicable turnover.\n\n69\\. The ESAs have proposed to further specify the list of ICT services in the Annex IV of the consultation paper on a draft Implementing Technical Standards to establish the templates composing the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers as mandated by Regulation (EU) 2022/2554[^48]. In case such list of ICT services would be included in the final related Implementing Technical Standards, the ESAs are of the view the applicable turnover could be determined on the basis of the revenues generated by such ICT services, and not on the basis of the revenues generated by all services provided by CTPPs. To ensure this proposal to be possible, the CTPPs will have to isolate these revenues by maintaining separate records or accounts for their turnover generated by the provision of ICT services and to have independent auditors certifying the accuracy of these revenues.\n\n70\\. In case a CTPP would not be able to provide in a timely manner the Lead Overseer with such audited revenues generated from ICT services only, to ensure no disruption to the overall fees allocation process, the scope of the applicable turnover used for this CTPP would be based on all its revenues, irrespective of the types of services provided.\n\nOn this basis, if the future Implementing Technical Standards on the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers include a list of ICT services as proposed by the ESAs in the related consultation paper published on 19 June 2023, the ESAs are proposing the Delegated Act to establish that the revenues generated by such ICT services provided by the CTPPs are considered in the determination of the applicable turnover. The Delegated Act should also require the CTPPs to isolate these revenues by maintaining separate records or accounts for their turnover generated by the provision of such ICT services and to have independent auditors certifying the accuracy of these revenues. In case a CTPP would not be able to provide in a timely manner the Lead Overseer with such tailored financial information, the scope of the applicable turnover used for this CTPP would be based on all its revenues, irrespective of the types of services provided.\n\nIn case such a list of ICT services would not be included in this Implementing Technical Standards to come, the ESAs are proposing the Delegated Act to establish that the revenues generated by all services provided by the CTPPs are considered in the determination of the applicable turnover.\n\n71\\. With regard to the issue of geographical distribution of the revenues of the CTPPs, some CTPPs may be companies with only European-based activities, but others may receive revenues generated from activities in non-EU countries. The determined applicable turnover should at least take into account all revenues generated from the provision of services by CTPPs to entities subject to DORA, including when such services are provided to European clients by entities established outside the EU[^49].\n\n72\\. During the public consultation, market participants have not confirmed it is possible to maintain dedicated financial statements focused on revenues generated by the provision of services to EU-based clients only, in a harmonised way used by all TPPs and did not confirm independent auditors would be able to audit and certify such dedicated financial statements. In addition, in the Commission Consolidated Jurisdictional Notice under Council Regulation (EC) No 139/2004 on the control of concentrations between undertakings (2008/C 95/01[^50]), the Commission states that audited accounts often do not provide a geographical breakdown and it is therefore necessary to rely on the best figures available. Because of the interrelated proportionate system to allocate the oversight fees among the CTPPs proposed by the ESAs in this technical advice, relying on figures calculated on a best effort basis is not appropriate. Hence, the public consultation did not confirm to the ESAs that all potential CTPPs would be capable of systematically providing a certified dedicated financial statement with the geographical distribution of their revenues so as to discount non-EU revenues from the applicable turnover.\n\n73\\. However, the ESAs acknowledge the need to reflect the European dimension of the activities of the CTPPs, which has been raised by several respondents during the public consultation. For that purpose, instead of adjustment in the scope of the applicable turnover, they propose to take into account the criticality indicators used to designate the CTPPs (see proposals in this technical advice) to reflect their importance in the Union. Hence, the fees paid by the CTPPs would be proportionate to their worldwide applicable turnover, taking their criticality for the European financial entities into account.\n\n74\\. In any case, in order to ensure consistency with Article 31(3) of the DORA, within a group, the applicable turnover of the entities designated as CTPPs would be considered.\n\nOn this basis, in order to ensure an equal treatment of all CTPPs, the ESAs propose to consider as the applicable turnover the worldwide revenues of the CTPPs adjusted for the criticality of the CTPP in the EU. Such adjustement will be based on the criticality indicators set out in the Delegated Act. This will allow the breakdown of the oversight fees to reflect the importance of the CTPPs in the EU, in the absence of information on the certified EU turnover.\n\nIn addition, for practical reasons, it should be clarified in the Delegated Act that if the revenues are reported in a currency other than the euro, the Lead Overseer would have to convert them into euro using the average euro foreign exchange rate applicable to the period during which the revenues were recorded. For that purpose, the euro foreign exchange reference rate published by the European Central Bank would be used.\n\n75\\. With regard to the issue of the profile of the clients of the CTPPs, it should be noted that such providers have, in principle, many kinds of clients, which are not only limited to financial entities as referred to in Article 2(2) of the DORA. Based on the explanations provided in Recital (31[^51]) of the DORA, the Oversight Framework is established to monitor the activities of the CTPPs provided to “financial entities” as referred to in Article 2(2) of the DORA and thus subject to the DORA[^52]. It could therefore be argued that only revenues streaming from services provided to financial entities referred to in Article 2(2) of the DORA and thus subject to the DORA should be taken into account for the determination of the applicable turnover.\n\n76\\. However, during the public consultation, market participants have not confirmed it is possible to maintain dedicated financial statements focused on revenues generated by the provision of services to financial entities subject to DORA. In order to know this, they explained such clients should be required to inform their ICT provider about that. However, even if financial entities were requested to do so, there would never be sufficient guarantee such indication to be duly provided by all relevant financial entities to all their ICT third-party providers. As a consequence, market participants did not confirm neither independent auditors would be able to audit and certify financial statements dedicated to revenues generated by services provided to this type of clients. Hence, the public consultation did not confirm to the ESAs that all CTPPs can separate, in a harmonised, consistent and certified manner, revenues generated by services provided to financial entities subject to the DORA.\n\nOn this basis, in order to ensure an equal treatment of all CTPPs, the ESAs recommend not taking the type of entity to which ICT services are provided into account for the determination of the applicable turnover.\n\n77\\. With regard to the criticality of the functions supported by ICT services included in the applicable turnover, based on the reading of Article 33(2) second subparagraph of the DORA, it appears that the Oversight Framework “shall focus mainly” on ICT services supporting the critical or important functions of financial entities. However, it is further clarified that “where necessary” the oversight “shall extend to ICT services supporting functions other than those that are critical or important”. In addition, it appears very challenging to distinguish in audited accounts between revenues generated by ICT services supporting critical and non-critical functions, as the criticality is not inherent to the provided ICT services themselves but to the functions they support within the concerned financial entities.\n\n78\\. During the public consultation, several market participants encouraged to take the criticality of the services into account. However, there was no alignment on the way the “criticality\" was understood, as some of them mentioned the criticality of the functions relying of the ICT services, while other made reference to an inherent criticality of the provided ICT services (to make a distinction between the various services CTPPs can provide). In addition, some market participants confirmed CTPPs do not have information on the criticality of the functions of their clients supported by the provided ICT services.\n\n79\\. Hence, the ESAs are of the view that the level of criticality of the functions supported by ICT services should not be used as a criterion by the CTPPs to determine their applicable turnover.\n\nTherefore, the ESAs are proposing not to use, in the Delegated Act, the criticality of the functions supported by the provided ICT services as a criterion to determine the applicable turnover of the CTPPs.\n\n80\\. To conclude, account taken of all of the above considerations, the ESAs are proposing the following allocation key to determine the applicable turnover of the designated CTTPs: it would be calculated on the basis of the revenues of ICT services provided to all their clients, on the basis of the audited worldwide revenues, and adjusted to reflect their criticality in the EU.\n\n## Methods of calculation of the Oversight fees\n\n81\\. In respect of the methods of calculations of the oversight fees, the first issue is to determine if the collected fees should be adapted yearly or fixed. To date, both approaches are used by the ESAs, but for different kinds of fees. Registration, recognition and certification fees to be paid by financial entities are generally envisaged as “fixed” fees. In some cases, their amount can however be adjusted based on (i) the complexity of the application, (ii) the size of the concerned entity (for instance, entities with a smaller number of employees can be subject to a smaller amount of registration fees), or (iii) the expected turnover. This assumes an advanced determination of every possible situation with different fee buckets (e.g. depending on the number of employees, the diversity of activities, the expected turnover, etc) to make it adaptable to the potential changes of the entities subject to such fees. Given the CTPPs will be designated only after the application of the DORA, it is not possible to determine fixed fees in the Delegated Act since neither the exact amount of oversight expenditure nor the exact number of CTPPs will be known before the oversight framework is fully established.\n\n82\\. With regard to existing annual supervisory fees, on the basis of the principle of annuality and the principle of full cost recovery, they are calculated based on the estimated (direct and indirect) costs (including the costs incurred by the CAs[^53]). While these estimated costs are generally consistent from one year to the next, there is still a need to adjust them every year. The total annual fees are therefore adjusted every year to match the estimated costs. At entity level, the annual fee is calculated based on a “fully proportionate approach”, i.e. the fee charged is determined as a prorated amount that corresponds to the percentage represented by the applicable turnover of the charged entity compared to the sum of applicable turnovers of all supervised entities.\n\n83\\. Therefore, based on their experience, the ESAs are of the view that yearly adaptable fees calculated through a fully proportionate approach should be used to calculate the annual oversight fees for CTPPs. The ESAs recognize that such approach contains some challenges, in particular in terms of predictability for both the CTPPs and the ESAs. The annual fees being proportionate to the applicable turnovers of CTPPs, this might result in a small number of CTPPs supporting a large part of the funding of the framework in case of significant disparity among overseen entities.\n\n84\\. To ensure all entities contribute to the funding of the framework on a minimum basis, some existing delegated acts (e.g. for trade repositories, securitisation repositories, benchmark and data reporting service providers) include a requirement for a minimum annual supervisory fixed fee. This gives a bit more predictability to the concerned entities. In addition, it ensures coverage of the ESAs’ minimum cost estimated for the oversight of one entity regardless its size. During the public consultation, market participants challenged the proposal of the ESAs (EUR 50 000), either to have clarification on such amount, or to suggest to align it on the yearly costs of 1 FTE. This minimum threshold is aligned with the minimum fees paid by financial entities already supervised by the ESAs, which ensure a fair treatment across entities under the direct responsibility of the ESAs. Such minimum fees should not significantly reduce the proportionality of the proposed method of calculation.\n\nTherefore, the ESAs are proposing the Delegated Act to determine a method of calculation fully proportionate to the applicable turnover of the CTPPs concerned, on the following basis:\n\n% 𝑜𝑜𝑜𝑜 𝑜𝑜𝑜𝑜𝑜𝑜𝑜𝑜𝑜𝑜𝑜𝑜𝑜𝑜ℎ𝑡𝑡 𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 𝑏𝑏𝑏𝑏 𝑡𝑡ℎ𝑒𝑒 𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶= applicable turnover of this CTPP applicable turnover of all CTPPs\n\nTo ensure that all CTPPs pay a relevant annual fee, including the “smallest” ones, such calculation should be complemented by a minimum fixed oversight fee, which would be paid if the fee resulting from the calculation above is smaller than such threshold. The ESAs are proposing such minimum fee to be fixed at EUR 50 000[^54].\n\n85\\. Another important aspect is to determine at what level the annual fees should be calculated, i.e. if the applicable turnover of the CTPPs is compared with the applicable turnover of the other CTPPs overseen by the same Lead Overseer or with the applicable turnover of all the CTPPs overseen by the three ESAs considered together. To recall, based on Article 31(1)(b) of the DORA, the appointment of the Lead Overseers will only rely on “the financial entities having together the largest share of total assets out of the value of total assets of all financial entities using the ICT services of the CTPPs, as evidenced by the sum of the individual balance sheets of those financial entities”. This could lead to differences regarding the number and the size of CTPPs being overseen by the three ESAs.\n\n86\\. If there is an expected relation between the estimated oversight costs and the number and the size of the CTPPs each Lead Overseer will have in its remit, this relation is not expected to be fully linear. The oversight expenditure will indeed integrate some fixed costs (i.e. costs that are related to the number and size of overseen CTPPs) and will also depend on the intensity of the oversight conduct that may be deemed necessary by each Lead Overseer (on the basis of the identified risks for each CTPP). In addition, some expenditure will be commonly “shared” (for instance, when the ESA staff work in a JET led by another ESA). For these reasons, calculating the annual fees applying the “fully proportionate approach” at the level of each Lead Overseer might lead to inconsistent fees being charged to CTPPs considered all together.\n\n87\\. The ESAs therefore recommend adopting an approach which ensures that (i) each Lead Overseer will be able to cover 100% of its estimated oversight expenditure and (ii) there is no bias in the invoiced oversight fees due to the appointed ESA (proportionality applied at cross-ESAs level and considered all CTPPs together).\n\nTo ensure appropriate proportionality and comparability amongst all the CTPPs, the ESAs are proposing the Delegated Act to determine the calculation of the annual oversight fees at cross-ESAs level.\n\nIn practice, each ESA – and each involved competent authority - will calculate its estimated costs to cover its direct and indirect oversight tasks for the following year. The sum of these estimated costs will be used as a basis to apply the fully proportionate calculation method and considering all CTPPs together.\n\nThe fees will be collected by the ESAs in the Lead Overseer role which will then reallocate the collected fees among the other ESAs based on their estimated total oversight expenditure[^55].\n\n88\\. With regard to the potential deficits or surpluses, the proposal of the ESAs is aligned with the Commission interpretation of the financial regulation. The total amount of the ESAs budget (including the total amount of annual fees, EU subsidy and contribution from the National Competent Authorities) is determined on the basis of their Activity-Based Management methodology. At the end of the financial year, any surplus from the ESAs total budget is recovered by the Commission in line with the principle of universality[^56]. The same logic applies for potential deficit, not recovered by the ESAs from the CTPPs at the end of the year.\n\n89\\. Finally, it is important to stress that, through the existing mechanisms in place (EU budgetary procedure, annual reporting, single programming document), any decision concerning the level of the ESAs total budget as well as the level of income per fund sources is adopted by the ESAs Board of Supervisors, of which the EC is a permanent Member. Furthermore, on a yearly basis, the European Court of Auditors assesses the regularity and accuracy in the implementation of ESAs’ budget, including the fee-funded budget, in line with the EU Financial Regulation[^57]. The final audit report is communicated to the European Parliament and Council in the context of the ESAs budgetary discharge.\n\nBased on the Commission interpretation of the Financial Regulation, the ESAs expect the Delegated Act to establish the following treatment for the management of the potential deficits or surpluses for the oversight fees collected from CTPPs:\n\n* In case of deficits (the ESAs collects less than incurred), the ESAs do not recover the deficit from CTPPs;\n* In case of surpluses (the ESAs collects more fees than incurred), the ESAs do not pay back the surplus to CTPPs, and such surpluses would be fully given to the Commission in the year Y+1 following the annual financial accounts, like for other types of surpluses (coming from EU subsidy or NCAs contributions) in line with the principles of annuality and universality.\n\n## Practical issues related to the payment of the fees\n\n90\\. With regard to the modalities and the schedule of payment of the fees, in some existing ESAs practices, fees are collected once a year (one-instalment system). In other cases, they are collected twice per year (two-instalment system), with the first instalment being based on the estimated annual fees before the financial accounts of the entity are available and the second instalment on the actual annual fees calculated based on the financial accounts and reduced by the amount of the first instalment. This second system is particularly relevant with respect to fees that are calculated based on (n-1) audited accounts (which are generally not available when the first instalment is paid). However, experience shows that this differentiated treatment (two-instalment system) complicates the collection of the fees and budgetary management of both the ESAs and the supervised entities. More specifically, the two-instalment approach is more burdensome (more calculation and invoicing) and has only limited benefits for entities (in practice calculating fees based on (n-2) audited account leads to similar fees being collected over time).\n\nTherefore, the ESAs are proposing, in the Delegated Act, to establish a one-instalment payment for the collection of the annual oversight fees from all CTPPs. In case CTPPs are designated for 1st January, the debit note would be sent by end March with a 30 days payment term (i.e. by the end of April) each year.\n\nAs some CTPPs may be third country entities, it is also proposed to specify in the Delegated Act that all the fees will be invoiced and paid in Euros.\n\n91\\. Based on the previous proposals, for the oversight conducted during year “n”, annual oversight fees paid by the CTPPs would be based on their (n-2) applicable turnover with a one-instalment system at the end of April of year n. To reduce the probability of partial oversight during the first year, the ESAs assume they will as far as possible update the list of CTPPs (and notify the designated companies[^58]) shortly before the end of the last quarter each year, so that the oversight activities could begin on 1 January of the following year. Such practice would give sufficient time to the ESAs to organize the oversight of the new CTPPs and to facilitate the management of the fees (each time a full year). The response to the potential voluntary opt-in requests could be finalised to the same timeline when it is consistent with Article 31(11) of the DORA, to align all the processes. This would also allow the potential third country CTPPs to establish their subsidiary in the Union in accordance with Article 31(12) of the DORA enabling initiation of the oversight activities from on January n+2.\n\n92\\. However, during the public consultation, some market participants highlighted the difficulty to audit and certify their financial statements in case they would have to prepare dedicated ones (on a reduced scope compared with the regular comprehensive turnover) for the need of the oversight fees allocation. Hence, the ESAs assume the CTPPs will need time to prepare their relevant applicable turnover on the adequate scope (as proposed in this technical advice). In order to grant sufficient time for this preparation, the ESAs are of the view that all CTPPs should pay fixed fees the first year they are designated, without prejudice of the proposal made by the ESAs for the first group of designated CTPPs when DORA will be implemented. In case a provider is effectively designated as a CTPP during a given year, due to the voluntary opt-in request process for instance[^59], a time coefficient should be applied to the same amount of fixed fees, taking into account the number of effective oversight days during the year.\n\nTherefore, the ESAs propose the Delegated Act to impose that the first year a CTPP is designated, it should pay a fixed fees of EUR 500 000. The cumulated fixed fees paid by such CTPPs and the annual oversight fees paid by the other CTPPs would have to cover together all costs derived from oversight activities (i.e. the overall amount of the fees paid by the other CTPPs would be reduced by the overall amounts of the fixed fees paid by the newly designated CTPPs, in order that the sum is equal to 100% of the estimated annual oversight expenditures).\n\nThis proposal of fixed fees is not applicable for the first group of CTPPs the ESAs will designate when DORA will apply, as a dedicated fees allocation process is proposed in parallel in this technical advice.\n\nIn the case of a partial year of oversight due to a designation (or positive notification to an opt-in request) during the year, the ESAs are proposing that the Delegated Act imposes the same fixed fees, taking into account the number of effective oversight days during the year[^60]: EUR 500 000\\*(number of days when overseen/365 days). However, in that case, such fixed fees would not be discounted from the total overall aggregated amount of the yearly estimated oversight fees paid by the other already designated CTPPs as it would be charged later in the year, while the other CTPPs would have already received their debit note or paid their yearly oversight fees.\n\nSuch fees would be paid within 30 days from the issuance of LO’s debit note at the start of the oversight activities.\n\n93\\. The ESAs deem also useful to specify in the Delegated Act how the competent authorities involved in the oversight tasks will be reimbursed. In some existing delegated regulations[^61], the reimbursement of the actual costs of CAs incurred as a result of carrying out delegated tasks is explicitly foreseen. This includes all fixed and variable costs related to the performance of the tasks or to the assistance provided to the ESAs. For CTTPs oversight, it appears to be useful for both the ESAs and the competent authorities to clarify on which basis the competent authorities will be reimbursed by the ESAs. For the CTPPs, this would also clarify that all costs will be covered by the ESA’s invoices. In order to facilitate oversight budget management of the competent authorities, it appears more efficient for the ESAs to reimburse the competent authorities in due time after they have collected the oversight fees from the CTPPs, so on the basis of the estimated expenditure of the competent authorities. Hence, both the ESAs and the competent authorities can fund their oversight activities with the collected oversight fees during the year.\n\nThe ESAs are, thus, proposing to specify in the Delegated Act that only the ESAs through the Lead Overseer will charge fees to CTPPs (taking into account the estimated expenditure of the involved competent authorities, as proposed in this technical advice). It should also be indicated that the competent authorities will be reimbursed for their estimated (fixed and variable) costs.\n\n94\\. The first time that ESAs will designate CTPPs (first year of designation of CTPPs), an ad hoc approach may be considered to fully fund the first oversight tasks, depending on the timing of the first designation. In that case, the overall oversight expenditure would be estimated in the annual budget of the ESAs at the end of the previous year, before the ESAs know the actual number and the profile of the CTPPs. The estimation of such expenditure would rely on the scope of oversight expenditure as presented above. However, the allocation of the oversight fees would, exceptionally, not depend on the applicable turnover of the CTPPs because it is assumed that during the first year of the concerned CTPPs would not have sufficient time to prepare and to send their certified audited financial accounts to the ESAs. Instead, it would depend on the number of designated CTPPs: indeed, the overall estimated oversight fees of the ESAs would be equally allocated among the designated CTPPs (each CTPP would pay the same amount exceptionally). The payment would rely on one-instalment approach, and the payment date would depend on the designation date.\n\n95\\. For this very first year of the oversight framework implementation, it is neither suggested to rely on fixed fees proposed in parallel for the CTPPs which will be designated for the first time during the following years. Indeed, such approach is not fully based on overall estimated expenditure of a particular year (but on an average), while the expenditure incurred by the oversight activities related to the oversight of these first designated CTPPs would be as far as possible anticipated in the annual budget of the ESAs.\n\nHence, the ESAs are proposing to specify in the Delegated Act that, exceptionally during the first year of CTPPs designation, the related oversight fees would be equally charged to the designated CTPPs, the amount for each CTPP depending on the overall estimated expenditure of the ESAs and the number of designated CTPPs. Such fees would be paid based on the one-instalment system, within 30 days from the issuance of Lead Overseer’s debit note at the start of the oversight activities.\n\n96\\. The ESAs understand that the call for technical advice of the Commission does not invite them to propose approaches on how to manage the late payment of the oversight fees. However, as it is a fundamental requirement in the existing fee regulations, the ESAs consider it appropriate to also cover this aspect in the Delegated Act on oversight fees.\n\n97\\. Here again, different approaches exist. In some cases (e.g. for the supervision of CRAs, TRs (including TRs under SFTR), SRs, benchmark administrators[^62]), a daily penalty equal to a fixed percentage of the amount due is applied. In other cases (e.g. for the supervision of DRSPs and TC CCPs[^63]), the default interest laid down in Article 99 of Regulation 2018/1046[^64] applies. As already flagged in previous pieces of advice[^65], the ESAs would suggest referring to the default interest laid down in Article 99 of Regulation (EU, Euratom) 2018/1046 for all categories of supervised entities in view of ensuring consistency of approaches.\n\nOn this basis, to manage potential late payments of the annual oversight fees, the ESAs are proposing to rely, in the Delegated Act, on Regulation 2018/1046 and to apply the default interest laid down in Article 99 of this Regulation.\n\n## Treatment of the opt-in application\n\n98\\. There is no explicit provision in the DORA related to the cost to be paid by the TPPs for their application to opt in to the Oversight Framework on a voluntary basis in accordance with Article 31(11) of the DORA. However, the assessment of such opt-in requests will oblige the ESAs to dedicate specific resources to analyse and assess the applications; and such resources should be compensated for. Therefore, consistent with existing requirements for the registration or certification fees for entities in the direct supervision remit of ESMA, which are deemed to be relatively comparable activities, it is proposed to establish a financial contribution for opt-in requests.\n\n99\\. If designated as CTPPs at the end of the assessment, such new TPPs would pay oversight fees like any other CTPP.\n\nHence, the ESAs are proposing to define, in the Delegated Act, a fixed fee that ICT service providers would have to pay when they submit opt-in application to the ESAs. Account taken of and in comparison with the variety of the fixed fees charged by ESMA for its certification and registration activities, the ESAs are of the view that the opt-in TPPs pay a fee of EUR 50 000[^66].\n\nSuch fixed fees will not be refundable because a significant amount of work goes into assessing a request from the initial stage. Therefore, if the applicant withdraws its application before the end of the assessment, or if the notified decision is negative, the paid fees will not be reimbursed.\n\n## Annex I – Detailed feedback statement\n\n### Feedback on the public consultation\n\nFor the purposes of this advice, and in accordance with the ESAs Regulation, the ESAs have widely consulted market participants, in an open and transparent manner. In particular, the ESAs published on 26 May 2023 a discussion paper on their advice to the European Commission on two delegated acts specifying further criteria for critical ICT third-party service providers (CTPPs) and determining oversight fees levied on such providers. The discussion paper was published on the websites of the three ESAs and invited market participants’ comments on all the proposals put forward and in particular to a series of questions presented throughout the discussion paper. Given the timeline of this advice, the consultation ended on 23 June 2023 where the ESAs received 41 responses. The feedback collected has been taken into account in the resulting opinions of the ESAs’ advice. Below, a detailed feedback is presented for each part of the discussion paper noting that comments have been consolidated accordingly as for example in many cases several industry bodies made similar comments or the same body repeated its comments in the response to different questions.\n\n### Criticality criteria\n\nGeneral remarks (Questions 1-5 in the discussion paper)\n\n### Indicative process for criticality assessment\n\n* Six respondents expressed general support on the proposed two-step approach with request to clarify that the criteria will cumulatively lead to an ICT TPP being designated as critical. Otherwise, non-critical TPPs may fall under the oversight framework. However, three respondents proposed the criteria to apply sequentially with the orderly application of each criterion during the assessment process to reduce the initial broad list of services considered.\n* One respondent noted the importance of an objective, documented, evidence-based criticality assessment of CTPPs to ensure transparency, fairness and efficacy. Similarly, another respondent proposed to employ objective, measurable factors for the criteria and to avoid subjective or indeterminate factors to ensure workability. View that a CTPP designation decision should be made after application of these criteria to relevant ICT services, not through retroactive evaluation after designation of a CTPP.\n* Two respondents proposed for the metrics/data basis for the indicators to be as clear and consistent as possible. For example, it is unclear how a TPP will be assessed if it considers critical for the banking sector but not for the insurance sector (under indicator 1.1). Proposal to validate the criteria and the proposed thresholds using practical examples and, if necessary, to make the significance more comprehensible.\n* One respondent proposed to consider the notion of \"regionality\" in the criteria. This would filter out TPPs that have a very high presence in a specific region, but whose presence is not as representative at pan-European level. An operational failure of this type of TPPs would have a substantial negative impact in a certain region with a risk of contagion to financial entities in other regions (due to their dependencies).\n* Four respondents noted that the need for further clarification or guidance on the definition of ‘ICT services’ and suggested the development of a taxonomy in this regard. This could also specify which ICT services are considered critical. Proposal for certain services to fall out of the definition (e.g. on-premise software license, maintenance, support services, professional services that may be provided upon client’s request) as these are not provided on an ongoing basis. Such a taxonomy should align with the market reality and benefit from the TPPs’ technical expertise during the development of the taxonomy.\n* Four respondents proposed to specify which ICT services would be considered critical. One respondent highlighted that this holds in particular as a first step to filter out non-critical services offered by a TPP. The criteria and their administration should distinguish between these categories of ICT services to avoid overinclusion and imposition of undue burdens and costs on both CTPPs, financial entities, ESAs/Lead Overseers. Similarly, another two respondents recommended the designation and subsequent oversight of CTPPs should revolve around critical ICT services and the failure or disruption of which could adversely impact financial stability. These critical ICT services could be clarified by the ESAs. One respondent proposed for the ESAs to consider existing practices in the EU and other jurisdictions in relation to the definition of important or critical business services and to seek alignment on definitions to facilitate predictability and trackability of those services across all the ICT CTPPs.\n* Similarly, three respondents noted the proposed indicators are too focused on the number of financial entities using the ICT services and do not reflect the nature of the ICT services provided. Proposal for the indicators to be more closely linked to operational continuity if a disruption occurs and to criterion 4 on substitutability.\n* One respondent commented that financial entities could benefit from a sufficient number of ICT TPPs being designated as critical as outsourcing to a CTPP overseen by the ESAs could be facilitated, including compliance with the related legal requirements.\n* Six respondents highlighted that further clarity on paragraph 27 of the Discussion Paper regarding the assessment of sub-contractors during the designation exercise. The respective register should not request from financial entities to track and document every subcontractor in their supply chain for all ICT TPPs used. Rather, the CTPPs should be designated on the basis of their contractual relationship with the financial entities only at the first level of the chain. Fixe respondents proposed to clarify or provide guidance on the treatment of subcontractors (including fourth-party relationships, intragroup relationships) and in designation. Another respondent proposed to request from the relevant CTPP the relevant information about its sub-contractors. A respondent noted that in most cases subcontractors do not have contractual arrangements with EU financial entities and therefore it is unclear whether these subcontractors will need to establish an EU entity in case they are established in a third country.\n* A respondent proposed to perform the criticality assessment following a risk-based approach and assessing the impact of the unavailability of an ICT TPP.\n* Three respondents considered the proposed thresholds rather low which would result in a large number of CTPPs. This may continue pose a challenge for the sector as it prepares for the DORA implementation. Proposal to focus on the most critical ICT services provided by a smaller number TPPs.\n* One respondent expressed concerns on the group application of the criticality criteria. Proposal to consider the criticality criteria separately for ICT services provided by different entities within the same group rather than in a way which is accumulative. View that it would appear odd if two businesses operated separately would not meet the thresholds but if considered at group level (same parent entity) (or visa-versa). Similarly, three participants noted uncertainty in relation to the designation of entities within a group while acknowledging the fact that criticality assessment should cover all entities within a group. Proposal to provide guidance on this issue and for a single entity to be designated and be responsible for DORA compliance as it would be most efficient for CTPPs, financial entities and Lead Overseers. For example, an ICT TPP group may provide multiple different ICT services to financial entities which could meet (i) both Step 1 and 2 indicators, (ii) meet Step 1 but not Step 2 (or vice versa); or (iii) meet neither. A respondent noted several challenges on the criticality assessment and potential designation at group level. In case of insufficient clarity on the scope of the oversight, there is a risk of weak oversight. Proposal to apply criticality assessment at entity or group level, designation to be primarily driven by (i) the ESAs focusing on specific ICT services that raise operational resilience concerns; and (ii) base the designation on the TPP that provides such ICT services, and (iii) target the associated ESA oversight around those ICT services.\n* Another respondent recommended the ESAs to produce an evidence-based rationale detailing the operational resilience risks they aim to mitigate when considering a group as a whole (as opposed to services provided by a group company), in particular clarifying whether and how they see any potential risk of contagion between an individual ICT TPP and the group to which it belongs. Other two respondents suggested the adoption of a pragmatic approach for designation purposes as designating various individual entities within the same group as CTPPs, based on the ICT services provided by the ‘group as a whole’, could have unintended consequences. Proposal for the ESAs to avoid generating an unnecessary administrative burden by designating multiple entities within the group as CTPPs as suggested in paragraph 26 of the Discussion Paper.\n* Another respondent noted that the scope of the Oversight Framework should not go beyond what is necessary to achieve its underlying objectives, also taking into account its effectiveness and necessary workload. It is further proposed that the potential CTPP should require a contractual arrangement with EU financial entities as this could allow for transparency and effective oversight processes.\n* A respondent proposed that in case an ICT TPP is part of a group comprised of financial entities and non-financial entities, the ICT TPPs part of that group should be excluded from the oversight framework similar to the entities to be excluded under DORA Article 31.8(i).\n* One participant proposed to consider the entire vendor chain as a significant number of firms have indirect relationships with fourth-party providers who have faced breaches.\n* One respondent requested to know more about the joint-ESAs high-level exercise on the ICT TPP landscape and related additional simulations, especially if financial entities are expected to be involved.\n* Three respondents highlighted that due to the specific scope of DORA oversight and the wider scope of NISD2, proposal not to use the essential or important entities under NISD2 as a starting point for the designation of CTPPs. Moreover, proposal by three respondents to further specify how this aspect will inform designation process, including integration with other Step 2 indicators and weight in the overall assessment.\n* One respondent highlighted that existing data sources and the registers of information would be sufficient for the designation of CTPPs. Proposal to avoid expanding the data requested via the registers solely for the purposes of the criticality assessment.Moreover, to reduce additional reporting burden on financial entities, it is proposed by one participant to collect relevant data from competent authorities, if available.\n* Proposal by one respondent for a gradual approach for the application of the indicative thresholds where initially they could be placed at a higher level to allow the oversight of the largest TPPs, and subsequently, to consider the use of lower thresholds. This is to account for the impact of a potential “quasi certification” system to ICT services’ market as a consequence of the DORA oversight. Similarly, proposal by one participant to consider the evolution when determining the indicators and for the ESAs to be targeted and controlled and look to expand at a later stage if necessary. Proposal to treat the minimum relevance thresholds (Step 1) as more meaningful initial sift of potential criticality. Proposal to put greater importance to criterion 1 and 3 due to their outcome-based focus on the systemic impact from a TPP failure.\n* One participant set out the view that criticality may well not exist even where thresholds are exceeded. Proposal (where possible) for the FEs to be encouraged to present to the ESAs the TPPs they consider critical. Proposal to also consider whether potential CTPPs may already fall under sectorial legislation.\n* While it is understood that the CfA is requesting the ESAs to further specify the criticality criteria, five participants noted that it would be useful to publish at a later stage a clear guidance on the assessment/methodology, including the precise number of thresholds together with the overall indicator/criteria weighting, as this could also support financial entities’ own internal assessments and enhance consistency across the industry. It should be made clearer how, in the further process, the criteria will be used to determine the CTPPs. Four respondents noted that all information related to the designation of CTPPs should be reviewed holistically by ICT TPPs to allow for a sufficient understanding of the future oversight framework. Proposal to publicly consult on the methodology and designation procedure ahead of the first designation, providing adequate review time.\n* One respondents proposed for the CTPPs’ identification process to align with the Central Securities Depositories Regulation (CSDR) and international standards (e.g. IOSCO Principles for Financial Market Infrastructures) to avoid duplication of measures and communication requirements. In particular, the criticality criteria may build on the current criteria laid down by sector-specific regulation.\n* Proposal by one participant to base the indicators on total assets per type of financial entity.\n* One respondent proposed to use absolute values instead of percentage values.\n\n### Minimum lifecycle duration\n\n* One respondent expressed support for the aim to ensure that the list of designated CTPPs is stable over time in order to manage threshold effects. Eight respondents recommended 3 years are in line with cross-industry life cycles noting also there could be a specific business context to passing certain thresholds.\n* Five respondents proposed the minimum turnover time in the CTPPs’ list to be shorter as 3 years are perceived excessive given the fast pace of technological developments, suggestion for 1 or 2 years. Three respondents proposed to allow flexibility and also to use a moving average as it may lead to a quicker release for the list (taking into account the high regulatory burden when designated as CTPP).\n* Three respondents proposed to apply similar approach in reverse to ensure stability of the CTPPs’ list in both directions and to ensure more consistency between the entry and exit to the regime.\n* Five respondents proposed to also consider alternative exit scenarios from the CTPPs’ list such as the possibility to allow proactive opt-out by a CTPP (e.g. due to divestment, change in services offerings, etc.), discretionary right by the Lead Overseer to appoint and remove a CTPP for planned or undertaken events (e.g. mergers, divestments of activities), qualitative assessment similar to the approach of the Directive on Resilience of Critical Entities (2020/0365). A respondent proposed immediate removal from the list.\n* Another respondent noted that removal from the CTPPs’ list should result from an overall assessment rather than focusing only on the thresholds to mirror the initial designation approach.\n* Two respondents noted the importance for a CTPP to remain accountable for the remediation actions defined/planned during the oversight, even when it stops being designated as “critical”.\n\n### Other related issues\n\n* One participant expressed uncertainty on the amount of information and the process to engage with competent authorities, which creates a significant administrative burden mainly for small/medium ICT TPPs. Proposal to standardise approach to request information in relation to ICT services/arrangements.\n* Two respondents proposed for the design of the indicators to be as simple as possible to avoid additional reporting burden for the financial entities.\n* A respondent proposed for the criticality assessment to provide a clear link between the risks posed by ICT TPPs and the potential impact on financial entities’ ability to operate their core services.\n* Another respondent noted the need of more clarity on the calculation of indicators as well as further sector-specific indications through upcoming dedicated information.\n* One respondent highlighted the importance of obtaining a comprehensive understanding of the dependencies and interconnections between the cloud service providers and the other ICT third-party providers to enable the assessment of the potential impact of TPPs’ failures or disruptions on the availability, integrity, and confidentiality of cloud services.\n* A respondent proposed the ESAs to explore the use of cyber risk ratings as a key metric in the criticiality assessment and ongoing monitoring of ICT TPPs.\n* Another respondent noted that the introduction of wider factors will hamper compatibility with the key characteristics outlined in the discussion paper, especially the need for designation criteria to be relevant and timely.\n* A respondent proposed the financial entities to report in a structured manner the ICT services they receive and also functions supported by these ICT services. Moreover, it is proposed to have baseline metric concerning the systemic impact a TPP may have on the provision of financial services e.g. establish an inclusion benchmark that an ICT service will meet this criterion if at least 20% of relevant financial entities rely on it for critical functions.\n* A respondent proposed to define critical ICT services using an inclusion benchmark e.g. if an ICT service is used to support critical or important functions of 20% of G-SIIs or O-SIIs.\n* A respondent mentioned that the ESAs will have the right to designate ICT TPPs as “critical” at any given moment.\n* Two participants highlighted practical challenges in assessing the interaction of the criticality criteria e.g. a TPP may serve numerous financial entities by providing low impact ICT services and thus irrelevant for step 2 assessment or not clear whether subcontractors will be assessed only for criterion 4. Two respondents stressed that it’s important to know the weighting given to each criterion and the relationship between them to allow an appropriate assessment. Proposal to assess the criteria sequentially with the orderly application of each criterion during the assessment process reducing an initial broad list of ICT services considered.\n* Two participants noted that the varying use of relevant terms (e.g. ICT TPPs, critical or important functions, etc.) may be an obstacle and it is proposed to maintain a functioning reporting-structure (bottom-up) of indicators and assuring their correctness.\n* A respondent proposed to also consider the concentration risk at Member State level in the interest of proportionality.\n* A respondent raised concerns on the potential application of minimum thresholds per ‘type of financial entity’ as it is understood that these will apply to all the entities listed in DORA Article 2 (a) to (t), including to ‘institutions for occupational retirement provision’. Given the relatively small landscape of these institutions, it is not considered appropriate for these institutions to be considered systemically important financial institutions and subsequently for the pension fund service providers to be designated as CTPPs. It is proposed to apply a holistic assessment of the criteria and moreover, to raise the proposed minimum threshold on type of assets.\n* Two respondents noted the practical challenges in the collection of the necessary data to assess the proposed indicators. Proposal for the data to be publicly available or filed with appropriate authorities as well as collect data directly from the TPPs. Another three respondents noted the need to leverage on existing data sources without adding reporting burden to the financial entities and hence to reconsider all the proposed indicators based on the data available. Some data could be also provided by the competent authorities, for example the assets under management (AUM). It was also noted that both the registers of information and the proposed indicators should not include data of a sensitive nature e.g. “annual expenses or estimated costs of the contractual agreements”, which it can also prove difficult to estimate (such information would not bring added value to the CTPPs’ designation. It was further proposed to introduce in the future a notification/interface with the relevant competent authorities to provide the required data.\n* A respondent raised concerns on potential delays if relying only on the registers of information for the designation of CTPPs as both the registers and the list of CTPPs are expected from January 2025.\n* Two respondents raised concern on the potential poor data quality to be used for the criticiality assessment as well as for oversight purposes. As this data will rely on the registers of information to be provided by the financial entities it is proposed for the register to be consistent (e.g. clear taxonomy and guidance) and granular. High-level and inconsistent data could inevitably lead either to inaccurate conclusions or to future oversight on non-relevant ICT services. Further clarity was requested on the additional data sources that can be used by the ESAs.\n\n### Criterion 1 (Questions 6-11 in the discussion paper)\n\n### Indicator 1.1\n\n* Four respondents noted that the metric on the total number of financial entities should not be considered in isolation and more elements could be considered such as balance sheet totals, market penetration, customer volume or similar business criteria, when also considered in conjunction with criterion 2. Same respondent noted there is no direct correlation between total assets and provision of ICT services.\n* A respondent proposed to replace the metric on total number of financial entities with the total revenues of financial entities as it could considered a more representative indicator. Another respondent noted that all financial entities seem to be given the same weight. It is proposed for the size of the financial entities to consider the number of customers in total or by the number of customers for special customer sectors.\n* Two participants noted that indicators 1.1 should put more emphasis on the type of ICT services provided to avoid unintended results. It is proposed for indicator 1.1 to consider ICT services supporting critical or important functions of financial entities. Similarly, another participant proposed for indicators 1.2 and 1.3 to consider ICT services supporting critical or important functions of financial entities. Another participant proposed to exclude non-material ICT services from criterion 1.\n* Two respondents raised concern on the 10% threshold as this seems to be very low and it will not act as an effective gateway. It is proposed to use a higher one to be systemically relevant. Another respondent noted the 10% threshold may not be adequate to disqualify the ICT services which would not cause a disruption if they failed. For example, an ICT TPP can be in a position to provide ICT services to many financial entities (more than 10%) however a potential disruption of these ICT services will not negatively impact the operations and activities of those financial entities. Proposal for a higher threshold.\n* Two respondents raised concerns on how indicator 1.1 will be assessed per each type of financial entity and whether it would be practicable to assess criticality per financial sub-sector.\n* Two respondents noted the need for further explanation on how subcontractors will be captured in indicators in 1.1, 1.2 and 1.3. Another respondent raised concerns in taking into account the subcontractors for assessing criterion 1 as this is not specified in DORA Article 31(2)(a) as it does in DORA Article 31(2)(c). Such a request via the registers of information will oblige the financial entities to monitor and document additional elements for each of their TPPs that subcontracts services to another provider. This is considered quite broad and burdensome. Proposal to limit such indirect ICT services only when these support critical or important functions of the financial entities.\n* A respondent noted that while there may be a concentration of financial entities using a specific CTPP, that same CTPP may be providing different ICT services to its financial entity client base, which in itself may not constitute a concentration risk at service level. It is proposed to take into account this nuance when finalising the advice to the EC and in any subsequent delegated act.\n\n### Indicator 1.2\n\n* Two respondents raised concerns on the application of the ‘total assets’ as a uniformed EU metric for assessment. A respondent noted that making use of the AuM (net asset value) to assess the relative weight of the financial entities using that ICT TPP would base the measurement on easily available and reliable data. Another respondent noted that the valuation of AuM is complex and this should be provided by the competent authorities. It was further noted that EU asset managers may also manage assets in other non-EU jurisdictions or that services of an ICT TPP could cover only part of the asset managers’ AUM. Another respondent noted that using AuM should only be used by asset managers with a UCITS or AIF licence. For investment firms that also provide portfolio management services at their own discretion, the total value of assets should be relevant across the board. Otherwise, this could lead to delimitation problems for investment firms that also perform other MiFID activities (such as dealing on own account).\n* A respondent proposed to take a differentiated approach for the different types of financial entities as well as differentiating asset classes.\n* A respondent proposed to specify that the total assets of credit institutions should derived from the ‘total assets’ on their audited balance sheets.\n* A respondent noted the term “premium collected” is too generic for insurance undertakings and proposed ‘gross written premiums’ instead as it would reflect better the European footprint.\n* Three respondents mentioned there are no relevant equivalent metrics available and two participants noted the complexity and complication of this metric. A respondent proposed to consider the total number of customers of financial entities and the impact of the ICT TPP on the critical or important functions (including for resolution purposes). Two respondents proposed as alternative metrics the market share of financial entities (e.g. market capitalization, revenue, or customer base) and profitability (e.g. profits or operating income). These could complement the assessment based on total value of assets/total assets equivalent. Another respondent proposed as equivalent metric to the indicator 1.2 the share of the revenues of financial entities using ICT services provided by the same ICT TPP over the total revenues in the EU financial sector.\n* A respondent raised concerns that any further differentiation would lead to more documentation work for the financial entities without any tangible benefits. It is therefore proposed for the indicators in step 1 to be kept as simple as possible acknowledging that these can only be an approximate reference.\n* Seven respondents found the proposed thresholds too low. Two participants suggested to increase it to 20-25% as it is an appropriate inclusionary benchmark to use in assessing the systemic nature. Another respondent proposes minimum 10% total or 20-25% per type of financial entity as financial sub-sectors may be dominated by few big financial entities and thus the TPP of such entities may then be encompassed solely based on this. A participant also proposed to use absolute value instead of percentage as thresholds, given the latter is sensitive to interdependencies.\n* Two respondents proposed to lower the thresholds without making the list too long.\n* Two respondents proposed a staged approach on the thresholds starting for example with 30% for first 2 years and then decreased to 10% to focus the oversight scope of the ESAs in the first years. This will allow time to the ESAs, TPPs and the financial entities to learn and improve.\n* A respondent noted that reference values are required to assess whether the proposed 10% threshold is appropriate. Another respondent suggested the performance of a dry run before setting minimum thresholds as well as an explanation of the economic rationale behind the proposed threshold (mentioned by two participants).\n* A respondent noted that minimum thresholds should not be applied in a mechanistic manner and the indicators should not be determinative. Flexibility should be in the process to enable a holistic approach, including inviting the TPPs to respond/sense check step 1 findings before proceeding with step 2.\n\n### Indicator 1.3\n\n* Three respondents noted the need for further specification for assessing indicator 1.3 as it appears highly subjective, including explanation on how the aggregated result across all financial entities will be used as a reference value.\n* A respondent noted that step 2 indicators (being of a qualitative nature) would be more appropriate to identify systemic impact, since they consider the type of activity impacted by the failure of the provider.\n* A respondent noted that indicator 1.3 does not align with DORA Article 31(2)(a). Further, DORA Article 31(2)(a) is limited to the impact on the stability, continuity or quality of the provision of financial services. It does not extend to the impact on the services, activities and operations of financial entities generally. Proposal for indicator 1.3 to be properly scoped and consistent with the focus of DORA Article 31(2)(a).\n* A respondent noted that business continuity plan and recovery procedures are confidential and need to remain confidential, therefore this information should not be part of the indicators.\n* A respondent noted that when a significant number of financial entities rely on ICT services from the same ICT TPP, it signifies a shared risk exposure (for example, if an ICT TPP were to experience a large-scale operational failure, it would affect multiple financial entities simultaneously). However, this can be mitigated by financial entities by taking proactive measures such as implementing backup systems, redundancy plans, and disaster recovery strategies. Six participants highlighted that further guidance would be welcomed on the definition of \"large-scale operational failure\" and \"substantial negative impact\". Proposal to refer only to critical or important functions, to assess whether other EU financial can also be affected and whether these as a whole are important for the European financial market.\n* One participant proposed for indicator 1.3 to limit the impact of failure of the ICT TPP on the provision of financial services by financial entities, and not on services, activities and operations generally. The following adjustment is suggested to make indicator 1.3 more specific and relevant: ‘Share of financial entities for which a large-scale operational failure of the same ICT TPP to provide its services would cause a substantial negative impact on the provision of financial services by those financial entities’.\n* A respondent suggested to link Indicator 1.3 with the substitutability of the provided ICT services and whether back-up services, alternative ICT TPPs or data exist.\n* A participant proposed to remove assessment of subcontractors as this would be inappropriately burdensome with a view to indirect dependence. Sub-contractors should be limited to indicator 1.4.\n* Another respondent proposed to distinguish between the operational failure of “the same ICT TPP” and the operational failure of “a relevant service line of a given ICT TPP” as it can be rare for an entire ICT TPP to fail.\n\n### Indicator 1.4\n\n* Four respondents stressed that this indicator could be difficult to define and quite subjective. Other than disaster recovery (DR) plans invoked, further guidance would be required for assessing this and as it will be specific to individual financial entities, the impact will vary across markets. Another respondent noted that a failure of an ICT TPP might not impact a financial entity if there is a readily available alternative ICT TPP that can be activated immediately (e.g. a network provider).\n* Three respondents requested clarity on whether indicator 1.4 applies only to subcontractors of CTPPs, who should provide this information, and noted that subcontractors of non-critical ICT TPPs will not be taken into account potential cluster risks. Another respondent noted there is no clear link between indicator 1.4 (step 2) and the designation process as well as the source of information to assess this indicator.\n* A respondent highlighted that further guidance is proposed to be provided on the proposed actions or approaches to be considered in the event of a concentration of sub-contractors is identified at EU level (e.g. substitutions of CTPPs).\n* A respondent proposed for this indicator to have an appropriate “filtering” effect by focusing on the business services (e.g. payments, liquidity management settlements and clearing) and the market share of financial entities receiving ICT services from the same CTPP. Similarly, another respondent proposed to consider subcontractors if they are providing a critical ICT service that supports critical or important functions of financial entities.\n* A participant proposed to include indicator 1.4 under criterion 3 as subcontractors related critical and important functions is mentioned in DORA Article 31(2)(c).\n* To ensure a risk-based approach, a respondent suggested to consider how a CTPP is using a specific sub-contractor as two or more CTPPs may use the same subcontractor to provide different services or a similar service in different locations.\n* Four participants proposed that footnotes (9) and (10) should be listed directly in the text as they contain relevant information.\n* A respondent proposed to reconsider the extension of the criticality of an ICT TPP or subcontractor to the entire group as it is not clear whether this includes all companies in a group, certain types of companies in a group or only the companies in the oversight scope. In the case of a diversified group, this could mean significant risks and increased implementation efforts (compliance with the requirements).\n* A respondent mentioned that the term “discontinuation” is quite vague hence the need for a clearer definition to be able to assess its potential impact. For example, it would be helpful to know whether the term covers suspension/interruption as well as cessation/termination.\n* A respondent noted that the activation of a contingency plan is not considered an appropriate input to identify the potential impact on the financial entities’ services, activities and operations.\n* Two respondents proposed that all indicators should consider direct or indirect critical subcontractors and take into account the whole supply chain.\n* A participant proposed to explicitly define what qualifies as a subcontractor and further guidance how to determine critical or important functions.\n* A respondent requested clarity that subcontractors that belong to the same group as the CTPP should be excluded when assessing this indicator, as these should be already considered in the context of the CTPP’s group assessment.\n\n### Data sources\n\n* Two respondents highlighted a need for clarity on the source(s) of information to assess the systemic impact of a large-scale operational failure. It is further noted it would be disproportionate to require financial entities to produce additional plans or documents to allow regulators perform similar assessments hence such assessment should leverage on existing BCPs and recovery plans.\n* Seven respondents proposed to use the registers.In particular, two respondents proposed this data to include LEI codes of ICT TPPs, criticality assessment, description and categorisation of the ICT services provided, critical functions supported, and subcontractors involved as well as to refer to EU consolidated level.\n* In relation to the total asset value, two respondents proposed to use existing regulatory reports and another respondent further proposed the ESAs (i) to publish anonymised data of EU-wide total value of assets (by class of financial entity) and (ii) require financial entities contracting with ICT TPPs to provide data on their individual asset value for the purpose of DORA. This will enable ICT firms to access to the data they require to assess their status under DORA.\n* A respondent noted that this information needs to be compiled by the ESAs and come directly from financial entities as ICT TPPs do not hold detailed information of the financial entities.\n* Another respondent proposed to use data to be collected by the CTPPs after the first designation.\n* A respondent proposed the following additional data sources: (i) industry reports or ad-hoc assessments commissioned to firms with dedicated capabilities, market experts, and experience (e.g. consultancy companies), (ii) self-reported data/surveys administered to ICT TPPs and subcontractors, (iii) database of registered ICT TPPs, subcontractors, and financial entities, (iv) entities (including TPPs) balance sheets.\n* A participant highlighted that information of subcontractors should be provided by the identified CTPPs.\n* A respondent proposed to use the designation of ICT TPP as “essential and important entities” under NIS2.\n* A respondent mentioned that it would be useful to provide the formula for the calculation of the different indicators as well as possible data sources for each indicator. Also clarity on who will perform the calculations, the timeframe of the calculation and how subcontractors will be considered in the calculation of the indicators.\n\nCriterion 2 (Questions 12-17 in the discussion paper)\n\n### General comments\n\n* Three respondents proposed to include the “criticality of the functions being supported by the CTPPs/ nature of ICT services received/ degree of substitutability” in the criterion 2 indicators.\n* Two respondents requested to clarify that criterion 2 mentioned in Article 31(2)(b) DORA Regulation and the additional indicators are not relevant for investment firms regulated under the IFD/IFR, nor for asset managers licenced under the UCITS or AIFM Directives either, that rely on ICT third-party service providers.\n* A respondent recommended to consider the principles of proportionality and subsidiarity as well as the need to ensure a level playing field. Not all financiel entities in scope of the DORA should be subject to the same reporting requirements and supervision by national competent authorities should be encouraged as these authorities would have detailed knowledge of the specificities of their respective national markets.\n* A participant expressed agreement that the number of G-SIIs and O-SIIs could be a useful indicator (indicator 2.1), but disagree with the assumption that scale necessarily leads to risk or less resilience as the provider might have a wider net of experience and can rapidly apply lessons learned to its entire ecosystem. It is therefore suggested extending this list to all providers to O-SIIs and G-SIIs to allow supervisors to enter earlier into the qualitative assessment. G-SIIs and O-SIIs may receive very different services from providers with very different risk profiles. Casting the net wide and allowing supervisors to review service by service in a qualitative analysis will lead to a better and fairer outcome.\n* A respondent proposed that the 10% minimum relevance thresholds established in indicators 1.1, 1.2, 3.1, 4.1 and 4.2 should be applied across all financial entities in the EU rather than at a country level given DORA is a Union wide piece of regulation and focussed on the risks to the EU as a whole. This would allow for a gradual expansion over time if necessary.\n* Another respondent requested more clarity on how the suggested thresholds have been chosen. Additionally, proposal to include guidance on 1) what happens if thresholds are exceeded, including what course of action is required to be taken, by financial entities, if any (up to and including exiting of CTPP's if that is the expectation) and 2) how each of the indicators are weighted and what course of action is expected for each one if thresholds are exceeded.\n* A respondent highlighted that without further context or information, it is difficult to assess the appropriateness of the thresholds. The thresholds should be set based on an understanding of the potential risks and dependencies associated with the ICT TPPs and the financial entities using their services.\n* A respondent encouraged the ESAs to assess the significance of those criteria which are indicators of systemic risk for the purposes of the holistic/collective assessment. As the other indicators listed are more risk-based and outcomes focused, suggestion to assign criterion 2 indicators with a lesser weighting.\n* A participant noted that it would have been beneficial to provide more details, in particular with regards to the formula behind the different indicators, possible data sources, assumptions made, and the treatment of sub-contractors.\n* A respondent expressed agreement on the fact that it is important to ensure that the critical sub-contractors and vendors are covered by the assessment as well.\n\n### Indicator 2.1\n\n* Four participants noted that indicators 2.1 and 2.2 refer to financial entities actively using ICT services provided by the ICT TPP. However, it may be unclear how the usage is defined or measured. Ambiguity may arise in determining whether active usage is based on contractual arrangements, operational integration, or other factors, leading to inconsistencies in assessing the criterion. Therefore, it is proposed that indicators 2.1 and 2.2 address “reliance” on ICT services providers (as opposed to mere “use”).\n* Two respondents requested a clarification of indicator 2.1 as it would be not clear if the minimum relevance threshold should be interpreted as meaning that any ICT TPP of a G-SII would be potentially critical or not. This might result in ICT TPPs refraining from entering into contracts with G-SIIs. The same should be considered with regard to Indicator 2.2.\n* A respondent proposed to merge indicators 2.1 and 2.2 for a more homogeneous evaluation and in order to avoid exceptions.\n* Another respondent proposed that specific guidance should be provided on how to assess the impact or significance of G-SIIs and O-SIIs on the stability and integrity of the EU financial system. Otherwise there would be a risk of ambiguity.\n* A participant highlighted that the lists of G-SIIs and O-SIIs refer to credit institutions, therefore excluding pension funds such as IORPs.\n* A respondent proposed to consider that providing services to a single G-SII (indicator 2.1) should not meet the minimum relevance threshold. Bearing in mind that there are around 30 G-SIIs. Therefore it is recommended to lift this threshold to 3 G-SIIs which represents a more meaningful market position. Likewise, it is recommended to lift the threshold from 3 O-SIIs to 5 O-SIIs considering there are more than 170 O-SIIs, and to at least 3 O-SII with an O-SII score above 3,000.\n\n### Indicator 2.2\n\n* Six respondents highlighted that the threshold of indicator 2.2 is too small. The threshold takes effect if at least one systemically important non-credit institution is affected. This puts these institutions on the same level as G-SIIs. Three participants noted that the same holds for the threshold of indicator 2.1 as the current level is likely to include many small and non-critical suppliers, which would make the step 2 assessment more extensive. One respondent recommended to use absolute values instead of percentage thresholds, given the latter is sensitive to interdependencies which can be difficult to measure.\n* Five respondents expressed their view that the approach behind indicator 2.2 leaves too much discretion in the hands of the competent authorities and may in fact create an uneven playing field within the EU market, i.e. what may prove “systemic” at a national level, may not necessarily be at an EU one. If the indicator is kept, it is suggested to provide more detailed information on the term “supervisory expert judgement”.\n* Two participants proposed with regards to indicator 2.2 to frame more tightly the rules around the designation of a financial entity as “systemic” by competent authorities, i.e., it should be made clear that only certain authorities (namely, the supervisory bodies of financial entities in scope of the DORA) can designate a financial entity as “systemic”. In this context is should also be clarified whether the term “systemic” is the only term accepted. A respondent highlighted that the approach described for indicator 2.2 could lead to divergent approaches per regulator per jurisdiction and might result in additional burdens for the designated entities.\n* A respondent expressed the concern that for indicator 2.2 supervisory information which is not publicly available or based on a clear set of criteria will be used.\n\n### Indicator 2.3\n\n* Ten respondents expressed agreement with the fact that recording of interconnectedness is complex in practice. For this reason, further guidance on this point should be included in the final response to the Commission. Another respondent questioned the added value of an indicator 2.3 in general. Another participant proposed to specify the definitions of “interdependence” and “connectedness” to facilitate identification of in scope arrangements and ensure consistency of reporting. Another respondent noted that the data used could include data on financial infrastructure services provided by G-SIIs or O-SIIs to other financial entities, as well as qualitative information.\n* Four respondents expressed their agreement with indicator 2.3.\n* Two respondents had the remark that data for indicator 2.3 on the interdependences between G-SIIs, O-SIIs and other financial entities could be available from existing regulatory disclosures, depending on the interdependencies being sought. Before clarifying what is within scope, recommendation to the ESAs to conduct further analysis on the data which is already available. Furthermore, it is proposed to focus within step 2 on identifying the number of G-SIIs, O-SIIs and other financial entities who are relying on the same ICT provider for critical/important functions, as the key interdependency. Another respondent noted that such data can only come from financial entities as ICT TPPs (such as cloud service providers) have limited visibility in the workload of customers and therefore are unable to provide such data.\n* Two participanted requested to clarify whether Article 394 of CRR in light of intra-bank business is meant by indicator 2.3.\n* Two respondents noted that links between pension funds and other types of financial entities are limited.\n* A respondent proposed to add to indicator 2.3 the “number and share of financial entities using the same ICT TPPs”, the “concentration of ICT TPPs in the market”, and the “level of dependency of the financial entity on a specific ICT TPP”, measured e.g. by the share of budget allocated to the ICT TPP/ the share of ICT services assigned to the ICT TPP weighted by their stratregic importance.\n* A respondent proposed to specify indicator 2.3 by explicitly defining the parameters used to determine “interdependence”, by providing guidance on how to measure the level of interdependence, and by providing guidance on how to assess the potential impact of interdependencies on the stability and integrity of the EU financial system.\n* A respondent proposed for indicator 2.3 to have a reasonable chain of causation that is demonstrably linked to established interdependence between financial entities. If an ICT TPP provides completely different services to two different financial entities, the fact that those two financial entities are interdependent, could be irrelevant if that dependency does not involve the services provided by the ICT TPP. It could only be relevant if both financial entities rely on the same service provided by the ICT TPP for the interdependent function. Therefore, indicator 2.3 can be both overinclusive and underinclusive and a more granular approach to data collection would be important. To fix this, it is suggested differentiating the assessment in a similar same way as proposed for indicator 1.3.\n\n### Data sources\n\n* Two respondents confirmed that the referenced G-SIIs and O-SIIs lists are accurate. Highlighted that uniform assessment criteria are still needed in the EU for the survey of systemically important “non-credit institutions” (indicator 2.2).\n* Three respondents generally proposed to use already available data such as industry reports or ad-hoc assessments commissioned to firms, surveys administered to ICT TPPs, interviews with financial entities and experts for assessing interdependencies, a database of registered ICT TPPs and G-SIIs and O-SIIs, and the balance sheets of financial entities and ICT TPPs. Another participant proposed to leverage on data from competent authorities and supervisory bodies, including expert judgement of relevant competent authorities.\n* A participant recommended to use the registers that financial entities currently maintain under the existing ESA outsourcing guidelines, and in particular the information about whether an ICT service is considered critical or important to determine which ICT services financial entities rely on. This would clarify the term “using ICT services”.\n* A respondent suggested for banks and with regards to indicator 2.3 to use bank’s individual CCR calculations as banks are required there to apply specific capital treatment to interbank exposures. However, such data is not publicly available, which might create issues in practice.\n* Two respondents noted that they are not aware of any relevant data sources.\n\nCriterion 3 (Questions 18-22 in the discussion paper)\n\n### Indicator 3.1\n\n* Eight respondents expressed agreement with the step 1 indicator proposed for criterion 3. Another respondent proposed to introduce additional indicator that assesses the average number of ICT services provided by an ICT TPP per financial entity as multiple financial entities relying on a particular ICT TPP for a high number of ICT services implies that there is a strong dependency. Another respondent suggested to limit “supporting” to ensure that only ICT TPPs that are providing ICT services that may materially impact the critical or important function are in scope.\n* Three respondents noted that indicators 3.1 and 1.2 are to a large extent duplicates.\n* Nine respondents noted that the 10% minimum threshold for indicator 3.1 is too low. Four respondents would appreciate evidence-based clarifications on how the 10% threshold was determined. Another respondent proposed to raise the threshold to 30% until 2026 and then to lower it to 10%. Another participant recommended to specify what happens if thresholds are exceeded, including what course of action is required from financial entities, as well as on the weighting of the indicators. Another respondent proposed to increase the threshold to 25%. Finally, another respondent suggested to apply the minimum threshold flexibly.\n* Two participants proposed to rethink the threshold for indicator 3.1 as the amount of assets has no influence on the criterion. Instead, the threshold should refer to the number of critical and essential business functions the ICT TPP is involved in. “Total value of assets” is not necessarily representative of the importance of a financial entity. For this reason “total number of financial entities” is preferred.\n* A participant suggested to have 10% as the total threshold or 20-25% as the threshold per type of financial entity. The same threshold should be implemented for indicator 1.2.\n* A respondent proposed to lower the minimum threshold for indicator 3.1 and to use revenue (or assets/ total assets-equivalent) rather than the number of financial entities.\n* A respondent proposed for the second threshold of indicator 3.1 to take into account also the size of a financial entity measured by the total value of assets or number of customers.\n* Two respondents expressed concerns with applying the 10% minimum threshold for indicator 3.1 as some national pension sectors represent a large share of AuM of EU IORPs. Several national pension fund service providers would hit this minimum threshold as a very limited number of pension service providers provide ICT services to the pension sector. Thus, the proposed minimum relevance thresholds would unnecessarily impact IORPs and related service providers. Therefore, proposal to implement a more holistic assessment process.\n* A respondent expressed its appreciation of the focus on ICT services that support critical or important functions and relative levels of criticality in indicators 3.1 and 3.2.\n* A participant suggested in order for the step 1 indicators to be practically implementable, to give more clarity on what constitutes “critical or important functions”. The EBA Guidelines under Section 4 provide a baseline to work from.\n* A respondent recommended to use a predetermined list of critical functions in order to ensure consistency in the process of identifying such.\n* A respondent proposed for indicator 3.1 to distinguish between different service lines, financial entities, and asset classes, as well as to target more specifically critical dependencies for important business services. It may even be considered to assess market risks differently at different levels of the market (e.g. large vs. medium vs. small financial institutions).\n* A respondent requested to define “critical or important functions”. Remark that it would have been beneficial to have written clear formulas for the indicators, to elaborate on possible data sources that could be used for the calculations, to provide more details on the assumptions behind the indicators, as well as to describe more clearly how you would consider sub-contractors in the indicator calculations.\n* A respondent highlighted that focusing on a risk-based approach similar to that applied for the identification of critical service providers within the scope of non-financial risk management for the management companies, proposal to consider that the assessment of critical functions should be following a business impact analysis and a risk-based approach. Resultingly, no appreciation of a taxonomy-based approach in the form of a list of critical activities, which completeness and suitability could be questioned within the context of specific activities and / or entities.\n* A respondent noted that the denominator is the same across indicators 1.2, 3.1 and 4.1, and only the numerator is changing capturing the reduced scope of entities for Indicator 3.1 (only for critical function) and Indicator 4.1 (only for hardly substitutable services). Since the numerator of Indicator 3.1 and 4.1 is a subset of the one of Indicator 1.2 it appears inconsistent to have the same threshold for all three. Indeed, overshooting any of the threshold for Indicator 3.1 and 4.1 will automatically result in the threshold for Indicator 1.2 also being overshoot. It is therefore recommended to calibrate the thresholds differently implying a larger number for Indicator 1.2 to avoid being redundant with Indicator 3.1 and 4.1.\n* A respondent proposed to distinguish between “criticality” and the “number of very critical functions”.\n* A respondent expressed its agreement with indicator 3.1, but highlighted that indicators 3.1 and 1.4 could be combined to include subcontracting and make reference to critical or important functions only. Before subcontracting, it should be assessed to what extend financial entity can and must keep data on subcontracting.\n* A respondent mentioned that qualitative information on how mortar a financial entity is may also be taken into account under criterion 3.\n\n### Indicator 3.2\n\n* Eleven respondents suggested to define the term “taxonomy of ICT services” and the term “level of criticality”. Another two respondents highlighted that a ‘taxonomy of ICT services’ should not be developed at a later stage as it plays an instrumental role. A respondent noted that indicator 3.2 is considered the most important indicator of all that have been listed. Absent a clear definition of Critical or Important function under the step 1 indicator, the proposed step 2 indicator risks becoming the de facto assessment about criticality. General area of ambiguity could be the subjectivity in assessing criticality in step 2 versus the quantitative indicators in step 1. A respondent requested to refrain from further classification schemes and taxonomies as they see the danger that this will lead to considerable efforts at the level of financial entities.\n* Fire respondents agreed that indicator 3.2 would benefit from an indicative ICT services taxonomy.\n* Five participants expressed their agreement with the step 2 indicator proposed.\n* Two respondents objected to the ranking of criticality and the creation of a distinct taxonomy for indicator 3.2. A respondent proposed to leverage the ongoing work of the FSB on third-party risk management, which seeks to introduce greater international harmonisation as to what amounts as critical as well as on work done by the ECB and SRB. The EBA Guidelines on Outsourcing Arrangements already require that financial institutions develop a methodology to identify critical outsourcing contracts. Establishing a new stand-alone taxonomy of criticality for DORA, could result in inconsistencies, and potentially a contract being deemed as critical under the EBA Guidelines but not necessarily under the newly proposed DORA taxonomy. Another participant proposed to build on the risk assessment framework already in place in the non-financial risk management framework of each management company.\n* Two respondents mentioned that the ESAs should be cautious on a future “ICT services taxonomy”. A respondent highlighted that a service may be critical, or a region may be critical for a particular financial entity, depending on how use of that service or region is implemented by a specific financial entity.\n* A respondent recommended to put more emphasis on the (critical) services. A better clarification of what constitutes a “critical or important function” would help narrow the criticality determination. In this context, it would be important to consider existing EU legislation (e.g. MiFID II).\n* A respondent proposed to develop another step 2 indicator that captures the situation where an ICT TPP is active in only one type of service or in a wide range of IT services. Financial entities may rely on the same ICT TPP for more than one service. While the potential impact of disruption to any of the individual services might not necessarily pose systemic risks, a simultaneous failure or disruption of all the services together might threaten the integrity of the financial system.\n* A respondent recommended to add to indicator 3.2 “where these ICT services support critical or important functions”.\n* A respondent suggested for indicator 3.2 to distinguish between different service lines, financial entities, and asset classes, as well as to target more specifically critical dependencies for important business services. It may even be considered to assess market risks differently at different levels of the market (e.g. large vs. medium vs. small financial institutions).\n* A participant proposed to nuance the reference to “total value of assets of financial entities” by referring to total value of assets of financial entities based in the EU.\n* A respondent noted that subcontracting should only be included when it has been evaluated to what extent financial entities can or must keep data on the subcontracting of ICT services.\n\n### Data sources\n\n* A participant recommended to make use of existing outsourcing registers and the DORA-related data collection exercise which have been conducted since October 2022, and subsequently the Register of Information.\n* Two respondents suggested to use for indicator 3.1 “Number of essential and critical business functions of the financial entity”, “Number of service providers and types of ICT services that have an impact on the business functions”, and for indicator 3.2 the ICT service taxonomy, if available.\n* Two respondents proposed to take into account “Industry reports or ad-hoc assessments commissioned to firms or market experts”, “Survey administered to financial entities and ICT TPPs”, “Database of registered ICT TPPs and financial entities”, “Work done by market research firms”, “audit reports”, as well as the “Balance sheets of financial entities and ICT TPPs”.\n* A participant recommended to use the registers that financial entities maintain under the existing ESA outsourcing guidelines to determine which ICT services support critical or important functions.\n* A respondent noted that such information needs to be compiled by the ESAs and should directly come from financial entities and ICT TPPs.\n* A respondent proposed to measure ICT service criticality as a consequence of “operational criticality” and “compliance criticality”.\n* A respondent highlighted that in Italy there is an outsourcing supervisory reporting that could be used.\n\nCriterion 4 (Questions 23-27 in the discussion paper)\n\n### Indicator 4.1\n\n* Four respondents agreed with indicator 4.1 , but highlighted its high level of complexity. Another participant agreed with indicator 4.1 without any additional remark.\n* Six respondents highlighted that indicator 4.1 might be considered subjective.\n* Two respondents proposed to consider alternative providers on the market i.e. monopoly versus oligopoly.\n* Two respondents recommended to focus on ICT services that support critical or important functions.\n* A respondent proposed that the degree of substitutability can be measured by market concentration and data portability. In particular, assessment could be made on the number and concentration of TPPs that provide ICT services within the market. Proposal for concentration to be assessed by taking into account the market share of a TPP in a market, in particular if a TPP has at least 20% market share for a particular critical ICT service, then the market could be considered as highly concentrated. In terms of the number of TPPs, a market with less than 3 TPPs could be considered as concentrated for a particular ICT service. Similary, a market with more than 10 TPPs for a particular ICT service would not be considered as highly concentrated. In terms of portability, if ICT services which present difficulty in porting data may be deemed critical if such migration is either impossible or presents substantial time (e.g. more than 12 months) and significant costs (e.g. 5% or more of the total IT budget of a financial entity) to switch to an alternative TPP.\n* A participant recommended to define what qualifies a provider as an alternative ICT TPP. Furthermore, “ability and capacity” might be subject to interpretation (technical capabilities/ infrastructure/ expertise/ regulatory compliance etc.).\n* A respondent suggested to focus indicators 4.1 and 4.2 on the substitutability of ICT services that support critical or important functions. Furthermore, an assessment should be made on the number and concentration of ICT TPPs that provide services that support critical or important functions within the marketplace. Substitutable services should be applied in a tech-neutral way and focus on the underlying functions of such service/ technology provided. Market concentration by no less than 10 providers for a particular function would suggest the market is not highly concentrated. Market concentration of no more than 3 providers would suggest such market is concentrated for a particular function. If a firm has at least 20% market share for a particular critical or important service, that would favor designation as a CTPP.\n* A respondent proposed to evaluate indicator 4.1 in the broader context of different service offerings and a specific approach may need to be taken based on the specific offering.\n* A respondent expressed its objection on indicator 4.1 invoking that the degree of substitutability is not arising from the DORA level 1 text.\n\n### Indicator 4.2\n\n* Four respondents expressed their agreement with indicator 4.2 , but highlighting its high level of complexity.\n* Six respondents noted that for indicator 4.2 the term “Highly complex/difficult to migrate or reintegrate ICT services” lacks clarity and is subjective. Another respondent proposed to rethink/redraft it and include definitions for “alternative\" and “complex / difficult”. Another two participants suggested to consider a risk-based approach.\n* Six respondents noted that in their view indicator 4.2 is subjective.\n* Two respondents proposed to consider the time required to migrate or reintegrate ICT services in order to allow for a comparison/benchmark of indicator 4.2.\n* A respondent recommended to refer under indicator 4.2 to “highly complex” only and not to “difficult”.\n* A respondent suggested not to consider the value of assets (as it is not necessarily representing risk) and suggestion to either rely on the number of supported firms only or to develop more appropriate metrics for indicator 4.2.\n* A respondent proposed to also consider risk assessment and exit plan analysis.\n* A respondent expressed its objection on indicator 4.2 invoking that the degree of substitutability is not arising from the DORA level 1 text.\n\n### Indicator 4.3\n\n* Six respondents expressed their agreement with indicator 4.3.\n* Eight participants expressed their objection on indicator 4.3 as according to the views of three respondents it is unlikely to gather comparable data, according to the views of two respondents capturing required data is complex and cumbersome, according to the views of four respondents it is not representative as many providers offer a broad range of services and therefore could have a significant market share in one area, while other providers may offer only one specific service and are very dominant in this specific area, and according to the views of two respondents it is sensitive information.\n* Three respondents suggested to consider in the context of indicator 4.3 that it is important to provide clear guidelines on how the total annual expenses or estimated costs and the total number of financial entities are determined to ensure consistency in the calculation process.\n* Two respondents noted that more clarity is needed on the expected origin of data (source) and its actual availability for use. This also should consider practical and legal challenges.\n* Two respondents proposed to use the “taxonomy of ICT services” mentioned in the context of indicator 3.2 as the basis for the calculation under indicator 4.3.\n* Two respondents recommended to consider ‘market density’ i.e. ’how many alternative service providers provide similar products’ (within a list of pre-defined categories) as a an indicator of market concentration risk.\n* A participant suggested to consider the estimated annual turnover with each ICT service provider as an appropriate indicator.\n* A participant proposed not to use the term “market share” which has a specific meaning in competition law and may therefore lead to confusion.\n* A respondent highlighted the relevance of the market share information, but expressed concerns on the lack of complete and reliable data.\n* A respondent expressed some doubts about the relevance of indicator 4.3.\n* A respondent expressed its preference for the publication of a mathematical formula underlying indicator 4.3.\n* A participant noted that a threshold is missing for indicator 4.3.\n\n### Data sources\n\n* Two respondents suggested to use information from the registers of the financial entities. A respondent highlighted that it should be restricted to services supporting critical or important functions.\n* Two respondents proposed to consider also general qualitative analysis on monopoly markets to assess the “level of substitutability”. Important to gather data from multiple sources. For indicator 4.3 cautious on the fact that market shares of ICT TPPs might be inflated.\n* Two participants recommended to take into account “Industry reports or ad-hoc assessments commissioned to firms or market experts”, “Survey administered to financial entities and ICT TPPs”, “Database of registered ICT TPPs and financial entities”, “Work done by market research firms”, “audit reports”, as well as the “Balance sheets of financial entities and ICT TPPs”.\n* A respondent noted that given the fact that substitutability is one of the attributes within the existing Outsourcing Registers, those should be the initial data souce for the ESAs to leverage.\n* A respondent proposed that if needed, data of national competent authorities should be leveraged.\n* A respondent recommended to the ESAs to compile such information leveraging data coming from financial entities as part of their ongoing exercise to identify ICT TPPs.\n* A participant noted that self-reporting is institution-specific and may be biased, inaccurate, based on outdated information, and/ or reflective of budgetary constraints. For this reason, verification by an independent expert is required.\n* A respondent noted that in Italy there is an outsourcing supervisory reporting that could be used.\n\n### Oversight fees\n\n### Scope of oversight expenditure (question 28 of the discussion paper)\n\n* A respondent broadly agreed with the scope of the oversight activities but wanted clarification on how the ESAs would approach third-country CTPPs (within the Union, or at firm’s relevant jurisdictions) and how this would impact the oversight expenditures.\n* Five respondents raised concerns about the way the oversight fees will be reflected in the prices paid by financial entities to their ICT providers designated as CTPPs, and stressed the need for transparency with regard to the oversight expenditure and fees determination. Some of them also suggested to have a staged approach when bringing CTPPs under oversight to limit the incurred expenditures, or to periodically review the impact of such fees on innovation in the European market.\n* A respondent stressed the need for proportionality and the fact fees collected from CTPPs should not fund the oversight of the TPPs who use voluntary opt-in.\n* Two repondents had a different opinion on the scope of the oversight fees and made alternative proposal on specific issues: to clarify that the oversight fees will be limited to tasks mentioned in Article 33 of the DORA or to exclude tasks unrelated to the conduct of oversight itself from the oversight expenditures to be covered by the oversight fees (i.e. the assessment of the CTPPs should not be covered).\n* A respondent confirmed the proposal of the ESAs is comprehensive and covers various aspects of oversight activities.\n\n### Applicable turnover (questions 29-34 of the discussion paper)\n\n### Determination of the applicable turnover of the CTPPs based on their certified audited accounts of the year (n-2)\n\n* Two respondents confirmed the timing is appropriate.\n* A respondent proposed to use N-1 financial statements as the basis of the calculation to ensure CTPPs can implement any required accounting changes before the requirements apply.\n* A respondent raised concerns on the reference to the IFRS to prepare the applicable turnover, for the third-country ICT providers that have to prepare their financial statements in accordance with other GAAP/standards. In addition, it stressed that there might be instances where these accounts may be subject to a statutory duty of confidentiality.\n* A respondent suggested to take the financial statements based on an average of 3 years (n-2 till n-5).\n* A respondent estimated the proposal of the ESAs does not appear to take into account the heterogeneity and specificity of business models and legal structures as the potential CTPPs may also be non-listed companies.\n\nApplicable turnover: revenues generated by all services\n\n* Four respondents proposed to define a list of ICT services (or made reference to the list of ICT services developed by the ESAs), which would exclude B2C services or B2B services that have limited / no application to, or impact on, the financial sector, of which revenues would be used to determine the applicable turnover. One also explained the revenues generated by the provision of such services would be available in the trial balance of the CTPPs which is audited by auditors even though auditors do not provide certification/audit opinion on it.\n* A respondent disagreed with the proposal of the ESAs, as to differentiate services would be easy, while some services only may be subject to DORA and only some of them may be considered as “critical” (without specifying what “critical” means in their answer). According to this participant, the fact providers pay taxes inside the EU would facilitate the determination and certification of their revenues for the services they think are relevant to determine the applicable turnover.\n* A respondent confirmed the proposal of the ESAs is reasonable as it would ensure that the revenues of all relevant services provided by the ESAs would be taken into account.\n\n### Applicable turnover: revenues generated by the provision of services to European clients only\n\n* Two respondents suggested entities could provide figures based on raw data on sales to EU legal entities broken down by the product/services that they reasonably believe would be deemed critical and the ESAs would assume that auditors would have performed the necessary reviews. One of the respondent supporting this alternative confirmed it would not be feasible to show the specific and exact traceability of those indicative numbers to the final audited financials of the legal entity that made those sales.\n* Two respondents highlighted the proposal of the ESAs would be disproportionate, especially if the services provided to the EU financial entities are a relatively small part of the overall revenues of the CTPPs, so it would lead to a higher revenue base than the inccured oversight costs.\n* A respondent suggested to focus on revenues from EU entities (which may not be limited to revenues generated from EU customers, as such entities also provide services to clients in the Middle East and Africa) which would be designated as critical for the provision of services to clients in the EU. By doing so, they estimate it would be disproportionate to require dedicated financial statements and any version of an IFRS audited revenue statement recognized in one of the European Member States would suffice.\n* A respondent suggested there should be a regional scoping, stressing that there are multiple methodologies by which this could be achieved (without further specification).\n* A respondent confimed accounts are allocated by nature of revenue and auditors do not certify them by geographic distribution. But CTPPs already have a note with geographical split contained in consolidated accounts under section “Geographical information” showing revenues from material countries of operations (including relevant EU countries) and region (e.g. rest of Europe) so certified revenues generated from European clients (without detailed split per country or revenue type) in consolidated accounts may be presented.\n* A respondent invited to clarify what does “European clients” mean.\n* A respondent confirmed it is possible for designated CTPPs to provide the ESAs with audited revenues generated by the provision of services to European clients only if CTPPs maintain separate records or accounts for their European clients and have independent auditors who certify the accuracy and origin of these revenues (following established auditing procedures and maintaining proper documentation).\n\n### Applicable turnover: revenues generated by the provision of services to clients subject to the DORA\n\n* Three respondents have confirmed CTPPs do not know if their clients are financial entities subject to the DORA and proposed the financial entities should declare to their ICT providers whether they are subject to the DORA. One of them suggested that if a CTPP can demonstrate it had an on-boarding process for all services covered by DORA that identified the specific customers and revenues and these were collected and taxed inside the EU, the ESAs should consider this.\n* Five respondents have indicated that CTPPs are unlikely to have audited revenues generated by the provision of services specifically to financial entities.\n* A respondent mentioned multiple methodologies exist to isolate revenues from services provided to financial entities, without further specification.\n* A respondent indicated that excluding service revenues that are not used by financial sector entities should not be highly complex, without further specification.\n* A respondent suggested to calculate the fees on the basis of the turnover related to the provision of services to financial entities.\n* A respondent suggested the approach should be flexible allowing CTPPs to do their best efforts to ascertain the relevant revenue, and the results would be presented to auditors for assessment. It also express concerns with regard to the proportionality of the approach, with greater fees allocated to CTPPs with high-revenue/low margin business models and lower fees to CTPPs with low-revenue/high-margin business models.\n* A respondent explained CTPPs can provide audited revenues generated by the provision of services to clients of the financial sector subject to DORA if they isolate such revenues by maintaining separate records or accounts for financial sector clients and have independent auditors to certify the accuracy and origin of these revenues.\n\n### Applicable turnover: criticality of the functions supported by the provided services\n\n* A respondent agreed with the proposal made in the discussion paper and highlighted that it would be challenging to provide audited revenues broken down by the services designated critical, while raising that discarding this dimension may overstate the revenues used in the analysis.\n* A respondent suggested the applicable turnover should be restricted to the critical functions given the scope of services provided by the ICT providers. The example taken to illustrate is the difference between cloud services and gaming devices’ revenues.\n* A respondent explained that the CTPPs can separate revenues for critical services.\n* A respondent proposed to focus on the turnover generated by services that support EU financial entities’ critical or important services.\n* Three respondents confirmed that CTPPs would not be aware of the criticality of functions supported by the provided services to the financial entities, which would in any case be a too subjective dimension in the determination of the applicable turnover.\n\n### Applicable turnover: additional comments\n\n* A respondent invited to work with a standard fee applying to all CTPPs equally, in addition to a flexible fee that depending on the turnover of the relevant CTPPs individually.\n* A respondent suggested to take into account the size of the client base of the CTPPs in the determination of the applicable turnover (without further specification).\n* A respondent highlighted the ESAs should address security concerns around how information related to the determination of the applicable turnover will be protected and provide guarantees about the storage and confidentiality of such information.\n* A respondent suggested the percentage of oversight fees paid by a single CTPP at all times to be limited to a designated percentage (e.g. 20%) of the total costs of the Lead Overseer incurred while executing the oversight function, for proportionality purposes.\n* Two respondents indicated the fees should be assessed on the basis of tasks conducted by the Lead Overseer in oversight of critical ICT functions and in proportion to turnover for services rendered to financial entities operating in the EU, what would mean to include ‘effort’ in the calculation of the fees (to ensure fees would be proportionate to the effort of the Lead Overseer in the execution of its tasks).\n* A respondent suggested the fees charge to the CTPPs should reflect the quality of the risk management governance of the CTPPs.\n\n### Methods of calculation (questions 35-36 of the discussion paper)\n\n### Methods of calculation of the oversight fees\n\n* A respondent suggested to define fees that reflect the actual cost of oversight, not on the basis of estimation. In addition, they suggested the following information to be disclosed: total annual oversight expenditure, annual oversight expenditure attributable to each CTTP, the cost/fee allocation to each CTTP, the methodology for that allocation and the information that methodology was applied to. They also suggested that surpluses should instead be allocated against future fees payable by CTTPs whose fees exceed the actual cost attributable to them and in proportion to their contribution in the year that generated the surplus.\n* A respondent invited the ESAs to publish the calculations (an aggregated budget for the oversight activities).\n* A respondent suggested to specify that CTPPs will pay fees to the Lead Overseer which is in charge of their oversight.\n* A respondent suggested the potential surpluses to be reduced from the oversight fees paid during the subsequent year, despite the principle of universality.\n* A respondent confirmed the methods of calculation proposed by the ESAs is fair and proportionate.\n\n### Level of the minimum annual fees\n\n* Two respondents disagreed the minimum fees should be indexed on inflation, and should rather be indexed on the annual evoluation of the aggregated applicable turnover of all CTPPs.\n* Two respondents wanted to know more about the rational of the EUR 50 000 proposed by the ESAs.\n* Two respondents supported the proposal to have a minimum fee but suggested to align it with the standard costs proposed by the ESAs to calculate the fees paid in case of designation during a given year (i.e. EUR 200 000).\n* A respondent invited to work with actual fees instead of minimum fees.\n* A respondent estimated EUR 50 000 may be underestimated, but did not make an alternative proposal.\n\n### Practical issues related to the payment of the fees (questions 37-40 of the discussion paper)\n\n### One-instalment payment approach\n\n* A respondent raised concerns that, if the CTPPs are designated by December and have to pay their fees by April the following year, they would not have sufficient time to prepare a budget to pay for these expenses. Hence, they proposed to account for a 12-month period to ensure that this would not be a problem for CTPPs.\n* Two respondents confirmed the proposal of the ESAs is clean and manageable.\n* A respondent estimated that a two-instalment payment and a 60-day payment term would be more appropriate and less financially intrusive.\n\n### Method of calculation of the fees that will be paid by CTPPs designated during a given year\n\n* A respondent proposed to extend the payment term from 30 to 60 days to align with established internal practices across CTPPs.\n* A respondent confirmed the proposed approach is fair and transparent aligning the fee with the duration of oversight activities.\n\n### Reimbursement process of the CAs’ oversight expenditures\n\n* A respondent estimated the expenditures of the CAs involved in oversight activities should be seen as part of their public duty.\n* A respondent confirmed the proposal is a sensible approach.\n\n### Funding of the oversight of the first designated group of CTPPs\n\n* A respondent suggested the ESAs should ensure the ICT providers have sufficient predictability about the amount of the oversight fees, in order to allow them to take such fees into account when defining their budget.\n* A respondent suggested to apply the fully proportionate approach for the first year as well, as the applicable turnover is proposed to be based on year (N-2) which sould be already available.\n* A respondent confirmed the proposal of the ESAs is a pragmatic solution.\n\n### Treatment of the opt-in application (question 41 of the discussion paper)\n\n* A respondent suggested to require a scaled fee instead of a fixed fee, that would be determined depending on the scale nd the scope of the applicant ICT providers. They also want to confirm that, if designated as CTPP, an applicant ICT provider would then pay oversight fees like other CTPPs.\n* A respondent supported the proposal of the ESAs but wanted to know more about the way the EUR 50 000 have been determined.\n* A respondent suggested to determine such fixed fee on the basis of the cost per hour of the authority to undertake the assessment of the voluntary requests.\n* A respondent confirmed the proposed fee is appropriate and justified.\n\n## Annex II: EC request to ESAs to provide technical advice on DORA\n\nRequest to the European Supervisory Authorities (ESAs) for technical advice on two delegated acts specifying further criteria for critical ICT third-party service providers (CTPPs) and determining fees levied on such providers\n\nWith this provisional mandate, the Commission seeks ESAs' technical advice on two delegated acts based on empowerments established in the Regulation on Digital Operational Resilience for the Financial Sector (the \"Regulation\"). The delegated acts would be adopted in accordance with Article 290 of the Treaty on the Functioning of the European Union (TFEU).\n\nThe present mandate is provisional as the Regulation has not yet entered into force. The European Parliament and the Council have adopted the Regulation and accompanying Directive on 10 and 28 November 2022, respectively. The acts are expected to be published in December 2022 and enter into force in January 2023.\n\nThe Commission reserves the right to revise and/or supplement this mandate. The technical advice received on the basis of this mandate should not prejudge the Commission's final decision.\n\nThe mandate follows the Regulation - Article 31(6) and Article 43(2) - the Communication from the Commission to the European Parliament and the Council - Implementation of Article 290 of the Treaty on the Functioning of the European Union (the \"290 Communication\"), the Interinstitutional Agreement between the European Parliament, the Council of the European Union and the European Commission on Better Law-Making and the Framework Agreement on Relations between the European Parliament and the European Commission (the \"Framework Agreement\").\n\nAccording to Article 31(6) of the Regulation and with regard to the criteria the ESAs must take into account when determining the critical nature of ICT third-party service providers, the Commission shall adopt a delegated act to further specify these criteria. In addition, according to Article 43(2) of the Regulation and with regard to the fees levied on CTPPs, the Commission shall adopt a delegated act to determine the amount of the fees and the way in which they are to be paid.\n\n\\*\\*\\* The European Parliament and the Council shall be duly informed about this mandate.\n\nIn accordance with the Declaration 39 on Article 290 TFEU, annexed to the Final Act of the Intergovernmental Conference which adopted the Treaty of Lisbon, signed on 13 December 2007, and in accordance with the established practice within the European Securities Committee, the Commission will continue, as appropriate, to consult experts appointed by the Member States in the preparation of possible delegated acts in the financial services area.\n\nIn accordance with point 15 of the Framework Agreement, the Commission will provide full information and documentation on its meetings with experts appointed by the Member States within the framework of its work on the preparation and implementation of Union legislation, including soft law and delegated acts. Upon request by the Parliament, the Commission may also invite Parliament's experts to attend those meetings. The Commission is empowered to adopt delegated acts pursuant to Article 31 and Article 43 of the DORA Regulation. As soon as the Commission adopts a possible delegated act, the Commission will notify it simultaneously to the European Parliament and the Council.\n\n## 1. Context\n\n### 1.1. Scope\n\nAs part of the 2020 Digital Finance package, the Commission put forward a legislative proposal for a Regulation on the Digital Operational resilience of the Financial Sector (DORA) accompanied by a Directive. The Council and the European Parliament reached on 10 May 2022 a political agreement, later formally endorsed by the two co-legislators on 29 June 2022 and 13 July 2022, respectively. The final adoption took place on 10 November 2022 and on 28 November by the European Parliament and the Council, respectively. Publication in the Official Journal of the EU is expected for December 2022. The texts will enter into force on the twentieth day following their publication. The Regulation will create a comprehensive framework addressing various, core components of the digital operational resilience of financial entities. It will enhance the overall conduct of ICT risk management, establish testing rules for ICT systems, increase financial supervisors’ awareness of cyber risks through an EU harmonized incident reporting scheme and introduce Union oversight to oversee financial entities’ dependency on ICT third-party service providers. The overall objective is to strengthen and align the digital operational resilience across the different Union financial areas. To address potential systemic and concentration risks posed by the financial sectors’ reliance on a small number of ICT third-party service providers, the Regulation introduces a Union oversight framework for providers deemed critical. As Lead Overseers, each of the three European Supervisory Authorities (EBA, ESMA and EIOPA) will have the power to monitor on pan-European scale the activity of CTPPs in the context of the ICT services they provide to the financial sector. In accordance with Article 31 of the Regulation, an ICT third-party service provider that is considered critical to the stability and integrity of the Union financial system, will be designated by the ESAs (through the Joint Committee) as a CTPP. In assessing criticality, the ESAs, upon recommendation from the Oversight Forum, will take into account a set of criteria set out in the Regulation. These criteria need to be further specified by a Commission delegated act. In accordance with Article 43 of the Regulation, the Lead Overseers will charge fees to ICT third-party service providers designated as critical, and those fees shall cover all the expenditure incurred by the Lead Overseers in relation to the conduct of oversight tasks. The Lead Overseers will charge fees based on a Regulation on fees to be adopted by the Commission through a delegated act. This provisional mandate addresses certain technical aspects of the upcoming Regulations on fees and the designation criteria. More specifically, in relation to the delegated act on fees, the current mandate addresses some of the elements which are needed in the specification of the amount itself, as well as the way and method(s) in which such fees are to be paid. In providing their advice, the ESAs could draw on relevant experiences from both national supervisors and ESMA (when setting supervisory fees for financial institutions).\n\nIn relation to the delegated act on specifying designation criteria, the current mandate addresses the need for further details aimed at shaping-up the designation criteria. The input sought here refers to several specific sets of indicators of a qualitative and quantitative nature, for each of the criteria, minimum thresholds triggering such indicators (if applicable in the case of qualitative indicators), and, more extensively, background information deemed relevant by the ESAs to help in the build-up of indicators.\n\n### 1.2. Principles that the ESAs should take into account\n\nOn the working approach, the ESAs are invited to take into account the following principles:\n\n* The principle of proportionality; the technical advice should avoid excessive financial, administrative or procedural burdens for CTPPs.\n* The rule-of-law principle, which requires the respect of appropriate rights of defence for entities subject to ESAs’ oversight.\n* In accordance with the ESAs Regulation, the ESAs should not be confined in their reflections to elements that they consider should be addressed by the delegated acts itself but, if appropriate, may also indicate the need for any further guidelines and recommendations that accompany the delegated acts to ensure effectiveness or clarity.\n* The ESAs shall determine their own working methods depending on the content of the provisions being dealt with. Nevertheless, across the board questions should be dealt consistently with standards of work being carried out by expert groups.\n\nThe ESAs should ensure cross-sectoral consistency, and, where relevant, cooperate with the European Systemic Risk Board on issues related to systemic cyber risk.\n\n* In accordance with the ESAs Regulation, the ESAs are invited to widely consult market participants, in an open and transparent manner, and take into account the resulting opinions in their advice. The ESAs should design this open consultation in a manner and approach they consider proportionate, appropriate and effective given the timeline of this advice. The ESAs should provide a detailed feedback statement on the consultation, specifying when consultations took place, as well as the main arguments for and against the issues raised. This feedback statement should be annexed to the technical advice. The technical advice should justify ESAs’ choices vis-à-vis the main arguments raised during the consultation process.\n* The ESAs are invited to justify their advice by providing a quantitative and qualitative cost-benefit analysis of all the options which they have considered and those which they have finally proposed in the advice. The ESAs should provide the Commission with a description of the problem, the objectives of the technical advice, options for consideration and a comparison of the main arguments for and against considered options. The cost-benefit analysis, that should be proportionate to the timeline of this advice, should justify ESAs’ choices vis-à-vis the main considered options.\n* The ESAs’ technical advice should not take the form of a legal text. However, they should provide the Commission with a clear and structured (\"articulated\") text, accompanied by sufficient and detailed explanations. Furthermore, the technical advice should be presented in an easily understandable language respecting current terminology in the Union.\n* The ESAs should provide a comprehensive technical analysis on the subject matters described in section 3 below, where these are covered by the delegated powers included in:\n* the relevant provisions of the Regulation;\n* the corresponding recitals, or;\n* the relevant Commission's request included in this mandate.\n* The ESAs should address to the Commission any question to clarify the text of the Regulation that the ESAs consider of relevance to the preparation of its technical advice.\n\n## 2. Procedure\n\nThe Commission is requesting ESAs’ technical advice in view of the preparation of two delegated acts to be adopted pursuant to the Regulation and in particular regarding the questions referred to in section 3 of this mandate. The mandate considers the Regulation (Article 31 and Article 43), the ESAs Regulation, the 290 Communication, the Framework Agreement and the ESAs’ Financial Regulation.\n\nThe Commission reserves the right to revise and/or supplement this mandate. The technical advice received based on this mandate will not prejudge the Commission's final decision.\n\nIn accordance with established practice, the Commission may continue to consult experts appointed by the Member States in the preparation of delegated acts relating to the Regulation. The Commission shall duly inform the European Parliament and the Council about this mandate. As soon as the Commission adopts the delegated acts, it will notify it simultaneously to the European Parliament and the Council.\n\n## 3. The ESAs are invited to provide technical advice on the following issues\n\nArticle 43(2) of the Regulation requires the Commission to adopt one delegated act to further specify the amount of the fees levied on CTPPs and the way in which they are to be paid by the latter, and a delegated act to further specify the criteria to be considered by the ESAs when assessing the critical nature of ICT third-party service providers.\n\n### 3.1. Specifying the amount of fees\n\nArticle 43(1) of the Regulation specifies that the fees collected from CTPPs shall cover the necessary expenditure in relation to the conduct of oversight tasks, including the costs which may be incurred because of the work carried out by the joint examination teams, and the cost of advice provided by independent experts in relation to matters falling under the remit of direct oversight activities. The fees charged to CTPPs shall be proportionate to the turnover of the CTPPs concerned.\n\nThe ESAs are invited to provide technical advice to assist the Commission in formulating elements needed for the Commission to enact a delegated act on fees for CTPPs, and more specifically on the following aspects:\n\n* The ESAs are invited to detail their assessment of the estimated costs they will incur as Lead Overseers for the oversight tasks and the work of the joint examination teams, as well as the estimated cost of advice provided by the independent experts in relation to matters falling under the remit of direct oversight activities. The ESAs should provide information on their estimates and on methods of calculation, including how the expenditure necessary for the performance of their tasks in relation to CTPPs should be distributed to the individual overseen CTPP. The ESAs should advise on how the surpluses/deficits in the overall oversight budget should be managed, and whether fees should be yearly adjustable or fixed.\n* The ESAs are invited to detail their assessment of the estimated costs they will incur for the assessment of the opt-in requests sent by ICT third party service providers to be designated as CTPPs based on article 31(11). The ESAs should provide information on their estimates and on methods of calculation, and if such fees should be yearly updated or fixed.\n* The ESAs should suggest the timing and appropriate modalities of the payment of the fees by the CTPPs or opt-in applicants. The ESAs are invited to advise on appropriate schedules for collection of fees.\n* According to Article 43(1) of the Regulation, the amount of a fee charged to a CTPP shall be proportionate to the turnover of the CTPP concerned. The ESAs are invited to provide technical advice on the appropriate method, basis and available information for considering the turnover of the CTPP in fee calculation.\n\n### 3.2. Specifying the criteria for assessing criticality\n\nThe ESAs are also invited to provide technical advice to assist the Commission in formulating elements needed for the Commission to enact a delegated act specifying further the criteria to be considered by the ESAs, upon recommendation of the Oversight Forum, when assessing the critical nature of ICT third-party service providers, including in case of voluntary opt-in request from an ICT third-party service provider based on Article 31 (11). These criteria set out in Article 31(2) of the Regulation are the following:\n\n* The systemic impact on the stability, continuity or quality of the provision of financial services in the event that a CTPP would face a large-scale operational failure to provide its services, taking into account the number of financial entities and the total value of assets of financial entities to which the CTPP provides services.\n* The systemic character or importance of the financial entities that rely on a CTPP, by taking into account (i) the number of global systemically important institutions (G–SIIs) or other systemically important institutions (O–SIIs) that rely on the CTPP, and (ii) the interdependence between the G–SIIs or O–SIIs and other financial entities, including situations where the G–SIIs or O–SIIs provide financial infrastructure services to other financial entities.\n* The reliance of financial entities on the services provided by a CTPP, in relation to critical or important functions of financial entities that ultimately involve the same ICT third–party service provider, irrespective of whether financial entities rely on those services directly or indirectly, through subcontracting arrangements.\n* The degree of substitutability of a CTPP, by taking into account (i) the lack of real alternatives, even partial, and (ii) difficulties in relation to partially or fully migrating the relevant data and workloads from the CTPP to another ICT third–party service provider.\n\nThe ESAs are invited to specify the relevant indicators of a qualitative and quantitative nature for each of the criteria of the Regulation mentioned above. This exercise would allow the criteria themselves to be applied, in concrete, to facilitate the designation. The ESAs are also invited to convey to the Commission any information necessary to build up and (if needed) to correctly read / interpret such indicators.\n\nThe Commission services thus seek technical input on precise, detailed and complete sets of indicators of a qualitative and quantitative nature, for each of the relevant DORA criteria. The advice should also consider minimum threshold(s) (if applicable in the case of qualitative indicators) which would need to be considered for designation subject to a further qualitative assessment and, more extensively, background information deemed relevant by the ESAs to help in the actual build-up and interpretation of such indicators.\n\nThe Commission services recall the importance of both the accuracy and completeness of these elements. To be able to carry out the assessment leading to the concrete designation process, the ESAs need to have at their disposal all relevant information and clarity of the parameters themselves.\n\nThe ESAs are invited to reflect on the frequency of reviewing the respective delegated acts to reflect related developments.\n\n## 4. Indicative timeline\n\nThis mandate takes into consideration the time that the ESAs need in preparing their technical advice and the timeline for the Commission to adopt delegated acts according to Article 290 of the TFEU.\n\nThe power of the Commission to adopt these two delegated acts is granted by Articles 31 and Article 43 of the Regulation. The European Parliament and the Council may object to a delegated act within a period of three months, extendible by three further months. The delegated act will only enter into force if neither the European Parliament nor the Council has objected (on expiry of that period) or if both institutions have informed the Commission of their intention not to raise objections.\n\nThe Regulation requires the Commission to adopt these two delegated acts within twelve months from its entry into force.\n\nFor the Regulation to be fully operational and the ESAs to initiate their oversight activities, it is of the outmost importance to start working on the matter as soon as possible. The deadline set to the ESAs to deliver the technical advice is 30 September 2023.\n\nThe request is also available online: Draft ESAs technical advice\\_commented by ESAs (europa.eu)\n\n[^1]: See Annex II.\n[^2]: See also Articles 31(6) and 57 of the DORA.\n[^3]: Article 31(8) of the DORA reads: “The designation \\[...\\] shall not apply to the following: (i) financial entities providing ICT services to other financial entities; (ii) ICT third-party service providers that are subject to oversight frameworks established for the purposes of supporting the tasks referred to in Article 127(2) of the Treaty on the Functioning of the European Union; ICT intra-group service providers; (iv) ICT third-party service providers providing ICT services solely in one Member State to financial entities that are only active in that Member State.”\n[^4]: Article 33(1) states that the Lead Overseer shall conduct the oversight of the assigned critical ICT third-party service providers and shall be, for the purposes of all matters related to the oversight, the primary point of contact for those critical ICT third-party service providers.\n[^5]: E.g. insurance undertakings with reinsurance undertakings, investment firms with clearing and settlement services providers, banks with payment service providers and payment card schemes.\n[^6]: FSB (2020a), Regulatory and Supervisory Issues Relating to Outsourcing and Third-Party Relationships: Discussion paper.\n[^7]: BCBS Principles of Operational Resilience (2021), https://www.bis.org/bcbs/publ/d516.pdf.\n[^8]: Such a methodology has to be developed by the ESAs before the completion of the first CTPP designation exercise, i.e., before the ESAs, through the Joint Committee and upon recommendation from the Oversight Forum established pursuant to Article 32(1) of the DORA, designate ICT TPPs that are critical for financial entities for the first time. It should be noted that this depends also on the date of adoption of the Delegated Act, which the Commission is empowered to draft in accordance with Article 31(6) of the DORA.\n[^9]: As also proposed by stakeholders during the public consultation, the minimum relevance thresholds proposed in this report have been simulated, to the extent possible, leveraging data stemming from the joint-ESAs high-level exercise in 2022 that involved asking a sample of financial entities across the EU financial sector to provide information on their use of ICT services (and, where relevant, the use of services by other entities in their corporate group) from ICT TPPs. The exercise identified around 15,000 ICT TPPs directly providing ICT services to financial entities.\n[^10]: The proposed holistic criticality assessment refers to an approach to evaluating the criticality of ICT TPPs in a comprehensive and interconnected manner, taking into account multiple factors or dimensions rather than focusing on individual criticality components in isolation. To the extent possible, the holistic approach involves considering the entirety of criticality dimensons in order to form a complete and balanced assessment. Choosing a holistic approach for the criticality assessment of ICT TPPs emphasizes the interconnectedness and complexity of the subject matter and aims to capture a more complete and integrated picture, enabling a more informed understanding of the ICT TPP landscape at EU level.\n[^11]: As per Article 4(1)(b) of the consultation paper on the ITS on the register of information, the register of information includes information on all the material subcontractors when an ICT service provided by a direct ICT TPP is supporting a critical or important function of the financial entities.\n[^12]: See also Articles 31(6) and 57 of the DORA.\n[^13]: As per Article 4(1)(b) of the consultation paper on the ITS on the register of information, the register of information includes information on all the material subcontractors when an ICT service provided by a direct ICT TPP is supporting a critical or important function of the financial entities.\n[^14]: See the footnote in the section “Background and rationale”.\n[^15]: Threshold effects in this context are understood as cases in which an ICT TPP is at the border of being considered as critical. For example, it should be avoided that an ICT TPP is considered as critical in year n, as non-critical in year n+1, but then again critical in year n+2. It is considered important for both the ICT TPP as well as the supervisory authorities to have some continuity in the list of CTPPs over time.\n[^16]: Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (Text with EEA relevance): EUR-Lex - 32022L2555 - EN - EUR-Lex (europa.eu).\n[^17]: Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC (Text with EEA relevance): EUR-Lex - 32022L2557 - EN - EUR-Lex (europa.eu).\n[^18]: Subject to the final ITS on the register of information under Article 28(9) of the DORA and the availability of relevant data.\n[^19]: Subject to the final ITS on the register of information under Article 28(9) of the DORA and the availability of relevant data.\n[^20]: The minimum relevance threshold for this indicator is met if for at least one type of financial entity 10% or more of the total number of financial entities of the same type use ICT services of the same ICT TPP or if 10% or more of the total number of financial entities use ICT services of the same ICT TPP.\n[^21]: The key data sources make reference to the Consultation Paper on Draft Implementing Technical Standards to establish the templates composing the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT TPPs as mandated by the DORA: https://www.eiopa.europa.eu/system/files/2023-06/4.%20CP%20- %20Draft%20ITS%20on%20register%20of%20information.pdf. Please note that the final list of key data sources will depend on the final version of the ITS, as adopted by the Commission.\n[^22]: Consultation Paper on Draft Implementing Technical Standards to establish the templates composing the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT TPPs: https://www.eiopa.europa.eu/system/files/2023-06/4.%20CP%20- %20Draft%20ITS%20on%20register%20of%20information.pdf. Please note that this list is subject to the final version of the ITS, as adopted by the Commission.\n[^23]: Subject to the final ITS on the register of information under Article 28(9) of the DORA and the availability of relevant data.\n[^24]: The minimum relevance threshold for this indicator is met if for at least one type of financial entity 10% or more of the total value of assets / total assets-equivalent of financial entities of the same type use ICT services of the same ICT TPP or if 10% or more of the total value of assets / total assets-equivalent of financial entities use ICT services of the same ICT TPP.\n[^25]: Subject to the final ITS on the register of information under Article 28(9) of the DORA and the availability of relevant data.\n[^26]: In line with the purpose of the ITS on the register of information as set out in the respective Consultation Paper, the templates included in the draft ITS aim to capture the ICT service supply chain with a focus on subcontractors of ICT services supporting critical or important functions or material parts thereof (‘material subcontractors’): https://www.eiopa.europa.eu/system/files/2023-06/4.%20CP%20- %20Draft%20ITS%20on%20register%20of%20information.pdf. Please note that this wording is subject to the final version of the ITS, as adopted by the Commission.\n[^27]: Global Systemically Important Institutions: https://www.eba.europa.eu/risk-analysis-and-data/global-systemically-important-institutions.\n[^28]: Other Systemically Important Institutions: https://www.eba.europa.eu/risk-analysis-and-data/other-systemically-important-institutions-o-siis-.\n[^29]: Subject to the final ITS on the register of information under Article 28(9) of the DORA and the availability of relevant data.\n[^30]: Institutions are given a score from 0 to 10,000 bps representing their systemic riskiness.\n[^31]: Subject to the final ITS on the register of information under Article 28(9) of the DORA and the availability of relevant data.\n[^32]: Such other information could be the list of financial entities required to perform TLPT (Article 26(8) of the DORA) taking into account the criteria set out in Article 4(2) of the DORA.\n[^33]: Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council Text with EEA relevance: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32014L0059.\n[^34]: The Consultation Paper on Draft Implementing Technical Standards to establish the templates composing the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT TPPs as mandated by the DORA (https://www.eiopa.europa.eu/system/files/2023-06/4.%20CP%20- %20Draft%20ITS%20on%20register%20of%20information.pdf) includes a list of ICT services (see Annex IV). Please note that this list may be subject to change and will depend on the final version of the ITS, as adopted by the Commission.\n[^35]: Subject to the final ITS on the register of information under Article 28(9) of the DORA and the availability of relevant data.\n[^36]: The reference to the ‘total value of assets’ is referred to in DORA Article 31(2)(a). However, this metric might not be representative for all types of financial entities subject to DORA to measure their systemic impact on the stability, continuity, or quality of the provision of the financial services they provide. Hence, from that point of view, it is proposed to take into account an equivalent metric to represent all the financial entities e.g. ‘assets under management’ or ‘premiums collected’. For this reason, it is considered important to define for each type of financial entity covered by DORA the most useful underlying basis.\n[^37]: Subject to the final ITS on the register of information under Article 28(9) of the DORA and the availability of relevant data.\n[^38]: The reference to the ‘total value of assets’ is referred to in DORA Article 31(2)(a). However, this metric might not be representative for all types of financial entities subject to DORA to measure their systemic impact on the stability, continuity, or quality of the provision of the financial services they provide. Hence, from that point of view, it is proposed to take into account an equivalent metric to represent all the financial entities e.g. ‘assets under management’ or ‘premiums collected’. For this reason, it is considered important to define for each type of financial entity covered by DORA the most useful underlying basis.\n[^39]: Subject to the final ITS on the register of information under Article 28(9) of the DORA and the availability of relevant data.\n[^40]: Subject to the final ITS on the register of information under Article 28(9) of the DORA and the availability of relevant data.\n[^41]: The Consultation Paper on Draft Implementing Technical Standards to establish the templates composing the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT TPPs as mandated by the DORA (https://www.eiopa.europa.eu/system/files/2023-06/4.%20CP%20- %20Draft%20ITS%20on%20register%20of%20information.pdf) includes a list of ICT services (see Annex IV). Please note that this list may be subject to change and will depend on the final version of the ITS, as adopted by the Commission.\n[^42]: Subject to the final ITS on the register of information under Article 28(9) of the DORA and the availability of relevant data.\n[^43]: Delegated Regulation (EU) 2022/805 specifying fees applicable to the supervision by ESMA of certain benchmark administrators (OJ L 145, 24.5.2O22, p. 14) ; Delegated regulation (EU) 2020/1302 with regard to fees charged by ESMA to central counterparties established in third countries (OJ L 305, 32.9.2020, p.1) ; Delegated regulation (EU) 272/2012 with regard to fees charged by ESMA to credit rating agencies (OJ L 90, 28.3.2012, p. 6) ; Delegated regulation (EU) 2022/930 specifying fees relating to the supervision by ESMA of data reporting service providers (OJ L 162, 17.6.2022, p. 1) ; Delegated regulation (EU) 2019/360 with regard to fees charged by ESMA to trade repositories (OJ L 81, 22.3.2019, p. 58) ; Delegated regulation (EU) 1003/2013 supplementing Regulation (EU) No 648/2012 with regard to fees charged by the ESMA to trade repositories (OJ L 279, 19.10.2013, p. 4) ; Delegated regulation (EU) 2020/1732 with regard to fees charged by ESMA to securitisation repositories (OJ L 390, 20.11.2020, p. 1).\n[^44]: The Oversight Forum will be in charge of promoting a consistent approach for the monitoring of ICT third party risk and assessing the results of oversight activities. It will be composed by the ESAs, NCAs, relevant additional authorities, NIS authorities, ECB, ESRB, ENISA and COM.\n[^45]: The list of CTPPs shall be yearly updated by the ESAs through the Joint Committee\n[^46]: Please see previous footnote with the list of applicable Delegated Acts\n[^47]: Article 3(21) reads “‘ICT services’ means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services”\n[^48]: See CP\\_-\\_Draft\\_ITS\\_on\\_register\\_of\\_information.pdf (europa.eu), Annex IV.\n[^49]: Pursuant to Article 31(12) of the DORA, TPPs established in a third country can be designated as critical and financial entities shall only make use of the services of such CTPP if the latter has established a subsidiary in the Union within the 12 months following the designation.\n[^50]: See eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52008XC0416(08)\n[^51]: Recital (31) of the DORA reads “\\[...\\] it is necessary to establish an appropriate Oversight Framework allowing for a continuous monitoring of the activities of ICT third-party service providers that are critical ICT third-party service providers to financial entities, while ensuring that the confidentiality and security of customers other than financial entities is preserved.”\n[^52]: As there are some financial entities not subject to the DORA, such as the ones mentioned in article 2(3) of the DORA or the ones mentioned in article 58(2) of the DORA.\n[^53]: The assessment relies on the estimation of the expenditure calculated by ESAs’ Activity Based Budgeting model and is part of the overall planning and budgeting process of all activities of the authorities (i.e., not only the one related to oversight or supervisory tasks).\n[^54]: Such minimum fees to be indexed each year\n[^55]: And with the involved competent authorities to reimburse their expenditures, see below.\n[^56]: At the end of each year, the Commission recovers the total surplus generated by all sources of income (including fee revenues). See ESAs financial regulation article 17(1).\n[^57]: Framework Financial Regulation for TFEU bodies, i.e. Commission Delegated Regulation (EU) 2019/715 on the framework financial regulation for the bodies set up under the TFEU and Euratom Treaty and referred to in Article 70 of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council (OJ L 122, 10.5.2019, p. 1).\n[^58]: Given that Article 31(5) second subparagraph of the DORA reads the “starting date \\[of the oversight\\] shall be no later than one month after the notification \\[of the designation as CTPP\\]”.\n[^59]: Article 31(11) third subparagraph of the DORA reads that “the decision referred \\[...\\] shall be adopted and notified to the ICT third-party service provider within 6 months of receipt of the application”, so it will depend when it is received by the ESAs during the year.\n[^60]: Such fees to be indexed each year\n[^61]: See for instance article 9(2) of Regulation (EU) No 272/2012 of 7 February 2012 or article 12(2) of Delegated Regulation (EU) 2019/360 of 13 December 2018.\n[^62]: CDR (EU) No 272/2012 of 7 February 2012, CDR (EU) No 1003/2013 of 12 July 2013, CDR (EU) No 2020/1732 of 18 September 2020, CDR (EU) No 2022/805 of 16 February 2022 and CDR (EU) No 2019/360 of 13 December 2018.\n[^63]: CDR (EU) No 2022/930 of 10 March 2022 and CDR (EU) No 2020/1302 of 14 July 2020.\n[^64]: Article 99 of the “Financial Regulation” relates to the rate applied by the European Central Bank to its principal refinancing operations, Regulation (EU, Euratom) 2018/ of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (europa.eu)\n[^65]: For instance the technical Advice on Fees Charged to CRAs by ESMA dated 21 June 2021 (ESMA80-196-5170) and Technical advice to EC on simplification and harmonisation of fees to TRs under EMIR and SFTR dated 8 July 2021 (ESMA74-362-1978).\n[^66]: Such fees to be indexed each year\n\n## Related Level 1 articles\n\n- [Article 31 — Designation of critical ICT third-party service providers](../../articles/31.md)\n- [Article 43 — Oversight fees](../../articles/43.md)\n"}