European Commission clarifies that financial services are not ICT services

Are financial entities providing ICT services? 

The third-party risk management provisions of the DORA-Regulation apply to financial entities receiving ICT services from ICT third-party service providers. ICT services are defined as “digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services”. This is a very broad definition with a large potential scope of application. After all, a great many services these days concern data and are provided online – meaning through ICT systems. 

This also applies to financial services. Financial entities often work together with other financial entities, receiving services from each other. If those services concern data and are provided electronically – which is usually the case – then those services could possibly be considered as ICT services. As a result, the financial entity receiving the services should consider this under their ICT third-party risk framework. The provision of these services should then comply with the requirements of DORA. 

This has caused quite a bit of confusion amongst financial entities. First of all, they are – as financial entities – already subject to DORA themselves. Second, the services they provide to each other are generally regulated financial services. Additional compliance with the DORA ICT third-party service provider provisions would therefore only result in unnecessary duplication of compliance requirements, and potentially conflict with other financial regulations. For instance, clearing services could be severally impacted through the far-reaching audit and access rights imposed by DORA. 

Industry pushback 

A number of industry federations already pushed back on this in a 2024 joint statement. The industry hoped to receive clarification from the European Supervisory Authorities (ESAs). Initially, those had endorsed the view that regulated financial services should not be considered as ICT services in the sense of DORA. A financial entity would then only be providing ICT services to another financial entity of the services would be “primarily ICT-focused in their nature and purpose, such as cloud computing services, software, and data service centres”. 

The initial endorsement from the ESAs was issued during the early 2024 dry run exercise, but was later retracted in July 2024, thus leaving the sector again in uncertainty. 

Official guidance 

Only early 2025 did the European Commission provide guidance on this matter, largely confirming the earlier point of view of the ESAs. In its guidance, the Commission points to DORA Recital 63, specifying that DORA should cover a wide range of ICT third-party service providers, including financial entities providing ICT services to other financial entities, and without prejudice to sectoral regulations applicable on regulated financial services. As a result, if a financial service provided by a financial entity to another financial entity includes an ICT component, two questions must be answered: 

1. Does the service constitute an ICT service under DORA? 

2. Does the service constitute a regulated financial service? 

Only if the answer to both questions is positive can the service be considered as constituting predominantly a financial service and not an ICT service. DORA’s ICT third-party service provider requirements will then not apply. 

Services provided by financial entities that include ICT components, but that are unrelated to or independent from regulated financial services, however, should continue to be considered as ICT services. They remain subject to DORA‘s ICT third-party service provider requirements. 

Similar conclusions apply to same ancillary services provided by a financial entity. Here, the assessment depends on whether the ancillary services are regulated financial services or whether they are services inseparable from, indivisible from, preparatory or necessary for the provision of regulated financial services, and are not provided in a standalone manner. 

Moving forward 

While the European Commission’s guidance is principally not legally binding, it does provide some much-needed official clarification on this matter. Financial entities receiving services from other financial entities should re-assess those services. Some services can now be considered as financial services – and thus not subject to DORA. However, some services will still remain ICT services under DORA – and thus subject to the ICT third-party service provider requirements. A careful assessment therefore still remains key. 

Do you have further questions on ICT third-party service provider compliance under DORA? Feel free to contact niels.vandezande@timelex.eu for an introductory call.