Executive Summary

The European Supervisory Authorities (European Banking Authority, European Securities and Markets Authority, European Insurance and Occupational Pensions Authority, together ESAs), together with the competent authorities (CAs), in 2022 carried out a joint high-level analysis with the objective of getting a preliminary overview of the provision of information and communication technology (ICT) services to the EU financial entities by ICT third-party service providers (TPPs). The analysis was performed to inform preparations for the application of the Digital Operational Resilience Act (DORA).

The analysis was carried out on the basis of voluntary information provided on a best-effort basis by a sample of financial entities across the EU representing different parts of the financial sector and providing information on their use of services (and, where relevant, the use of services by other entities in their corporate group) from ICT TPPs. The sample was selected to ensure broad coverage, but its degree of statistical representativeness is unknown.

The high-level results of this analysis provide a first overview of ICT TPPs across the financial sector, including the services they provide to financial entities in the sample. The ESAs identified around 15,000 ICT TPPs directly serving financial sector entities across the EU.

According to the results, the frequently used ICT TPPs directly support many critical or important functions and provide a large range of services. Moreover, where financial entities use services to support critical or important functions, or where service continuity would have a high impact, most of such services are non-substitutable.

In addition to the first mapping of the ICT TPP landscape in the EU, the analysis also offered valuable input to the ESAs policy making process. In particular, the experience of the data collection, its analysis and the actual data analysed have already been taken into account when drafting the discussion paper on the joint ESAs advice to the European Commission on two delegated acts specifying further criteria for critical ICT TPPs and determining oversight fees levied on such providers and the first batch of DORA consultation papers, in particular the ITS to establish the templates for the register of information.