DORA – European Commission rejects draft RTS on subcontracting ICT services

In a letter to the chair of the joint committee of the European Supervisory Authorities (ESAs), the European Commission notified the ESAs that it is rejecting the draft regulatory technical standards (RTS) on subcontracting ICT services supporting critical or important functions under the Digital Operational Resilience Act (DORA). The ESAs submitted the draft RTS to the European Commission on 26 July 2024 for adoption.

The European Commission is rejecting the draft RTS on the basis that it considers the provisions in Article 5 of the draft RTS relating to the monitoring of the subcontracting chain to be outside the scope of the ESAs’ mandate under Article 30(5) of DORA. The Commission is not rejecting the draft RTS in their entirety but has requested the removal of Article 5 and the related recital 5 and will adopt the RTS provided that the ESAs re-submit a revised version that incorporates these changes.  It is therefore likely that the other elements of the RTS will be accepted and financial entities may wish to consider whether they are comfortable proceeding on that basis.

Background

In relation to the subcontracting of ICT services supporting critical or important functions, the draft RTS supplement Article 30(2)(a) of DORA by specifying:

• the due diligence and risk assessment obligations of financial entities during the pre-contractual phase and during the course of the contract where material changes are planned
• the elements that must be incorporated into the written agreement between the financial entity and the ICT service provider

The requirements in Article 5 of the draft RTS fall within the second limb above and relate to the chain of ICT subcontractors providing services supporting critical or important functions. It appears that the European Commission has taken issue with the provisions in Article 5 that deal with the monitoring of the subcontracting chain.

For example, Article 5 requires financial entities to ensure that the written agreements entered into with their ICT service provider enable them to:

• effectively monitor the sub-contracted ICT services and the ICT risk that may arise in relation to the use of ICT services provided by subcontractors (Article 5(2))
• assess how the risks associated with a long or complex chain of subcontractors may impact their ability to fully monitor the contracted ICT services and the ability of the competent authorities to effectively supervise (Article 5(3))
• have access to contractual documentation between the ICT service provider and its subcontractors (Article 5(4))

Commentary

When initially published, the detailed requirements in the draft RTS posed practical difficulties for financial entities as to how to adapt their existing contracts to ensure that they maintain oversight of the ICT service provider’s obligations which flow down through the subcontracting chain, particularly for multi-layered chains. The Commission’s request for the deletion of the onerous obligations under Article 5 relating to the monitoring of subcontractors will therefore likely be welcomed by many industry stakeholders. However, it is worth noting that financial entities will nonetheless be required to ensure that their written agreements contractually oblige the ICT service provider to monitor all subcontracted ICT services supporting a critical or important function, as required under Article 4 of the draft RTS. As a result, for financial entities currently in the process of negotiating or updating their contractual arrangements, the overlap between the monitoring principles in Article 4 and Article 5 of the RTS mean that changes to contractual arrangements made to date to address Article 5 may still be helpful and relevant to ensuring compliance with the requirements of Article 4.

The further delay in finalising the RTS does however increase the uncertainty for financial entities that have been waiting for the final set of RTS to be published before they conclude their DORA-specific amendments to contractual agreements. These financial entities risk supervisors calling them out as being non-compliant as the DORA implementation date has passed. Irish financial entities will hope that the Central Bank of Ireland applies the ‘Day 1/Day 2’ approach to DORA implementation and affords them some flexibility during supervisory engagements relating to subcontracting arrangements. Read about the ‘Day 1/Day 2’ approach in our previous client insight.  

Comments by Mr Gerry Cross in June last year on the subcontracting chain appear to be particularly pertinent in terms of the approach that financial entities may consider taking in the absence of the finalised RTS. Mr Cross noted that financial entities “need to have ongoing knowledge about the overall functioning of the chain or “tree” of subcontracting arrangements and this means that there should be appropriate monitoring of the overall functioning of that “tree”. It does not mean that each link in the chain needs to be monitored. And for example one way of fulfilling the responsibility may be to make sure that primary or material subcontractors themselves have in place an approach to subcontracting and due diligence that is robust and appropriate. Where more detailed monitoring should be required is in respect of those subcontractors that are material to the critical or important functions of the firm”.

The above points will form part of the discussion at our upcoming Regulatory Series webinar on Thursday 13 February 2025 ‘DORA day one – Where are we and what next?’ which you can register for here.

Next steps

The ESAs have six weeks to amend the draft RTS in line with the European Commission’s proposed amendments and resubmit them to the Commission. If the ESAs fail to resubmit the amended RTS within the six-week period or if they submit revised draft RTS that are not amended in line with the Commission’s proposed amendments, the Commission may adopt the RTS with amendments it considers appropriate or reject the revised draft.

For further information on DORA and its impact on your firm, please contact Patrick Brandt, Partner, Aideen Burke, Partner, Ciara Brady, Senior Associate, Tayla Price, Lawyer, Louise Hogan, Senior Associate, Sarah Lee, Senior Knowledge Lawyer or any member of ALG's Financial Regulation Advisory team. Alternatively, visit ALG’s DORA Hub.

Date published: 7 February 2025