Final Report on Draft Regulatory Technical Standards on Harmonisation of Conditions for Oversight Activities

Final Report
Draft Regulatory Technical Standards on harmonisation of conditions enabling the conduct of the oversight activities JC 2024 35 17 July 2024

Contents

1. Executive Summary 3

2. Background and rationale 5

3. Draft Regulatory Technical Standards 7

4. Impact assessment 22

5. Feedback from the Public Consultation 32

6. Executive Summary

7. One of the objectives of Regulation (EU) 2022/2554 on digital operational resilience for the
   financial sector (DORA) is to harmonise the conditions enabling the oversight activities and create a new oversight framework for the oversight of critical third party service providers in Europe.

8. Article 41(1) of the DORA mandates the European Supervisory Authorities (ESAs) to develop
   through the Joint Committee common draft Regulatory Technical Standards further specifying:

• the information to be provided by an ICT third-party service provider in the application
  for a voluntary request to be designated as critical under Article 31(11);
• the content, structure and format of the information to be submitted, disclosed or
  reported by the ICT third-party service providers pursuant to Article 35(1), including the template for providing information on subcontracting arrangements;
• the details of the competent authorities’ assessment of the measures taken by critical
  ICT third-party service providers based on the recommendations of the Lead Overseer pursuant to Article 42(3)

3. This report follows a consultation paper (CP) which presented a first draft of the RTS and 8
   questions and was open to comments from the public from 8 December 2023 to 4 March 2024.
4. A total of 44 responses were received to the public consultation, covering all sectors. The
   feedback received is presented in detail in Sections 5 and 6.
5. The ESAs assessed the concerns raised to decide which changes, if any, should be made to the
   draft RTS. In the light of the comments received, the ESAs agreed with some of the proposals and their underlying arguments and have introduced changes to the draft RTS.
6. The main changes are related to the scope of the information to be provided by an ICT third
   party service provider in the application to be designated as critical , the relevant identification code , the scope and content of the information to be provided by the critical third-party service providers to the Lead Overseer including information about their subcontracting arrangements and the competent authorities’ assessment of the risks addressed in the recommendations of the Lead Overseer.
7. More information on the feedback received and how this was taken on board by the ESAs is
   provided in the “Feedback Statement”.
   Next steps
8. The ESAs will submit the final draft RTS to the European Commission for adoption. Following
   its adoption in the form of a Commission Delegated Regulation, it will then be subject to scrutiny of the European Parliament and the Council before publication in the Official Journal of the European Union.