ALFI responds to the ESA consultation on the proposed RTS on subcontracting ICT services supporting critical and important functions, under DORA

On 1 March 2024, ALFI responded to the ESA consultation on the draft regulatory technical standards to further specify the elements which a financial entity needs to determine and assess when subcontracting ICT services supporting critical or important functions.

The proposed RTS sets out requirements when the use of subcontracted ICT services supporting critical or important functions by ICT third-party service providers is permitted by financial entities, the conditions applying to such subcontracting and the requirements regarding the implementation, monitoring and management of contractual arrangement.

In its response to this consultation, ALFI highlighted the following points:

1. Criticality: only the subcontractors that are deemed critical for the ICT TPP to deliver its critical service to the FE, should enter the scope of the requirement;
2. Bargaining power: the proportionality principle should apply and flexibility should be granted to FE in the direction to compliance, when addressing situations of unlevelled bargaining power between the FE and the ICT TPP;
3. ICT TPP enhanced liability: the ICT TPP should keep bearing responsibility in the form of supervisor’s oversights. The Regulation should foster, in terms of due diligence material, a “push” rather than a “pull” approach;
4. FE need-to-know right: leeway should be given to the ICT TPP to implement the most efficient set up, in terms of subcontracting, and bear the respective responsibility.

View ALFI response.