Article 40: Joint examination teams
Article 40 requires a Joint Examination Team to be set up for each critical ICT third-party provider to assist the Lead Overseer in oversight activities, in particular general investigations and inspections. The team draws on staff from the European Supervisory Authorities and the competent authorities supervising the financial entities that rely on the provider, with the provider's home-Member-State authority able to join on a voluntary basis, all working under a designated Lead Overseer coordinator.
Chapter V, Managing of ICT third-party risk · Pillar: ICT Third-Party Risk
Key points
- One Joint Examination Team is established per critical ICT third-party provider
- Pools ESA and competent-authority staff with ICT and operational-risk expertise
- Works under a Lead Overseer coordinator rather than reporting separately to each authority
- Composition criteria are set out in Commission Delegated Regulation (EU) 2025/420
How this fits DORA
Article 40 sits within the ICT Third-Party Risk pillar. For the full set of obligations and how they interlock, see the DORA requirements overview.
Read the official text
This is an editorial summary. Read the binding text of Article 40 in the consolidated regulation on EUR-Lex.