DORA for ICT Third-Party Providers
ICT third-party providers, cloud, software, data and managed-service firms serving financial entities, are not directly bound by most DORA obligations, but they are pulled in through their clients' contractual and register requirements under Articles 28–30. A subset may be designated critical and face direct EU oversight.
How DORA reaches providers indirectly
Financial entities must include specific provisions in ICT contracts, access and audit rights, security, sub-outsourcing limits, and exit strategies, and must record every arrangement in their register of information. Providers that cannot meet these terms risk losing financial-sector business.
What providers should prepare
- Contract templates aligned to Article 30 mandatory clauses.
- Evidence packs: certifications, audit reports, resilience testing.
- Clear sub-outsourcing disclosure.
The critical-provider route
The largest, most systemic providers may be designated critical ICT third-party providers and brought under a direct EU oversight framework.
Who has actually been designated so far
Designation is not hypothetical. On 18 November 2025 the European Supervisory Authorities published the first CTPP list: 19 firms, spanning cloud infrastructure, financial data and software, telecoms, and IT services. The list is Accenture, Amazon Web Services EMEA, Bloomberg, Capgemini, Colt Technology Services, Deutsche Telekom, Equinix (EMEA), Fidelity National Information Services (FIS), Google Cloud EMEA, IBM, InterXion HeadQuarters, Kyndryl, LSEG Data and Risk, Microsoft Ireland Operations, NTT DATA, Oracle Nederland, Orange, SAP, and Tata Consultancy Services. Cloud and data-centre operators make up the largest share, with telecom carriers, IT-services firms, and financial data or software vendors filling out the rest, a mix that reflects the concentration and substitutability criteria the ESAs designate against, not simply company size. A provider not on this first list can still be added in a future designation round, and a provider that expects to qualify can also opt in voluntarily under Article 31(11). See our page on critical ICT providers for what direct EU oversight then requires of a designated firm.
Frequently asked questions
Is my ICT company directly regulated by DORA?
Generally no, unless designated critical. Most providers are affected through contractual and register obligations imposed by their financial clients.
Which companies have been designated critical ICT third-party providers so far?
The first 19 designated on 18 November 2025 were Accenture, AWS EMEA, Bloomberg, Capgemini, Colt Technology Services, Deutsche Telekom, Equinix (EMEA), FIS, Google Cloud EMEA, IBM, InterXion HeadQuarters, Kyndryl, LSEG Data and Risk, Microsoft Ireland Operations, NTT DATA, Oracle Nederland, Orange, SAP, and Tata Consultancy Services. Future designation rounds can add more.
What contract terms will clients demand?
Article 30 mandatory clauses: access and audit rights, security and incident cooperation, sub-outsourcing controls, service levels, and exit strategies.
How do I become 'critical' and what changes?
The European Supervisory Authorities designate critical providers based on systemic importance; designation brings direct oversight, examinations, and possible recommendations.