Critical ICT Third-Party Oversight Framework

The oversight framework under DORA is a supervisory regime for ICT third-party providers that are designated as critical. It sits at EU level, led by a Lead Overseer and involving the European Supervisory Authorities, and it is aimed at providers whose services matter to many financial entities at once. Its purpose is to address a gap that firm-by-firm supervision cannot close: when a provider serves a large part of the sector, no single firm's oversight, and no single national supervisor's view, captures the full risk.

Designation does not turn a provider into a regulated financial entity in the ordinary sense, and it does not remove the responsibilities of the financial entities that use its services. It creates a structured way for supervisors to request information, to examine the provider, to make recommendations, and to follow up on them. Financial entities still need their own third-party risk management, their own contracts, and their own contingency planning. The framework adds sector-level visibility and coordination on top of those duties, rather than replacing them.

A provider that serves many firms creates a shared risk that is difficult to manage through bilateral contracts alone. Each firm can ask questions and seek protections, but each firm sees only its own use of the service. It cannot see how many other firms depend on the same provider, how the provider prioritises recovery across customers, or whether a weakness affects the sector as a whole. Supervisors face a similar limit when they look only at firms within their own jurisdiction.

The oversight framework is designed to join up that picture. By looking at the provider as a whole, across its financial entity customers and across member states, supervisors can assess risks that are invisible from any single relationship. That includes the provider's own dependencies, its resilience arrangements, and its ability to support recovery for many customers at once. The framework therefore complements, rather than duplicates, the supervision of individual financial entities.

Designation is based on criteria set out in DORA, which consider factors such as the importance of the provider's services to financial entities, the number and type of entities that rely on them, and the potential systemic impact of a failure. The assessment draws on information from financial entities, from supervisors, and from the providers themselves. It is a supervisory judgement about criticality, not a commercial ranking, and it can change as the market and the provider's role change.

Once designated, a provider is subject to oversight activities described in the following sections of this guide and in the companion guides on the Lead Overseer and joint examination teams. The provider is expected to cooperate with oversight, to provide information, and to respond to recommendations. Financial entities that use a designated provider should understand that designation exists, but they should not treat it as a substitute for their own due diligence, monitoring, and exit planning.

Oversight involves information gathering, examination, and follow-up. Supervisors may request information about the provider's services, its resilience arrangements, its subcontractors, and its incident history. They may examine systems and processes through joint examination teams. They may make recommendations where they identify risks or weaknesses, and they may follow up to see whether those recommendations have been addressed. The framework also provides for dialogue with the provider, so that findings can be understood in context before conclusions are drawn.

For financial entities, the practical significance of those activities is indirect but real. Oversight findings can inform a firm's understanding of a shared dependency, and recommendations can lead to changes in a provider's arrangements that benefit all of its customers. At the same time, a firm should not assume that oversight has examined every aspect of the service it uses, or that a provider without findings is free from risk. Oversight is risk-based and periodic, while a firm's own monitoring needs to be continuous in relation to its own services.

A financial entity's duties do not shrink when its provider is designated. The entity still needs to identify its important services, map its dependencies, assess concentration, set contractual protections, monitor performance, and plan for disruption and exit. Those duties are described across this site's guides on third-party risk, and they apply whether a provider is designated or not. Designation changes the supervisory context, not the firm's accountability for its services.

That distinction matters for internal governance. A board or senior management team that treats designation as assurance may underinvest in its own contingency planning. A team that treats designation as additional information, to be combined with its own monitoring and testing, is using the framework as intended. The framework helps supervisors see the sector picture. It does not, and cannot, run a firm's services on its behalf.