European Commission rejects the RTS on subcontracting ICT services supporting critical or important functions
11 Mar 2025
|
On 21 January 2025, the European Commission sent a letter to the Chair of the Joint Committee of the Supervisory Authorities (ESAs) addressing the draft Regulatory Technical Standards (RTS) under the Digital Operational Resilience Act (DORA). The draft RTS, submitted by the ESAs in July 2024, outlined requirements for financial entities when subcontracting ICT services supporting critical or important functions.
While the European Commission acknowledges the draft RTS, it has rejected it as it considers that Article 5 of the draft RTS which concerns monitoring subcontracting chains exceeds the mandate set out in DORA. In turn, the European Commission deems that Article 5 and recital 5 should be removed from the draft RTS in order to be within the scope of the mandate set out in DORA.
The European Commission has stated that it intends to adopt the RTS once these concerns are taken into consideration and the relevant amendments are undertaken.
This decision highlights the commitment to maintain regulatory clarity while reinforcing financial entities’ digital resilience obligations under DORA.
The official letter can be found here.
