On February 9, 2021, the European Securities and Markets Authority (ESMA), the European Banking Authority (EBA) and the European Insurance and Occupational Pensions Authority (EIOPA) (collectively the ESAs) published a joint letter¹ on streamlining the governance and oversight concepts in DORA. The joint letter was sent to the EU’s legislative policymaking stakeholders on the DORA proposal² and is likely to influence further detailed rulemaking and the direction DORA takes³.

In summary, DORA, as an EU Regulation, aims to establish a comprehensive and cross-sectoral EU-27 digital operational resilience framework with rules for all regulated financial institutions. DORA’s requirements go well beyond the Network Information Systems Directive (NISD 2)⁴, which focused on a narrow set of firms, introducing a minimum standard on cyber-resilience that was introduced in other financial services rules as well as the EU’s General Data Protection Regulation. DORA introduces much more prescriptive requirements to a much wider set of market participants. A proportionate approach to compliance set out in DORA effectively introduces a sliding scale of compliance, with critical and significant firms having greater compliance obligations than others, whereas de minimis thresholds allow microenterprises to apply DORA only in select instances.

As set out in detail in the earlier coverage in this dedicated series on DORA, under this framework one of the relevant ESAs (or the ECB-SSM) is designated as “Lead Overseer” for each Critical Third Party Service Provider (CTPP) (also referred to as critical ICT third-party service providers). The Lead Overseer has to assess whether that provider has in place comprehensive, sound and effective rules, procedures, mechanisms and arrangements to manage the ICT risks that it may pose to financial entities. The ESAs will act as “Lead Overseers” and the national competent authorities (NCAs) as enforcers.

The oversight framework envisaged by DORA builds on the existing institutional architecture, whereby the Joint Committee of the ESAs ensures cross-sectoral coordination relating to all ICT risk matters, in accordance with its tasks on cybersecurity. The Joint Committee will establish a sub-committee, the “Oversight Forum”, to support its work in this area. The Oversight Framework will set up a designation mechanism applicable to CTPPs, taking into account the dimension and nature of the financial sector’s reliance on services provided by CTPPs. Concretely, the designation will be based on a set of quantitative and qualitative criteria (some of which remain to be defined) setting out the parameters as a basis for inclusion into the oversight. The proposal will also foresee a voluntary opt-in for CTPPs that have not been designated on the basis of future criteria.

The ESAs express their view

While the ESAs are generally supportive of DORA, notably as the legislative proposal builds upon the ESAs’ joint advice from 2019⁵, the ESAs also suggest some changes to the current proposal. This Client Alert summarizes the supervisory and regulatory policy statements set out in this letter. In particular, the ESAs set out further principles in respect of CTPPs and the need for an oversight framework to cover the information and communication technology (ICT) services they provide to the financial services sector. Specifically the ESAs welcome that (our emphasis in bold):

“The proposed oversight framework is the first concrete initiative to address the complex issue of the dependencies on CTPPs in the financial sector, including monitoring third party concentration risks. This is imperative in its own right and should provide a pathway to any broader oversight in the future. At the same time, to manage public expectations, it is important to clearly communicate that the proposed oversight role for the ESAs is limited to the ICT risks which CTPPs may pose to financial entities, and that the oversight currently envisaged will not amount to full supervision of CTPPs across their full range of activities. To ensure the credibility of this new oversight activity, also in the context of the envisaged powers and resources, it is essential to clearly communicate that its scope is limited to the CTPPs’ activities related to financial entities.”

This statement is important in that the ESAs are clear that their supervision will be narrow in focus but that there may also be residual issues that remain unaddressed given the significance of CTPPs for other sectors of the EU’s Single Market well beyond the ESA’s regulatory and supervisory mandates, which are limited to financial markets. The ESAs have specifically commented on the following areas where they see a need for improvement:

1. More streamlined governance and decision-making process

More streamlined governance and decision-making process between the Joint Committee and the supervisory boards of the ESAs and the Oversight Forum – the latter being a creation proposed by DORA which the ESAs have evaluated as having a proposed size that “…appears to contribute to this complexity…” of decision-making;

2. The proposed composition of the Oversight Forum may be challenged

The proposed composition of the Oversight Forum may be challenged given the “…highly technical nature of the entities falling under the scope of its oversight” and possible technical capacity and expertise needed to address what the ESAs state are “…quite technical IT issues related to the oversight activities”.

3. Clearer channels of communication and cooperation amongst supervisory teams

The ESAs have also called for the legislative policymakers to establish cross-ESA teams to work on the oversight of CTPPs, including cross-sectoral CTPPs (see below), almost in a more established form of a college of supervisors. In some ways this echoes some aspects of the supervisory model that underpins the work of the ESAs in other areas of financial market supervision and borrows from some outcomes of supervision that have been achieved within the Banking Union’s supervisory architecture.

4. Clearer arrangements on which ESAs would have primary oversight, as Lead Overseer

Clearer arrangements on which ESAs would have primary oversight, as Lead Overseer, in supervising CTPPs that operate across multiple sectors (cross-sector CTPPs) and thus across mandates of the respective ESAs as the Lead Overseer, and clarification whether all of the relevant NCAs would effectively be bound by and act upon the Lead Overseer’s recommendations.

The ESAs have used the joint letter to invite the EU legislative policymakers to consider an oversight model that permits stronger cooperation amongst the ESAs, possibly through the creation of a joint ESA executive body which would integrate the role of the current proposed Oversight Forum and be responsible for supervising cross-sector CTPPs. This executive body would be led by a small and functional group of members with appropriate technical capacity and expertise.⁶ The ESAs have further suggested that: “Necessary powers could be allocated to this executive body by the legislation to enhance its decision-making role and to ensure a unified and harmonized approach across the ESAs. In addition, the legislation could clarify the potential designation of CTPPs providing services to financial entities across the remit of a single ESA (i.e. sector-specific CTPPs), along with the governance model to be applied in these cases.”

5. Greater coherence between oversight recommendations and follow-up actions

The ESAs have pointed to a perceived mismatch between the ESA’s conduct of oversight work and the lack of enforcement powers concerning the remedial actions addressed to CTPPs and how they comply with the recommendations addressed to them. Specifically the ESAs point to the conceptual scenario where, after the issuing of recommendations, NCAs will be responsible for following them up and take actions against “their” supervised financial entities where such recommendations are not addressed by the CTPP. Even if DORA, in its current detail, gives the NCAs the right to require the supervised financial entity to temporarily suspend the CTPP’s services or to terminate the contracts with the CTPP, it raises questions on the efficacy of the proposed enforcement mechanism, including a potential for inconsistencies of approaches and outcomes across member states, thus undermining the effectiveness of the entire oversight framework. The ESAs, in pointing to parallels in existing oversight frameworks, have proposed that enforcement is conducted at the EU level and applied directly to CTPPs, which would then be “endorsed” (an undefined term/concept) by NCAs.

6. Greater interaction with relevant authorities and bodies that perform similar tasks

Notably the ESAs have called for DORA (or implementing and/or regulatory technical standards) to set out details on how the ESAs should interact with other oversight bodies such as data protection authorities, including where CTPPs serve the wider economy, where alignment will be required between ESAs’ recommendations and the work of those other authorities.

7. Greater application of a proportionate approach

The ESAs have commented on the current DORA proposal’s exclusion of micro-enterprises from compliance with certain requirements of DORA but criticized it for not making any reference to sectoral legislation when defining the financial entities within DORA’s scope of application. The ESAs have expressed support for DORA to perhaps be applied in a more proportionate manner to financial sector entities, although details of what this might entail i.e., use of CTPPs, overall risk scores of the entities etc., have not been put forward.

The ESAs have stated that they anticipate that under the current DORA proposal they will have to finalize a number of further rules that are secondary to but very much in support of the overall outcomes that DORA aims to deliver. This includes at least 10 regulatory technical standards, two implementing technical standards, one set of guidelines and several recurring reports in addition to policy work for each of the ESAs. Most of these are, by the ESAs’ estimates, to be delivered within 12 months.

Further new types of work are also expected by each of the ESAs in designing and implementing new policy in the form of regular reporting and several tasks relating to ICT-related incident reporting, including cooperation with the structure and authorities established by the EU’s cybersecurity policy and legislative efforts and reforms, including in the amended NISD2. Other workstreams that the ESAs are expected to discharge in their oversight role are financial cross-sector exercises along with periodic communication and cooperation.

The ESAs have stated that they “…strongly believe that the proposed new resource demands have been significantly underestimated. As a result, the allocated resources are insufficient to meet the scale and complexity of the new ongoing task, risking the effectiveness of the oversight framework.” Absence an appropriate allocation of resources (of all levels of seniority in terms of full-time employees) for ESAs to deliver this detail, their work may be delayed and this may derail the direction of change and compliance that DORA aims to implement. To put its requirements into context, footnote 3 in the letter points to the National Bank of Belgium’s supervision of SWIFT (which would be a (major) CTPP under DORA) through five full-time employees along with support from G10 central banks for the performance of fieldwork, which the ESAs have estimated as contributing to an additional 3 full-time employees.

Outlook

DORA requires a lot from those that qualify as financial entities, inasmuch as it does for supervisors transitioning to this new regulatory and oversight regime and the identification, mitigation and management of a whole new taxonomy of risks. As dependency on ICT service providers is likely to grow, financial services providers and other firms will need to carefully consider what actions they can take to deal with ICT concentration risk. They will also need to ensure that their contractual arrangements with outsourcing service providers, as well as ICT third-party service providers, and their internal policies and procedures are reflective of DORA’s provisions and supervisory expectations.

While the ESAs have pointed to challenges, it is conceivable that such issues may be overcome by allocating higher budgets to the ESAs to hire suitably qualified supervisory staff or other arrangements to leverage staff of NCAs, as opposed to fundamentally reshaping each of the ESAs proposed extension of mandates to CTPP supervision. This would be in keeping with similar previous developments, where EU legislative policymakers have first proposed new rules and frameworks and followed-up with bolstering the ESAs’ available resources and tools, often with one ESA being asked to take charge over the others.

The lawyers of our financial institutions regulatory team are assisting a number of banks and other regulated firms on regulatory matters. If you would like to discuss any of the items mentioned, or how they may affect your business more generally, please contact any of our key contacts or the wider team of our financial institutions regulatory team.

1. Available here.↩
2. Mrs. Irene Tinagli MEP, Chair of the Committee on Economic and Monetary Affairs of the European Parliament, to Mr. Joao Leão, President of the ECOFIN Council in the Council of the European Union as well as Mairead McGuinness, Commissioner in charge of Financial Stability, Financial Services and Capital Markets Union of the European Commission (DG-FISMA).↩
3. For a general background on DORA, its opportunities and challenges please see coverage available here and here. ↩
4. Available here.↩
5. Joint Advice on the need for legislative improvements relating to Information and Communication Technology (ICT) risk management requirements in the EU financial sector, April 10, 2019 available here. ↩
6. ESA membership in such a body could be limited to executive directors and some senior staff. Furthermore, the ESAs have stated that: “Membership among NCAs should also be limited to a few nominated representatives from the Board of Supervisors from each ESA. Therefore, among the membership, it would be essential to ensure a sufficient level of expertise on technology and information security risks in an effort to gather the necessary specialized expertise in the executive body and to bring important efficiency to the oversight framework.” ↩