DE
FR
IT
العربية
Contents 5
Since 17 January 2025, Regulation (EU) 2022/2554, known as DORA, has applied directly to almost all supervised financial entities in the EU. On 18 November 2025, EBA, ESMA and EIOPA designated the first 19 critical ICT third-party providers, including major cloud and technology providers. This makes the previously abstract oversight framework concrete: financial entities must not only know which of their providers have been classified as critical, but also systematically keep track of their own contracts, risks and dependencies. Structured Third-Party Risk Management (TPRM) is therefore becoming an important part of DORA implementation.
Since the ESAs designated the first 19 critical ICT third-party providers on 18 November 2025, these providers have been subject to a Lead Overseer with extensive examination and information-gathering powers. However, financial entities remain responsible for their own obligations: under Articles 28 and 30 DORA, they must continue to embed due diligence, concentration risk assessments, audit and access rights, and binding exit strategies in their contracts and processes. This further increases the importance of systematic Third-Party Risk Management.
What does the list of 18 November 2025 change in practice?
For the first time, the list names the ICT third-party providers classified as critical and subject to direct oversight by a European supervisory authority. The first 19 designated critical ICT third-party providers cover various technology areas, including cloud computing, data centres, telecommunications, managed services and other ICT services.
In the first list of critical ICT third-party providers published on 18 November 2025, EBA, ESMA and EIOPA designated 19 providers as critical. They include Amazon Web Services EMEA Sarl, Google Cloud EMEA Limited, IBM, Accenture, Capgemini, Deutsche Telekom and Bloomberg, among others. The designation was based on the criteria set out in DORA.
For the affected providers, the designation means direct European oversight. However, this does not change the financial entities’ own responsibility for managing their ICT third-party providers. They must continue to assess which providers support critical or important functions, what dependencies and concentration risks exist, and whether their contracts meet regulatory requirements.
This is precisely where structured Third-Party Risk Management (TPRM) comes in: critical providers, dependencies, risks, contractual requirements and their ongoing monitoring should be centrally recorded and managed in a transparent and traceable way.
How does oversight by the Lead Overseer work?
Depending on the sector, EBA, EIOPA or ESMA assumes the role of Lead Overseer for each designated provider and coordinates the oversight.
The Lead Overseer is supported by Joint Examination Teams made up of staff from the European supervisory authorities and relevant competent authorities. These teams conduct risk-based examinations and assess, among other things under Article 33 DORA, whether a provider has effective structures for ICT risk management, incident handling, security and subcontracting.
The guide on oversight activities, published by the European supervisory authorities on 15 July 2025, describes the process from designation through risk assessment and examination to the follow-up of recommendations. Oversight includes, among other things, information requests, investigations and on-site inspections.
For financial entities, this development means one thing above all: direct oversight of a critical provider does not replace their own Third-Party Risk Management. Companies must still be able to understand which providers support their critical functions, what risks arise from these dependencies, and how those risks are monitored and managed. Centralising provider information, criticality, dependencies and measures creates the transparency needed for this.
Which contractual obligations remain with financial entities?
Before entering into a contract, financial entities must continue to assess themselves whether a function is critical or important, what concentration risk arises and whether the provider passes the required due diligence.
Under Article 28 DORA, before entering into a contractual arrangement, it must be assessed whether it concerns a critical or important function, ICT concentration risk under Article 29 must be evaluated, and due diligence of the provider must be carried out. For contracts concerning critical or important functions, Article 30 DORA requires, among other things, appropriate access, inspection and audit rights for the financial entity, appointed third parties and competent authorities.
Article 30 DORA also requires an exit strategy that enables an orderly transition. These minimum contractual requirements apply regardless of whether a provider is on the list of critical ICT third-party providers. However, their practical relevance continues to increase as critical ICT dependencies become more important.
For companies, this means that contract management and Third-Party Risk Management should not be viewed in isolation. Criticality, risks, contractual requirements and exit strategies should form part of an end-to-end process that remains traceable throughout the entire provider lifecycle.
What happens if a provider does not implement recommendations?
If a critical provider does not implement the recommendations of the Lead Overseer, the relevant national supervisory authority may, under the conditions set out in Article 42 DORA, require the affected financial entity to suspend or terminate its relationship with the provider.
This makes one point clear: even though direct examinations focus on the critical ICT third-party provider, the financial entity remains responsible for managing its own ICT risks. The costs of European oversight, however, are borne by the critical ICT third-party providers.
For financial entities, maintaining an up-to-date overview of critical providers, their risk profiles, contract status, dependencies and supervisory findings is therefore essential. Only this enables changes to be identified early and necessary measures to be managed in a transparent and traceable way.
What does this mean for Swiss institutions?
DORA does not generally apply directly to Swiss financial entities as Swiss regulation. The European framework becomes particularly relevant where business activities, EU branches or contractual relationships with EU-regulated financial entities and their providers are affected. For the national regulation of Swiss institutions, FINMA Circular 2023/01 “Operational risks”, or the applicable FINMA regulatory framework, remains decisive.
In practice, DORA can nevertheless have an impact through cross-border business relationships and contractual requirements. Swiss institutions should therefore not only assess whether DORA applies directly to them, but also analyse which requirements are effectively passed on to them by customers, business partners or providers.
A practical first step is to compare your own provider inventory with the list of the 19 designated critical ICT third-party providers. Next, assess which critical or important functions are supported by these providers, what dependencies and concentration risks exist, and whether existing contracts cover the relevant requirements under Articles 28 and 30 DORA. This information should be documented centrally and updated regularly so that changes in providers and risks can be identified at an early stage.
Manage Third-Party Risk and Operational Resilience centrally
The SwissGRC platform helps companies systematically map critical functions, provider dependencies and risks. With Third-Party Risk Management and Operational Resilience, risks, contractual requirements and measures can be centrally monitored and managed transparently throughout the entire provider lifecycle.
Operational ResilienceFrequently asked questions
Which providers have been on the DORA list of critical ICT third-party providers since November 2025?
On 18 November 2025, EBA, ESMA and EIOPA designated the first 19 providers as critical. They include major cloud and technology providers, among others. The list is published and updated by the European supervisory authorities.
What is a Lead Overseer under DORA?
Depending on the financial sector, the Lead Overseer is EBA, ESMA or EIOPA and assumes direct oversight of a designated critical ICT third-party provider. Supported by Joint Examination Teams, it conducts risk assessments and supervisory examinations and follows up on recommendations issued to providers.
Do financial entities still need to conduct their own contract reviews despite EU oversight of cloud providers?
Yes. The designation changes oversight of the provider, but not the financial entity’s own responsibility. Under Articles 28 and 30 DORA, due diligence, concentration risk assessment and appropriate audit, access and exit rights remain relevant, among other requirements.
What happens if a critical ICT provider does not implement the Lead Overseer’s recommendations?
Under the conditions set out in Article 42 DORA, the relevant national supervisory authority may require the affected financial entity to suspend or terminate its relationship with a provider. The financial entity’s own responsibility for managing its ICT risks therefore remains unchanged.
Does DORA also apply to Swiss banks?
DORA does not generally apply directly to Swiss institutions. However, the European legal framework may become relevant, particularly through EU branches, cross-border business relationships and contractual requirements. Swiss institutions should therefore assess which direct and indirect points of contact with DORA exist.
