The EU’s DORA critical ICT third-party providers regime is now live: on 18 November 2025 the three European Supervisory Authorities (EBA, EIOPA and ESMA) published the first list of designated critical ICT third-party providers (CTPPs) under the Digital Operational Resilience Act. Nineteen technology firms, from hyperscale cloud platforms to market-data and core-banking vendors, are now subject to direct oversight by EU financial regulators.
That is a structural change. For the first time, supervisors can examine the technology suppliers that banks, insurers and investment firms depend on, rather than only the regulated firms that buy from them. Because DORA requires the list to be updated every year, the question for operators is no longer whether vendor oversight arrives, but how it reshapes their own contracts, registers and exit plans.
Who the 19 DORA critical ICT third-party providers are
The official list, published under Article 31(9) of DORA, names the following providers in alphabetical order. The groupings below are Fintechly’s, based on the services each firm is best known for.
| Broad service type | Designated providers |
|---|---|
| Cloud and hyperscale infrastructure | Amazon Web Services EMEA Sarl, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Nederland B.V. |
| Data centres and networks | Equinix (EMEA) B.V., InterXion HeadQuarters B.V., Colt Technology Services, Deutsche Telekom AG, Orange SA |
| IT services and managed services | Accenture plc, Capgemini SE, International Business Machine Corporation, Kyndryl Inc., NTT DATA Inc., Tata Consultancy Services Limited |
| Financial services software and data | Bloomberg L.P., Fidelity National Information Services, Inc., LSEG Data and Risk Limited, SAP SE |
The ESAs describe the group as providing “a range of ICT services (e.g. from core infrastructure to business and data services) to financial entities of all types and sizes across the European Union”. The mix matters: the list goes well beyond the three largest cloud platforms and reaches into consulting, network and financial-data businesses that many fintechs use without thinking of them as systemic.
How the ESAs decided who is critical
According to the ESAs, designation followed a three-step method set by DORA and by Commission Delegated Regulation (EU) 2024/1502, which specifies the criticality criteria.
- Data from registers of information. The ESAs collected the registers that financial entities maintain of their contractual arrangements for ICT services.
- A criticality assessment. Working with national competent authorities from banking, insurance and pensions, and securities markets, the ESAs assessed each provider’s systemic importance, its role in supporting critical or important functions, and how substitutable its services are.
- A right to be heard. Providers assessed as critical were notified and could submit a reasoned statement before final designation decisions were adopted.
The first step is the one that ties CTPP designation back to every regulated firm. The register of information that a payments institution or neobank files is not only a compliance artefact for its own supervisor; it is the raw data the ESAs use to map concentration risk across the EU. Inaccurate or incomplete registers weaken that map.
What direct oversight of a CTPP actually involves
Under DORA, one of the three ESAs is appointed as Lead Overseer for each CTPP, according to Article 31(1)(b). The ESAs’ DORA oversight guidance says the Lead Overseer is supported by Joint Examination Teams drawing on staff from the ESAs and national authorities, and that the ESAs run oversight through a single joint directorate operating as “one team”.
The oversight cycle
The ESAs define oversight as five activities: designation, risk assessment, planning, execution of oversight examinations, and the issuance and follow-up of recommendations. The stated aim is to assess whether CTPPs have appropriate risk management and governance frameworks to keep the services they deliver to financial entities resilient.
The governance around it
An Oversight Forum, set up under Article 32 of DORA as a sub-committee of the ESAs’ Joint Committee, prepares individual acts addressed to CTPPs and collective recommendations, with the aim of keeping oversight consistent. It includes the chairpersons of the ESAs, senior representatives from national authorities and observers, and may draw on independent experts. The legal base sits in Articles 31 to 44 of Regulation (EU) 2022/2554, supplemented by Delegated Regulations (EU) 2025/295 on the conduct of oversight and (EU) 2025/420 on Joint Examination Teams.
Oversight complements, not replaces, the bank’s own duties
The most important line in the ESAs’ guidance is easy to miss: the oversight framework “complements, rather than replaces, financial entities’ own responsibilities for managing ICT-related risks”. A bank that runs its core platform on a designated cloud provider still owns its third-party risk management, its contractual protections and its exit strategy. Designation does not certify the provider as safe for any particular customer.
In practice, this creates a two-layer model. Supervisors examine the provider’s resilience at Union level, while each regulated firm must still show its own supervisor that it understands the dependency, has tested alternatives where needed and has contracts that meet DORA’s requirements. For firms whose cloud core banking migration is under way, the CTPP list is a useful prompt to revisit concentration analysis rather than a reason to relax it.
The list changes every year, and providers can opt in
Article 31(8) of DORA requires the ESAs to publish and update the list of CTPPs annually, so the first list, dated 18 November 2025, is a starting point rather than a fixed perimeter. Firms should expect designations to shift as register data improves and as usage patterns change.
Providers not on the list can also ask to be designated. Under Article 31(11), an ICT provider may submit a reasoned application to the ESAs, which say they will reply within six months of formal receipt. The application carries a fixed opt-in fee of EUR 50,000 under Commission Delegated Regulation (EU) 2024/1505, and the ESAs encourage applicants to send an informal draft first.
| Feature | What the framework says |
|---|---|
| First list published | 18 November 2025, 19 providers |
| Update frequency | Annual, under Article 31(8) |
| Who oversees | A Lead Overseer drawn from the EBA, EIOPA or ESMA, with Joint Examination Teams |
| Opt-in route | Reasoned application under Article 31(11), EUR 50,000 fixed fee, reply within six months |
| Cross-border cooperation | Memorandum of understanding with UK authorities, after an equivalence assessment of the FCA and PRA confidentiality regimes |
Why the UK link matters for cross-border fintechs
Many of the designated providers serve both EU and UK financial firms from shared infrastructure. The ESAs have signed a memorandum of understanding on DORA oversight with the United Kingdom, after a DORA-specific assessment that found the confidentiality and professional secrecy regimes of the Financial Conduct Authority and the Prudential Regulation Authority equivalent. For groups operating on both sides of the Channel, that cooperation reduces the risk of conflicting demands on the same supplier, though each regime still applies its own rules to regulated firms. Fintechly’s coverage of the UK’s cyber resilience agenda sets out where British policy is heading.
DORA critical ICT third-party provider FAQs
Does using a designated CTPP reduce our own DORA obligations?
No. The ESAs state that the oversight framework complements, rather than replaces, financial entities’ own responsibilities for managing ICT-related risks. Your firm still owns its contractual protections, its register of information and its exit planning for the services it buys from the provider.
How often will the list of critical ICT third-party providers change?
Article 31(8) of DORA requires the ESAs to publish and update the list annually. The first list was published on 18 November 2025, so firms should check the ESAs’ websites for each annual update and adjust vendor risk assessments accordingly.
Why does our register of information matter for CTPP designation?
The ESAs used data from financial entities’ registers of information as the first step of the designation process. Errors or gaps in your register distort the EU-wide picture of concentration risk and may also draw questions from your own competent authority.
Can a technology vendor ask to become a CTPP?
Yes. Under Article 31(11), a provider not on the list can submit a reasoned application, which carries a fixed opt-in fee of EUR 50,000. The ESAs say they will reply within six months of formally receiving the application.
Which regulator oversees a designated provider?
Each CTPP is assigned a Lead Overseer, which is one of the EBA, EIOPA or ESMA. The Lead Overseer is supported by Joint Examination Teams that include staff from the ESAs and national competent authorities.
For banks, payment firms and fintechs, the CTPP list is best read as a map of shared dependencies. It tells risk teams which suppliers regulators now regard as systemic, and it raises the bar on how firms document and test their reliance on them. Operators reviewing their stack should pair it with a fresh look at their core banking system dependencies and at how payments infrastructure is being tested by faster cyber threats.
