EU: New rules for financial entities subcontracting ICT services

Why should I read this?

The Subcontracting RTS was published by the Joint Committee of the European Supervisory Authorities (“ESAs”) on 26 July 2024. It is the last of several policy documents mandated by DORA, which are essential for implementing its requirements and also arguably the most controversial. A wide range of financial entities within scope of DORA (“financial entities”) have until 17 January 2025 to ensure that they comply with DORA and the final form policy documents, so the timeframe for understanding and implementing these new rules is incredibly tight.

The Subcontracting RTS specifies further the elements referred to in Article 30(2)(a) of DORA that financial entities must determine and assess when subcontracting ICT services supporting critical or important functions (or material parts thereof). Article 30(2)(a) of DORA requires of financial entities that:

“the contractual arrangements on the use of ICT services shall include at least the following elements […] a clear and complete description of all functions and ICT services to be provided by the ICT third-party service provider, indicating where subcontracting of an ICT service supporting a critical or important function, or material parts thereof, is permitted and, when that is the case, the conditions applying to such subcontracting.”

Financial entities must ensure that they comply with Article 30(2)(a) and the Subcontracting RTS in respect of both their new contracts for ICT services and their existing contracts for ICT services. Any changes required to those contracts must be implemented in a timely manner and as soon as it is possible and the financial entity must document the planned timeline for the implementation (Article 4(2) of the Subcontracting RTS).

Service providers providing ICT services (‘ICT third-party service providers’) should expect their financial entity customers to request changes to their contracts for ICT services in the coming months, as the deadline for DORA compliance rapidly approaches.

What should I do?

Financial entities must review their contracts for ICT services, assess their compliance with the Subcontracting RTS and make amendments to the existing contracts and template documentation where required. The same requirements apply to intra-group arrangements for ICT services.

The Subcontracting RTS places no direct obligations on service providers (it is the regulated financial entity’s obligation to ensure compliance). Nevertheless, we recommend that service providers who provide ICT services to financial entities familiarise themselves with the requirements of the Subcontracting RTS so that they are prepared to respond to customer change requests driven by DORA.

What are the key provisions in the Subcontracting RTS?

The obligations under the Subcontracting RTS for financial entities within scope of DORA fall within two categories.

First, financial entities must decide before entering into an arrangement with an ICT third-party service provider whether an ICT service supporting critical or important functions (or material parts thereof) may be subcontracted, having assessed at least the elements in Article 3 of the Subcontracting RTS. These elements fall broadly under the headings of due diligence and risk assessment:

Due diligence

• assessing the due diligence processes implemented by the ICT third-party service provider to assess the operational and financial abilities of potential ICT subcontractors;
• assessing the ability of the ICT third-party service provider to identify, notify and inform the financial entity of any subcontracting in the chain of subcontracting providing ICT services supporting critical or important functions or material parts thereof;
• that the subcontracting arrangements will allow the financial entity to comply with its own obligations;
• the ICT third-party service provider’s ability to monitor its subcontractors;
• the abilities of the financial entity to monitor and oversee the subcontracted services;

Risk Assessment

• the impact of possible failure of a subcontractor on the financial entity’s digital operational resilience and financial soundness;
• risks associated with the potential location of potential subcontractors;
• ICT concentration risk;any obstacles to the exercise of audit, inspection and access rights.
• any obstacles to the exercise of audit, inspection and access rights.

Secondly, if sub-contracting of ICT services supporting critical or important functions is permitted, the financial entity must identify the conditions under which such subcontracting is permitted. In particular, the written contractual agreement between the financial entity and the ICT third-party service provider must specify the elements in Articles 4, 5, 6 and 7 of the Subcontracting RTS. At a high level these include, in relation to the subcontracting of ICT services supporting critical or important functions (or material part thereof):

• responsibility, monitoring and reporting obligations of the ICT third-party service provider;
• contractual requirements on the subcontractor on business contingency plans and service levels in relation to those plans;
• security, rights of access, inspection and audit;
• identification of the chain of ICT subcontractors, on an ongoing basis;
• provisions enabling the financial entity’s effective monitoring of the contracted ICT services;
• information rights on contractual documentation between ICT third-party service providers and its subcontractors;
• requirements in relation to material changes to those subcontracting arrangements (as specified in Article 6);
• termination rights in the scenarios specified in Article 7 (e.g. if the ICT third-party service provider implements material changes to its subcontracting arrangements despite an objection to the changes from the financial entity).

What else do I need to know about the Subcontracting RTS?

The first draft of the Subcontracting RTS was published by the ESAs in Consultation Paper ESA/CP/2024. The deadline for responding to that consultation was 4 March 2024. In response to consultation, the ESAs made a number of changes.

The key changes include:

• Scope - clarification that these requirements apply to subcontracting of ICT services supporting critical or important functions (or material part thereof). While financial entities must identify the overall chain of subcontractors performing those ICT services as part of their risk assessment, monitoring and other obligations relate to the chain of subcontractors providing ICT services supporting critical or important functions (and not the supply chain in its entirety).
• Proportionality – helpful clarity on the elements relevant to applying the proportionality principle to the Subcontracting RTS. Financial entities must take into account the size and the overall risk profile of the financial entity and the nature, scale and elements of increased or reduce complexity of its services, activities and operations, including the elements in Article 1 of the Subcontracting RTS. In reply to feedback given in consultation, the ESAs have stated that these are further criteria that can be taken into consideration by financial entities for the application of the requirements under the Subcontracting RTS in a proportional manner. This supplements the proportionality principle in Article 4 of DORA. The ESAs have stressed that proportionality does not mean waiving the requirements.
• Conditions for subcontracting relation to the chain of ICT subcontractors providing a service supporting critical or important functions by the financial entity – Article 5 has been largely written to make the requirements more specific and to clarify that the requirements do not apply to the full ICT subcontracting chain but rather the ICT subcontractors supporting critical or important functions. The obligation on financial entities to review contractual documentation between ICT third-party service providers and subcontractors has been softened such that the contractual arrangement must permit the financial entity to obtain information on such contractual documentation but does not mandate review of that documentation.
• Material changes to subcontracting arrangements of ICT service supporting critical or important functions – the new Article 6 on this topic is useful clarification.

Next steps

The Subcontracting RTS is still marked as draft and is awaiting adoption by the European Commission. Any further changes are likely to be minimal but interested parties will need to check the final form remains as currently published.

For more information on the Subcontracting RTS

Please contact Joanne Veitch, Simon Lightman, Simon Gamlin, Craig Rogers, Stephanie Shepherd, Isabella Norbu, Nils Muller, Eve England or Richard Hill.

Further reading on DORA

The EU’s Digital Operational Resilience Act (DORA) | Eversheds Sutherland (eversheds-sutherland.com)