The 19 Designated Critical ICT Providers (CTPPs)

On 18 November 2025, the European Supervisory Authorities (EBA, EIOPA and ESMA, the ESAs), acting through their Joint Committee on a recommendation from the Oversight Forum, published the first list of designated critical ICT third-party service providers (CTPPs) under the Digital Operational Resilience Act (DORA), as Article 31(1) and (9) require. A total of 19 providers were designated and are now subject to EU-level oversight by a Lead Overseer. This article provides the complete list, explains how designation works, what each designation means, and what financial entities must do next.

How are critical ICT third-party providers designated under DORA? Under Article 31 of Regulation (EU) 2022/2554, the three ESAs, acting through their Joint Committee and on the recommendation of the Oversight Forum, designate the ICT third-party service providers that are critical for financial entities. They assess each provider against four criteria: the systemic impact of its failure, the systemic importance of the financial entities that rely on it, how far those entities rely on it for critical or important functions, and how substitutable it is (Article 31(2)). Commission Delegated Regulation (EU) 2024/1502 specifies these criteria further. The provider is heard before the decision, and each designated provider is assigned a Lead Overseer.

Updated 5 November 2026: a new section sets out the designation procedure step by step (who decides, the four criteria, the role of Delegated Regulation (EU) 2024/1502, the exclusions and the opt-in route), and a short FAQ closes the article. Updated 6 October 2026: an earlier version of the table below did not match the list published by the ESAs. It has been rebuilt from the official document, linked as the source under the table, and the analysis that relied on it has been rewritten. We thank the reader who pointed it out.

The Official List: 19 Designated CTPPs (November 2025)

The table below reproduces the official list, in the order published by the ESAs. Designation rests on the four criteria of Article 31(2): the systemic impact of a large-scale failure of the provider, the systemic importance of the financial entities that rely on it, their reliance on it for critical or important functions, and how far it can be substituted.

Source: ESAs, list of designated critical ICT third-party service providers (Article 31(9) DORA), 18 November 2025. Entity names are reproduced exactly as published, in the same alphabetical order. The Group, Type and Main ICT services columns are our own description, to help you match the list against your Register of Information: the official list contains the legal entity names only.

Lead Overseer: the published list does not state which ESA oversees each provider. The rule is set by Article 31(1)(b): the Lead Overseer is the ESA responsible for the financial entities that together hold the largest share of total assets among all financial entities using that provider. The three ESAs coordinate their oversight through the Joint Oversight Network (Article 34).

How CTPPs Are Designated Under DORA

What Makes a Provider a CTPP

DORA defines an ICT third-party service provider as an undertaking providing ICT services (Article 3, point (19)), and a critical ICT third-party service provider as an ICT third-party service provider designated as critical in accordance with Article 31 (Article 3, point (23)). Criticality is therefore a legal status that results from a decision of the ESAs. It is not a label a financial entity gives to its own providers.

DORA reaches ICT providers in two ways:

• Every ICT third-party service provider is reached indirectly, through the risk management, contracts and exit strategies of the financial entities it serves (Articles 28 to 30). Our guide to ICT third-party risk management under DORA covers that chain, and DORA for ICT providers explains it from the provider's side.
• Designated CTPPs are, in addition, overseen directly at EU level under the oversight framework of Articles 31 to 44, by a Lead Overseer.

Designation does not shift responsibility. Financial entities that use ICT services from third parties remain fully responsible, at all times, for complying with DORA (Article 28(1)(a)), whether the provider is designated or not.

Who Designates, and Who Becomes Lead Overseer

Under Article 31(1), the ESAs, through the Joint Committee and upon recommendation from the Oversight Forum established under Article 32(1), take two decisions:

1. they designate the ICT third-party service providers that are critical for financial entities, following an assessment against the criteria of Article 31(2) (point (a));
2. they appoint as Lead Overseer for each CTPP the ESA responsible for the financial entities that together hold the largest share of total assets out of the value of total assets of all financial entities using that provider (point (b)).

Where a CTPP belongs to a group, it designates one legal person as coordination point to ensure adequate representation and communication with the Lead Overseer (Article 31(4)).

The Four Criteria of Article 31(2)

All four criteria are taken into account. For a provider that belongs to a group, they apply to the ICT services provided by the group as a whole (Article 31(3)). The last column is the question we suggest asking on the financial entity side: it is not part of the Regulation.

What Delegated Regulation (EU) 2024/1502 Adds

Article 31(6) empowered the Commission to specify the criteria further. It did so in Commission Delegated Regulation (EU) 2024/1502, which organises the assessment in two steps: a first, quantitative step based on indicators with minimum thresholds, then a qualitative assessment of the providers that pass it. The indicators and thresholds are set out per criterion in the Delegated Regulation itself. Read them there rather than in a summary: they are precise, and a paraphrase loses the detail that matters.

The data the ESAs work from comes from the financial entities themselves. Each financial entity keeps a Register of Information on all its contractual arrangements for ICT services and reports on it to its competent authority (Article 28(3)), in the templates of Commission Implementing Regulation (EU) 2024/2956. Competent authorities transmit those reports to the Oversight Forum, which assesses the ICT third-party dependencies of financial entities on that basis (Article 31(10)). A gap in your register is therefore also a gap in the evidence used for designation.

The Designation Procedure, Step by Step

1. Data collection. Competent authorities collect the Registers of Information and pass the information on (Articles 28(3) and 31(10)). For the first designations, the registers were due to the ESAs by 30 April 2025.
2. Assessment and recommendation. Providers are assessed against Article 31(2) and Delegated Regulation (EU) 2024/1502, and the Oversight Forum makes its recommendation (Article 31(1)).
3. Right to be heard. The provider is notified of the outcome of the assessment. Within six weeks of that notification it may submit a reasoned statement with any relevant supporting information, and further information may be requested within 30 calendar days of receiving that statement (Article 31(5)). The ESAs' roadmap of February 2025 targeted July 2025 for these notifications.
4. Decision. The provider is notified of its designation and of the date from which oversight starts, no later than one month after that notification (Article 31(5)). The Lead Overseer is appointed at the same time (Article 31(1)(b)).
5. Information to users. The CTPP notifies the financial entities to which it provides services that it has been designated (Article 31(5)).
6. Publication and annual update. The ESAs publish the list of CTPPs at Union level and update it every year (Article 31(9)). The first list was published on 18 November 2025 and is reproduced above. Check the ESAs' websites for the version in force before relying on it.

Exclusions and the Opt-In Route

Article 31(8) excludes four categories from designation:

• financial entities that provide ICT services to other financial entities;
• ICT third-party service providers subject to oversight frameworks established to support the central bank tasks referred to in Article 127(2) TFEU;
• intra-group ICT service providers;
• ICT third-party service providers that provide services solely in one Member State to financial entities that are only active in that Member State.

A provider that is not on the list may request to be designated (Article 31(11)). It submits a reasoned application to the EBA, ESMA or EIOPA, and the ESAs, through the Joint Committee, decide within six months of receiving the application.

Designation also has a consequence for providers established outside the Union: financial entities may only use the services of a CTPP established in a third country if that provider establishes a subsidiary in the Union within the 12 months following its designation (Article 31(12)).

What CTPP Designation Means in Practice

For Designated Providers

Once designated, a CTPP falls under the oversight framework of Articles 31 to 44. In practice, it must:

• Notify the financial entities it serves that it has been designated (Article 31(5))
• If it belongs to a group, designate one legal person as coordination point with the Lead Overseer (Article 31(4))
• Cooperate in good faith with the Lead Overseer (Article 35(5)), which can request information and documentation, conduct general investigations and on-site inspections, and ask for reports on the remedies implemented (Articles 35(1) and 37 to 39)
• Respond to the Lead Overseer's recommendations, for example on ICT security requirements, on the terms under which it serves financial entities, or on planned subcontracting (Article 35(1)(d)). Within 60 calendar days, it must either notify its intention to follow them or give a reasoned explanation for not doing so (Article 42(1)). Recommendations are not binding, but a missing or insufficient explanation is disclosed publicly (Article 42(2))
• Pay oversight fees that cover the Lead Overseer's expenditure (Article 43)

Non-compliance with information requests, investigations, inspections or requests for remediation reports exposes a CTPP to periodic penalty payments decided by the Lead Overseer, imposed daily until compliance and for no more than six months (Article 35(6) to (8)). How the amount is calculated is set out in our guide to DORA penalties and enforcement.

For Financial Entities Using These Providers

Designation changes who oversees the provider. It does not change the clauses your contracts need, and it does not lighten your own obligations: a financial entity remains fully responsible for compliance whichever ICT third-party service provider it uses (Article 28(1)(a)). For you, designation adds two things: an EU establishment condition for third-country CTPPs, and the follow-up of the Lead Overseer's recommendations. If any of the 19 providers above appears in your Register of Information (RoI):

1. Classify each service, not the provider: record the designation in your third-party inventory, then check, contract by contract, whether the ICT service supports a critical or important function (CIF). That answer decides which Article 30 clauses apply and whether an exit strategy is required.
2. Verify contractual compliance: every ICT contract must contain the nine elements of Article 30(2), and a contract for services supporting a CIF must also contain the six of Article 30(3). A contract with a CTPP that supports only non-critical functions needs the Article 30(2) set, like a contract with any other provider. Where elements are missing, request an addendum (both lists are set out below).
3. Check the EU establishment condition: if the CTPP is established in a third country, you may only keep using its services if it has established a subsidiary in the Union within the 12 months following its designation (Article 31(12)). This is the one condition DORA attaches to your use of a provider because it is a CTPP.
4. Follow up the Lead Overseer's recommendations: your competent authority informs you of the risks identified in recommendations addressed to a CTPP, and you must take them into account in your ICT third-party risk management (Article 42(3)). If you do not address them, the competent authority may, as a last resort, require you to suspend or terminate the service (Article 42(4) and (6)).
5. Review exit plans where a critical or important function is supported: Article 28(8) requires exit strategies for ICT services supporting CIFs, whoever the provider is. Exit plans must be comprehensive, documented, and sufficiently tested and reviewed periodically, in line with the proportionality criteria of Article 4(2). DORA sets no fixed testing frequency. Our guide to cloud exit strategy and concentration risk covers the method.
6. Assess concentration before adding CIF services: before contracting for a service that supports a CIF, assess whether it would mean relying on a provider that is not easily substitutable, or holding several CIF arrangements with the same or closely connected providers (Article 29(1)).
7. Align your incident reporting: a disruption at a CTPP can trigger your own incident classification and reporting obligations (Articles 18 and 19), even if your own systems are not directly affected.
8. Keep your management body informed: it approves and periodically reviews your policy on the use of ICT services provided by ICT third-party service providers, and it needs reporting channels on those arrangements (Article 5(2)(h) and (i)).

Concentration Risk: What the List Reveals

Grouped by the type of service they provide, the 19 designations reach well beyond the cloud platforms:

• IT services and outsourcing (6): Accenture, Capgemini, IBM, Kyndryl, NTT DATA and Tata Consultancy Services. This is the largest group on the list: application management, infrastructure operations and systems integration that many financial entities run through a handful of firms.
• Cloud platforms (4): Amazon Web Services, Google Cloud, Microsoft and Oracle.
• Telecommunications (3): Colt, Deutsche Telekom and Orange.
• Financial data and technology (3): Bloomberg, LSEG Data and Risk, and FIS.
• Data centres (2): Equinix and InterXion.
• Enterprise software (1): SAP.

Three practical consequences for your own concentration analysis:

• Look beneath your direct contracts. Data centre and network operators often sit underneath another provider. You can depend on Equinix, InterXion or a telecoms operator through your cloud, hosting or outsourcing provider without holding a contract with them. For services supporting a critical or important function, your Register of Information must also record the subcontractors that effectively underpin the service, which is where these indirect dependencies appear.
• Match by group, not by contracting entity. The list names one legal entity per provider, while your contracts are often signed with a local subsidiary or reseller. Record the ultimate parent of each provider in your register, so that several contracts are recognised as one dependency on the same group.
• Absence from the list proves nothing. Article 31(8) excludes four categories from designation (listed in the section on how CTPPs are designated above), among them financial entities that provide ICT services to other financial entities. Market infrastructures such as central securities depositories, which are financial entities themselves, therefore cannot appear. Your obligations under Articles 28 to 30 apply to every ICT third-party service provider, designated or not.

Where you rely on several designated providers in the same category for separate critical or important functions (for example two cloud platforms), document that reliance explicitly in your concentration risk assessment (Article 29).

Which Article 30 Clauses Your Contract Needs

Contracts with CTPPs do not need a special set of clauses. Article 30 DORA sorts contracts by the function the ICT service supports, not by the status of the provider. Designation brings the provider under EU oversight (Articles 31 to 44); it does not change which clauses your contract must contain.

Every ICT contract: Article 30(2)

Nine elements, whatever the provider and whatever the service:

• (a) Services: a clear and complete description of all functions and ICT services, stating whether subcontracting of a service supporting a critical or important function is permitted and, if so, on what conditions
• (b) Locations: the regions or countries where services are provided and data is processed and stored, with advance notice from the provider of any planned change
• (c) Data protection: provisions on the availability, authenticity, integrity and confidentiality of data, including personal data
• (d) Data return: access, recovery and return of data in an easily accessible format if the provider becomes insolvent, is resolved or discontinues its business, or if the contract is terminated
• (e) Service levels: service level descriptions, including updates and revisions
• (f) Incident assistance: help when an ICT incident related to the service occurs, at no additional cost or at a cost determined in advance
• (g) Cooperation with authorities: full cooperation with the competent authorities and resolution authorities of the financial entity
• (h) Termination: termination rights and related minimum notice periods, in accordance with the expectations of competent authorities and resolution authorities. DORA does not set a fixed notice period.
• (i) Training: the conditions for the provider's participation in your ICT security awareness programmes and digital operational resilience training (Article 13(6))

The contract must also allow termination in the circumstances listed in Article 28(7), such as a significant breach by the provider, or where the competent authority can no longer effectively supervise the financial entity because of the arrangement.

Services supporting a critical or important function: Article 30(3)

Six further elements apply when the ICT service supports a CIF, whether or not the provider is designated:

• (a) Quantified service levels: full service level descriptions with precise quantitative and qualitative performance targets
• (b) Notice and reporting: notice periods and reporting obligations of the provider, including notice of any development that might materially affect its ability to deliver the service
• (c) Contingency and security: requirements for the provider to implement and test business contingency plans and to have appropriate ICT security measures, tools and policies in place
• (d) TLPT: participation and full cooperation in your threat-led penetration testing (TLPT) under Articles 26 and 27
• (e) Monitoring and audit: unrestricted rights of access, inspection and audit for you, an appointed third party and your competent authority, and the provider's full cooperation during on-site inspections and audits, including those of the Lead Overseer
• (f) Exit: exit strategies with a mandatory adequate transition period, during which the provider keeps delivering the service while you migrate to another provider or in-house

Three points are often missed. A microenterprise may agree that its access, inspection and audit rights are delegated to an independent third party appointed by the provider (Article 30(3), last subparagraph). Where the provider may subcontract services supporting a CIF, Delegated Regulation (EU) 2025/532 adds what the contract must specify, including which services may be subcontracted, on what conditions, and a notice period for you to object to material changes (Articles 4 to 6). And recovery time and recovery point objectives (RTO and RPO) are not an Article 30 clause: you set them for each function in your own backup and recovery arrangements (Article 12(6)). Where you need the provider to meet them, carry them in the quantified service levels of point (a).

Where your provider offers a DORA addendum, check its latest version in the provider's trust centre or legal portal, verify that it has been formally executed (signed or electronically accepted) rather than simply made available, and map each of its terms to the points above. For CIF services, read point (e) with particular care: a certification or audit report supplied by the provider is assurance, not an audit right, and you may not rely on such reports alone over time (Delegated Regulation (EU) 2024/1773, Article 8(3)).

Key Takeaways

• 19 providers were designated as CTPPs on 18 November 2025: the first list published under Article 31(9) DORA, which the ESAs update every year
• The list is broader than the cloud: six IT services firms, four cloud platforms, three telecoms operators, three financial data and technology providers, two data centre operators and one enterprise software provider
• Designation places a provider under EU oversight by a Lead Overseer (Articles 31 to 44). It does not change which Article 30 clauses your contracts need
• Clauses follow the function supported: nine Article 30(2) elements in every ICT contract, plus six Article 30(3) elements when the service supports a critical or important function, whoever the provider is
• Exit strategies are required for ICT services supporting critical or important functions (Article 28(8)), and exit plans must be tested and reviewed periodically on a proportionate basis. DORA fixes neither a contractual notice period nor a testing frequency
• The one CTPP-specific condition on your use of a provider: a CTPP established in a third country must set up a subsidiary in the Union within 12 months of its designation, or financial entities may no longer use its services (Article 31(12))
• Lead Overseer recommendations do not bind the CTPP, but your competent authority passes on the risks they identify, and you must take those risks into account (Article 42(3))

Next Steps

Use the table above to cross-check your Register of Information, matching on the group rather than the contracting entity, and including the subcontractors that underpin services supporting critical or important functions. For each CTPP that appears, confirm which functions each of its services supports, check the contract against Article 30(2) and, where a critical or important function is involved, Article 30(3), and make sure your incident response runbook accounts for disruptions originating at the provider. Our Third-Party Risk Scorer and Register of Information guide can help structure this review.

Frequently asked questions

Who designates critical ICT third-party providers under DORA?

The three European Supervisory Authorities (EBA, EIOPA and ESMA), acting through their Joint Committee and upon recommendation from the Oversight Forum (Article 31(1)). In the same decision they appoint a Lead Overseer for each designated provider.

Does designation make the provider responsible for the financial entity's ICT risk?

No. Under Article 28(1)(a), financial entities remain fully responsible, at all times, for complying with DORA when they use ICT services from third parties, designated or not.

How long does a provider have to respond to its assessment?

Six weeks from the notification of the outcome of the assessment, to submit a reasoned statement with any relevant supporting information (Article 31(5)).

Can an ICT provider ask to be designated as critical?

Yes. Under Article 31(11), a provider that is not on the list may submit a reasoned application to the EBA, ESMA or EIOPA. The ESAs decide within six months of receiving the application.

Where is the current list of CTPPs?

The ESAs publish the list and update it every year (Article 31(9)). The first list, of 18 November 2025, is reproduced in the table above with a link to the official document. Check the ESAs' websites for the version in force.

Must a third-country CTPP have an EU presence?

Yes. Financial entities may only use the services of a CTPP established in a third country if it establishes a subsidiary in the Union within the 12 months following its designation (Article 31(12)).