Breaking: ESAs Publish First List of Critical ICT Third-Party Providers Under DORA

In a landmark development for DORA compliance, the European Supervisory Authorities (ESAs) have published the first official list of Critical ICT Third-Party Service Providers (CTPPs) on November 18, 2025. This designation marks a major milestone in operationalizing DORA's third-party risk regime.

What Are Critical Third-Party Providers (CTPPs)?

Under DORA, CTPPs are ICT service providers whose failure or disruption could pose systemic risk to the financial sector. The ESAs designation brings these providers within a new, EU-level system of direct oversight.

Criteria for CTPP Designation

Designation rests on the four criteria of Article 31(2) DORA, applied to the ICT services the provider delivers:

• Systemic impact: the impact on the stability, continuity or quality of financial services if the provider faced a large-scale operational failure, taking into account the number of financial entities and the total assets of those relying on it
• Systemic importance of its clients: the systemic character or importance of the financial entities that rely on the provider
• Reliance for critical or important functions: how far financial entities rely on the provider for services supporting critical or important functions
• Substitutability: the lack of real alternatives, and how difficult it would be to migrate data and workloads to another provider

Who Made the List?

The ESAs explain that the designated CTPPs deliver a range of ICT services, from core infrastructure to business and data services, to financial entities of all types and sizes across the EU. The official list names 19 legal entities. We reproduce it in full, with the group and type of service of each, in our list of the 19 designated CTPPs.

Notable Designations

Amazon Web Services (AWS) has been officially designated as a Critical Third-Party Provider. According to AWS's official statement, they will now participate in a formal oversight process designed to promote a deeper understanding of how cloud technologies enhance the resilience of the financial services industry.

The 19 designations fall into six groups:

• Cloud platforms: Amazon Web Services, Google Cloud, Microsoft and Oracle
• IT services and outsourcing: Accenture, Capgemini, IBM, Kyndryl, NTT DATA and Tata Consultancy Services
• Telecommunications: Colt, Deutsche Telekom and Orange
• Data centres: Equinix and InterXion
• Financial data and technology: Bloomberg, LSEG Data and Risk, and FIS
• Enterprise software: SAP

What Does CTPP Designation Mean?

For the Designated Providers

CTPPs are now subject to direct ESA oversight, which includes:

• Regulatory examinations: Regular assessments of risk management and governance frameworks
• On-site inspections: Physical audits of operations and security controls
• Information requests: Mandatory reporting to supervisory authorities
• Recommendations and penalties: the Lead Overseer can issue recommendations, which do not bind the provider but must be followed or explained within 60 calendar days (Article 42(1)), and can impose periodic penalty payments when the provider does not cooperate (Article 35(6) to (8))

For Financial Institutions

If your organization uses a designated CTPP, you must:

• Review existing contracts: Ensure all DORA-required clauses are in place
• Update risk assessments: Document the criticality of CTPP services
• Strengthen monitoring: Implement continuous oversight of CTPP performance
• Prepare exit strategies: Maintain documented and tested exit plans
• Report to authorities: Include CTPP relationships in your Register of Information

The ESA Oversight Framework

This designation follows the ESAs' publication of their supervisory approach in the July 2025 guide on CTPP oversight. The framework establishes:

Risk Assessment Process

The ESAs will assess whether CTPPs have appropriate:

• Risk management frameworks
• Governance structures
• Business continuity plans
• Incident response capabilities
• Security controls and testing programs

Ongoing Supervision

The oversight regime includes:

• Annual risk assessments
• Regular dialogue with CTPP management
• Coordination with national competent authorities
• Information sharing across the EU

Timeline and Key Dates

Impact on Financial Institutions

Immediate Actions Required

1. Identify CTPP relationships: Review your ICT provider inventory against the published list
2. Contract compliance check: Verify DORA-compliant clauses are in all CTPP agreements
3. Risk assessment update: Reassess concentration risk and dependencies
4. Board reporting: Inform management body of CTPP designations affecting your institution
5. Register of Information: Update your regulatory submissions to reflect CTPP status

Strategic Considerations

Financial institutions should consider:

• Multi-cloud strategies: Reducing concentration risk by diversifying providers
• Exit planning: Developing robust transition capabilities
• Contract negotiations: Leveraging CTPP status in service level discussions
• Collaboration: Working with CTPPs on compliance documentation

What This Means for Cloud Adoption

The CTPP designation should not be viewed as a barrier to cloud adoption. AWS has stated that it views the designation as an opportunity to demonstrate how cloud technologies enhance, rather than threaten, operational resilience.

Designation Is Not a Seal of Approval

• It does not certify the provider: designation reflects how much the financial sector depends on a provider, not the quality of its controls
• It does not lighten your obligations: you remain fully responsible for compliance whichever provider you use (Article 28(1)(a)), including your own due diligence, audit rights and Article 30 clauses
• It does give you information: your competent authority informs you of the risks identified in Lead Overseer recommendations, and you must take them into account (Article 42(3))

Penalties for Non-Compliance

Organizations failing to properly manage CTPP relationships face significant consequences:

• Financial penalties: ceiling set by your national supervisor (Art. 50). DORA fixes no EU-wide amount
• Individual liability: Article 50(5) extends penalties to the management body and other responsible individuals, at amounts set by national law
• Operational restrictions: Regulators may impose business limitations
• Reputational damage: Public disclosure of compliance failures

Next Steps for Your Organization

To ensure compliance with DORA's CTPP requirements:

1. Download the ESA list: Review the official list of designated CTPPs and match it against your Register of Information by group, not by contracting entity
2. Conduct impact assessment: Identify which CTPPs you rely on
3. Review contracts: Ensure DORA-compliant clauses are in place
4. Update risk frameworks: Integrate CTPP oversight into your ICT risk management
5. Engage with providers: Coordinate compliance efforts with your CTPPs
6. Document everything: Maintain comprehensive records for regulatory review