ESMA_QA_2847
Topic
Other DORA topics
15/05/2026
Subject Matter
conclusion of ICT arrangement for the purpose of tests
Question
In certain scenarios, a financial entity may enter into an arrangement with an ICT third-party service provider solely for testing purposes. These tests typically span several weeks, during which digital service is delivered through ICT systems on an ongoing basis, however to no internal or external users. Furthermore, digital service provided by the ICT third-party service provider is not supporting any function of financial entity, and the testing process itself has no operational impact on the entity's current standing or infrastructure.
Question:
1. Is the financial entity required to notify in a timely manner about any planned contractual arrangement the competent authorities of an arrangement concluded strictly for testing purposes, if it is anticipated that—upon successful completion—the digital service will eventually support a critical or important function?
2. What is the exact date which shall be used in the register of information if the tests will be succesfull and the digital service will be offered to one or more internal or external users? Should this date correspond to the initial commencement of the testing phase or the formal launch of the service in the production environment?
Level 1 Regulation
Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)
ESMA_QA_2830
Topic
Crypto-Asset Service Provider (CASP)
06/04/2026
Subject Matter
Third-party advice by independent contractors not authorised as CASPs under Article 62(2)(q) of the MiCA Regulation
Question
Under Article 62(2)(q) of the Markets in Crypto-Assets Regulation (MiCAR):
1. May independent contractors provide advice on crypto-assets on behalf of crypto-asset service providers (CASP) without being authorised as CASPs nor directly employed by said CASPs?
2. May independent contractors be hired by CASPs to provide crypto-assets advice on behalf of said CASPs?
Level 1 Regulation
MiCA
ESMA_QA_2800
Topic
Suitability
10/03/2026
Subject Matter
Personal recommendation and suitability statement: documentation nature and staff attribution in split/automated processes
Question
Under MiFID II, investment advice is defined as a personal recommendation to a client in relation to transactions in financial instruments. In practice, the personal recommendation, the suitability assessment, the documentation and the technical generation/transmission of the suitability statement may be performed by different persons and/or partly automated systems.

Could ESMA clarify the following points:

1. For determining whether and by whom investment advice was provided, is it primarily relevant who gave/communicated the personal recommendation to the client, rather than who merely prepared/generated/transmitted the suitability statement through IT systems?

2. Should the suitability statement under MiFID II / Delegated Regulation (EU) 2017/565 be understood as documentation and rationale of a recommendation that has already been made, rather than as a constitutive element of “investment advice”?

3. Is it necessary, for the attribution of investment advice to a specific staff member, that the same staff member is technically able to create/approve/transmit the suitability statement, or can these steps be separated without changing the attribution of who “advised”?
Level 1 Regulation
Directive 2014/65/EU - Markets in Financial Instruments Directive (MiFID II)
ESMA_QA_2799
Topic
Suitability
10/03/2026
Subject Matter
Attribution of investment advice in split or system-supported workflows (personal recommendation vs suitability statement)
Question
In practice, investment firms may apply “tandem” or split workflows where one staff member conducts the client meeting, gathers the client’s circumstances and communicates/explains a concrete course of action to the client, while another staff member and/or a partly automated system performs the suitability assessment, approval and/or generates/transmits the suitability statement.

Against this background, could ESMA clarify, under MiFID II and relevant Level-2 measures, the EU-law criteria for determining whether the staff member who leads the client interaction and explains the recommendation is already providing investment advice, or whether that activity can be regarded as acting under supervision?

In particular:

1. For the attribution of investment advice, is the decisive element who communicates the personal recommendation to the client, rather than who technically generates/approves/transmits the suitability statement?

2. In split workflows, what organisational minimum features are expected to evidence “under supervision” (e.g. explicit assignment of the supervisory role, timely intervention capability, documented review/approval/sign-off), where the supervised staff member communicates the personal recommendation?
Level 1 Regulation
Directive 2014/65/EU - Markets in Financial Instruments Directive (MiFID II)
ESMA_QA_2792
Topic
ICT third-party risk management
03/03/2026
Subject Matter
is Mastercard Schemes Network ICT service?
Question
Is Mastercard Schemes Network ICT service?
Level 1 Regulation
Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)