Search a question

ESMA_QA_2675
Topic
ICT third-party risk management
28/10/2025
Subject Matter
Contractual agreement with ICT service providers
Question
Art. 30 (1) & (2) of DORA demand that financial institutions have signed contractual agreements with all their ICT service providers, in particular in Art. 30(2) &(3) the elements that shall be included in the contractual arrangements are listed.

Are ICT service providers permitted under DORA to charge the financial institutions "merely for signing" a DORA addendum or updated contractual arrangements in the framework of Art. 30, DORA?

Level 1 Regulation
Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)
ESMA_QA_2646
Topic
ICT third-party risk management
18/09/2025
Subject Matter
Audit frequency limitations
Question
As DORA requires financial entities to pre-determine the frequency of audits and inspections on the basis of a risk-based approach, are financial entities not permitted to agree on a maximum audit frequency (e.g. once per year) with their ICT third-party service providers?
Level 1 Regulation
Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)
ESMA_QA_2547
Topic
Other DORA topics
27/05/2025
Subject Matter
Does DORA also apply to non-EU AIFM?
Question
The regulation applies to managers of alternative investment funds according to Article 2, point (k) of DORA. According to Article 3, (point 44), of DORA a manager of alternative investment funds is defined as “a manager of alternative investment funds as defined in Article 4(1), point (b), of Directive 2011/61/EU”.
According to Article 4(1), point (b), of Directive 2011/61/EU (AIFM Directive) “AIFMs’ means legal persons whose regular business is managing one or more AIFs”. We are of the understanding that Article 4(1), point (b), does not exclude non-EU AIFM. EU AIFM and non-EU AIFM are defined in Article 4(1), point (L) and point (ab). Since DORA only refers to article 4(1), point (b), of the AIFM Directive and not to article 4(1), point (L), we are wondering if DORA applies to both EU and non-EU AIFM as the definition implies.
Level 1 Regulation
Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)
ESMA_QA_2496
Topic
ICT-related incident 
27/03/2025
Subject Matter
Incident report submission format
Question
What is the submission format for the incident reports (initial notification, intermediate and final) that CTPPs and Financial Entities need to submit to the CA?
Level 1 Regulation
Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)
ESMA_QA_2459
Topic
Register of information
11/03/2025
Subject Matter
Fintech company: DORA AND ROI
Question
Hi Team,

Hope you are well!

We are a Spanish Fintech company called Toqio, our company lets you create, customize, and scale unique financial products in our platform.Please find more information below:

https://toqio.co/platform

Could you please confirm that we have to comply with DORA and also we have to send the ROI to the authorities?

Thank you in advance,

Kindest regards,

Ester
Level 1 Regulation
Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)