ESMA_QA_2056
20/12/2023
Subject Matter
Software distributors
    When an off-the-shelf software license (e.g. operating systems, database) is purchased through a distributor, is the distributor qualifying as “ICT third-party service provider” in case if the distributor itself is not providing any additional services in addition to the distribution, and its contractual tasks are completed with the successful intermediation of the license agreement? Is the software company qualifying as a direct “ICT third-party service provider” based on the end-user license agreement (EULA) accepted by the financial entity?
    Status: Question Rejected

    Additional Information

    Level 1 Regulation
    Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)
    Additional Legal Reference
    On Draft Implementing Technical Standards to establish the templates composing the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers as mandated by Regulation (EU)
    Topic
    ICT third-party risk management