ESMA_QA_2056
20/12/2023
Subject Matter
Software distributors
Original question
When an off-the-shelf software license (e.g. operating systems, database) is purchased through a distributor, is the distributor qualifying as “ICT third-party service provider” in case if the distributor itself is not providing any additional services in addition to the distribution, and its contractual tasks are completed with the successful intermediation of the license agreement? Is the software company qualifying as a direct “ICT third-party service provider” based on the end-user license agreement (EULA) accepted by the financial entity?
Status: Question Rejected
Additional Information
Level 1 Regulation
Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)
Additional Legal Reference
On Draft Implementing Technical Standards to establish the templates composing the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers as mandated by Regulation (EU)
Topic
ICT third-party risk management