ESMA_QA_2378
17/12/2024
Subject Matter
Article 3(28) and EU Subcontractors
    DORA Article 3(28) excludes natural persons from the definition of 3rd country subcontractors, does the same apply to EU Subcontractors?
    ESMA Answer
    17-12-2024

      Article 3(28) clearly carves out natural persons from the definition of 3rd country subcontractors. This does however not infer that natural persons are not included in the scope of EU subcontractors.

      The ITS on the Register of Information clearly indicates that (i) subcontractors may be individuals acting in business capacity (Article 3(6)) and (ii) in Part 2, tables on instructions, line B_05.01.0070). It is clarified that ICT third party service providers may be either legal persons or individuals acting on business capacity.

      When we look at Article 29(2) of DORA, we can infer that the relevant subcontractors are anyway ICT third party service providers. Hence, other than in the case of the third-country subcontractors, the ITS on registers has clarified that EU ICT subcontractors may be individuals.

      Status: Answer Published

      Additional Information

      Level 1 Regulation
      Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)
      Topic
      Digital operational resilience testing