ESMA_QA_2675
28/10/2025
Subject Matter
Contractual agreement with ICT service providers
    Art. 30 (1) & (2) of DORA demand that financial institutions have signed contractual agreements with all their ICT service providers, in particular in Art. 30(2) &(3) the elements that shall be included in the contractual arrangements are listed.

    Are ICT service providers permitted under DORA to charge the financial institutions "merely for signing" a DORA addendum or updated contractual arrangements in the framework of Art. 30, DORA?

    Status: Question Rejected

    Additional Information

    Level 1 Regulation
    Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)
    Additional Legal Reference
    Art. 30, DORA
    Topic
    ICT third-party risk management