Subcontracting ICT services

This is a placeholder-page for the full legal text of the regulator techincal standard (RTS) on subcontracting ICT services, supplementing DORA. It was submitted by the ESAs to the European Commission in January 2024 as mandated by Article 30(5) of DORA. It is expected to become applicable on 17 January 2025 along with DORA.

Until we publish the full legal text here, please find the draft RTS on ESMA’s web page or the adopted regulation on the EC’s web page..

The RTS on subcontracting ICT services mandates financial entities to thoroughly assess subcontracting risks during precontractual phases, encompassing due diligence processes. It also outlines requirements for implementing, monitoring, and managing subcontracting conditions, ensuring comprehensive oversight of the ICT subcontracting chain.