The European Commission (“Commission”) has formally rejected a draft Regulatory Technical Standard (“RTS”) proposed by the European Supervisory Authorities (“ESAs”) concerning the subcontracting of ICT services supporting critical or important functions under DORA.
In a letter addressed to the Chair of the Joint Committee of the ESAs, it was stated that while the draft RTS provided essential conditions for ICT subcontracting, one key provision exceeded the ESAs’ mandate under DORA. Specifically, Article 5 of the RTS, which imposed monitoring requirements on subcontracting chains, which was deemed to go beyond the delegated authority granted by Article 30(5) of DORA; as it introduced requirements which are not specifically linked to the conditions for subcontracting.
As a result, the Commission has requested the ESAs to remove these provisions before reconsidering the RTS. Despite the rejection however, the Commission expressed willingness to adopt the RTS once the necessary amendments are made. The ESAs now have six weeks to revise the RTS in line with such instructions and failure to do so would result in the Commission reserving the right to adopt the RTS with its own amendments or reject it entirely.
The Commission’s rejection raises uncertainty for captured financial entities and ICT third-party service providers that have already entered into contracts based on the draft regulatory framework. Institutions that pre-emptively aligned their agreements with the draft RTS may need to reassess their contractual obligations. Such ambiguity is bound to lead to delays in compliance strategies and potential operational disruptions until a revised RTS is formally adopted.
Nevertheless, the outcome of the ESAs' response will be closely monitored as financial institutions prepare for the full implementation of DORA’s requirements.
--
For more information and assistance, please contact us at info@gtg.com.mt.
News update by: J.J. Galea