The European Commission (Commission) recently published a letter (Letter) that it sent to the European Supervisory Authorities (ESAs) rejecting certain draft regulatory technical standards (RTS) under the EU Digital Operational Resilience Act (DORA). The draft RTS specified the conditions and criteria to be considered by financial entities when sub-contracting information communication and technology (ICT) services supporting critical or important functions. The Letter, dated 21 January 2025, follows the ESAs’ submission of its final report on the draft RTS in July 2024. 

In the Letter, the Commission explained its rejection on the basis that the requirements introduced by Article 5 of the draft RTS on the “Conditions for sub-contracting relating to the chain of ICT sub-contractors providing a service supporting a critical or important function by the financial entity” go beyond the mandate provided to the ESAs under Article 30(5) of DORA. This is because they introduce requirements not specifically linked to the conditions for sub-contracting. 

In light of this, the Commission considered that Article 5 of the draft RTS and the related Recital 5 should be removed to ensure the ESAs comply with its mandate set out in DORA. 

The Commission intends to adopt the RTS once its concerns are addressed and the necessary modifications are made by the ESAs.

The Letter is available here.