YTYK You think you know

Card 15 of 15 Third-party risk — the register and the overseer ●●● Sharp edge

The EU supervises your cloud provider directly

The ESAs designate critical ICT third-party providers (CTPPs) and place them under a direct EU oversight framework, each with a Lead Overseer that can request information, conduct investigations and inspections, issue recommendations — and, ultimately, where a CTPP does not comply, lead to financial entities being required to suspend or terminate use of the service.

Why it is like this

Concentration had reached the point where a handful of providers were systemically important to European finance while sitting entirely outside financial regulation. This is the first EU regime to reach them, and it reaches them directly rather than through their customers.

Not to be confused with

Licensing or authorisation. A CTPP is not authorised and does not become a regulated financial entity; it is overseen. And the enforcement route runs through the financial entities — the Lead Overseer cannot fine the provider into compliance, but it can make its customers leave.

In practice

Designation is based on systemic impact, the criticality of the entities relying on the provider, substitutability and degree of concentration — and a provider may also ask to be designated voluntarily.

Source: Regulation (EU) 2022/2554 (DORA) — Art. 31 to Art. 44. Read on .

Predict Check yourself

A Lead Overseer issues recommendations to a designated CTPP, which declines to follow them. What is the ultimate consequence?

  1. Competent authorities can require the financial entities using it to suspend or terminate the service — enforcement runs through the customers.
  2. The CTPP's authorisation to operate in the EU is withdrawn.
  3. The CTPP is fined up to 2% of worldwide turnover and may continue operating.
  4. Nothing — the recommendations are advisory and carry no consequence.
Show the answer

Competent authorities can require the financial entities using it to suspend or terminate the service — enforcement runs through the customers.

The provider was never authorised, so there is no licence to withdraw. The lever is the customer base, which is what makes the regime unusual.