ESAs designate the first critical ICT third-party providers under DORA

On 18 November 2025 the European Supervisory Authorities (EBA, EIOPA and ESMA) published the first list of ICT third-party service providers designated as critical under DORA. Designated providers come under direct ESA oversight, which will assess whether they maintain appropriate risk-management and governance frameworks for the services they deliver to the EU financial sector.

DORA's oversight regime is now operating, not theoretical: the major cloud and platform providers that financial entities depend on have an EU supervisor of their own, and oversight findings will flow into firms' third-party risk assessments.

The designated ICT providers directly; every financial entity that relies on them for critical functions indirectly.

Check which of your critical ICT vendors appear on the ESAs' list, record the designation in your register of information, and factor ESA oversight into your third-party risk assessments.