Under DORA Article 31, the European Supervisory Authorities designate ICT third-party providers as critical based on systemic impact, the importance of the financial entities relying on them, dependence for critical functions, and how hard the provider is to replace. The ESAs published the first list on 18 November 2025. Designated providers come under direct EU oversight.
The four criteria
Article 31(2) says designation rests on all of these, assessed for the ICT services provided:
- Systemic impact on the stability, continuity or quality of financial services if the provider suffered a large scale operational failure, considering the number of financial entities and their assets.
- Systemic character of the customers, such as how many globally or other systemically important institutions rely on the provider, and how interdependent they are.
- Reliance for critical or important functions, directly or through subcontracting.
- Substitutability: the lack of real alternatives, or the cost, time and risk of migrating data and workloads.
If the provider belongs to a group, the criteria apply to the services of the group as a whole.
What the ESAs did
The ESAs' announcement states that the list was prepared using data from the registers of information that financial entities keep on their ICT contracts, followed by a criticality assessment with national competent authorities from the banking, insurance and pensions, and securities sectors. Providers assessed as critical were formally notified and could submit a reasoned statement before final decisions. The announcement describes the designated providers as offering services from core infrastructure to business and data services. It does not state the count on that page, so refer to the published list for names and numbers.
The register of information is therefore not only a compliance document. It feeds supervisory decisions about which providers get oversight.
What designation means
After designation, a Lead Overseer is appointed among the ESAs. The provider has six weeks to submit a reasoned statement after notification of the assessment (Article 31(5)), and oversight starts no later than one month after notification of the designation. Providers established in a third country must set up a subsidiary in the EU within 12 months of designation for financial entities to keep using them (Article 31(12)). Providers not on the list may apply to be designated (Article 31(11)).
Some are excluded: financial entities providing ICT services to other financial entities, intra-group providers, providers subject to certain central bank oversight frameworks, and providers serving only one member state's purely local financial entities (Article 31(8)).
What it means for financial entities
Designation does not remove a financial entity's duties. Article 28(1)(a) keeps the entity fully responsible. You still need your register entries, contract terms, exit plans and monitoring. Designation adds an extra layer of supervisory scrutiny of the provider.
What it means for other providers
If you are not designated, you can still expect customers to push down the same contract terms. Being ready with a clear subprocessor list, incident notification terms, audit process and exit assistance helps in procurement either way.
Safeguard's compliance and evidence automation and SBOM and dependency scanning can help vendors assemble the technical evidence customers request.
Quick check
Does DORA oversight apply to every cloud provider?
No. Only providers the ESAs designate as critical come under the Oversight Framework. Other providers are managed through their customers' contracts and risk processes.
Where is the official list?
The ESAs link it from their November 2025 announcement. Check it directly for current names, because the list is updated yearly under Article 31(9).
Sources
- Regulation (EU) 2022/2554 (DORA), EUR-Lex
- ESMA: European Supervisory Authorities designate critical ICT third-party providers
Last reviewed: 19 October 2026.
