The ESAs acknowledge the European Commission's amendments to the technical standard on subcontracting under the Digital Operational Resilience Act

The European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) today issued an Opinion on the European Commission’s (EC) rejection of the draft Regulatory Technical Standard (RTS) on subcontracting.

The EC rejected the original draft RTS on subcontracting, which specified further elements that financial entities must determine and assess when subcontracting ICT services that support critical or important functions under the Digital Operational Resilience Act (DORA), on the grounds that certain elements exceeded the powers given to the ESAs by DORA.

Today’s Opinion acknowledges the assessment performed by the EC and confirms that the amendments proposed ensure that the draft RTS is in line with the mandate set out under DORA. For this reason, the ESAs do not recommend further amendments to the RTS in addition to the ones proposed by the EC.

The ESAs encourage the EC to finalise the adoption of the RTS without further delay as submitted to the ESAs.

Legal basis

Article 30(5) of DORA mandates the ESAs to develop draft regulatory technical standards specifying the elements that a financial entity must determine and assess when subcontracting ICT services supporting critical or important functions. The ESAs submitted to the EC their original RTS on 17 July 2024. On 21 January 2025 and in accordance with Article 15(1) of the ESAs Regulations, the EC notified the ESAs that it rejected the draft RTS. Pursuant to Article 10(1) of the ESAs Regulations, the ESAs prepared this Opinion on the proposed amendments to the draft RTS by the EC.