Question ID: DORA 192 - 3206
Regulation Reference: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Topic: Other DORA topics
Article: 2(1)(u)
Status: Rejected
Date of submission: 12 Dec 2024
Question
Pursuant to article 2 of DORA, professionals of the financial sector defined in articles 257 seq. of the Luxembourg law on the insurance sector dated 7 December 2015 (as amended from time to time) are not in the scope of DORA. Nevertheless, some of the professionals of the insurance sector provide ICT services. When they provide OCT services, would they enter into the scope of article 2 paragraph 1 (u) DORA?
Background of the question
the question relate to the question currently under analysis of the provision of ICT services by financial entities as ancillary services in addition to their core activity. The professional of the insurance sector has not been included in the scope of DORA but they sometimes provide ICT services.
EIOPA answer
The question has been rejected because it seeks bespoke advice. Moreover, the matter it refers to has been answered in Q&A DORA030, which provides guidance regarding the difference between ICT service and financial service. The following bilateral answer, not to be published, is proposed: DORA applies to all financial entities as defined in Article 2 of the Regulation. If a company – even if they are financial entities – provides ICT services to other financial entities the specific DORA provisions apply, including in the sense that financial entities, their customers, are mandated to require them to comply with the requirements stemming from DORA. For further information relating to the scenario when a financial entity provides ICT services to other financial entities please refer to DORA030.