Art. 5 Ex-ante risk assessment | RTS on ICT third-party service provider policy | DORA

Article 5 sets out the pre-contractual obligations that must be embedded in a financial entity's policy before any contractual arrangement with an ICT third-party service provider is concluded.

It establishes two clear prerequisites: first, that business needs are defined upfront, and second, that a thorough risk assessment is carried out.

The risk assessment requirement is notably detailed, covering a broad range of risk categories that must be evaluated, from operational and legal risks through to data location risks and ICT concentration risks.

This article connects directly to Article 4, which governs the lifecycle of contractual arrangements, by anchoring the planning phase of that lifecycle in a structured, risk-informed approach.

Important points:

Define business needs and conduct a risk assessment before entering into any contractual arrangement with an ICT third-party service provider.
The risk assessment must be conducted at financial entity level and, where applicable, at consolidated and sub-consolidated level.
The risk assessment must cover a wide range of risk categories, including ICT concentration risks at entity level and risks linked to the location where data is processed and stored.

1. The policy shall require that the business needs of the financial entity are defined before a contractual arrangement is concluded.
1. The policy shall require that a risk assessment is conducted at financial entity level and, where applicable, at consolidated and sub-consolidated level before a contractual arrangement is concluded.
2. The risk assessment shall take into account all the relevant requirements laid down in Regulation (EU) 2022/2554 and applicable sectoral Union legislation. It shall consider, in particular, the impact of the provision of ICT services supporting critical or important functions by ICT third-party service providers on the financial entity and all the risks posed by the provision of those ICT services supporting critical or important functions by ICT third-party service providers, including the following:
  1. operational risks;
  2. legal risks;
  3. ICT risks;
  4. reputational risks;
  5. risks linked to the protection of confidential or personal data;
  6. risks linked to the availability of data;
  7. risks linked to the location where the data is processed and stored;
  8. risks linked to the location of the ICT third-party service provider;
  9. ICT concentration risks at entity level.