Recital 98
Digital Operational Resilience Act · UE 2022/2554
| (98) | In order to further quantify and qualify the criteria for the designation of ICT third-party service providers as critical and to harmonise oversight fees, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission to supplement this Regulation by further specifying the systemic impact that a failure or operational outage of an ICT third-party service provider could have on the financial entities it provides ICT services to, the number of global systemically important institutions (G-SIIs), or other systemically important institutions (O-SIIs), that rely on the ICT third-party service provider in question, the number of ICT third-party service providers active on a given market, the costs of migrating data and ICT workloads to other ICT third-party service providers, as well as the amount of the oversight fees and the way in which they are to be paid. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making (22). In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council should receive all documents at the same time as Member States’ experts, and their experts should systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. |
In Luxembourg, the CSSF is the competent authority for monitoring financial entities subject to DORA and oversees the integration of Commission delegated acts into its sectoral circulars, in particular CSSF Circular 22/806 on ICT outsourcing arrangements, which predated DORA and is being progressively aligned with the Regulation. Any change in CTPP criteria from a delegated act is typically relayed through a CSSF circular update or FAQ that your compliance teams must integrate without delay.
Luxgap practice: we configure CTPP Radar to monitor the OJEU and CSSF publications (circulars, FAQs, communiques) simultaneously, so your internal thresholds stay aligned with both EU law and Luxembourg prudential doctrine.