ESMA_QA_2056

Status: ✅ Answer Published

Link to ESMA Q&A tool: https://www.esma.europa.eu/publications-data/questions-answers/2056

---

Regulatory Context

Regulation : DORA

Level 1 Regulation: Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)

Level 2 Regulation: No information available

Level 3 Regulation: No information available

Topic: ICT third-party risk management

Subject Matter: Software distributors

---

Question

Submission Date: 20 December 2023

When an off-the-shelf software license (e.g. operating systems, database) is purchased through a distributor, is the distributor qualifying as “ICT third-party service provider” in case if the distributor itself is not providing any additional services in addition to the distribution, and its contractual tasks are completed with the successful intermediation of the license agreement? Is the software company qualifying as a direct “ICT third-party service provider” based on the end-user license agreement (EULA) accepted by the financial entity?

---

ESMA Answer

Answer Date: 20-12-2023

No answer has been published yet for this question.

---

This document was automatically extracted from the ESMA EMIR Q&A database.