ESMA_QA_2378
Status: ✅ Answer Published
Link to ESMA Q&A tool: https://www.esma.europa.eu/publications-data/questions-answers/2378
Regulatory Context
Regulation : DORA
Level 1 Regulation: Regulation (EU) 2022/2554 - The Digital Operational Resilience Act (DORA)
Level 2 Regulation: No information available
Level 3 Regulation: No information available
Topic: Digital operational resilience testing
Subject Matter: Article 3(28) and EU Subcontractors
Question
Submission Date: 17 December 2024
DORA Article 3(28) excludes natural persons from the definition of 3rd country subcontractors, does the same apply to EU Subcontractors?
ESMA Answer
Answer Date: 17-12-2024
Article 3(28) clearly carves out natural persons from the definition of 3rd country subcontractors. This does however not infer that natural persons are not included in the scope of EU subcontractors. The ITS on the Register of Information clearly indicates that (i) subcontractors may be individuals acting in business capacity (Article 3(6)) and (ii) in Part 2, tables on instructions, line B_05.01.0070). It is clarified that ICT third party service providers may be either legal persons or individuals acting on business capacity. When we look at Article 29(2) of DORA, we can infer that the relevant subcontractors are anyway ICT third party service providers. Hence, other than in the case of the third-country subcontractors, the ITS on registers has clarified that EU ICT subcontractors may be individuals.
This document was automatically extracted from the ESMA EMIR Q&A database.