What are critical ICT third-party providers?
Critical ICT third-party providers, abbreviated CTPPs, are technology companies formally designated by the European Supervisory Authorities under DORA because many financial entities depend on their services and a major failure could affect the financial system. Designation concerns the provider at EU level. A bank separately decides whether each contracted service supports one of its critical or important functions.
Critical ict third party providers in brief
| Term | critical ICT third party providers |
|---|---|
| Meaning | Critical ICT third-party providers, abbreviated CTPPs, are technology companies formally designated by the European Supervisory Authorities under DORA because many financial entities depend on their services and a major failure could affect the financial system. Designation concerns the provider at EU level. A bank separately decides whether each contracted service supports one of its critical or important functions. |
| Bank use | The framework addresses concentration risk across banks, insurers, payment firms and market infrastructures. It covers more than cloud platforms: telecoms, data centers, financial data, enterprise software and managed IT can also become systemically important. Banks use the published designation in their provider inventory, but contract classification still follows the function that the individual service supports. |
| Main risk | A common mistake is to treat EU oversight as a substitute for vendor management. The financial entity remains responsible for due diligence, contracts, monitoring, incidents, concentration and exit. Another mistake is to label every service from a designated group as critical. The bank needs a service-level assessment that traces the supported process and subcontractors before applying the extra contract clauses. |
| Rule set | Articles 31 to 44 of DORA establish designation and oversight. Articles 28 to 30 govern the financial entity's third-party risk and contracts. The first list was published in November 2025 and is updated annually. The framework does not remove national supervision of the banks that buy the services. |
| Detailed page | Detailed guide |
How does critical ICT third party providers work?
Critical ICT third-party providers, abbreviated CTPPs, are technology companies formally designated by the European Supervisory Authorities under DORA because many financial entities depend on their services and a major failure could affect the financial system. Designation concerns the provider at EU level. A bank separately decides whether each contracted service supports one of its critical or important functions.
The ESAs use systemic impact, the importance of dependent financial entities, reliance for critical functions and substitutability as designation criteria. One authority becomes Lead Overseer and can request information, investigate, inspect and issue recommendations. Joint examination teams support the work. The provider pays oversight fees, but designation is not a financial-services license.
Why does critical ICT third party providers matter to banks?
The framework addresses concentration risk across banks, insurers, payment firms and market infrastructures. It covers more than cloud platforms: telecoms, data centers, financial data, enterprise software and managed IT can also become systemically important. Banks use the published designation in their provider inventory, but contract classification still follows the function that the individual service supports.
What risks and design choices come with critical ICT third party providers?
A common mistake is to treat EU oversight as a substitute for vendor management. The financial entity remains responsible for due diligence, contracts, monitoring, incidents, concentration and exit. Another mistake is to label every service from a designated group as critical. The bank needs a service-level assessment that traces the supported process and subcontractors before applying the extra contract clauses.
Which rules and standards apply to critical ICT third party providers?
Articles 31 to 44 of DORA establish designation and oversight. Articles 28 to 30 govern the financial entity's third-party risk and contracts. The first list was published in November 2025 and is updated annually. The framework does not remove national supervision of the banks that buy the services.
Critical ict third party providers in Germany, Austria and Switzerland
BaFin and the ECB supervise German users, the FMA supervises Austrian users and the national authorities act on findings from the EU Lead Overseer. Switzerland is outside DORA, so FINMA applies Swiss outsourcing and operational-risk expectations. Frankfurt hosts the EBA's sister authorities EIOPA and AMLA as well as the ECB, concentrating several European supervisory functions near major users of ICT services.
About Finance Loop: critical ICT third party providers
Finance Loop brings together bank technology, payments, capital markets and supervisory professionals who work on critical ICT third party providers. In Frankfurt, technical decisions meet the systems of the ECB, Bundesbank, Deutsche Börse and the banks based there.
The detailed page on critical ICT third party providers and Finance Loop events connect the definition with financial-sector projects and practitioners.