> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/eu-level/q-and-a/eba-qa-2024-7096-exemption-for-non-eu-ict-intra-group-service-providers.md). # Exemption for Non-EU ICT Intra-group Service Providers | | | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Authority** | EBA | | **Q\&A ID** | EBA\_QA\_2024\_7096 | | **Topic** | Oversight framework of CTPPs | | **Legal basis** | [Article 31(8)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-31-designation-of-critical-providers) DORA | | **Status** | Final Q\&A | | **Published** | 11/12/2024 | | **Submitted** | 29/05/2024 | | **Answer prepared by** | Answer prepared by the Joint ESAs Q\&A | | **Source** | [EBA Q\&A](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7096) | ## Question Is it accurate to interpret that an ICT intra-group service provider established outside the EU (non-EU country), providing critical services to an EU-based financial institution (parent undertaking), falls within the exemption outlined in [Article 31(8)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-31-designation-of-critical-providers) of DORA, thereby exempting the need for establishing a subsidiary within the EU? ## Background In accordance with the provision of [Article 31(12)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-31-designation-of-critical-providers) of DORA, financial institutions may use the services of ICT providers from third countries that have been designated as critical only if these providers have established a subsidiary in the EU within 12 months of the designation. However, paragraph 8 of the same article provides exceptions, which include ICT intra-group service providers. The third-party provider is part of a financial group with the parent undertaking established in an EU country, while the third-party provider itself is established in a non-EU country. The provider primarily offers services to financial institutions within the same group and in our assessment meets the criteria for an "ICT intra-group service provider" as defined in Article 3(20). The bank is inquiring whether, in this case, the third-party provider is required to establish a subsidiary in the EU. ## Final answer In accordance with [Article 31(8)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-31-designation-of-critical-providers) point (iii) of DORA, the designation as critical ICT third-party provider referred to in [Article 31(1)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-31-designation-of-critical-providers) of DORA does not apply to ICT intra-group service providers. That provision does not make a distinction between intra-group providers established within the Union or in a third country Since intra-group service providers as defined in [Article 3(20)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-i-general-provisions/article-3-definitions) of DORA (which is “an undertaking that is part of a financial group and that provides predominantly ICT services to financial entities within the same group or to financial entities belonging to the same institutional protection scheme, including to their parent undertakings, subsidiaries, branches or other entities that are under common ownership or control”) are not subject to a designation as critical, the conditions for an application of [Article 31(12)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-31-designation-of-critical-providers) of DORA cannot be met for those providers, and the requirement for an EU-based subsidiary does not apply. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/eu-level/q-and-a/eba-qa-2024-7096-exemption-for-non-eu-ict-intra-group-service-providers.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.