> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/eu-level/q-and-a/eba-qa-2024-7290-definition-and-scope-of-ict-services.md). # Definition and scope of ICT services | | | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | **Authority** | EBA | | **Q\&A ID** | EBA\_QA\_2024\_7290 | | **Topic** | ICT third-party risk management | | **Legal basis** | [Article 3(21)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-i-general-provisions/article-3-definitions) DORA | | **Status** | Final Q\&A | | **Published** | 14/11/2025 | | **Submitted** | 20/12/2024 | | **Answer prepared by** | Answer prepared by the Joint ESAs Q\&A | | **Source** | [EBA Q\&A](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7290) | ## Question What is the correct reading of Article 3 (21) and Recital 63, Article 2 and Article 58(2) of Regulation (EU) No. (EU) 2022/2554 (DORA Reg) in combination with the COM/2023/0365 European Commission Report on the review of Directive 2015/2366/EU ? ## Background In our understanding, in line with the European Commission report COM/2023/0365, payments systems and entities involved in payment processing activities should not be treated as entities falling within scope of DORA Regulation to whom DORA requirements would be applicable directly (as financial institutions listed in [Article 2](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-i-general-provisions/article-2-scope) (Scope) of DORA) and that consequentially would be subject to direct oversight by competent authorities. However, it does not affect that such operators of payments systems and entities involved in payment processing activities should be treated as ICT service providers by financial institutions, as established by Recital 63, whereas operation of such payment processing systems/infrastructures/networks should be treated as ICT services by financial entities. Consequentially, mandatory DORA requirements should be applied to such arrangements impacting such payment system operators indirectly, as they in essence match the "ICT services'' definition provided by [Article 3(21)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-i-general-provisions/article-3-definitions) of DORA Regulation. Inter alia, it would include securing contractual framework that match the requirements of Articles 28 and 30. Various major payment systems/infrastructure providers are refusing to negotiate terms of agreements governing use of their payment systems/infrastructures, arguing that requirements set by DORA are not applicable to payment systems/infrastructures. ## Final answer [Article 2(1)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-i-general-provisions/article-2-scope) of the Digital Operational Resilience Act (DORA) introduces the entities within the scope of DORA. Providers of payment-processing activities or operating payments infrastructures, including payment card schemes, are not included in said Article and, therefore, are not to be considered financial entities within the scope of DORA. [Article 3(21)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-i-general-provisions/article-3-definitions) of DORA defines ‘ICT services’ as digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services. Recital (63) of DORA specifies that providers of payment-processing activities or operating payments infrastructures should be considered to be ICT third-party service providers under DORA, with the exception of central banks when operating payment or securities settlement systems, and public authorities when providing ICT related services in the context of fulfilling State functions. It follows from the above that any relevant service provided by providers of payment-processing activities or operating payments infrastructures that falls within the definition under [Article 3(21)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-i-general-provisions/article-3-definitions) of DORA, should be considered as an ICT service under DORA. Therefore, financial entities should ensure they comply with relevant provisions of DORA relating to the services provided by these ICT third-party service providers. It should, however, be noted that not all services provided by these providers, including payment card schemes, are to be considered ICT services. Services provided by a governance body of a scheme or business processes of the providers of payment-processing activities or operating payments infrastructure without a prevailing ICT component, such as clearing and settlement, should not be considered within the scope of ICT services under [Article 3(21)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-i-general-provisions/article-3-definitions) of DORA. Finally, it should be noted that in accordance with [Article 31(8)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-31-designation-of-critical-providers)(ii) of DORA, ICT third-party service providers that are subject to oversight frameworks established for the purposes of supporting the tasks referred to in Article 127(2) of the Treaty on the Functioning of the European Union, shall not fall within the scope of the oversight framework of critical ICT third-party service providers under DORA. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/eu-level/q-and-a/eba-qa-2024-7290-definition-and-scope-of-ict-services.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.