> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/eu-level/q-and-a/eba-qa-2025-7309-annual-report-on-new-arrangements-on-the-use-of-ict-services.md). # ANNUAL REPORT ON NEW ARRANGEMENTS ON THE USE OF ICT SERVICES | | | | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Authority** | EBA | | **Q\&A ID** | EBA\_QA\_2025\_7309 | | **Topic** | Register of information (DORA) | | **Legal basis** | [Article 28(3)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-28-general-principles) DORA | | **Status** | Final Q\&A | | **Published** | 14/08/2025 | | **Submitted** | 17/01/2025 | | **Answer prepared by** | Answer prepared by the Joint ESAs Q\&A | | **Source** | [EBA Q\&A](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7309) | ## Question Does [Article 28(3)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-28-general-principles) DORA require a separate and specific communication in addition to the Register of Information, or whether the communication of such data is already fulfilled through the annual submission of the same Register, constituting a single compliance obligation? In the event that a separate communication is required in addition to the annual submission of the Register of Information, what is the meaning of the term ' categories of third-party ICT service providers '? ## Background Pursuant to the provisions of Chapter V, Section I, [Article 28](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-28-general-principles), Paragraph 3 of the DORA Regulation states: “ Financial entities shall communicate at least once a year to the competent authorities the number of new agreements for the use of ICT services, the categories of third-party ICT service providers, the type of contractual arrangements, and the ICT functions and services provided ”. Article 28(3) specifies the obligation to report annually the number of new agreements with ICT suppliers, their categories, the type of contracts and the ICT services provided. However, some questions of interpretation remain open, including: * The nature of the reporting : it is unclear whether this obligation should be considered a separate fulfilment from the annual submission of the Information Register, which already includes details on ICT suppliers and contracts. For example, if a financial entity enters into 10 new ICT contracts with different suppliers in a year, these contracts will be included in the Information Register. It remains to be clarified whether separate reporting is also required and, if so, how to correctly categorise suppliers. The nature of the reporting : it is unclear whether this obligation should be considered a separate fulfilment from the annual submission of the Information Register, which already includes details on ICT suppliers and contracts. For example, if a financial entity enters into 10 new ICT contracts with different suppliers in a year, these contracts will be included in the Information Register. It remains to be clarified whether separate reporting is also required and, if so, how to correctly categorise suppliers. * The definition of ‘categories of third-party ICT service providers ’: the Regulation does not specify whether this term refers to standardised classifications (e.g. cloud providers, data centres, cybersecurity) or to criteria defined independently by financial entities, and no further evidence was found on this. For example, in the case where a financial entity enters into a new contract with a cloud provider for the storage of critical data, the question arises as to which category should be used to classify this provider, whether generically ‘cloud provider’ or another category not explicitly defined. The definition of ‘categories of third-party ICT service providers ’: the Regulation does not specify whether this term refers to standardised classifications (e.g. cloud providers, data centres, cybersecurity) or to criteria defined independently by financial entities, and no further evidence was found on this. For example, in the case where a financial entity enters into a new contract with a cloud provider for the storage of critical data, the question arises as to which category should be used to classify this provider, whether generically ‘cloud provider’ or another category not explicitly defined. ## Final answer With the aim of ensuring consistency on extractions of data, the ESAs Decision (see ESA 2024 22 ), requires that competent authorities provide to the ESAs on a yearly basis the registers of information referred to in [Article 28(3)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-28-general-principles) of Regulation (EU) 2022/2554, in accordance with the reporting timelines set out in Article 4 and 5 of said decision. In general, this will fulfill the requirement, and no second specific communication is needed. In addition to said yearly submission, financial entities shall make available to the competent authority, upon its request, the register of information in accordance with [Article 28(3)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-28-general-principles), fourth subparagraph of Regulation (EU) 2022/2554. Finally, financial entities shall inform the competent authority in a timely manner regarding any planned ICT third party contractual arrangements supporting critical or important functions or if a function supported by ICT third parties becomes critical or important, as per [Article 28(3)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-28-general-principles), fifth subparagraph of Regulation (EU) 2022/2554. Categorization of third-party ICT service providers should be made according to the type of service they provide, using the typology of services laid out in Annex III of Regulation (EU) 2024/2956 --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/eu-level/q-and-a/eba-qa-2025-7309-annual-report-on-new-arrangements-on-the-use-of-ict-services.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.