Types of 'telephone services' included under the definiti...

EBA Q&A 2025_7539 on Regulation (EU) 2022/2554 (DORA): Types of 'telephone services' included under the definition of 'ICT services'.

Authority	EBA
Q&A ID	EBA_QA_2025_7539
Topic	ICT-related incidents (management / classification / reporting)
Legal basis	Article 3(21) DORA
Status	Final Q&A
Published	06/02/2026
Submitted	30/07/2025
Answer prepared by	Answer prepared by the Joint ESAs Q&A
Source	EBA Q&A

Question

Which types of telephone services fall within the scope of the definition of "ICT services"?

Background

Article 3(21) defines ICT services as " digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services ". Recital 35 further states that this exclusion covers " only the limited category of traditional analogue telephone services qualifying as Public Switched Telephone Network (PSTN) services, landline services, Plain Old Telephone Service (POTS), or fixed-line telephone services ".

However, there is uncertainty as to whether more modern telecommunications infrastructure - such as fiber-optic lines or black fiber - should be considered part of the excluded category or fall within the scope of ICT services. For example, while fiber-optic services are not analogue in nature, it is unclear whether their classification as “landline” services results in their exclusion.

Clarification on the general criteria or characteristics that distinguish included from excluded telephone services would be helpful for consistent interpretation and application of the DORA Regulation.

Final answer

The exclusion provided under Article 3(21) of DORA, which refers to “traditional analogue telephone services”, cannot be extended to fibre optic networks, including dark fibre.

DORA deliberately defines ICT services broadly so as to encompass any digital (i.e. electronic rather than purely electrical) service that directly contributes to the functioning of financial entities’ information and communication systems. This includes connectivity and data transmission services, such as telecommunications networks, and therefore fibre optic infrastructure.

Recital 35 clarifies that the exclusion is limited to traditional analogue telephone services. This expression refers to telephony based on analogue circuit switching, such as classic fixed-line voice services delivered via the public switched telephone network (PSTN) for Plain Old Telephone Service (POTS) as referred to in that recital. These services deliver speech as continuous analogue electrical signals (without the involvement inverse multiplexers to separate voice from data signals at the delivery location).

Recital 35, which also mentions landline services, must be interpreted consistently with this notion: it concerns fixed lines solely when they are delivering the traditional analogue voice service, not the physical infrastructure as such. The rationale for the exclusion does not lie in the use of a physical cable (copper, fibre, etc.), but rather in the transmission technology employed. The analogue PSTN works through continuous electrical modulation. Fibre networks, by contrast, are designed to carry digital optical signals, which rely on packet-switched transmission and require electronic systems to be activated, routed, and secured. They are used for digital telephone services, such as Voice over IP (VoIP) and cloud-based communications platforms. The mere fact that fibre is “dark” does not alter its inherent function as a medium for digital traffic: it remains a passive transmission capacity which, once lit, plays a direct role in carrying digital signals and must therefore be treated as part of an ICT service.

It has to be reminded that DORA’s objective is to preserve the resilience and operational continuity of ICT systems and services supporting the financial sector. From this perspective, the distinction between “lit” and “unlit” fibre is immaterial: what matters is that fibre constitutes critical infrastructure which must be deployed, monitored, and protected (redundancy, contingency, recovery in case of cuts) to ensure the resilience of financial entities’ digital operations. Unlike legacy analogue voice services, which are being phased out and no longer pose material resilience concerns, fibre-based services are central to today’s digital communications and therefore fall fully within the scope of ICT services.