> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/eu-level/soft-law/opinions/jc-2025-06-opinion-rts-subcontracting.md). # JC/2025/06 — ESAs Joint Committee Opinion on the rejection o... | | | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Authority** | Joint (ESAs) | | **Reference** | JC/2025/06 | | **Legal basis** | [Article 30(5)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-30-key-contractual-provisions) DORA; Article 10 ESAs Regulations | | **Status** | In force | | **Published** | 7 March 2025 | | **Source** | [Landing page](https://www.eba.europa.eu/publications-and-media/press-releases/esas-issue-joint-opinion-rejection-rts-subcontracting-under-dora) | | **Documents** | [Opinion PDF](https://www.eba.europa.eu/sites/default/files/2025-03/e6353fc2-3e10-40a8-9b7e-25e6f02e3207/JC%202025%2006%20-%20Final%20Opinion%20on%20the%20rejection%20of%20the%20RTS%20on%20subcontracting%20under%20DORA.pdf) | JC 2025 06 07 March 2025 ## Opinion of the European Supervisory Authorities On the Draft Regulatory Technical Standards specifying the elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions under Article 30(5) of Regulation (EU) 2022/2054. ## Introduction and legal basis 1. [Article 30(2)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-30-key-contractual-provisions)(a) of EU) 2022/2554 on digital operational resilience for the financial sector (DORA) 1 sets out that the contractual arrangements on the use of ICT services between financial entities and third party service providers ' shall include at least the following elements: (a) a clear and complete description of all functions and ICT services to be provided by the ICT third-party service provider, indicating whether subcontracting of an ICT service supporting a critical or important function, or material parts thereof, is permitted and, when that is the case, the conditions applying to such subcontracting '. 2. [Article 30(5)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-30-key-contractual-provisions) of DORA mandates the European Supervisory Authorities (ESAs) to develop draft regulatory technical standards specifying the elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions. On 17 July 2024, the ESAs, have submitted the above-mentioned draft regulatory technical standards (RTS) to the European Commission. 3. The draft RTS submitted to the European Commission specifies the conditions and the criteria to be taken into account by financial entities when subcontracting ICT services supporting critical or important functions throughout the lifecycle of contractual arrangements between financial entities and ICT third-party service providers. In particular, financial entities are required to assess the risks associated with subcontracting during the precontractual phase, including the due diligence process. Furthermore, the RTS includes requirements for the implementation and management of contractual arrangements on subcontracting, including conditions to ensure that financial entities monitor the subcontractors effectively underpinning the ICT services that support critical or important functions. 1 4. On 21 January 2025, the European Commission, acting in accordance with the procedure set out in the fourth subparagraph of Article 15(1) of the ESAs Regulations, notified the ESAs that it rejects the draft RTS 3 . The trigger of this rejection is that the requirements introduced by Article 5 of the draft RTS on the 'Conditions for subcontracting relating to the chain of ICT subcontractors providing a service supporting a critical or important function by the financial entity' go beyond the empowerment given to the ESAs by [Article 30(5)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-30-key-contractual-provisions) of DORA as introducing requirements not specifically linked to the conditions for subcontracting. In particular, the Commission considered that one specific aspect, namely that the content of the provisions relating to the monitoring of the subcontracting chain, is not within the scope of the mandate set out in [Article 30(5)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-30-key-contractual-provisions) of DORA and that Article 5 and the related recital 5 are therefore to be removed from the draft RTS to ensure its compliance with the mandate. 5. Pursuant to Article 10(1) of the ESAs Regulations, the ESAs prepared this Opinion on the proposed amendments to the draft RTS by the European Commission. 6. This opinion has been prepared jointly by the ESAs and adopted by the three Board of Supervisors on 03 March 2025. The Opinion will be published on the websites of the ESAs. ## 2. General comments 7. The ESAs acknowledge that the amendments suggested by the EC will ensure that the draft RTS is fully in line with the mandate set out under [Article 30(5)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-30-key-contractual-provisions) of Regulation (EU) 2022/2554 to ' specify further the elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions '. The ESAs take note, and do not recommend amendments to the EC proposed amendments. 8. For further background, the financial entities are expected to adhere to the provisions on subcontractors as per DORA Article 29(2) fourth subparagraph, and Article 3(6) of the ITS on the Register of Information. ## 3. Other editorial comments 9. The European Commission has provided several drafting amendments meant to ease the reading of the draft RTS or to make more explicit the link of some provisions with the legal mandate. The ESAs consider that such changes do not imply a change in policy and represent non-substantive changes. 3 9a7139d5-1cbf-4dca-a5cf-853467b375c7\_en --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/eu-level/soft-law/opinions/jc-2025-06-opinion-rts-subcontracting.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.