DORA criteria must be clear and predictable

The Iceland Chamber of Commerce has reviewed the draft regulation on the entry into force of the EU regulations on digital operational resilience in the financial market. The regulation will implement two delegated Commission Regulations (EU) concerning the designation of critical third-party providers of information and communication technology services.

The Chamber raises no objections to the implementation of the above regulations, but urges the authorities not to go beyond the minimum requirement, whether in terms of scope or of how the rules are interpreted in Icelandic law. In the Chamber's assessment, there is a risk that uncertainty may arise over the concept of critical third-party providers under DORA and delegated Regulation (EU) 2024/1502.

If a domestic service provider is designated as a critical third-party provider, it falls under a special oversight framework pursuant to DORA in which the EFTA Surveillance Authority acts as lead overseer. Such a designation entails extensive obligations, including disclosure duties, cooperation with supervisory authorities, powers of audit and investigation, and the payment of oversight fees under the delegated regulation.

The Iceland Chamber of Commerce points out that these obligations come on top of the costs and regulatory burden that the implementation of DORA has already imposed on companies providing information and communication technology services to financial undertakings. It is clear that if a company falls under the regulation's oversight framework, this can have substantial financial and operational consequences. For that reason it is important that the designation criteria are clear, predictable, and interpreted in line with DORA's objective that oversight should cover only those service providers of genuine systemic significance for the European financial market.

Although the explanatory memorandum accompanying the draft states that Icelandic service providers are not considered likely to fall under the oversight framework in the near future, it is uncertain how the designation criteria may come to be interpreted in practice. Predictability in their application matters a great deal, since uncertainty about possible designation can affect operational decisions and increase companies' regulatory burden. In the Chamber's view it is essential that, when assessing whether a service provider qualifies as a critical third-party provider, regard is had to the nature and scale of the company's activities and the systemic importance of the service it provides, rather than to the size or turnover of international groups to which Icelandic companies may belong.

The Iceland Chamber of Commerce therefore encourages the authorities to clarify, so far as possible, how the designation criteria of the delegated regulation will be applied to domestic entities. Doing so would reduce the uncertainty inherent in the implementation of the regulation.

This article was automatically translated from the Icelandic original.