DORA designation criteria must be clear and predictable

Viðskiptaráð has reviewed draft regulations bringing into force the EU regulations on digital operational resilience in the financial market. The regulation will implement two delegated Commission regulations (EU) concerning the designation of critical third parties that provide information and communications technology services.

The Chamber raises no objections to the implementation of the above regulations, but urges the authorities to go no further than the minimum requirement demands, whether in terms of scope or of how the rules are interpreted in Icelandic law. In the Chamber's view, there is a risk that uncertainty may arise around the concept of critical third parties under DORA and delegated regulation (EU) 2024/1502.

If a domestic service provider is designated as a critical third party, it will fall under a dedicated oversight framework under DORA in which the EFTA Surveillance Authority acts as lead overseer. Such a designation entails extensive obligations, including disclosure duties, cooperation with supervisory authorities, powers of audit and investigation, and the payment of oversight fees under the delegated regulation.

Viðskiptaráð points out that these obligations come on top of the costs and regulatory burden that the implementation of DORA has already imposed on companies providing information and communications technology services to financial undertakings. Clearly, if a company falls under the regulation's oversight framework, this can have a significant financial and operational impact. For that reason it is important that the designation criteria are clear and predictable, and interpreted in line with DORA's aim that oversight should cover only those service providers that are genuinely of systemic importance to the European financial market.

Although the explanatory notes accompanying the draft state that Icelandic service providers are not considered likely to fall under the oversight framework in the near future, it is uncertain how the designation criteria may be interpreted in practice. Predictability as to how they will be applied matters a great deal, since uncertainty about a possible designation can affect operational decisions and add to companies' regulatory burden. In the view of Viðskiptaráð, it is essential that any assessment of whether a service provider counts as a critical third party looks to the nature and scale of the company's own activities and the systemic importance of the services it provides, rather than to the size or turnover of the international groups to which Icelandic companies may belong.

Viðskiptaráð therefore encourages the authorities to clarify, as far as possible, how the designation criteria of the delegated regulation will be applied to domestic parties. Doing so would reduce the uncertainty inherent in the implementation of the regulation.

This article was automatically translated from the Icelandic original.