ALFI responds to ESAs consultation on DORA criteria for critical ICT Third-party service providers

ALFI responded to the ESAs‘ consultation on DORA criteria for critical ICT third-party service providers and oversight fees.
The ESAs (EBA, EIOPA, and ESMA) initiated level 3 discussions on 26 May 2023, introducing a joint Discussion Paper to gather stakeholders‘ input on DORA. The paper addressed two technical aspects: identifying critical ICT third-party service providers and determining the payment amount to the Lead overseer. It included 41 questions for stakeholders to answer partially or in full.
ALFI provided its feedback on a selection of ESA’s questions, which we would like to present in full below, together with a brief summary of ALFI’s corresponding answers:
—
Question 6: Do you agree with the list of step 1 indicators proposed to cover criterion 1 referred to in Article 31(2) of the DORA? If not, please elaborate and, if applicable, propose alternative indicators that could be considered taking into account the relevant background information about proposed indicators.
ALFI suggests using a risk-based approach to assess the criticality level of service providers, similar to non-financial risk management. They propose considering the number of financial entities using a service provider, as well as the asset under management figures. They note that the relative market share information may be relevant but lacks complete and reliable data.
Question 8: With regard to indicators 1.2 and 1.3, please provide any equivalent metrics (in relation to the total value of their assets) you may consider appropriate to measure the pan-European footprint of the various financial entities subject to the DORA, that you would deem to be better adapted.
ALFI refers to their previous response and suggests using the existing risk-based approach in identifying critical service providers for management companies.
Question 11: Which key data sources would you propose to use for the indicators under criterion 1? Please explain.
ALFI suggests using self-reported data from ICT third-party providers, self-reported data from financial entities, third-party data providers, and national competent authorities. They recommend leveraging existing data sources, particularly the data available at national competent authorities, for efficiency and to avoid duplication.
Question 18: Do you agree with the list of step 1 indicators proposed to cover criterion 3 referred to in Article 31(2)(c) of the DORA? If not, please elaborate and, if applicable, propose alternative indicators that could be considered taking into account the relevant background information about proposed indicators.
ALFI recommends a risk-based approach similar to non-financial risk management for identifying critical functions. They suggest using a business impact analysis and a risk-based approach to assess critical functions. They believe that a taxonomy-based approach may not be suitable and that individual assessments conducted by management companies would provide better-fitting outcomes.
Question 19: Do you have any comments on the proposed minimum relevance thresholds?
ALFI suggests that the proposed thresholds for indicators related to the share of financial entities using ICT services (1.2, 3.1, and 4.1) should be calibrated differently to avoid redundancy. They also note that the proposal to calculate the denominator per type of financial entity is coherent to account for industry differences.
Question 21: Do you have any comments in relation to information provided in the “Notes” section under each of the indicators?
ALFI believes that an indicative „ICT services“ taxonomy would not benefit the industry. They suggest that the criticality assessment should build on the existing risk assessment framework already in place in the non-financial risk management framework of each management company.
Question 22: Which key data sources would you propose to use for the indicators under criterion 3? Please explain.
ALFI refers to the consistency argument made in response 19, emphasizing the use of existing data sources and leveraging national competent authorities for efficient data collection.
Question 23: Do you agree with the list of step 1 indicators proposed to cover criterion 4 referred to in Article 31(2)(d) of the DORA? If not, please elaborate and, if applicable, propose alternative indicators that could be considered taking into account the relevant background information about proposed indicators.
ALFI suggests that a risk-based approach with a focus on the cost of substitutability and a reasonable time frame would be more appropriate for assessing substitutability. They recommend considering risk assessment analysis and exit plans already performed in critical outsourcing assessments.
Question 24: Do you have any comments on the proposed minimum relevance thresholds?
ALFI refers to the consistency argument made in their previous responses and suggests considering different thresholds for indicators 1.2, 3.1, and 4.1 to avoid redundancy. They also note that the proposal to calculate the denominator per type of financial entity is coherent to account for industry differences.