FAQs – Digital Operational Resilience Act (DORA) – CFCL
In this section, you will find answers to the following questions. The questions highlighted in grey have been added or updated.
- What is an ICT service under DORA?
- Which financial services does Clearstream Fund Centre Luxembourg S.A. (CFCL) provide?
- Are any of the services provided by Clearstream Fund Centre S.A. (CFCL) considered ICT services under DORA?
- Is Clearstream Fund Centre S.A. (CFCL) responding to individual requests to fill in DORA related Providers Questionnaires?
1. What is an ICT service under DORA?
Definition: DORA defines an information and communication technology (ICT) service as digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which include the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services (Article 3(21) DORA).
Contractual requirements: Agreements for ICT services provided by ICT third-party service providers to financial entities must comply with Article 30 DORA.
Types of ICT services: Annex III of the Commission Implementing Regulation 2024/2956 (the “ITS”) provides a list of types of ICT services, to be used for the register of information as per Article 28(3) DORA.
Clarification: The European Commission provided further clarification on what types of services should be considered ICT services, based on the definition in Article 3(21) DORA.
2. Which financial services does Clearstream Fund Centre Luxembourg S.A. (CFCL) provide?
Clearstream Fund Centre Luxembourg S.A. (CFCL) is authorised as a credit institution under the Luxembourg Law of 5 April 1993 and provides a comprehensive range of financial services. These services include, inter alia, order routing, settlement, custody and banking-type services. CFCL operates under the supervision of the Commission de Surveillance du Secteur Financier (CSSF).
3. Are any of the services provided by Clearstream Fund Centre S.A. (CFCL) considered ICT services under DORA?
According to the clarification by the European Commission, when the providing financial entities and the financial services they provide are regulated under Union law or any national legislation of a Member State or of a third country, then the related service should be considered to predominantly be a financial service and should not be treated as an ICT service within the meaning of Article 3(21) DORA.
As a regulated financial entity providing services under CRD and MiFID II, we consider the clarifications in line with our view that the services provided by CFCL which are regulated financial services or ancillary services that are inseparable are not considered ICT services under DORA.
4. Is Clearstream Fund Centre S.A. (CFCL) responding to individual requests to fill in DORA related Providers Questionnaires?
Following the clarification, we maintain our position that we do not respond to individual DORA related questionnaires.