FAQs – Digital Operational Resilience Act (DORA) – CBF, CBL and LuxCSD
In this section, you will find answers to the following questions. The questions highlighted in grey have been added or updated.
- What is an ICT service under DORA?
- Which financial services do Clearstream Banking AG, Clearstream Banking S.A. and LuxCSD S.A. provide?
- Are any of the services provided by the CSDs considered ICT services under DORA?
- Are the CSD’s responding to individual requests to fill in DORA related Providers Questionnaires?
1. What is an ICT service under DORA
Definition: DORA defines an information and communication technology (ICT) service as digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which include the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services (Article 3(21) DORA).
Contractual requirements: Agreements for ICT services provided by ICT third-party service providers to financial entities must comply with Article 30 DORA.
Types of ICT services: Annex III of the Commission Implementing Regulation 2024/2956 (the “ITS”) provides a list of types of ICT services, to be used for the register of information as per Article 28(3) DORA.
Clarification: The European Commission provided further clarification on what types of services should be considered ICT services, based on the definition in Article 3(21) DORA.
2. Which financial services do Clearstream Banking AG, Clearstream Banking S.A. and LuxCSD S.A. provide?
Clearstream Banking S.A. (CBL), LuxCSD S.A. (LuxCSD) and Clearstream Banking AG (CBF), hereinafter “the CSDs”, are authorised under Article 16 and 54 CSDR to provide CSD services1. While CBL and LuxCSD are supervised by the Commission de Surveillance du Secteur Financier (CSSF), CBF is supervised by the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin).
Under our licences we offer a comprehensive range of financial services such as custody accounts, securities issuance, settlement, order routing, custody, banking-type services, collateral, lending, liquidity management services and the connectivity for the purpose of managing clients’ custody accounts.
3. Are any of the services provided by the CSDs considered ICT services under DORA?
According to the clarification by the European Commission, when the providing financial entities and the financial services they provide are regulated under Union law or any national legislation of a Member State or of a third country, then the related service should be considered to predominantly be a financial service and should not be treated as an ICT service within the meaning of Article 3(21) DORA.
As the CSDs’ services are strictly regulated under CSDR, we consider the clarifications in line with our view that our products and services including core services, non-banking-type ancillary services and banking-type ancillary services, are not considered ICT services under DORA.
4. Are the CSD’s responding to individual requests to fill in DORA related Providers Questionnaires?
Following the clarification, we maintain our position that we do not respond to individual DORA related questionnaires.
----------------------------------------------------------
1. LuxCSD S.A. has been authorised only under Article 16 CSDR.