FAQs – Digital Operational Resilience Act (DORA) – CFCL
In this section, you will find answers to the following questions. The questions highlighted in grey have been added or updated.
- What is an ICT service under DORA?
- Which financial services does Clearstream Fund Centre Luxembourg S.A. (CFCL) provide?
- Has CFCL completed an impact analysis of DORA?
- Will Clearstream entities conclude dedicated DORA agreements with individual clients?
- Is CFCL responding to individual requests to fill in DORA-related due diligence questionnaires?
- Will CFCL provide information about subcontractors if any of their services are considered ICT services?
1. What is an ICT service under DORA?
Definition: DORA defines an information and communication technology (ICT) service as digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which include the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services (Art. 3(21) DORA).
Contractual requirements: Agreements for ICT services provided by ICT third-party service providers to financial entities must comply with Article 30 DORA.
Types of ICT services: Annex III of the Commission Implementing Regulation 2024/2956 (the “ITS”) provides a list of types of ICT services, to be used for the register of information as per Article 28(3) DORA.
Clarification: The European Supervisory Authorities’ (ESAs’) FAQ document “DORA 2024 Dry Run exercise on reporting of registers of information” clarified that “in case a financial entity must be authorised/licensed/registered as financial entity to deliver a service, such service is therefore a regulated financial service and not an ICT service in the meaning of DORA Article 3(21)”. However, these FAQs have been partially withdrawn and the European Commission plans to clarify this through a Q&A with the support of the ESAs.
2. Which financial services does Clearstream Fund Centre Luxembourg S.A. (CFCL) provide?
Clearstream Fund Centre Luxembourg S.A. (CFCL) qualifies as a credit institution under the Capital Requirements Regulation (CRR) and provides a comprehensive range of financial services. These services include, inter alia, order routing, settlement, custody and banking-type services. CFCL operates under the supervision of the Commission de Surveillance du Secteur Financier (CSSF).
3. Has CFCL completed an impact analysis of DORA?
Yes, an impact assessment for Clearstream legal entities with respect to their obligations under DORA has been completed.
4. Will Clearstream entities conclude dedicated DORA agreements with individual clients?
We are awaiting further clarification on the definition of “ICT services”, in particular with respect to services provided by regulated financial entities, such as those provided by credit institutions like CFCL. Deutsche Börse Group is closely monitoring regulatory developments and will roll out respective DORA appendices for services that are to be considered as ICT services.
Therefore, we kindly ask you to wait until the matter is fully clarified and apologise for not being able to amend any contracts until then.
5. Is CFCL responding to individual requests to fill in DORA-related due diligence questionnaires?
Until clarification is provided on the definition of ICT services, we are not able to respond to individual DORA-related questionnaires. In the meantime, please refer to the key documents page for CFCL, section “CFCL Compliance and due diligence documentation”.
6. Will CFCL provide information about subcontractors if any of their services are considered ICT services?
The Regulatory Technical Standard (RTS) on subcontracting is currently only available in a draft version and does not constitute applicable law. CFCL will take the necessary measures for implementation as soon as the aforementioned RTS has been adopted and entered into force with binding effect.