FAQs – Digital Operational Resilience Act (DORA) – CBF, CBL and LuxCSD
In this section, you will find answers to the following questions. The questions highlighted in grey have been added or updated.
- What is an ICT service under DORA?
- Which financial services do Clearstream Banking AG, Clearstream Banking S.A. and LuxCSD S.A. provide?
- Have the CSDs completed an impact analysis of DORA?
- Will Clearstream entities conclude dedicated DORA agreements with individual clients?
- Are the CSDs responding to individual requests to fill in DORA-related Providers Questionnaires?
- Will the CSDs provide information about subcontractors if any of their services are considered ICT services?
1. What is an ICT service under DORA?
Definition: DORA defines an information and communication technology (ICT) service as digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which include the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services (Art. 3(21) DORA).
Contractual requirements: Agreements for ICT services provided by ICT third-party service providers to financial entities must comply with Article 30 DORA.
Types of ICT services: Annex III of the Commission Implementing Regulation 2024/2956 (the “ITS”) provides a list of types of ICT services, to be used for the register of information as per Article 28(3) DORA.
Clarification: The European Supervisory Authorities’ (ESAs’) FAQ document “DORA 2024 Dry Run exercise on reporting of registers of information” clarified that “in case a financial entity must be authorised/licensed/registered as financial entity to deliver a service, such service is therefore a regulated financial service and not an ICT service in the meaning of DORA Article 3(21)”. However, these FAQs have been partially withdrawn and the European Commission plans to clarify this through a Q&A with the support of the ESAs.
2. Which financial services do Clearstream Banking AG, Clearstream Banking S.A. and LuxCSD S.A. provide?
Clearstream Banking S.A. (CBL), LuxCSD S.A. (LuxCSD) and Clearstream Banking AG (CBF), hereinafter “the CSDs”, are authorised under Article 16 and 54 CSDR to provide CSD services.1 While CBL and LuxCSD are supervised by the Commission de Surveillance du Secteur Financier (CSSF), CBF is supervised by the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin).
Under our licences we offer a comprehensive range of financial services such as custody accounts, securities issuance, settlement, order routing, custody, banking-type services, collateral, lending, liquidity management services and the connectivity for the purpose of managing clients’ custody accounts.
3. Have the CSDs completed an impact analysis of DORA?
Yes, an impact assessment for Clearstream legal entities with respect to their obligations under DORA has been completed.
4. Will Clearstream entities conclude dedicated DORA agreements with individual clients?
We are awaiting further clarification on the definition of “ICT services”, in particular with respect to services provided by regulated financial entities, such as those provided by CSDs. Deutsche Börse Group is closely monitoring regulatory developments and will roll out respective DORA appendices for services that are to be considered as ICT services.
Therefore, we kindly ask clients to wait until the matter is fully clarified and apologise for not being able to amend any contracts until then.
5. Are the CSDs responding to individual requests to fill in DORA-related Providers Questionnaires?
Until clarification is provided on the definition of ICT services, we are not able to respond to individual DORA-related questionnaires. In the meantime, please refer to the Due Diligence Information in the “About us” section of this website.
6. Will the CSDs provide information about subcontractors if any of their services are considered ICT services?
The Regulatory Technical Standard (RTS) on subcontracting is currently only available in a draft version and does not constitute applicable law. CSDs will take the necessary measures for implementation as soon as the aforementioned RTS has been adopted and entered into force with binding effect.
----------------------------------------------------------
1. LuxCSD S.A. has been authorised only under Article 16 CSDR.