What is a critical or important function under the DORA regulation?

What is a critical or important function under the DORA regulation?

On 17 January 2025, the Regulation on Digital Operational Resilience for the Financial Sector (“DORA”) will enter into force across the EU. The new Regulation and the related new laws and regulations introduce new legal standards on cybersecurity in the financial sector. DORA is part of Dutch financial supervisory law.

In the Netherlands, the national authorities De Nederlandsche Bank (DNB) and the Dutch Authority for the Financial Markets (AFM) are responsible for the enforcement of financial supervisory law, which will soon include DORA.

New DORA obligations from January 17, 2025

The DORA now requires financial entities to impose stricter legal and contractual obligations on so-called “third party ICT service providers”. A third party ICT service provider is an undertaking that provides ICT services to a financial entity, as defined in the DORA.

The DORA has milder and stricter regimes. For example, the DORA makes a clear distinction between, in general terms, “ Contractual agreements concerning the use of ICT services ” on the one hand and “ Contractual agreements concerning the use of ICT services that support critical or important functions ” on the other. More and more far-reaching obligations should be imposed on the second category.

The second category of obligations for ICT services that support critical or important functions include, for example, unlimited rights of access, inspection and audit to monitor the performance of the critical ICT service, so these obligations can be very far-reaching for the IT supplier.

Am I critical?

With some regularity we receive the question from IT suppliers in practice, "Am I critical?". As well as: "According to one I am critical, but according to the other I am not. How is that possible?". In order to create clarity it is important to explain what DORA defines as "critical".

The DORA contains the following legal definitions:

Article 3 under 22) DORA:

“critical or important function” means a function the disruption of which would materially impair the financial performance of a financial entity or the soundness or continuity of its services and activities, or the cessation or defective or failed performance of which would materially impair the continued compliance by a financial entity with the conditions and obligations under its authorisation or its other obligations under applicable financial services law;

And

Article 3 under 23) DORA:

“critical third party ICT service provider” means a third party ICT service provider designated as critical in accordance with Article 31; [addition: designated by the ESAs through the Joint Committee, which are the financial supervisors at European level]

The DORA contains an obligation for financial entities to develop an ICT risk management policy, part of which is that the financial entity forms an opinion on the overall risk profile of ICT services provided to it.

This has to be done in light of the principle of proportionality and taking into account the nature, scale, complexity and significance of ICT-related interdependencies and the risks arising from IT contracts, taking into account the criticality or importance of the respective services, processes or functions and the potential impact on the continuity and availability of financial services and activities, at individual and group level.

In short, it is not the IT supplier itself that is usually critical, but certain ICT services that an IT supplier provides may or may not be critical for a certain financial entity given its business operations. The European supervisors have been given the authority to designate certain IT suppliers as a whole as critical for the financial sector, for example the largest tech giants with influence within the financial sector.

What are the implications of providing certain ICT services to a financial entity that support a critical or important function for the financial entity?

We previously wrote an article about the basic requirements that DORA now sets for IT contracts in the financial sector.

 

It is highly advisable to explicitly state in the IT contract between an IT supplier and a financial entity whether certain products purchased by the financial entity are given the 'critical or important function' label and for what reasons.

The consequence of the qualification of an ICT service to a financial entity as 'supporting a critical or important function' is that the strictest regime within the DORA will generally apply. In addition to the basic requirements for IT contracts in the DORA, for example , additional obligations should be included on the subjects specified in the DORA.

It is the responsibility of the financial entity to have such contractual obligations included in IT contracts from now on. The DORA contains a statutory accountability obligation:

“ Article 28 paragraph 1 DORA:  

Financial entities shall manage the ICT risk of third party providers as an integral part of the ICT risk within their ICT risk management framework as referred to in Article 6(1) and in accordance with the following principles:

(a)financial entities that have entered into contractual arrangements for the use of ICT services for their business activities shall at all times remain fully responsible for compliance with and accountability for all obligations under this Regulation and applicable financial services law

[…];”

If existing contracts do not provide sufficient evidence as to whether or not this is the case and what the consequences of this situation are for the specific agreements between the parties, drawing up a DORA addendum may provide a solution.

Liability risks when providing business-critical ICT services

In addition to the new legislation and regulations, according to case law on this subject, the provision of so-called 'business-critical applications' entails more serious legal consequences and therefore higher legal risks for the IT supplier than is the case with any non-business-critical ICT services.

For example, the Amsterdam District Court ruled on 9 April 2009, ECLI:NL:RBAMS:2009:BJ5559 (OILILY/ SAASPLAZA) as follows:

“4.5. For the time being, it is therefore plausible that the services provided by SaaSplaza to the Oilily Group are so essential to the business operations of the Oilily Group that SaaSplaza cannot, in the given circumstances, simply proceed to immediately suspend its obligations. Oilily must therefore in principle be granted a reasonable period to prepare for termination of the contractual relationship with SaaSplaza .”

In short, if your company or organization provides ICT services to clients for whom these ICT services are business-critical, you ought to be aware of the legal risks associated with this.

Conclusion

In light of new legislation and regulations in the field of cybersecurity and network and information security, such as but not limited to the DORA, the need to seriously address cybersecurity within your company or organization has become more urgent. If your company or organization provides ICT services to clients in regulated sectors for whom these ICT services are business critical, you can expect increasingly heavy obligations.

IT suppliers that qualify as “third-party providers of ICT services” within the meaning of the DORA will have to be careful and provide the appropriate safeguards in this financial context together with the financial entity.

Questions?

Want to know more? Are you an IT supplier supporting financial entities? Or a financial entity that will fall under DORA as of January 17, 2025? Want to know what DORA will mean for your organization or company?

For legal questions regarding cybersecurity law, please contact our IT lawyers.