Last reviewed · Version 1.1.0 · Evidence cutoff
DORA Article 28 RTS/ITS Pack — entity-level RoI, third-party-policy and subcontracting controls
The DORA Article 28 RTS/ITS Pack is the entity-level rule set that tells a financial entity what must sit behind its Register of Information, its policy for ICT services supporting critical or important functions, and its subcontracting-chain controls. The pack comprises Commission Delegated Regulation (EU) 2024/1773 on ICT third-party policy, in force from 15 July 2024; Commission Delegated Regulation (EU) 2025/532 on subcontracting, in force from 22 July 2025; and Commission Implementing Regulation (EU) 2024/2956 on standard RoI templates, in force from 22 December 2024. This radar is the WHAT counterpart to the existing DORA Article 28 RoI tracker, which maps the WHERE surface of NCA submission channels and ESA forwarding.
Ordinis is recused. Finray Technologies Ltd ships Ordinis, the compliance-operations layer for ICT third-party risk and DORA-Article-28-anchored register-of-information workflow. Where Ordinis materials cover one of the controls below, the vendor evidence is captured in the graph with the standard supports edge from product to control; no ranking, scoring, league-table position or “best-of” recommendation is implied. The same disclosure applies on every Finray Intelligence radar where a Finray product evidences a control in scope; see the cluster footer on /intelligence/ for the standing recusal language.
Primary sources: https://eur-lex.europa.eu/eli/reg/2022/2554/oj, accessed 2026-05-10; https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj, accessed 2026-05-10; https://eur-lex.europa.eu/eli/reg_impl/2024/2956/oj, accessed 2026-05-10; https://eur-lex.europa.eu/eli/reg_del/2025/532/oj, accessed 2026-05-10.
The three implementing acts
Commission Delegated Regulation (EU) 2024/1773 is the policy RTS under DORA Article 28(10). It turns the general Article 28 duty to manage ICT third-party risk into a written-policy operating model: management-body adoption, annual review, a method for deciding which ICT services support critical or important functions, named internal responsibilities, lifecycle governance, pre-contract risk assessment, due diligence, conflicts-of-interest assessment, Article 30 clause alignment, ongoing monitoring and exit planning. It is the bridge between a policy document and evidence that the contracting lifecycle actually follows the policy.
Commission Implementing Regulation (EU) 2024/2956 is the Article 28(9) ITS on standard templates for the Register of Information. It is an Implementing Regulation, not a delegated regulation, and it defines the RoI as a relational data product: entity identity, group hierarchy, contractual-arrangement references, provider identifiers, function identifiers, ICT service taxonomy, data locations, supply-chain rank, audits and exit fields. It also sets completion logic, data-quality expectations and the Annex III ICT service taxonomy.
Commission Delegated Regulation (EU) 2025/532 is the subcontracting RTS. It applies when ICT services support a critical or important function, or material parts of such a function, and asks whether subcontracting is permitted, how risk factors are assessed, whether the direct ICT third-party provider can identify and monitor relevant subcontractors, how access and inspection rights flow through the chain, how location and data-processing risks are assessed, and what notification, objection, modification and termination rights exist.
Companion Commission acts
The Article 28 RTS/ITS Pack does not stand alone. Six companion Commission instruments operate inside the same DORA Article 28–35 perimeter and the radar carries complementary-to edges to each: Commission Delegated Regulation (EU) 2024/1502 (criticality criteria for CTPP designation under DORA Article 31(6)), Commission Delegated Regulation (EU) 2024/1505 (Lead Overseer oversight fees under DORA Article 43), Commission Delegated Regulation (EU) 2024/1772 (RTS on ICT-related incident classification under DORA Article 18), Commission Delegated Regulation (EU) 2024/1774 (RTS on ICT risk management under DORA Article 15), Commission Delegated Regulation (EU) 2025/295 (RTS on oversight conduct), and Commission Delegated Regulation (EU) 2025/420 (RTS on Joint Examination Teams under DORA Article 40).
The Treaty basis matters at the legislative-act-class level. Article 290 TFEU empowers the Commission to adopt delegated acts — non-legislative acts of general application that supplement or amend non-essential elements of the legislative act. Article 291 TFEU empowers the Commission to adopt implementing acts — non-legislative acts laying down uniform conditions for implementing legally binding Union acts. In the DORA Article 28 pack, Commission Delegated Regulation (EU) 2024/1773 (third-party policy) and Commission Delegated Regulation (EU) 2025/532 (subcontracting) are Delegated Regulations under Article 290 — they supplement Article 28(10) and Article 30(5) with detailed content the legislator did not specify. Commission Implementing Regulation (EU) 2024/2956 (RoI templates) is an Implementing Regulation under Article 291 — it lays down uniform templates for implementing the Article 28(9) reporting duty. The distinction surfaces in the EUR-Lex ELI URL structure (reg_del versus reg_impl) and in the legislative-act-class field on every node in this radar.
Subcontracting RTS rejection-readoption history
Commission Delegated Regulation (EU) 2025/532 (subcontracting) did not pass on the first attempt. The ESAs delivered draft RTS to the Commission in early 2024 containing an Article 5 chain-wide monitoring requirement: financial entities would have had to monitor every link in the ICT subcontracting chain end-to-end, not just the direct provider’s monitoring of its own subcontractors. The Commission rejected the draft on the basis that chain-wide monitoring sat outside the Article 30(5) empowerment, which limits the RTS to “elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions”. The ESAs issued a revised opinion on 7 March 2025 narrowing Article 5 to the direct-provider monitoring perimeter, and the readopted instrument entered into force as Commission Delegated Regulation (EU) 2025/532 on 22 July 2025.
The operational consequence for financial entities: ongoing monitoring under Article 5 of Commission Delegated Regulation (EU) 2025/532 covers the direct ICT third-party provider’s processes for selecting, governing, supervising and terminating its own subcontractors that perform critical or important functions. It does not require the financial entity itself to monitor every subcontractor several layers down the chain. The contractual flow-through of audit, access and termination rights remains, but the monitoring perimeter at the financial-entity level is bounded.
What the RoI must contain
The RoI field layer starts with the entity table. B_01 requires the financial entity’s LEI at B_01.01.0010, its legal name, country, entity type and, where relevant, group hierarchy and total-asset data. These are not decorative fields; they are the join keys used by the entity, the group and the competent authority to reconcile who is maintaining the register and which licence perimeter the record belongs to.
B_02 then moves to the contractual arrangement. The radar treats the contractual arrangement reference number at B_02.01.0010 as the stable spine of the register, because every later service, provider, cost, date, governing-law, notice-period and data-location field depends on it. B_02 also captures whether the arrangement is standalone, overarching or associated, the annual expense or estimated cost, the identification code of the ICT third-party provider, the type of code used, the function identifier, the ICT service type and the start and end dates.
B_05 is where the RoI stops being a flat vendor list. It records the ICT service supply-chain rank at B_05.02.0050, with the direct provider at rank 1 and subcontractors ranked below it. B_05 also identifies the recipient of subcontracted ICT services. Read with the subcontracting RTS, those fields force a chain view: provider identity, recipient, role, rank and materiality need to be explainable, not merely named.
B_06 connects services to functions. The function identifier links an ICT service to the function it supports, while the criticality or importance assessment and its last-assessment date show whether the service supports a critical or important function. Recovery time objective and recovery point objective fields turn continuity assumptions into reportable data. B_07 then adds the audit and exit layer: substitutability of the ICT third-party provider, date of last audit and exit-plan existence at B_07.01.0090.
Third-party policy and subcontracting controls
The policy RTS controls are lifecycle controls. Before contract signature, the entity should be able to show management-body adoption, annual policy review, a criticality methodology, named internal responsibilities and an independent review or audit plan. Pre-contract diligence then covers legal, operational, ICT, reputational, confidentiality, data, availability, location and concentration risks, plus due diligence on the provider’s ability, expertise, resources and information-security standards.
At contract stage, the policy RTS looks for DORA Article 30(2) and 30(3) clause alignment. That means clause matrices, negotiated-deviation records, access and inspection rights, audit and ICT testing rights, and evidence that certificates or third-party reports are used with scope controls rather than as a substitute for direct assurance. After signature, ongoing service monitoring, incident reporting, service and security reporting, corrective-action tracking and documented exit planning become the recurring proof points.
The subcontracting RTS overlays the supply chain. It asks for risk factors before subcontracting is used; a pre-contract decision on whether subcontracting is permitted; due diligence on the direct provider’s subcontractor selection and monitoring process; capacity to identify all relevant subcontractors; contractual conditions that let the financial entity comply with DORA; same access and inspection rights through the chain; ongoing reporting; location, data-processing and data-storage assessment; advance notification of material changes; objection or modification rights; and a termination right where subcontracting is unauthorised or objected to.
First-batch CTPP designations
On 18 November 2025, the ESAs published the first DORA Article 31(9) list of critical ICT third-party providers after collecting RoI data, assessing criticality with competent authorities and notifying providers before final decisions. The list is a designation outcome, not a provider-service taxonomy and not a legal-entity identifier register. Primary source: ESA Article 31(9) CTPP designation list, accessed 2026-05-10.
The hyperscaler and enterprise-software group is Amazon web Services EMEA Sarl, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, International Business Machine Corporation, Oracle Nederland B.V. and SAP SE; the system-integrator and consulting group is Accenture plc, Capgemini SE, Kyndryl Inc., NTT DATA Inc. and Tata Consultancy Services Limited. The data and market-infrastructure group is Bloomberg L.P., LSEG Data and Risk Limited and Fidelity National Information Services, Inc.; the telecom and infrastructure group is Colt Technology Services, Deutsche Telekom AG, Equinix (EMEA) B.V., InterXion HeadQuarters B.V. and Orange SA.
The ESA list does not publish LEIs, and this radar does not infer them. The operator-lane reconciliation register at /tmp/finray-gleif/ctpp-lei-reconciliation-register.md can support a later legal-entity lookup, but no LEI is published in this v1 graph or prose.
How to read the radar
The graph separates regulators, regulations, supervisory standards, controls, vendors, products, CTPP licensed-entity nodes, a CTPP designation status class and the EU/EEA jurisdiction perimeter. Regulator nodes use round rectangles, regulation nodes use hexagons, standards use rectangles, controls use diamonds, vendors use ellipses, products use vee shapes, CTPP nodes use octagons, status classes use triangles and the jurisdiction node uses a star.
The main reading paths are regulation to control, implementing act to parent DORA article, provider designation to status class, provider designation to DORA Article 31, and product to control. Vendor-owned materials appear only as supports edges. A supports edge means the vendor or product page describes functionality relevant to a control surface; it does not mean the ESAs, the Commission or a national competent authority has endorsed that vendor, accepted a buyer’s implementation or validated the buyer’s RoI.
The control layer is deliberately atomic. RoI controls carry field accuracy, data lineage and update-cadence watch concerns. Policy controls carry policy review, management-body approval and owner-evidence watch concerns. Subcontracting controls carry onboarding diligence, chain-visibility refresh and objection-right watch concerns. That distinction keeps the radar from turning a legal pack into a generic outsourcing checklist.
Editorial conclusion
The RTS/ITS Pack makes the entity-side DORA Article 28 obligation concrete: RoI fields define what must be reported, the policy RTS defines how the contractual lifecycle is governed, and the subcontracting RTS defines how chain visibility, rights and exit must flow beyond the direct provider. No public EU/EEA enforcement decision was identified that sanctions a financial entity specifically for DORA Article 28 RoI deficiencies at this cut-off, so the graph treats evidence gaps as public-evidence status, not proof of supervisory silence. Read with the DORA Article 28 RoI tracker, this radar answers what goes into the RoI while the existing tracker answers where the RoI goes.
This radar should be read alongside /intelligence/dora-article-28-roi-tracker/ for the supervisory pathway, NCA portal status and ESA forwarding deadlines; /intelligence/amlr-amla-implementation-tracker/ for the parallel AMLR/AMLD6 implementation map; /intelligence/deployment-topology-regulatory-alignment/ for cloud-deployment-topology overlap with DORA Article 30 contractual provisions; and /intelligence/methodology/ for the source-discipline and recusal policy applied here.