EIOPA · 2673

ICT third-party risk management (DORA)

Name: ICT third-party risk management (DORA): EIOPA Q&A — EU Financial Regulatory Q&A
Creator: European Insurance and Occupational Pensions Authority
License: https://creativecommons.org/licenses/by/4.0/

Regulation: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Article: N/A
Topic: ICT third-party risk management (DORA)
Submitted: 2023-06-06
Answered: 2024-03-14

More Q&As on this regulation →

Question

If a firm is referring its staff to an online third-party ID verification provider and the third-party immediately passes its ratings to the firm via an API, but only stores the data for 30 days, could this be viewed as an outsourcing arrangement or not?

Background

Thinking of accepting a TPRM role.

Answer

This question has been rejected because it is an institution-specific question requiring bespoke advice.

View original on European Insurance and Occupational Pensions Authority ↗

This Q&A is published by European Insurance and Occupational Pensions Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.