EIOPA · DORA112 - 3138
ICT third-party risk management (DORA)
- Regulation
- (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
- Topic
- ICT third-party risk management (DORA)
- Submitted
- 2024-08-06
- Answered
- 2025-07-25
Question
Regarding the "Identification code of the ICT third-party service provider’s ultimate parent undertaking" and the "Type of code to identify the ICT third-party service provider’s ultimate parent undertaking". I am having doubts regarding the concept of ultimate parent undertaking. My question is if, for the purpose of DORA, we should consider the concept foreseen in Article 48a of Directive 2013/34/EU: "(1) “ultimate parent undertaking” means an undertaking which draws up the consolidated financial statements of the largest body of undertakings;". Or, if we should consider simply highest parent of a company?
Background
Concept of “ultimate parent undertaking”.
Answer
The question has been rejected because it is seeking confirmation of a requirement already clearly set out in the regulation.
This Q&A is published by European Insurance and Occupational Pensions Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.
Similar Q&As
ICT third-party risk management (DORA)
Answered 2024-11-28
ICT third-party risk management (DORA)
Answered 2025-11-21
ICT third-party risk management (DORA), Other DORA topics
Answered 2025-07-25
ICT third-party risk management (DORA)
Answered 2025-11-21
ICT third-party risk management (DORA)
Answered 2025-11-20
More Q&As on this topic
📋 Track EU financial regulation continuously
Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.
14-day free trial. No credit card required.