Outsourcing of critical functions and DORA: delegate the task, never the control

You can outsource almost anything, but never the responsibility. We design and review the outsourcing arrangements of your regulated entity, including the ICT chapter under DORA, so that relying on providers does not leave you without answers when the supervisor asks.

Contact us

Are you going to outsource (or already did, without paperwork)?

Tell us which functions are in the hands of third parties and we will tell you which contracts, registers and notifications are missing.

  • 50+ firms advised
  • Reply within 24 h
  • No commitment
Mandatory ICT clauses
DORA Art. 30
DORA application
January 2025
DORA Regulation
Reg. 2022/2554
Key Spanish law
Law 6/2023
Profiles

How firms outsource (and run into trouble) in the sector

Four entities, four different third-party dependencies. All legitimate; none defensible without a contract, visibility and a plan B.

EAF

The lean structure that delegates the back office

“There are three of us: administration, technology and part of compliance sit outside the firm. We wanted to make sure that structure can still be defended as sufficient resources.”

Management company

The core system that lives in the cloud

“All our operations run on one cloud provider. With DORA we found that the contract provided for no audit, no data location and no exit strategy.”

Securities broker

The chain of subcontractors

“Our technology provider in turn subcontracts to two others. We realized we did not know who actually touched our data or from which country.”

Banking

The inventory nobody had

“Each department hired providers on its own. The first step was to build a single inventory and classify what was truly critical or important.”

Where firms fail

Three mistakes that turn outsourcing into a supervisory finding

Outsourcing is lawful, common and often the best decision. What the supervisor does not forgive is delegation without a solid contract, without visibility and without an exit.

Delegating and walking away: the function travels, the responsibility does not. If the provider fails, the file is yours. The supervisor requires effective control and continuous monitoring, not a contract signed and forgotten in a drawer.

Contracts with no clauses: without access, information and audit rights (including for the supervisor), without service levels and without an exit plan, the arrangement cannot be defended. With ICT providers, DORA also imposes mandatory contract content (Art. 30).

The invisible chain: your provider subcontracts, the subcontractor subcontracts again and nobody in your entity knows anymore where anything is processed. Without visibility of the chain there is no control to defend.

The outsourcing map: what you can delegate, what you cannot, and what DORA adds for ICT providers
Category What it covers What the rules require
Can be delegated, with conditions Critical or important functions: technology, back office, administration and control functions on the terms permitted Written contract, effective control and continuous monitoring, access and audit rights, exit plan and notification to the supervisor where applicable
Cannot be delegated The responsibility of the entity and its management body, and the effective management of the business Outsourcing cannot hollow the entity out of substance or shift to a third party its obligations to clients and the supervisor
ICT providers under DORA Technology services that support essential or important functions: cloud, software, data, communications Since January 2025: register of information on providers, mandatory contract clauses under Art. 30 and third-party risk management

Put your outsourcing in order before the supervisor does

We inventory your arrangements with third parties, classify what is critical, renegotiate the contracts that fall short, set up the DORA register of information and test the exit plans. So that delegating remains an advantage and not an open flank.

Talk to a lawyer
Frequently asked questions

What entities ask about outsourcing

What is a critical or important function?

In general terms, one whose failure or deficiency would seriously compromise the entity’s continuing compliance with the conditions of its authorization, its financial results, or the soundness and continuity of its services.

The label matters because it triggers the enhanced regime: a contract with minimum content, intensified control, notification to the supervisor as the case may be, and an exit plan. Classifying correctly, with written criteria, is the first control in the system.

Can I outsource the regulatory compliance function?

As a general rule, yes, especially in smaller entities where proportionality justifies it. The conditions: a written mandate with a clear scope, full access by the provider to the information, direct reporting to the management body, and supervision by the entity of the service.

What is never transferred is responsibility: compliance remains yours. This is how we structure our outsourced compliance officer service, and in a similar way the outsourced DPO.

What must the outsourcing contract include?

The essential building blocks:

  • Description of the service and measurable service levels.
  • Access, information and audit rights for the entity, its auditors and the supervisor.
  • Confidentiality, data protection and the location of processing.
  • Rules on subcontracting: conditions, notification and flow-down of rights.
  • Business continuity, incident management and an exit plan.

If the service is ICT and supports essential or important functions, DORA adds specific mandatory clauses (Art. 30).

Do I have to notify the supervisor of the outsourcing?

Outsourcing of critical or important functions must be brought to the supervisor’s attention on the terms of the rules applicable to your type of entity. In a new authorization, moreover, the split between in-house and outsourced resources is part of the program of operations.

The practical rule: if the delegation changes your resource structure, the supervisor expects to hear about it before finding out in an inspection. And the DORA register automatically makes a good part of your ICT map visible.

What about chain subcontracting?

It is the classic blind spot. Your contract must regulate whether the provider may subcontract, under what conditions and with what duty to inform you, and must pass your access and audit rights down to the relevant subcontractors.

For ICT services, the register of information under DORA requires you to also record the relevant subcontracting chains: if today you do not know who is behind your provider, you cannot complete that register rigorously.

What has DORA changed since January 2025?

Regulation (EU) 2022/2554 (DORA), applicable since January 2025, makes digital operational resilience a cross-cutting obligation for the financial sector: ICT risk management, incidents, testing and, what affects outsourcing most, a specific regime for ICT third-party risk.

Its two flagship pieces: the register of information on all arrangements with ICT providers and the mandatory contract clauses of Art. 30. We cover this in detail in our DORA services.

What is the register of information on ICT providers?

A structured inventory of all your arrangements with ICT service providers, identifying which functions each one supports, how critical it is and the relevant subcontracting chains. It must be kept up to date and be available to the supervisor.

Well built, it is more than an obligation: it is a snapshot of your real technology dependence and the basis for prioritizing contract renegotiations and exit plans. Poorly built, it is the first inconsistency a reviewer will spot.

What exactly is expected of an exit plan?

A realistic strategy to bring the function back in-house or migrate it to another provider if the current one fails, defaults or disappears: scenarios, owners, timelines, data to recover and estimated costs. For critical functions it is not optional.

The supervisory standard rises every year: from having a document to being able to show that the plan is executable, with dependencies identified, alternatives sounded out and, where possible, elements tested. An irreversible dependence on a single provider is, in itself, a risk that must be explained.

Operational guide

An outsourcing program that sustains itself

Three phases and ten steps to move from improvised outsourcing to a governed program: know what you have, contract it properly and control it for as long as it lasts.

Phase 1

Inventory and classification

We bring all arrangements with third parties into a single repository, including legacy and group ones, and classify what is a critical or important function and which ICT service falls under DORA. Without a map there is no program.

Phase 2

Contract and rollout

Provider due diligence, negotiation of the clauses the rules require (access, audit, subcontracting, exit, DORA Art. 30 where applicable) and any notifications to the supervisor. The contract is your main evidence.

Phase 3

Control, exit and supervisor

Service indicators, incident management, audit rights genuinely exercised, an up-to-date register of information and reviewed exit plans. The program is defended with what you do every quarter, not with what you signed once.

Defensible outsourcing in 10 steps

  1. Single inventory: bring all arrangements with third parties into one repository, including historical, intragroup and those contracted by individual departments.
  2. Classification: determine, with written criteria, what is a critical or important function and which ICT services support essential functions.
  3. Provider due diligence: assess solvency, technical capacity, security and reputation before signing, and document the analysis.
  4. Complete contract: set out in writing the service, service levels, access and audit, data, subcontracting, continuity, incidents and exit.
  5. DORA chapter: if the service is ICT, include the mandatory clauses of Art. 30 and classify its criticality for the register.
  6. Notification to the supervisor: handle the notifications that apply and reflect the outsourcing in your program of operations.
  7. Register of information: build and maintain the register of ICT providers and the general inventory of outsourcing arrangements, with an assigned owner.
  8. Ongoing control: define indicators, follow-up meetings, incident management and real exercises of your audit rights.
  9. Subcontracting chain: demand visibility of the relevant subcontractors and extend your access rights to the whole chain.
  10. Exit plan: prepare and review the reversal or replacement strategy for each critical function, with owners, timelines and alternatives.

If you want to delegate specific functions with all the safeguards, see outsourced compliance officer, outsourced DPO and the full adaptation to DORA.

Free resource · PDF

Download the MiFID II Checklist

The 10 conduct controls the CNMV expects to see working at an EAF or investment firm, with the typical evidence for each one. Ideal as a quarterly self-assessment with your team.

  • The 10 essential conduct controls
  • The evidence expected for each control
  • 5 signs that a control exists only on paper
  • Professional PDF · 5 pages · 11 KB

No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.

Your download has started

The checklist is downloading now. If it does not start automatically, click here.

Need help implementing any of the steps after reading it? Write to us directly:

Chat with us on WhatsApp
Operational glossary

Regulated outsourcing in nine terms

This is the vocabulary used by the rules, by supervisors and, increasingly, by your own providers when negotiating. You should walk into that room knowing it.

Critical functionConcept

What cannot fail

A function whose failure would seriously compromise the entity’s authorization, results or continuity of services.

Outsourcing it triggers the enhanced regime.
OutsourcingFramework

Doing it through someone else

An arrangement under which a third party carries out a process, service or activity that the entity would otherwise perform itself.

Intragroup also counts as outsourcing.
ResponsibilityPrinciple

The one thing you cannot delegate

The entity and its management body answer to clients and the supervisor exactly as if the function were in-house.

A contract never transfers it.
Exit planContingency

The end, planned from the start

A strategy to reverse or migrate the function if the provider fails or the arrangement ends: scenarios, timelines, data and alternatives.

For critical functions, indispensable.
Subcontracting chainRisk

Who is behind your provider

The third parties to which your provider in turn delegates. Without visibility and flow-down of rights, control evaporates.

The DORA register makes it visible.
DORARule

Regulation (EU) 2022/2554

The digital operational resilience regulation for the financial sector, applicable since January 2025. It reshapes ICT third-party risk.

Its Art. 30 sets mandatory contract clauses.
Register of informationEvidence

The census of your ICT providers

A structured inventory of all ICT arrangements, with the functions supported, criticality and subcontracting chains.

Up to date and available to the supervisor.
ICT providerThird parties

The technology third party

Whoever provides digital and data services on an ongoing basis: cloud, software, communications, processing.

Under DORA, with its own contract regime.
Audit rightContract

Being able to look inside

The power of the entity, its auditors and the supervisor to access, inspect and audit the provider and its service.

Agreed in the contract and genuinely exercised.
Outsourcing playbook

The five phases the supervisor will audit

Outsourcing phase
What the supervisor expects
Typical evidence

Classification

Written criteria to identify critical or important functions and essential ICT services, applied consistently.

Outsourcing policy, classified inventory and a criticality analysis for each arrangement.

Due diligence

Prior assessment of the provider, proportionate to criticality: solvency, capacity, security, concentration.

Due diligence reports, completed questionnaires and approval at the appropriate level.

Contract

Complete minimum content: service levels, access and audit, data, subcontracting, continuity and exit; DORA Art. 30 for ICT.

Signed contracts with the required clauses and a content verification matrix.

Monitoring

Effective control throughout the life of the arrangement: indicators, incidents, reviews and audits carried out.

Provider dashboards, minutes of follow-up meetings and audit reports on the provider.

Exit and contingency

Realistic exit plans for critical functions and active management of concentration and dependency risk.

Documented and reviewed exit plans, alternatives identified and tests carried out.

Signs that your outsourcing is out of control

Five phrases we often hear in the first diagnostic. Each one is a potential finding; together, a case file.

  • There is no single inventory: each department keeps its own contracts and nobody has the full picture.
  • The contract with your cloud provider does not mention supervisor access or audit rights.
  • You know your provider subcontracts, but you could not say to whom or from which country it operates.
  • The outsourced compliance function has not submitted a single report to the management body this year.
  • If your critical provider goes down tomorrow, there is no written exit plan and no alternative identified.
Ecosystem

Outsourcing touches every line of your organization

Delegating functions reshapes internal control, anti-money laundering and even how your resources fit the authorization. These pages complete the picture so you can decide what to move outside and how to govern it.

Legal

Legal outsourcing

Recurring legal advice as an external service: what it covers, how it is structured and what a small entity gains.

See the service →
RecurringBoutique
Model

Three lines of defense

Where outsourced functions fit in your control model, so that delegating does not break the architecture.

See the model →
ControlArchitecture
AML/CFT

SEPBLAC representative

The anti-money laundering side: what can rely on external support and what requires an internal presence.

See the role →
SEPBLACAML
EAF

EAF obligations

The leanest structures in the sector are also the most dependent on providers: here is how the two fit together.

See the obligations →
ResourcesCompliance

For specific functions, see the outsourced compliance officer and the outsourced DPO; for the technology side, the adaptation to DORA; and if your resources map affects your license, the investment firm (ESI) authorization.

Contact

Book a call

Describe your provider map (technology, back office, compliance, cloud) and we will review with you which arrangements are critical functions, what each one requires and where your risk lies.

Outsourcing of critical functions: requirements, control and the DORA chapter

Regulated entities (investment firms, management companies, payment institutions and credit institutions) now build their operations on third parties: technology, back office, administration, control functions. The rules do not prohibit this; they set conditions. The MiFID II framework, Delegated Regulation (EU) 2017/565 and, in Spain, Law 6/2023 and Royal Decree 813/2023 set the rules of the game for critical or important functions, and Regulation (EU) 2022/2554 (DORA) adds, since January 2025, a specific regime for ICT providers. The principle that organizes everything else: the task is delegated, the responsibility never.

What a critical or important function is (and why the label matters)

A function is critical or important when its failure would seriously compromise continuing compliance with the conditions of the authorization, financial results, or the soundness and continuity of services. The classification is not rhetorical: it triggers the enhanced regime (a contract with minimum content, intensified control, notification to the supervisor as appropriate and an exit plan) and explains why the first control of any outsourcing program is a classification with written criteria. For an entity going through authorization, moreover, the split between in-house and outsourced resources must match the program of operations: a structure hollowed out of substance does not pass the sufficient-resources test.

The requirements of a defensible outsourcing arrangement

Four conditions support any serious delegation. A written contract with service levels, access, information and audit rights (for the entity, its auditors and the supervisor), a data regime, regulated subcontracting, continuity and exit. Effective control: indicators, monitoring, incidents and audits carried out, because the supervisor assesses what you do during the life of the arrangement, not just what you signed. Responsibility intact: the entity and its management body answer as if the function were in-house, which requires a real ability to oversee the provider. And an exit plan for what is critical: reversal or replacement scenarios with owners, timelines and alternatives identified.

Chain subcontracting and notification to the supervisor

The risk grows downstream: your provider delegates to another, that one to a third, and the entity loses the map of who processes what and from where. A well-built contract regulates whether subcontracting is allowed, under what conditions and with what duty to inform, and passes access and audit rights down to the relevant subcontractors. In parallel, outsourcing of critical or important functions is notified to the supervisor on the terms of the rules for each type of entity; the practical rule we apply with clients is simple: if the delegation alters your resource structure, it is better for the supervisor to hear it from you than from an inspection.

DORA: the specific regime for ICT providers

Since January 2025, DORA layers a complete technology chapter on top of the general regime: ICT third-party risk management, a register of information covering all arrangements with ICT providers (functions supported, criticality and subcontracting chains) and mandatory contract clauses (Art. 30) for contracts that support essential or important functions. For many entities, the DORA exercise has uncovered the reality of their technology dependence: cloud contracts without audit rights, opaque chains and impossible exits. Our team combines contract review with building the register and fitting it into the risk map: you will find it in our DORA services, supported by the control and risk function and internal audit.

DORA Regulation (EU) 2022/2554 DORA Art. 30 MiFID II Law 6/2023 Royal Decree 813/2023 CNMV

Functions you can outsource with us

Outsourced compliance officer Outsourced DPO SEPBLAC representative Legal outsourcing DORA compliance

Control and organization

Control and risk function Three lines of defense Internal audit Investment firm (ESI) authorization (CNMV) Program of operations EAF obligations

Resources

CNMV inspections AI Act and financial institutions Blog: financial regulation

Official sources

Key legislation, linked to the official text:

Legislation and links reviewed in .

More in Corporate Compliance