DORA: European authorities designate 19 critical ICT third-party providers

2025-11-18 · Publisher : Autorités européennes de supervision (ESAs) · Domain : Cloud & DevOps

The three European Supervisory Authorities publish the first list of 19 critical ICT third-party providers under DORA, including AWS, Google Cloud and Microsoft. They come under direct European oversight.

### Background On 18 November 2025, the European Supervisory Authorities (EBA, EIOPA and ESMA) publish the first list of **19 critical ICT third-party providers** (CTPPs) designated under the **DORA** regulation. It includes cloud hyperscalers, among them Amazon Web Services, Google Cloud and Microsoft, but also data center operators, network operators and financial software vendors. ### Key facts - Designation rests on the systemic impact of a failure, the importance of the financial entities served, reliance for critical functions and the absence of easy alternatives. - Each provider gets a lead overseer (EBA, EIOPA or ESMA) depending on the share of institutions it oversees. - The authorities can carry out investigations and inspections and issue recommendations; periodic penalty payments of up to 1% of average daily worldwide turnover are possible. - Each provider must designate a legal entity, ideally an EU subsidiary, as a coordination point, and pay annual oversight fees. - The list will be updated every year. ### Why it matters For the first time, US cloud providers are supervised directly by European regulators, beyond the contracts with their customers. Banks and insurers must keep exit plans, because as a last resort the authorities can require the suspension or termination of a service. For IT services firms, it is one more argument to propose reversible architectures. ### Takeaway In November 2025 hyperscalers come under direct European financial oversight.

Tags : Réglementation, Europe, Hyperscaler, Cloud, Sécurité