The ESAs, the European Banking Authority (EBA), European Insurance and Occupational Pensions Authority (EIOPA), and European Securities and Markets Authority (ESMA) have accepted the European Commission’s (EC) rejection of its draft regulatory technical standard (RTS) on subcontracting.

In an opinion, the ESAs acknowledged the assessment performed by the EC and confirmed that the amendments proposed ensure that the draft RTS is in line with the mandate set out under the Digital Operational Resilience Act (DRA).

“For this reason, the ESAs do not recommend further amendments to the RTS in addition to the ones proposed by the EC,” they said.

The EC rejected the original draft RTS on subcontracting, which specified further elements that financial entities must determine and assess when subcontracting ICT services that support critical or important functions under DORA, on the grounds that certain elements exceeded the powers given to the ESAs by DORA.

“The ESAs encourage the EC to finalise the adoption of the RTS without further delay as submitted to the ESAs,” the opinion stated.

Article 30(5) of DORA mandates the ESAs to develop draft regulatory technical standards specifying the elements that a financial entity must determine and assess when subcontracting ICT services supporting critical or important functions.

The ESAs submitted their original RTS to the EC on 17 July 2024 but on 21 January 2025, in accordance with Article 15(1) of the ESAs Regulations, the EC notified the ESAs that it rejected the draft RTS.

---