What it asks for. The European Supervisory Authorities, through the Joint Committee, designate ICT third-party service providers that are critical for financial entities and appoint a Lead Overseer for each. Designation follows an assessment of criteria set out in the article.
In practice. The criteria are the systemic impact on the stability, continuity or quality of financial services if the provider faced a large-scale operational failure, the systemic character or importance of the financial entities that rely on it, their reliance on the provider for critical or important functions, and the degree of substitutability. Providers can request voluntary designation, and some providers, such as those subject to other oversight frameworks or intragroup providers, are excluded. A critical provider established in a third country must establish a subsidiary in the Union within twelve months of designation. Financial entities should identify which of their providers are designated and track oversight outcomes.
Common gaps. Financial entities often assume oversight of a designated provider replaces their own due diligence, which it does not.