Critical ICT third-party provider (DORA CTPP)

Designation requires four cumulative conditions to be met: the systemic impact of a large-scale operational failure, the systemic character or importance of the dependent financial entities, the fact that this dependence attaches to critical functions, and the degree of substitutability of the provider. The fourth criterion is the only one that actually measures systemic character, and it inverts the competition reflex: what makes a provider critical is not its market share but the impossibility of leaving it quickly. The method used to build the list interests insurance more than the list itself, since a supervisor obtained through a reporting obligation the map of shared technical dependencies the market had demanded for fifteen years without ever being able to produce it, for want of power to compel declaration. Not to be confused with a critical or important function, which describes what the financial entity entrusts to a third party: the critical provider is designated by the European authorities, the critical function is declared by the entity in its register of information. Where the word appears: in Regulation (EU) 2022/2554, known as DORA, from Article 31 onward; in a policy, the same risk appears under supplier failure cover.