The European Supervisory Authorities and UK Financial Regulators Sign Memorandum of Understanding on Oversight of Critical ICT Third-Party Service Providers Under DORA

Why It Matters

The MoU deepens EU‑UK regulatory cooperation, reducing systemic risk from ICT service providers and reinforcing operational resilience in a post‑Brexit financial landscape.

Key Takeaways

• ESAs and UK regulators formalize DORA oversight cooperation
• MoU confirms UK confidentiality regime equivalent to EU standards
• Joint monitoring targets critical ICT third‑party risk
• Coordination aims to boost EU‑UK financial operational resilience
• Framework aligns with DORA Articles 36,44,49

Pulse Analysis

Digital Operational Resilience Act (DORA) has become the cornerstone of EU financial stability, mandating rigorous oversight of critical information and communication technology (ICT) third‑party service providers. As financial institutions increasingly rely on cloud platforms, data analytics and outsourced cybersecurity solutions, regulators face the challenge of ensuring that these external dependencies do not become vectors for systemic disruption. DORA’s articles on oversight, international cooperation and cross‑sector exercises aim to create a harmonised risk‑management framework that can be applied uniformly across member states, fostering both transparency and accountability among ICT vendors.

The newly signed MoU between the European Supervisory Authorities and the United Kingdom’s BoE, PRA and FCA marks a pivotal step in extending DORA’s reach beyond EU borders. By conducting a targeted equivalence assessment, the ESAs verified that the UK’s confidentiality and professional‑secrecy regime meets EU standards, clearing a major legal hurdle for information exchange. This cooperation signals a pragmatic post‑Brexit approach, where regulatory alignment is pursued where it adds value, rather than being hindered by political divisions. The MoU establishes clear procedures for joint monitoring, data sharing and coordinated supervisory actions, effectively creating a trans‑national safety net for critical ICT services.

For banks, insurers and asset managers, the MoU translates into more predictable oversight and reduced duplication of compliance efforts. Institutions operating in both jurisdictions can now expect a more streamlined reporting process and clearer expectations around third‑party risk assessments. Moreover, the collaborative framework encourages the development of industry‑wide best practices, potentially accelerating the adoption of resilient cloud architectures and automated risk‑analytics tools. As cyber threats evolve, such cross‑border regulatory synergy will be essential to safeguard the integrity of the global financial system.

The European Supervisory Authorities and UK financial regulators sign Memorandum of Understanding on oversight of critical ICT third-party service providers under DORA

The European Supervisory Authorities and UK financial regulators sign Memorandum of Understanding on oversight of critical ICT third-party service providers under DORA 14 January 2026

Digital Finance and Innovation

International cooperation

The European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) have today signed a Memorandum of Understanding (MoU) with the Bank of England (BoE), the Prudential Regulation Authority (PRA), and the Financial Conduct Authority (FCA). This agreement enhances the cooperation between the authorities to oversee critical ICT third-party service providers (CTPPs) as required by the Digital Operational Resilience Act (DORA).

The MoU establishes clear principles and procedures for cooperation, information sharing and coordination of oversight activities between the relevant authorities responsible for EU CTPPs/UK CTPs oversight. The MoU aims at enhancing third-party risk management and contributing to the overall operational resilience of the financial sector in the EU and UK through strong cross-border cooperation. 

​​Legal basis and background

The MoU has been prepared in accordance with DORA Articles 36, 44, and 49, which cover the ESAs’ oversight powers, international cooperation, and financial cross-sector exercises, communication and cooperation.

​To exchange information with a third-country authority, the ESAs must ensure that the confidentiality and professional secrecy regime in the third country is equivalent to that in the EU. Therefore, before signing this MoU, the ESAs conducted an assessment that confirmed the UK confidentiality and professional secrecy regime’s equivalence with that in DORA.

14/01/2026

MoU DORA oversight ICT CTPPs

Memorandum of Understanding between the ESAs and the UK Financial Authorities on the oversight activities of critical ICT third-party service providers

14/01/2026

DORA Art.55

ESAs targeted equivalence assessment of DORA confidentiality and professional secrecy regimes