ESMA, UK Regulators Sign MoU on DORA ICT Oversight

The European Supervisory Authorities (EBA, EIOPA, and ESMA) have entered into a Memorandum of Understanding (MoU) with the Bank of England, the Prudential Regulation Authority, and the Financial Conduct Authority. This agreement, effective January 14, 2026, establishes principles for cooperation and information sharing regarding the oversight of critical ICT third-party service providers (CTPPs) under the Digital Operational Resilience Act (DORA). The MoU follows an assessment confirming the equivalence of the UK's confidentiality and professional secrecy regime with DORA requirements.

This MoU is crucial for financial entities operating in both the EU and UK that rely on critical ICT third-party providers. It aims to strengthen third-party risk management and enhance the overall operational resilience of the financial sector through cross-border collaboration. Regulated entities should be aware that oversight activities for CTPPs will now involve coordinated efforts between EU and UK authorities, potentially leading to more harmonized supervisory expectations and information requests related to ICT risk management and operational resilience.