Digital Operational Resilience Act (DORA)

The Digital Operational Resilience Act, or "DORA", is an EU regulation on digital operational resilience for the financial sector that comes into force on 17 January 2025. DORA aims to establish a harmonised operational resilience framework across the EU. Amongst other things, DORA requires Financial Entities to ensure their agreements with ICT service providers contain certain contractual requirements. These are predominantly set out in Articles 28 and 30 of DORA. LSEG expects a number of its services will constitute “ICT services” for the purposes of DORA.

DORA applies across the financial services sector in all EU member states, specifically to ICT services used in the EU by Financial Entities. It also introduces a framework for direct oversight of designated ICT service providers by the EU regulatory authorities, even if outside the EU. For LSEG, this means that: (1) a number of LSEG’s regulated EU businesses fall within the direct scope and impact of DORA; and (2) LSEG expects clients of certain LSEG services which are in the scope of DORA as ICT services to request support with their DORA obligations.

LSEG considers resilience as a strategic priority and is putting in enormous effort to enhance its existing processes to align to DORA by 17 January 2025. LSEG has also been engaging with regulators and industry experts through active participation in various DORA-related consultation processes (including in respect of Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS)).

Where LSEG entities provide ICT services to clients who are themselves subject to DORA, we have made a number of updates to our operational processes to support such clients’ compliance with DORA, including making available the relevant Annex or updating the existing Rulebook for the benefit of eligible EU clients who require DORA-compliant contractual terms.

Where LSEG is an ICT service provider, the relevant LSEG business has either prepared an Annex or updated its existing Rulebook as detailed above. The relevant Annex and updated Rulebook (or, in the case of Acadia, the existing MSA) contains the contractual provisions that the relevant LSEG business is prepared to offer clients of LSEG ICT services which are in scope for DORA.

The Annex and relevant Rulebook clauses have been drafted following detailed scrutiny of DORA provisions, in particular Articles 28 and 30 of DORA and any relevant RTS. In drafting an Annex and relevant Rulebook clauses, we have taken into account standard market practices followed by other ICT service providers and included industry and client feedback, where applicable and available.

For ICT services relating to LSEG’s Data & Analytics, Risk Intelligence, FTSE Russell and FX businesses, the LSEG Annex can be requested at the self-service client portal https://resiliencehub.lseg.com/. Once the LSEG Annex is signed, the contractual terms for the applicable ICT service(s) will be updated to include the LSEG Annex terms effective from 17 January 2025 or the date when the LSEG Annex is signed by the client, whichever is later. Contact your Account Manager for further information on the Annex Request process and the portal. 

For ICT services relating to London Stock Exchange plc’s businesses, the LSEG Annex can be requested at each business division’s self-service DORA webpage, available below. Clients will receive a DORA variation letter for each business division, which will incorporate the LSE Annex. Once signed, the contractual terms for the applicable ICT service(s) will be updated to include the LSE Annex terms effective from 17 January 2025 or the date when the variation letter is signed by the client, whichever is later.

For ICT services provided by LSEG Regulatory Reporting, clients can email their PTRR account representative to request a copy of the PTRR Annex.
Login | Regulatory Reporting Support Portal (lseg.com)

For ICT services provided by TradeAgent, SwapAgent and Acadia, no further action is required as the DORA provisions are contained directly in the relevant Rulebook or MSA and, where they have been inserted as part of a Rulebook amendment, will apply automatically at the expiration of the relevant notice period for amendments.
https://clearingservices.lch.com

For the avoidance of doubt, each of the respective Annexes applies only to the relevant LSEG businesses as stated above and does not apply to ICT services provided by any other LSEG businesses or any other financial services provided by LSEG. If you have questions related to other LSEG businesses or any other financial services provided to you by LSEG, contact your LSEG account representative. https://portal.acadiasoft.com

DORA includes a requirement for Financial Entities to complete a register containing information relating to ICT Services they receive and the third-party providers of such services (“Registers of Information”). Completed Registers of Information are to be submitted to the applicable competent authority for DORA.

Some LSEG Financial Entity clients will therefore want to request LSEG to provide certain information to help them populate these Registers of Information. LSEG clients can make such requests via the client portal for Data & Analytics, FTSE Russell, Risk Intelligence and FX, or by reaching out to their respective LSEG account representative for other LSEG businesses.

We are carefully monitoring and tracking developments relating to the designation of critical ICT third-party service providers to ensure that we satisfy any applicable regulatory requirements relating to any potential designation in a timely manner.