What is a Critical or Important Function under DORA?
Under DORA, a critical or important function is a function whose disruption would materially impair a financial entity's financial performance or the soundness or continuity of its services and activities, or whose discontinued, defective or failed performance would materially impair its continuing compliance with the conditions and obligations of its authorization or other obligations under financial services law.
- A critical or important function under DORA Article 3(22) is one whose disruption would materially impair a firm's financial performance, service continuity or regulatory compliance.
- The test descends from the MiFID II outsourcing test and does the same job as the UK's important business services, but the two definitions differ.
- ICT services supporting such a function attract DORA's strictest contract, register, concentration, subcontracting, exit and testing obligations.
- The financial entity decides and must document the methodology and outcome for every function reviewed.
What is a Critical or Important Function under DORA?
Under DORA, a critical or important function is one whose disruption would materially impair a firm's financial performance, the soundness or continuity of its services, or its compliance with its authorization and financial services law.
Article 3(22) of DORA words it in full: a function the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of which would materially impair its continuing compliance with the conditions and obligations of its authorization or with its other obligations under applicable financial services law. The source is Regulation (EU) 2022/2554, the Digital Operational Resilience Act, which has applied since 17 January 2025. It descends from the outsourcing test in Article 30 of Commission Delegated Regulation (EU) 2017/565 under MiFID II and the European Banking Authority's outsourcing guidelines, which treat a function as critical or important where a defect or failure in its performance would materially impair the firm's compliance, financial performance or continuity of services. It does the same job as the UK regime's important business services under PRA SS1/21 and FCA SYSC 15A, but the two tests differ.
Why it matters
- It scales DORA's obligations. ICT services supporting a critical or important function attract the strictest contractual, register, subcontracting, exit and testing requirements.
- It defines the resilience perimeter. Identifying the functions is the first step of the ICT risk management framework and of the mapping of ICT assets and dependencies.
- It is a supervisory focus. Firms must report the functions in the register of information and justify the classification.
Identifying critical or important functions
Start from the business services and the processes that deliver them, then apply the two limbs of the definition: would disruption materially impair financial performance or the soundness or continuity of services, and would failure materially impair compliance with authorization conditions or financial services law? Document the test, the evidence and the decision for every function reviewed, including those classified as not critical or important, because supervisors will examine the methodology.
What follows from the classification
- Register of information: all contractual arrangements with ICT third-party providers recorded, distinguishing those that support critical or important functions.
- Contracts: the additional provisions of Article 30(3), including service levels, incident support, participation in testing and audit rights.
- Pre-contract assessment: concentration risk and substitutability under Article 29.
- Exit strategies under Article 28(8) and business continuity plans and testing tied to the function.
- Subcontracting conditions and monitoring of the chain of providers.
Related terms
- Important Business Services
- Operational resilience
- Third-party risk management (TPRM)
- Business continuity management (BCM)
- Resilience Testing & Exercising
- Cyber resilience
In SmartSuite
SmartSuite Operational Resilience and Business Continuity holds the inventory of functions and services with the classification decision and evidence, links each critical or important function to the ICT assets, providers and contracts that support it, and feeds the register of information and the testing plan from the same records.
Frequently asked questions
Is a critical or important function the same as an important business service?
No. Important business service is the UK term under PRA SS1/21 and FCA SYSC 15A, defined by the harm a disruption could cause to consumers, markets or the firm, with impact tolerances attached. DORA's critical or important function is defined by material impairment to the firm's performance, continuity or compliance. The lists often overlap but are derived separately.
Who decides which functions are critical or important?
The financial entity does, and it must be able to justify the decision to its supervisor. DORA does not publish a list. Firms apply the Article 3(22) test through a documented methodology, record the outcome for each function in scope, and revisit it when services, providers or the business change.
Why does the classification matter for ICT providers?
Because DORA's requirements on contracts, the register of information, concentration risk, subcontracting and exit strategies apply in full only to ICT services supporting critical or important functions. A provider behind such a function faces more detailed contractual provisions, closer monitoring and, if designated by the European Supervisory Authorities, direct oversight.
Get started with SmartSuite
See how connected GRC, IT and operations work on one platform.