1. Introduction

The designation of Critical ICT Third-Party Service Providers (CTPPs) is an important feature of European Union financial-sector cybersecurity regulation. It is governed principally by Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector (DORA).

DORA establishes a regulatory framework under which certain technology service providers may be designated as critical because their services are essential to the operational resilience of banks, insurers, investment firms, payment institutions, and other regulated financial entities.

In Spain, this framework is especially relevant to ICT companies providing cloud computing, data hosting, cybersecurity infrastructure, payment-processing technology, banking software, data analytics, and other important digital services to regulated financial institutions.

A designation dispute may arise when an ICT service provider challenges:

Its classification as a critical ICT third-party service provider.

The criteria used to establish criticality.

The accuracy of data relied upon by the European Supervisory Authorities.

The proportionality of the resulting supervisory obligations.

The designation of an ICT group subsidiary rather than another group entity.

Supervisory fees, information requests, investigations, or penalties.

Restrictions or recommendations affecting its relationships with Spanish financial institutions.

The central legal distinction is that designation is an EU-level supervisory decision, not an ordinary administrative licensing decision issued by the Spanish banking authorities.

The principal institutions involved are the European Banking Authority (EBA), European Securities and Markets Authority (ESMA), and European Insurance and Occupational Pensions Authority (EIOPA), acting through the DORA oversight framework.

DORA has applied since 17 January 2025.

An important qualification concerning case law: direct judicial precedents specifically deciding challenges to DORA critical ICT provider designations must be distinguished from judgments concerning comparable EU supervisory decisions, judicial review, proportionality, fundamental rights, and administrative procedure. The cases discussed below principally establish those broader legal principles; they should not be represented as DORA designation judgments.

2. Principal Legal Framework

DORA is an EU regulation, so its substantive provisions apply directly in Spain without requiring wholesale national transposition.

However, Spanish supervisory institutions continue to exercise their own functions within the EU regulatory system.

These include:

Banco de España, particularly regarding banking and payment-sector supervision.

Comisión Nacional del Mercado de Valores (CNMV), concerning securities and investment-sector supervision.

Dirección General de Seguros y Fondos de Pensiones (DGSFP), concerning insurance and pension-sector supervision.

These institutions are important for financial-entity compliance, ICT risk management and related national supervisory decisions. They do not replace the EU-level designation mechanism for critical ICT providers.

3. Meaning of a Critical ICT Third-Party Service Provider

An ICT third-party service provider is an undertaking providing digital or data services to financial entities.

Examples include providers of cloud infrastructure, core banking platforms, cybersecurity monitoring, data-centre services, network operations and managed digital services.

A provider may become critical when its disruption could create significant risks for the financial system.

Criticality depends on regulatory criteria rather than simply the provider's commercial size, market reputation or technological sophistication.

Criticality assessment under Article 31 DORA

ICT third-party service provider serving EU financial entities

Systemic impact

Effect of failure on financial stability and service continuity

Importance of clients

Systemic character of financial entities relying on the provider

Critical functions

Reliance on ICT services supporting critical or important functions

Substitutability

Difficulty of replacing the provider or migrating the services

Joint Committee designation process

Assessment under DORA and applicable delegated criteria, including the provider's opportunity to respond

Critical ICT provider designation

Subject to EU oversight and applicable review mechanisms

A provider's designation can therefore be contested where the supervisory assessment allegedly misstates the provider's actual systemic significance.

Example

Suppose a Spanish banking technology company provides transaction-monitoring software to several credit institutions.

The European Supervisory Authorities assess whether the company's services support critical banking functions, whether disruption could affect financial stability, and whether banks could substitute another provider without serious operational interruption.

The company argues that:

Its customers have functioning contingency arrangements.

Other technology vendors offer comparable services.

It provides a supporting service rather than infrastructure indispensable to financial transactions.

The underlying customer-dependency figures are inaccurate.

This can generate a legal dispute about factual assessment, interpretation of Article 31, and proportionality.

The company cannot necessarily defeat designation merely by demonstrating the existence of competitors. The legal assessment also considers practical migration constraints, concentration risk and the importance of the affected financial functions.

4. European Union Designation Procedure

Article 31 DORA must be read together with Commission Delegated Regulation (EU) 2024/1502, which develops the relevant criticality assessment criteria.

Stage 1: Collection of supervisory information

Financial institutions are required to maintain registers of information concerning their contractual arrangements for ICT services.

These registers help the authorities identify concentrations of reliance on particular providers.

In Spain, relevant information is gathered through the applicable supervisory channels, including the national competent authorities and the wider European supervisory framework.

The collected information may concern the number and importance of financial entities using a provider, the nature of the ICT services, the financial functions supported, and the difficulty of replacing the provider.

Potential dispute: A provider may contend that the supervisory database contains duplicate customer records, outdated service classifications or incorrect dependency information.

Stage 2: Assessment of criticality

The European Supervisory Authorities assess the provider according to the relevant DORA criteria.

The delegated regulation makes the assessment more structured, but it does not transform every qualitative supervisory question into a purely mathematical test.

A designation may involve both quantitative evidence and an assessment of the operational significance of particular technology services.

Potential dispute: The provider may argue that the authorities relied on inappropriate comparators, misunderstood contractual relationships, or incorrectly assessed substitutability.

Stage 3: Opportunity to respond

Article 31 provides for notification of the proposed assessment and an opportunity for the ICT provider to submit a reasoned statement and relevant information before designation.

This safeguards procedural fairness.

A provider might challenge a designation where it was deprived of a meaningful opportunity to address essential adverse findings.

The precise time limits and procedures should be determined from the applicable provision and current implementing arrangements, rather than assuming that ordinary Spanish administrative deadlines apply.

Stage 4: Designation and notification

The Joint Committee of the European Supervisory Authorities is responsible for the designation process.

The designation may place the provider within the EU oversight framework, with one of the European Supervisory Authorities acting as the Lead Overseer.

The provider may challenge the decision through the legally available EU review procedures.

Stage 5: Supervision after designation

Designation is not equivalent to an automatic finding of misconduct.

Its significance is that the provider becomes subject to oversight concerning matters such as:

ICT security and risk management.

Availability, integrity and continuity of services.

Physical and information security.

Incident-related arrangements.

Governance of subcontracting.

Testing and operational resilience arrangements.

Remediation of identified shortcomings.

The oversight framework includes information requests, investigations, inspections and recommendations. Certain enforcement measures may follow noncompliance with legally binding requirements.

The scope of the powers and the consequences of refusing a recommendation must be distinguished carefully from the power to impose a direct administrative sanction.

5. Major Categories of Designation Disputes in Spain

A. Incorrect classification as a critical provider

A provider may argue that its services are important commercially but insufficiently critical to justify the DORA designation.

For example, a Madrid-based software provider might supply customer relationship management applications to banks without supporting payment execution, deposit-account infrastructure or other essential operations.

The company argues that its services can be temporarily suspended without causing material systemic disruption.

The authorities may nevertheless consider broader dependency information demonstrating that the services underpin important banking processes.

Legal question: Did the authorities correctly assess the systemic impact and functional importance of the services?

Relevant principles include accuracy of facts, correct application of the statutory criteria, appropriate reasoning and judicial review of complex assessments.

B. Disputes concerning substitutability

Substitutability is particularly important where an ICT service depends on proprietary technology or complex integration.

A provider may argue that there are numerous competitors, so it cannot be indispensable.

However, theoretical market competition and practical operational substitutability are not identical.

A bank may technically be able to procure another cloud or software service while still requiring substantial time for data migration, security testing, system integration and supervisory compliance.

Legal question: Has the authority assessed actual replacement barriers rather than merely market share or the existence of competing suppliers?

Relevant evidence may include alternative vendors, transition costs, migration periods, interoperability requirements and the availability of exit plans.

C. Group structure and multinational designation

Technology companies often operate through multiple EU and non-EU subsidiaries.

A provider may argue that a particular Spanish subsidiary does not actually supply the services under review, or that contractual and operational responsibilities belong to another group entity.

Disputes may concern which legal person is designated, which group relationships are relevant, and who must fulfil associated obligations.

DORA also establishes particular requirements for critical providers established in third countries, including an EU-subsidiary requirement.

Legal question: Has the authority correctly identified the relevant provider and applied the DORA rules concerning corporate structure?

D. Procedural fairness and access to information

A provider may contend that it cannot meaningfully respond to a designation proposal without access to the underlying findings.

The authorities, however, may hold confidential information about banks, financial stability, outsourcing dependencies and commercially sensitive technology arrangements.

The dispute therefore involves balancing rights of defence with confidentiality requirements.

Legal question: Was sufficient information disclosed to permit an effective defence without improperly revealing protected supervisory material?

E. Proportionality and economic freedom

Designation produces compliance and supervisory burdens.

These may involve additional governance responsibilities, oversight fees, documentation, examination of subcontracting arrangements and operational remediation.

A provider may argue that the burdens are disproportionate to the risk it presents.

However, demonstrating increased compliance costs does not itself prove that a designation is unlawful.

The court must assess the regulatory objective, the relevant statutory framework and whether the authorities acted within the limits of their powers.

F. Disputes concerning subsequent oversight measures

A lawfully designated provider may nevertheless dispute an individual information request, inspection, recommendation, periodic penalty payment or other supervisory measure.

It is therefore essential to distinguish:

An action challenging the underlying designation.

An action challenging a later supervisory decision.

Proceedings concerning a Spanish financial institution's failure to comply with its own DORA obligations.

Each may involve different defendants, remedies and jurisdictional rules.

6. Important European Union Case Laws

The following decisions provide a doctrinal foundation for analysing DORA designation disputes.

They are analogical authorities, not judgments directly determining whether a particular ICT provider should have been designated under Article 31 DORA.

Case 1: United Kingdom v European Parliament and Council — C-270/12

Court of Justice of the European Union | Judgment of 22 January 2014

Background

The United Kingdom challenged provisions of Regulation (EU) No 236/2012 that empowered ESMA to intervene in exceptional circumstances relating to short selling.

The dispute raised questions concerning the delegation of powers to an EU agency and the limits of discretionary decision-making.

Principal legal questions

Could an EU agency exercise intervention powers affecting economic operators, and were those powers sufficiently circumscribed by legal criteria and review mechanisms?

Judgment

The Court dismissed the challenge and upheld the contested powers.

It considered the powers to be framed by conditions, criteria and institutional safeguards that permitted judicial control.

Legal principles

EU agencies may exercise significant technical supervisory powers where the legislative framework lawfully confers and circumscribes those powers.

The existence of discretion does not automatically make an agency's decisions unlawful.

The powers must remain subject to applicable legal constraints and judicial review.

Application to Spanish ICT designation disputes

A technology provider challenging designation cannot succeed simply by arguing that ESMA, EBA or EIOPA possesses substantial technical discretion.

It would need to demonstrate a specific legal defect, such as the incorrect application of Article 31, the infringement of a procedural guarantee, or an assessment outside the authority's legally conferred powers.

Significance: This judgment is particularly important for assessing the legality of supervisory authority discretion within the DORA framework.

Case 2: Tetra Laval BV v Commission — C-12/03 P

Court of Justice of the European Union | Judgment of 15 February 2005

Background

The dispute concerned the European Commission's prohibition of a proposed concentration involving Tetra Laval and Sidel.

The case involved complex economic predictions about the effects of a corporate merger.

Judgment

The Court addressed the standard of judicial review applicable to complex economic assessments.

It confirmed that, even where an EU institution has a margin of assessment, the courts must verify the reliability and adequacy of the evidence supporting its conclusions.

Legal principles

Judicial review may examine whether the evidence relied upon is factually accurate, reliable, consistent, complete enough for the relevant assessment, and capable of supporting the conclusions drawn.

Application to DORA

Imagine that a technology provider is designated because supervisory data indicates that 70% of a particular banking segment depends on its services.

If that figure is distorted by duplicate registrations or inaccurate service classifications, the provider may challenge the reliability of the evidence.

A court would not necessarily substitute its own technical judgment for that of the regulators. However, it could review whether the assessment was based on sufficiently reliable facts and whether the conclusion followed from those facts.

Significance: Technical complexity does not make supervisory findings immune from judicial scrutiny.

Case 3: Technische Universität München v Hauptzollamt München-Mitte — C-269/90

Court of Justice of the European Communities | Judgment of 21 November 1991

Background

The case concerned an administrative determination involving scientific equipment and the availability of equivalent equipment within the Community.

The decision required a complex technical assessment.

Judgment

The Court emphasized the procedural guarantees necessary where administrative authorities exercise complex technical discretion.

These included careful examination of the relevant facts, the opportunity for affected persons to express their views in the appropriate circumstances, and adequate reasoning.

Legal principles

Technical expertise must operate within a lawful administrative procedure.

Discretionary decisions must be based on a careful and impartial examination of the material information.

Application to DORA

An ICT provider could rely on this reasoning if it contends that the authorities disregarded relevant technical material establishing that its services could be replaced quickly and securely.

For example, evidence about independent system architecture, alternative hosting capacity or the existence of tested migration procedures might be relevant to substitutability.

The authorities must evaluate material evidence according to the legal assessment criteria.

Significance: This judgment supports procedural fairness and careful technical assessment in administrative designation decisions.

Case 4: Fedesa and Others — C-331/88

Court of Justice of the European Communities | Judgment of 13 November 1990

Background

The case concerned a challenge to Community legislation restricting certain hormone-related substances in livestock production.

The applicants raised arguments including proportionality.

Judgment

The Court explained how proportionality applies when reviewing EU measures involving policy choices and institutional discretion.

Where the legislature has broad discretion, judicial review may be limited to whether a measure is manifestly inappropriate for the legitimate objective pursued.

Legal principles

Proportionality requires consideration of the relationship between regulatory objectives and the measures adopted.

The intensity of review depends upon the nature of the measure and the extent of institutional discretion.

Application to DORA

A critical provider may contend that a requirement or supervisory measure creates excessive costs relative to the operational risk involved.

A proportionality argument should address the actual measure being challenged.

For example, a challenge to an individual information request may require a different analysis from a challenge to the DORA legislation establishing the oversight regime.

Significance: The judgment offers an important framework for proportionality arguments, but it does not imply that every costly ICT supervisory obligation is unlawful.

Case 5: Berlusconi and Fininvest — C-219/17

Court of Justice of the European Union | Judgment of 19 December 2018

Background

The dispute concerned supervisory proceedings relating to the acquisition of a qualifying holding in a credit institution.

The procedure involved actions by the Italian national supervisory authority and a final decision by the European Central Bank.

Principal legal question

Which courts had jurisdiction to review acts undertaken within a composite procedure involving national and EU authorities?

Judgment

The Court explained that, in the relevant supervisory procedure, review of the national preparatory measures fell within the jurisdiction of the EU Courts where those measures formed part of the process leading to the ECB's final decision and did not have independent binding effects.

Legal principles

The allocation of judicial jurisdiction depends on the structure of the decision-making procedure.

National participation does not necessarily convert an EU decision into a national administrative act.

Effective judicial protection must be preserved without fragmenting the review of an EU decision improperly.

Application to Spain

Suppose Banco de España provides dependency information used during the designation of a cloud provider.

The provider may wish to challenge that information or the eventual EU designation.

It must identify whether it is contesting a national act producing its own legal effects or an EU-level decision.

The fact that Spanish supervisory information contributed to the designation does not necessarily confer jurisdiction on a Spanish administrative court to annul the EU decision.

Significance: This is one of the most relevant cases for distinguishing Spanish administrative proceedings from EU-level judicial review.

Case 6: Unión de Pequeños Agricultores v Council — C-50/00 P

Court of Justice of the European Union | Judgment of 25 July 2002

Background

An agricultural association sought to challenge EU legislation directly.

The dispute concerned the admissibility of an annulment action, particularly the requirement of individual concern.

Judgment

The Court reaffirmed the treaty requirements governing direct challenges brought by private applicants against EU acts.

It also addressed the relationship between direct EU judicial remedies and judicial protection through national courts.

Legal principles

Private parties must satisfy the applicable standing requirements for direct annulment proceedings.

The availability of effective judicial protection does not permit the courts simply to disregard the admissibility conditions established by the Treaties.

Application to DORA

A provider directly addressed by a designation decision may have a stronger basis for standing than a competing company merely alleging commercial disadvantage from the designation of another provider.

A challenge must still establish that the disputed measure is reviewable and that the applicant meets the relevant Article 263 TFEU requirements.

Significance: This judgment is important for distinguishing the right to challenge an individual designation from a general interest in questioning financial-sector regulation.

Case 7: Inuit Tapiriit Kanatami and Others v Parliament and Council — C-583/11 P

Court of Justice of the European Union | Judgment of 3 October 2013

Background

The applicants challenged EU legislation concerning seal products.

The dispute addressed the meaning of a regulatory act under Article 263(4) TFEU.

Judgment

The Court distinguished legislative acts from regulatory acts for purposes of the Treaty provision governing direct actions by private parties.

Legal principles

Article 263(4) contains different routes by which natural and legal persons may challenge EU acts, depending on whether they are addressed by the measure or meet the relevant direct-concern, individual-concern or regulatory-act conditions.

Application to DORA

A provider challenging its own individual designation is in a different legal position from a provider attempting to challenge DORA or a delegated regulation generally.

The applicable route depends on the legal nature of the act being challenged.

Significance: The case helps determine admissibility where disputes concern the regulatory criteria themselves rather than only a provider-specific designation.

Case 8: Kadi and Al Barakaat International Foundation v Council and Commission — Joined Cases C-402/05 P and C-415/05 P

Court of Justice of the European Communities | Judgment of 3 September 2008

Background

The cases concerned EU restrictive measures implementing United Nations sanctions.

The measures affected the applicants' property and other protected interests.

Judgment

The Court emphasized the importance of fundamental rights and effective judicial protection in reviewing EU measures.

The EU Courts retained authority to examine whether EU acts complied with fundamental rights.

Legal principles

EU measures remain subject to applicable fundamental-rights safeguards.

Affected parties must have access to legally adequate judicial protection.

Institutional or public-interest objectives do not eliminate the requirement of judicial scrutiny.

Application to ICT designation

A designation decision should not be treated as legally unreviewable merely because it concerns systemic cybersecurity risk or confidential financial-supervisory information.

Nevertheless, a DORA designation is not equivalent to a sanctions listing. The nature of the measure, the applicable procedures and the intensity of review differ.

Significance: The case provides broader constitutional support for effective review of EU administrative measures.

Case 9: Association de médiation sociale v Union locale des syndicats CGT — C-176/12

Court of Justice of the European Union | Judgment of 15 January 2014

Background

The case addressed the legal effects of a Charter provision and a directive in litigation involving private parties.

Judgment

The Court distinguished between Charter provisions capable of operating as directly enforceable rights in particular circumstances and provisions requiring further legal implementation.

Legal principles

Charter rights must be applied with regard to their nature, scope and the applicable EU legal framework.

Not every Charter provision independently supports every form of claim.

Application to DORA

An ICT provider may invoke Charter protections such as freedom to conduct a business under Article 16.

However, that protection is not absolute. The regulatory framework and permitted limitations must be examined under Article 52(1).

This matters where a provider argues that designation substantially affects its commercial freedom, contractual arrangements or ability to operate within the EU market.

Significance: The judgment provides useful context for understanding the enforceability and limits of Charter arguments, although it is not a direct authority on DORA designation.

Case 10: Bank Refah Kargaran v Council — C-134/19 P

Court of Justice of the European Union | Judgment of 6 October 2020

Background

A bank pursued damages concerning EU restrictive measures.

The dispute addressed jurisdiction and effective judicial protection in relation to EU action.

Judgment

The Court confirmed jurisdiction to hear the relevant claim for damages arising from unlawful restrictive measures.

Legal principles

The EU judicial system provides remedies capable of addressing unlawful EU conduct, subject to the applicable jurisdictional and substantive conditions.

Application to DORA

Where an unlawful EU supervisory measure allegedly causes financial loss, a provider may consider whether an action for non-contractual liability is available under Articles 268 and 340 TFEU.

Damages are not automatic simply because a designation is contested or annulled.

A claimant generally needs to establish a sufficiently serious breach of a rule intended to confer rights, actual damage, and a direct causal link.

Significance: The judgment helps explain the broader EU remedies framework; the specific damages principles must be applied using the established EU non-contractual liability jurisprudence.

7. Judicial Remedies Against a Critical ICT Provider Designation

The judicial route depends on the precise act being contested, the institution adopting it, and any administrative review procedure applicable under the founding regulations of the European Supervisory Authorities.

A. Review before the European Supervisory Authorities' Board of Appeal

Article 60 of the regulations establishing EBA, ESMA and EIOPA provides an administrative appeal mechanism for specified decisions.

For DORA-related disputes, it is necessary to examine whether the particular decision falls within the Board of Appeal's jurisdiction.

Where the Board of Appeal mechanism applies, an affected provider may contest an eligible decision on grounds such as incorrect application of law, assessment errors or procedural irregularities.

The relevant appeal period is generally two months, under the applicable founding regulation, although the precise triggering event and procedural rules must be checked.

Not every step in a DORA designation or oversight procedure is necessarily independently appealable.

B. Action for annulment before the EU Courts

Article 263 TFEU permits judicial review of eligible EU acts.

An ICT provider may seek annulment of a designation decision where the admissibility requirements are satisfied.

The principal grounds include:

The ordinary Article 263 filing period is two months, calculated in accordance with the relevant Treaty and procedural rules.

Important: A provider should not assume that an administrative appeal automatically suspends the judicial deadline or the contested measure. The applicable appeal architecture must be verified.

C. Interim relief

A designation or related oversight decision may have immediate operational consequences.

In an appropriate case, the provider may seek interim measures under Articles 278 and 279 TFEU.

Such relief is not automatic.

The EU Courts generally consider whether there is a prima facie case, urgency, the risk of serious and irreparable harm, and the balance of interests.

The public interest in financial stability and digital operational resilience may be particularly relevant.

D. Action for damages

Articles 268 and 340 TFEU provide the relevant framework for certain claims seeking compensation for unlawful EU conduct.

A provider alleging commercial loss must establish the applicable conditions for non-contractual liability.

These generally include a sufficiently serious breach of a rule intended to confer rights on individuals, actual damage and causation.

A claim for compensation differs from a claim for annulment.

E. Challenges before Spanish administrative courts

Spanish administrative courts may be competent where a Spanish regulator adopts a reviewable national decision against a financial entity or provider within its own powers.

For example, a dispute may involve a Spanish financial institution's ICT risk-management obligations or national enforcement action.

However, Spanish courts cannot simply annul an EU-level critical ICT provider designation.

A dispute concerning the validity of an EU act may, where procedurally appropriate, engage the preliminary-reference mechanism in Article 267 TFEU.

The distinction between national action and EU action is central to jurisdiction.

8. Relevance of Spanish Constitutional Law

Although DORA is EU legislation, Spanish constitutional principles remain relevant to measures taken by Spanish authorities within their lawful competence.

Article 9.3 — Legal certainty and prohibition of arbitrariness

Article 9.3 of the Spanish Constitution protects legal certainty and prohibits arbitrary public action.

A Spanish administrative decision concerning ICT supervision should therefore have a legally supportable basis.

This does not create an independent Spanish constitutional power to annul a final EU designation.

Article 24 — Effective judicial protection

Article 24 protects effective judicial protection.

It is particularly relevant to access to courts, procedural safeguards and the availability of legal remedies within the Spanish legal system.

EU-level designation review is governed primarily by EU judicial-remedy rules and Article 47 of the EU Charter.

Article 38 — Freedom of enterprise

Article 38 recognizes freedom of enterprise within the framework of the market economy.

A Spanish technology company may invoke economic freedom when challenging a national regulatory measure that disproportionately affects its business.

Nevertheless, freedom of enterprise does not prevent lawful financial regulation.

At EU level, the corresponding analysis often centres on Article 16 of the Charter.

Article 103 — Objective and lawful administration

Article 103 requires Spanish public administration to serve the general interest objectively and act in accordance with the law.

It is relevant when reviewing how Spanish supervisory authorities exercise their own powers.

Key limitation: EU acts are reviewed for validity within the EU judicial system. National constitutional principles do not, by themselves, authorize a Spanish court to declare an EU regulation or EU designation invalid.

9. Hypothetical Spanish Banking Technology Dispute

Consider the following illustration. It is hypothetical and not a reported case.

Facts

A technology company incorporated in Barcelona supplies cloud-based banking infrastructure to Spanish and other European financial institutions.

The European Supervisory Authorities designate the company as a critical ICT third-party service provider.

The assessment refers to a high concentration of banking clients, the importance of their functions, and significant barriers to changing providers.

The company disputes the designation on four grounds:

The authorities attributed services supplied by another group entity to the Barcelona company.

Several financial institutions maintain functioning alternative infrastructure.

The criticality assessment used outdated contractual information.

Material evidence submitted by the company was allegedly not considered.

Legal analysis

First issue: Identification of the correct legal entity

The court would examine the relevant statutory rules and the factual relationship between the designated undertaking and the services under assessment.

The existence of a corporate group does not automatically settle which entity should be designated.

Second issue: Substitutability

The authority may consider whether switching providers is realistically achievable within a period compatible with the continuity of financial functions.

Evidence of alternative providers is relevant, but a provider must distinguish theoretical market alternatives from practical resilience.

Third issue: Reliability of evidence

The reasoning in Tetra Laval supports meaningful judicial review of the quality of evidence underlying complex institutional assessments.

Material inaccuracies may undermine the designation where they are relevant to the outcome.

Fourth issue: Procedural fairness

The principles associated with Technische Universität München support scrutiny of whether material submissions were examined carefully and whether sufficient reasons were given.

Possible outcomes

Designation upheld

The competent reviewing body finds that the statutory criteria, supporting evidence and procedural requirements were adequately satisfied.

Designation annulled and reassessment required

A material legal or procedural defect leads to annulment, requiring the authority to take the necessary measures to comply with the judgment.

Separate oversight measure successfully challenged

The original designation remains valid, but a later legally defective supervisory act is annulled or otherwise remedied.

The outcome depends on the evidence and the applicable procedural rules, not merely on whether the company disputes its systemic importance.

10. Critical ICT Designation versus Other Financial and Cybersecurity Classifications

These classifications are not interchangeable.

A large cloud company is not automatically a critical DORA provider merely because it has significant market power.

Likewise, DORA designation does not, by itself, establish abuse of dominance or an infringement of competition law.

One undertaking may simultaneously be subject to several regulatory regimes, but each regime has its own criteria and legal consequences.

11. Practical Litigation Strategy for a Spanish ICT Provider

A provider challenging designation should concentrate on the disputed legal act and the evidence relevant to the DORA criteria.

The strongest challenge is generally one that identifies a particular breach of a legal requirement and explains its material consequences.

An assertion that designation is commercially inconvenient is insufficient without a legally relevant defect.

12. Frequently Arising Legal Questions

Can Banco de España designate a technology company as a critical ICT provider under DORA?

No. The DORA critical ICT provider designation mechanism operates at EU level through the European Supervisory Authorities. Banco de España retains its relevant national supervisory responsibilities.

Can an ICT provider refuse the designation?

An ICT provider cannot invalidate a lawful designation simply by refusing to accept it. It must use an applicable administrative or judicial remedy.

Does designation automatically prohibit the company from providing services in Spain?

No. Designation places the provider within a special oversight framework; it is not a general prohibition on serving regulated financial institutions.

Does DORA designation mean that the provider has committed a cybersecurity violation?

No. Criticality is based on the systemic importance of ICT dependencies, not necessarily on wrongdoing.

Can a provider dispute financial penalties or oversight fees independently?

Potentially, yes. The relevant review procedure depends on the nature of the financial measure, the decision-maker, and the applicable legal provisions. Fee assessment, penalties and designation are distinct legal questions.

Can the designation be reconsidered when business circumstances change?

The DORA framework provides for reassessment of criticality. Material changes in service dependencies, client relationships or relevant corporate structure may therefore affect future assessments. A request for reconsideration is not necessarily a substitute for challenging an existing decision within the applicable time limit.

13. Conclusion

Critical ICT provider designation disputes in Spain involve the interaction of EU financial regulation, digital operational resilience, administrative law, judicial review and fundamental rights.

Article 31 DORA provides the principal legal foundation for deciding whether an ICT service provider is sufficiently important to warrant critical-provider oversight. Commission Delegated Regulation (EU) 2024/1502 further structures that assessment.

The most important legal issues are whether the authorities applied the proper statutory criteria, relied upon accurate and sufficient evidence, respected procedural safeguards, acted within their powers, and adopted reviewable and legally justified measures.

The most directly useful broader judgments are United Kingdom v Parliament and Council for EU agency powers, Tetra Laval for judicial review of complex assessments, Technische Universität München for procedural safeguards, Fedesa for proportionality, and Berlusconi and Fininvest for the division of national and EU judicial jurisdiction.

Ultimately, a critical ICT designation is a preventive financial-resilience classification, not a punishment. Nevertheless, designation decisions and subsequent oversight measures remain subject to applicable EU legal safeguards and remedies.

Research qualification: This explanation uses established EU legislation and judicial authorities. I could not verify live court registers or the latest October 2026 designation decisions because web search is unavailable. The ten judgments discussed are not presented as direct DORA designation precedents, and the present status of any newly filed Spanish or EU DORA designation litigation should be independently checked before relying on it in formal proceedings.