The DORA Oversight Fee and Critical Third-Party Cost Model

Designation as a critical ICT third-party provider under DORA is usually discussed as a compliance event. On the balance sheet it is something else: a recurring fee liability and a permanent cost centre most providers do not model until the debit note arrives.

In November 2025 the European Supervisory Authorities named the first cohort of critical ICT third-party service providers — nineteen names, split for oversight between the EBA, ESMA and EIOPA. Most commentary treated the list as a governance and reporting story: what these providers now have to demonstrate, what their financial-entity clients have to check. That is real, and we have written about what designation actually means for the provider. But it buries the part a board should have costed a year earlier. Designation is not a one-off. It creates an annual oversight fee and a standing obligation to be overseen, and both belong in a budget line, not a footnote.

What the fee actually is

The oversight fee is not a fixed tariff you can look up. Article 43 of DORA makes it cost-recovery: the fee must fully cover the Lead Overseer’s necessary expenditure in carrying out oversight, and it must be proportionate to the provider’s turnover. Commission Delegated Regulation (EU) 2024/1505, adopted on 22 February 2024, turns that principle into a division problem.

The mechanics run roughly like this. The ESAs estimate the total cost of running the oversight framework for the year — the joint examination teams, the independent experts, the administrative overhead of the whole apparatus. Each designated provider then pays a share of that total, weighted by its applicable turnover relative to the others. There is a minimum annual fee to cover fixed administrative costs, so even the smallest designated provider pays something, and there is an adjusted fee in the designation year itself. The fee is billed by debit note and is payable within a short window — on the order of thirty days from issuance — so it is not a liability you can defer across a reporting boundary.

The practical consequence is that your fee is not knowable in advance as an absolute number. It moves with the ESAs’ total oversight budget and with the composition of the designated population. A board that wants a figure to plan against has to model a range, not wait for a price.

The applicable-turnover trap

The word doing the work in that calculation is applicable. Applicable turnover, as the delegated regulation defines it, is your revenue in the Union from providing ICT services to financial-services clients. That is a narrow slice for most large providers — the EU financial book, not the global one, not the whole customer base.

The trap is in the fallback. If a provider does not supply that figure in the form the regulation wants, the Lead Overseer is entitled to calculate on the basis of worldwide revenues generated irrespective of the type of client. For a global cloud or core-software provider whose EU financial-services revenue is a fraction of a much larger whole, that fallback is not a rounding difference. It is the gap between a fee scaled to one slice of the business and a fee scaled to all of it. The finance and tax functions that can produce a defensible, auditable EU-financial-services revenue figure on demand will pay on the narrow base. The ones that cannot, or do not organise to, hand the Lead Overseer a reason to use the broad one.

That is a data and controls problem before it is a compliance problem, and it is exactly the kind of thing that is cheap to solve in advance and expensive to argue about after the first debit note.

The fee is the small number

Here is the part that gets lost when the fee is discussed in isolation. The invoice is the visible cost. The expensive thing is the operating model the fee pays for you to be subjected to.

A designated provider has to stand up and staff a coordination point for the oversight relationship — in practice, a resourced EU legal entity able to interface with the Lead Overseer. It has to respond to requests for information, host and support joint examination team visits, produce and maintain self-assessments, disclose and keep current its subcontracting arrangements, and remediate the recommendations the Lead Overseer issues. None of that is a project with an end date. It is a permanent function, and it consumes senior engineering, security, legal and compliance time on a rolling basis. Building the self-assessment and incident pipeline that this apparatus expects is itself a standing engineering commitment.

So the cost model has three layers, and only the first is the fee. The fee is the recurring cash liability. The second layer is the fixed operating cost of the oversight function — headcount, tooling, the coordination entity. The third is the opportunity cost: the senior technical people answering the regulator are not building product. For a provider deciding how hard to resist or plan for designation, the second and third layers usually dwarf the first.

Why under-resourcing is the wrong economy

There is a tempting move for a provider that resents the whole regime: designate a coordination entity, keep it thin, and do the minimum. DORA prices that move directly. Under Article 35 the Lead Overseer can impose periodic penalty payments of up to 1% of the provider’s average daily worldwide turnover, charged on a daily basis until compliance is achieved, for up to six months. Note the base: worldwide turnover, not the applicable slice, and daily. A provider that treats oversight as a paperwork nuisance and lets a recommendation go unremediated is exposed to a penalty calculated on the whole business, compounding by the day. That is the reason the standing function has to be resourced to actually keep up, not just to exist on paper.

What to put in front of the board

If your firm sits anywhere near the designation criteria — concentration in the EU financial sector, substitutability, systemic importance to your clients — the useful exercise is not a legal opinion on whether you will be designated. It is a costed scenario. Three things belong in it:

• A modelled fee range, built on a defensible applicable-turnover figure your finance function can actually produce and evidence — and a sensitivity showing what the worldwide-revenue fallback would cost if you cannot.
• The annual run-rate of the oversight operating model: the coordination entity, the oversight-facing headcount, the assurance and evidence tooling, treated as a permanent cost centre rather than a mobilisation project.
• The downside case — what a sustained Article 35 penalty would do to the numbers — so the board can see why the operating model is funded to comply, not merely to appear compliant.

For the financial entities on the other side of these arrangements, the same modelling has a mirror image: how much of a provider’s new cost base flows back through pricing, and whether a designated provider is more or less durable as a dependency. We have set out that reading for both sides separately.

The fee is the invoice you can see. The cost is the operating model behind it, and the time to price both is while designation is still a scenario, not a letter.

Sixteen Pillars is a technology governance consultancy based in Cyprus. Engagements run remote across the EU, UK, and Middle East, with on-site time where the engagement requires it.