In our understanding, in line with the European Commission report COM/2023/0365, payments systems and entities involved in payment processing activities should not be treated as entities falling within scope of DORA Regulation to whom DORA requirements would be applicable directly (as financial institutions listed in Article 2 (Scope) of DORA) and that consequentially would be subject to direct oversight by competent authorities. 

However, it does not affect that such operators of payments systems and entities involved in payment processing activities should be treated as ICT service providers by financial institutions, as established by Recital 63, whereas operation of such payment processing systems/infrastructures/networks should be treated as ICT services by financial entities. Consequentially, mandatory DORA requirements should be applied to such arrangements impacting such payment system operators indirectly, as they in essence match the "ICT services'' definition provided by Article 3 (21) of DORA Regulation. Inter alia, it would include securing contractual framework that match the requirements of Articles 28 and 30.

Various major payment systems/infrastructure providers are refusing to negotiate terms of agreements governing use of their payment systems/infrastructures, arguing that requirements set by DORA are not applicable to payment systems/infrastructures.