Critical or important function (DORA)

Under DORA, a critical or important function is one whose disruption would materially impair a financial entity's financial performance, soundness or continuity of services, or continuing compliance with its authorisation.

Part of the Learn hub and the customer data glossary.

What it means in practice

Article 3(22) of DORA defines the term as a function, "the disruption of which would materially impair the financial performance of a financial entity", or the soundness or continuity of its services and activities. It also covers a function whose discontinued, defective or failed performance would materially impair the entity's continuing compliance with the conditions and obligations of its authorisation, or with its other obligations under financial services law 1.

The classification matters because it triggers duties. For ICT services supporting critical or important functions, financial entities must put in place exit strategies (Article 28(8)), and the contractual arrangements must include additional elements (Article 30(3)) 1. The register of information must also show which services support such functions.

The function is assessed, not the tool. A customer data platform that only sends marketing newsletters rarely supports a critical function. If the same stack also delivers payment confirmations, fraud alerts or outage notices, the entity may reach a different conclusion for that service. The assessment is the entity's own, made on its own facts, and should be documented.

Mixing operational and marketing messaging on one platform can quietly raise a vendor's criticality, so separating them is a design choice with regulatory consequences.

Example (bank): a bank classes its payment-confirmation notifications as supporting an important function. The same vendor also sends newsletters. The bank either separates the two services or applies the stricter exit and contract requirements to the whole arrangement.

Related terms

• Register of information: records which services support such functions.
• Data processing agreement: sits beside DORA contract terms.
• Data egress: exit strategies need export plans.
• Single-tenant vs multi-tenant: a deployment choice for critical services.
• Audit ledger: evidence for supervisors.

Where it matters

• DORA and your marketing stack: register, contracts and exit plans.
• Cloud exit strategy for marketing and customer data: template and checklist.

Back to the customer data glossary or the Learn hub.