Chargement…
Chargement…
Register of Information des fournisseurs ICT. Surveillance des CTPPs (Critical Third-Party Providers) par les ESAs. Exit strategy obligatoire fonctions critiques.
| Fournisseur | Service | Pays | Criticité | CTPP | Exit | Concentration | Coût/an |
|---|---|---|---|---|---|---|---|
Amazon Web Services EMEA SARL IaaS production (eu-west-3 Paris + eu-west-1 Dublin). Hosting OMS, PMS, reporting. LEI 529900N3CBQQNLVYWE85 | Cloud IaaS | LU | CRITICAL | ✓ | draft | 88 | 1850 k€ |
Bloomberg Finance L.P. B-PIPE market data + Bloomberg Terminal (78 terminaux). LEI 549300L0F39SOTNHNB22 | Data provider | US | CRITICAL | — | draft | 78 | 1420 k€ |
BNP Paribas Securities Services Dépositaire-conservateur + valorisateur. Externalisation fonction valorisation. LEI 549300WBCUNQGVN6P408 | Outsourcing IT | FR | CRITICAL | — | in-place | 65 | 1100 k€ |
Linedata Services PMS Front Investor (gestion portefeuilles) + middle office. Hébergé chez Linedata. LEI 969500LINEDATAYZB987 | Outsourcing IT | FR | CRITICAL | — | missing | 85 | 680 k€ |
Charles River Development (State Street) OMS/EMS Charles River IMS. Trading desk + compliance. LEI 549300ZK53CNGEEI6A29 | Trading platform | US | CRITICAL | — | draft | 80 | 540 k€ |
I-TRACING SAS SOC managé 24/7 + IR. Surveillance SIEM + EDR. LEI 969500ITRACINGFR0021 | Security vendor | FR | CRITICAL | — | draft | 55 | 320 k€ |
Refinitiv (LSEG) Data ESG + référentiel instruments (backup Bloomberg). LEI 213800BRT8VJZQ86RP06 | Data provider | GB | IMPORTANT | — | in-place | 45 | 280 k€ |
Microsoft Ireland Operations Ltd Microsoft 365, Azure AD, Teams. Bureautique + identité. LEI 635400AKJBGNS5WNQL34 | Cloud SaaS | IE | CRITICAL | ✓ | in-place | 72 | 240 k€ |
Splunk Cloud Services UK SIEM Splunk Cloud. Logs sécurité centralisés. | Cloud SaaS | GB | CRITICAL | — | draft | 50 | 215 k€ |
Equinix France SAS Colocation racks production (interconnect SWIFT, marketdata). | Telecom/Réseau | FR | CRITICAL | — | draft | 40 | 185 k€ |
OVHcloud SAS Site DR + archivage immuable Veeam. LEI 9695004B62U64S94QM43 | Cloud IaaS | FR | CRITICAL | — | in-place | 35 | 165 k€ |
CrowdStrike France Falcon EDR + Identity Threat Protection. | Security vendor | FR | CRITICAL | — | draft | 50 | 145 k€ |
SWIFT (S.W.I.F.T. SCRL) Messagerie financière sécurisée. LEI 549300NJTSJ6PXFKZX13 | Telecom/Réseau | BE | CRITICAL | — | draft | 70 | 145 k€ |
ServiceNow Netherlands ITSM + GRC. Tickets, change, IRM. | Cloud SaaS | NL | IMPORTANT | — | in-place | 25 | 125 k€ |
Mazars (Forvis Mazars) Audit ICT + CAC. Audit interne SI. | Services prof. | FR | ORDINARY | — | in-place | 12 | 110 k€ |
Google Cloud EMEA Limited Workspace (DR mail) + BigQuery analytics secondaire. LEI 549300PPXHEU2JF0AM85 | Cloud SaaS | IE | IMPORTANT | ✓ | in-place | 30 | 95 k€ |
Wavestone Conseil sécurité + pentests applicatifs. | Services prof. | FR | ORDINARY | — | in-place | 15 | 95 k€ |
Workday France SIRH + paie. | Cloud SaaS | FR | IMPORTANT | — | draft | 22 | 92 k€ |
Salesforce.com France CRM commercial + service client. | Cloud SaaS | FR | ORDINARY | — | in-place | 20 | 88 k€ |
Datadog France Observability — APM + logs + monitoring. | Cloud SaaS | FR | IMPORTANT | — | draft | 25 | 88 k€ |
Cisco Systems France Webex + connectivité Cisco SD-WAN. | Telecom/Réseau | FR | IMPORTANT | — | draft | 25 | 78 k€ |
Atos France HSM cloud + gestion clés cryptographiques. | Security vendor | FR | CRITICAL | — | draft | 60 | 78 k€ |
Zscaler Switzerland ZIA + ZPA — secure web gateway + zero trust access. | Security vendor | CH | IMPORTANT | — | draft | 28 | 68 k€ |
CyberArk Software France PAM coffre comptes privilégiés. | Security vendor | FR | CRITICAL | — | draft | 45 | 52 k€ |
Cloudflare France WAF + anti-DDoS + DNS résolveur portail clients. | Security vendor | FR | IMPORTANT | — | in-place | 30 | 42 k€ |
Veeam Software France Logiciel sauvegarde + immuable repositories. | Outsourcing IT | FR | IMPORTANT | — | in-place | 20 | 42 k€ |
Tenable Network Security France Tenable.io scan vulnérabilités. | Security vendor | FR | IMPORTANT | — | in-place | 20 | 38 k€ |
Sekoia.io Threat Intelligence Platform. | Security vendor | FR | IMPORTANT | — | in-place | 18 | 32 k€ |
DocuSign France Signature électronique contrats clients. | Cloud SaaS | FR | IMPORTANT | — | in-place | 20 | 28 k€ |
Iron Mountain France Archivage physique documents légaux. | Outsourcing IT | FR | ORDINARY | — | in-place | 10 | 22 k€ |
Adobe Systems Software Ireland Creative Cloud + Acrobat Sign. | Cloud SaaS | IE | ORDINARY | — | in-place | 8 | 18 k€ |
Synacktiv Pentest avancé + Red Team. Prestataire TLPT 2025. | Services prof. | FR | ORDINARY | — | in-place | 15 | — |
Les Critical Third-Party Providers (CTPPs) — typiquement Microsoft, AWS, Google — sont désignés et supervisés directement par les ESAs (EBA, EIOPA, ESMA) selon l'Article 31 DORA. Les premières désignations ont été publiées en 2025. Ces CTPPs sont soumis à des inspections, recommandations, et pouvoirs de sanction propres.