EditEIOPA’s internal audit gaps: a whistleblower’s warning on DORA credibility, Big Tech oversight, and EU regulatory hypocrisy
The question is whether the European financial supervisors have the resources, expertise, and political backing to effectively oversee global tech giants
In the high-stakes world of European financial supervision, where the EU’s flagship Digital Operational Resilience Act (DORA) aims to tame the power of global tech giants, a new controversy is emerging from within one of the bloc’s key watchdogs.
A whistleblower contacted EUalive, raising serious questions about the European Insurance and Occupational Pensions Authority (EIOPA). The tip alleges that EIOPA is downplaying critical weaknesses in its own data management and IT security – weaknesses uncovered by the European Commission’s Internal Audit Service (IAS) – while simultaneously positioning itself as the enforcer of tough new rules on Critical ICT Third-Party Providers (CTPPs), including hyperscalers like Amazon Web Services, Microsoft Azure, and Google Cloud.
The story, as framed by the source, is one of transatlantic power struggles, regulatory double standards, and the risk that internal governance failures could undermine EIOPA’s authority to police some of the world’s most powerful technology companies.
What are CTPPs and why do they matter?
Under DORA (Regulation (EU) 2022/2554), the EU designated a small group of major technology, cloud, telecom, and data providers as Critical ICT Third-Party Providers (CTPPs). These entities are considered vital to the stability of the entire European financial system — banking, insurance, and securities markets alike.
On 18 November 2025, the three European Supervisory Authorities (EBA, EIOPA, and ESMA) published the first official list of 19 CTPPs. The designation was based on criteria including:
– The systemic impact if a provider failed.
– The concentration of reliance by financial firms.
– How easily services could be substituted.
– Broader importance across sectors.
The list (in alphabetical order, with legal entity names) includes:
– Accenture plc (Managed IT services)
– Amazon Web Services EMEA Sarl (Cloud computing)
– Bloomberg L.P. (Financial data and analytics)
– Capgemini SE (Managed IT services)
– Colt Technology Services (Network/infrastructure)
– Deutsche Telekom AG (Telecom/network)
– Equinix (EMEA) B.V. (Data centers)
– Fidelity National Information Services, Inc. (FIS)
– Google Cloud EMEA Limited (Cloud computing)
– IBM (International Business Machines Corporation)
– InterXion HeadQuarters B.V. (Data centers, part of Digital Realty)
– Kyndryl Inc. (Managed IT services)
– LSEG Data and Risk Limited (Financial data and analytics, London Stock Exchange Group)
– Microsoft Ireland Operations Limited (Azure cloud)
– NTT DATA Inc.
– Oracle
– Orange SA
– SAP (Enterprise software)
– Tata Consultancy Services Limited
Implications are significant. CTPPs now face direct oversight by the ESAs – and imposing them stricter risk management obligations than for regular ICT third-party providers (TPPs) a lighter-touch regime than full financial regulation, but still involving inspections, mandatory incident reporting, resilience testing, and potential penalties for non-compliance. Financial institutions that rely on these providers for critical functions must include specific contractual clauses (audit rights, exit strategies, etc.) and strengthen their own risk management. The goal of DORA is clear: reduce dangerous concentration risks in the financial sector’s digital supply chain, where a handful of global (often U.S.-based) providers underpin critical operations for thousands of European firms.
The whistleblower’s allegation: “sweeping under the carpet”
According to the whistleblower’s tip, EIOPA’s 2025 Annual Report (published in June 2026) references an IAS audit of the agency’s data management and IT security. The report mentions four “very important” and four “important” findings, which EIOPA frames primarily as governance shortcomings. The whistleblower argues this framing is misleading and potentially dangerous:
“Assuming this is an accurate account of the results, while governance gaps themselves do not directly equate to technical compromise, they materially increase EIOPA’s exposure to ICT security risk and have several practical consequences.”
The tip outlines concrete risks:
– Credibility problem with CTPPs: EIOPA helps supervise providers like Google Cloud and Microsoft. If the agency cannot demonstrate strong internal IT governance and risk management, its legal and moral authority to demand improvements from these powerful companies could be challenged – potentially leading to appeals, delays, or reputational pushback from firms facing costly remediation.
– Risks to sensitive data: EIOPA holds market-sensitive information on insurance undertakings and on security weaknesses identified in CTPPs themselves. Governance weaknesses could lead to:
– Unprioritized risks leaving critical assets under-protected.
– Misaligned controls causing outages or disruption.
– Unclear roles slowing incident response.
– Fragmented vendor oversight creating exploitable gaps.
– Poor documentation increasing the risk of fines and eroding trust.
In short, the source claims these findings are far more consequential than portrayed – governance failures act as an “enabler” for broader ICT security, regulatory, and reputational risks that could damage confidence from both CTPPs and the European insurance industry.
Transparency concerns and unanswered questions
The full IAS audit report itself remains non-public. Only a high-level summary appears in EIOPA’s Annual Report. The whistleblower states they sent questions to EIOPA, which went unanswered, and EUalive filed a formal Request for Access to Documents regarding the specific IAS audit on data management and IT security.
This lack of transparency, the source suggests, is deliberate – to protect the agency’s reputation when the reality may be “worse than reported.”
The bigger picture: EU oversight vs. Big Tech
The allegations land amid ongoing tensions between the EU and major U.S. technology companies over digital regulation. DORA represents the EU’s attempt to assert control over critical digital infrastructure that underpins its financial system. Critics have long questioned whether the European financial supervisors (EBA, ESMA and EIOPA for CTPPs and national financial regulators for TPPs, respectively) have the resources, expertise, and political backing to effectively oversee global giants.
If an EU agency responsible for part of that oversight has significant unaddressed internal weaknesses in data and IT governance, it raises uncomfortable questions about consistency and effectiveness.
As one observer might put it: Can you credibly police the digital resilience of Microsoft and Google Cloud when your own house may not be fully in order?
What happens next?
EIOPA has not responded to a list of questions by EUalive. The agency continues to play a central role in DORA implementation, including oversight of the newly designated CTPPs.
For now, the whistleblower’s account highlights a classic tension in regulation: the gap between ambitious external rules and internal institutional readiness. Whether these “very important” findings represent serious vulnerabilities or manageable governance issues remains a matter of interpretation – but the lack of full public access to the underlying audit report ensures the debate will continue in the shadows.
All in all, the revelations about the handling by EIOPA lead to simple conclusions. Mistakes can happen in any system; when they happen they must be corrected. Cover-ups are not mistakes; they are deliberate decisions. In this case the cover-up could have very serious consequences. This must be investigated further, and EU institutions should not hide behind secrecy.
Following the publication of this article EIOPA responded to questions by EUalive by saying that the findings from the internal audit by the European Commission’s Internal Audit Service that focused on the 2023-2024 period and specifically targeting data management, dissemination and IT were of administrative nature and none was considered critical.
EUalive welcomes more tips at editor@eualive.net
Caption: A visual published on the website of the European Insurance and Occupational Pensions Authority (EIOPA)
Updated: July 6, 2026 - 14:29
