Saved-document comparison

32022R2554.txt version record.

This page displays a comparison between saved source copies. It does not state what the source means or determine legal, regulatory, or entity status.

Comparison metadata

Source family	eu-legislation/eurlex-full-text
Check result	source page substantially replaced
Previous saved copy	20260822T222832Z docs_evidence\eu-legislation\eurlex-full-text\20260822T222832Z\32022R2554.txt · sha256 520efc51193bf68bfefe9a90b26b4137505679a5d3e2ab0915fbb91d232c0bbb
Latest saved copy	20260823T093000Z docs_evidence\eu-legislation\eurlex-full-text\20260823T093000Z\32022R2554.txt · sha256 5a6d2c025bcd46ce5841d7fda636a4c4ef713e157b60a79fe6d4635929e70389
Computed difference	112.73% of lines changed, computed as changed units / max(previous units, latest units) × 100.

Changed saved lines

− REGUL A TIONS

− REGUL A TION (EU) 2022/2554 OF THE EUR OPEAN P ARLIAMENT AND OF THE C OUNCIL

− of 14 December 2022

− on digital operational resilience for the f inancial sect or and amending Regulations (EC)

− No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011

− (T ext with EEA relevance)

− THE EUR OPEAN P ARLIAMENT AND THE COUNCIL OF THE EUR OPEAN UNION,

− Havi ng regar d to the T reaty on the Functioning of the European U nion, and in par ticular Ar ticle 114 thereof,

− Havi ng regar d to the proposal from the European Commission,

− Af ter transmission of the draf t legislative act to the national parliaments,

− Havi ng regar d to the opinion of the European Central Bank (

− 1

− ) ,

− Havi ng regar d to the opinion of the European Economic and Social Committee (

− 2

− ) ,

− A cting in accordance with the ordinar y legislative procedure (

− 3

− ) ,

− (1) In the digital age , inf or mation and communication tec hnology (ICT) suppor ts compl ex systems used f or ever yda y

− activities. It keeps our economies r unning in ke y sect ors, including the financia l sector , and enhances the

− functioning of the intern al mark et. Increased digitalisation and inte rconnectedness also amplify ICT r isk, making

− society as a whole, and the fi nancial system in par ticular , more vulnerable to cyber threats or ICT disr upti ons. While

− the ubiquitous use of ICT systems and high digitalisation and connectivity are toda y core f eatures of the activities of

− U nion fi nancial entities, their digital resilience has yet to be bette r addressed and integrat ed into their broader

− operational framew ork s.

− (2) The use of ICT has in the past decades g ained a pivotal role in the provision of fi nancial ser vices, to the point where it

− has now acquired a cr itical im por tance in the operation of typical daily functions of all financial entities.

− Digitalisation now covers, f or instance, pa yments, which hav e increasing ly mov ed from cash and paper -based

− methods to the use of digital solutions, as well as secur ities clear ing and settlement, electronic and algor ithmic

− trading, lending and funding operations, peer -to -peer finance, credit rating, claim manage ment and back -off ice

− operations. The insurance sector has also been transf or med by the use of ICT , from the emerge nce of insurance

− (

− 1

− ) OJ C 343, 26.8.2021, p. 1.

− (

− 2

− ) OJ C 155, 30.4.2021, p. 38.

− (

− 3

− ) P osition of the European P arliament of 10 November 2022 (not yet published in the Official Jour nal) and decision of the Council of

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/1

− interm ediar ies offer ing their ser vices online operating with InsurT ech, to digital insurance under wr iting. Finance has

− not only become larg ely digital throughout the whole sector , but digitalisation has also deepened inter connections

− and dependencies within the fi nancial sector and with third-par ty infrastr ucture and ser vice provid ers.

− (3) The European Systemic Risk Board (ESRB) reaff ir med in a 2020 repor t addressing system ic cyber r isk how the

− existing high level of inter connectedness across fi nancial entities, financial markets and fi nancial mark et

− infrastr uctures, and par ticularly the inte rdependencies of their ICT systems , could constitute a systemic vulnerability

− because localised cyber incidents could quickly spread from any of the appro ximat ely 22 000 U nion financia l

− entities to the entire fi nancial system , unhindered by g eographical boundar ies. Ser ious ICT breac hes that occur in

− the fi nancial sect or do not merely aff ect financial entities taken in isolation. They also smooth the wa y f or the

− propagati on of localised vulnerabilities across the fi nancial transmission c hannels and poten tially tr igge r adverse

− consequences f or the stability of the U nion’s financia l system, such as generating liquidity r uns and an o verall loss

− of conf idence and tr ust in financia l markets.

− (4) In recent ye ars, ICT r isk has attracted the atte ntion of intern ational, U nion and national policy makers, regulator s and

− standard-setting bodies in an atte mp t to enhance digital resilience, set standards and coordinate regulatory or

− super visor y w ork . At intern ational level, the Basel Committ ee on Banking Super vision, the Committee on Pa yments

− and Market Infrastr uctures, the Financial Stability Board, the Financial Stability Institute, as well as the G7 and G20

− aim to provide compet ent author ities and mark et operators across var ious jur isdictions with too ls to bolster the

− resilience of their financial systems . That w ork has also been dr iven by the need to duly consider ICT r isk in the

− conte xt of a highly inte rconnected g lobal financial system and to seek more consistency of relevant best practices.

− (5) Despite Uni on and national targe ted policy and legislative initiatives, ICT r isk continues to pose a c hallenge to the

− operational resilience, performa nce and stability of the U nion fi nancial syste m. The ref or ms that f ollo wed the 2008

− fi nancial cr isis pr imar ily strengthened the fi nancial resilience of the Union fi nancial sector and aimed to safeguard

− the competitiveness and stability of the U nion from economic, pr udential and mark et conduct perspectives.

− Although ICT secur ity and digital resilience are par t of operational r isk, they have been less in the f ocus of the post-

− fi nancial cr isis regulat or y agenda and have developed in only some areas of the Union’s financia l ser vices policy and

− regulatory landscape, or in only a f ew Member Stat es.

− (6) In its Communication of 8 March 2018 entitled ‘Fin T ech A ction plan: For a more competitive and innovative

− European financia l sector ’ , the Commission highlight ed the paramount imp or tance of making the U nion financial

− sector more resilient, including from an operational perspective to ensure its tec hnological safety and good

− functioning, its quic k recovery from ICT breac hes and incidents, ultimat ely enabling the eff ective and smooth

− provision of fi nancial ser vices across the whole U nion, including under situations of stress, while also preser ving

− consumer and mark et tr ust and conf idence.

− (7) In Apr il 2019, the European Super visor y Auth or ity (European Banking Author ity), (EB A) established by Regulation

− (EU) No 1093/2010 of the European Parliament and of the Council (

− 4

− ) , the European Super visor y Author ity

− (European Insurance and Occupational Pensions Auth or ity), (‘EIOP A ’) established by Regulation (EU)

− No 1094/2010 of the European P arliament and of the Council (

− 5

− ) and the European Super visor y A uthor ity

− (European Secur ities and Marke ts Auth or ity), (‘ESMA ’) established by Regulation (EU) No 1095/2010 of the

− (

− 4

− ) Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European

− Super visor y Au thor ity (European Banking Autho r ity), amending Decision No 716/2009/EC and repealing Commission Decision

− 2009/78/EC (OJ L 331, 15.12.2010, p. 12).

− (

− 5

− ) Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European

− Super visor y Authority (European Insurance and Occupational P ensions Authority), amending Decision No 716/2009/EC and

− repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48).

− Offi cial Jour nal of the European Uni on L 333/2 27.12.2022

− European Parliament and of the Council (

− 6

− ) (known collectively as ‘European Super visor y A uthor ities’ or ‘ES As’ )

− jointly issued tec hnical advice calling f or a coherent approac h to ICT r isk in fi nance and recommending to

− strengthen, in a propor tionate wa y , the digital operational resilience of the financia l ser vices industr y through a

− sector -specifi c initiative of the U nion.

− (8) The Uni on fi nancial sector is regulated by a Sing le Rulebook and govern ed by a European system of financia l

− super vision. Nonetheless, provis ions tackli ng digital operational resilience and ICT secur ity are not yet fully or

− consistently har monised, despite digital operational resilience being vital f or ensur ing financial stability and mark et

− integrit y in the digital ag e, and no less im por tant than, f or example, common pr udential or mark et conduct

− standards. The Sing le Rulebook and system of super vision should theref ore be developed to also co ver digital

− operational resilience, by strengthening the mandates of compet ent author ities to enable them to super vise the

− manage ment of ICT r isk in the financial sect or in order to protect the int egr ity and efficiency of the internal market,

− and to facilitat e its orderly functioning.

− (9) Legislative dispar ities and uneven national regulatory or super visor y approaches with regard to ICT r isk tr igg er

− obstacles to the functioning of the internal mark et in financia l ser vices, impeding the smooth exer cise of the

− freedom of establishment and the provis ion of ser vices f or financia l entities operating on a cross-border basis.

− Com petition between the same type of financial entities operating in differ ent Member States could also be

− distor ted . This is the case, in par ticular , f or areas where U nion har monisation has been ver y limite d, such as digital

− operational resilience testing, or absent, such as the monitori ng of ICT third-par ty r isk. Dispar ities stem ming from

− developments envisag ed at national level could g enerate fur ther obstacles to the functioning of the intern al mark et

− to the detr iment of market par ticipants and financial stability .

− (10) T o date, due to the ICT r isk related provisions being only par tially addressed at U nion level, there are gap s or overlaps

− in im por tant areas, such as ICT -related incident repor ting and digital operational resilience testing, and

− inconsiste ncies as a result of emerging diverge nt national r ules or cost-ineff ective application of o verlapping r ules.

− This is par ticularly detr imental f or an ICT -intensive user such as the fi nancial sector since tec hnology r isks have no

− borders and the financial sect or deplo ys its ser vices on a wide cross-border basis within and outside the Union.

− Individual financia l entities operating on a cross-border basis or holding several author isations (e.g. one financial

− entity can hav e a banking, an inv estment fir m, and a pa yment institution licence, each issued by a differ ent

− compet ent author ity in one or several Member Stat es) face operational c hallenges in addressing ICT r isk and

− mitig ating adverse im pacts of ICT incidents on their o wn and in a coherent cost-eff ective wa y .

− (11) As the Sing le Rulebook has not been accompanied by a compre hensive ICT or operational r isk framework, fur ther

− har monisation of ke y digital operational resilience requirements f or all financial entities is required. The

− development of ICT capabilities and o verall resilience by f inancial entities, based on those ke y requirements, with a

− view to withstanding operational outag es, w ould help preser ve the stability and integr ity of the Union financial

− mark ets and thus contr ibut e to ensur ing a high level of protection of invest ors and consumers in the Union. Since

− this Regulation aims to contr ibut e to the smooth functioning of the inte r nal mark et, it should be based on the

− provisions of Ar ticle 114 of the T reaty on the Functioning of the European U nion (TFEU) as interpreted in

− accordance with the consiste nt case la w of the Cour t of Justice of the European Union (Cour t of Justice).

− (12) This Regulation aims to consolidat e and upgrade ICT r isk requirements as par t of the operational r isk requirements

− that have, up to this point, been addressed separately in var ious U nion legal acts. While those acts covered the main

− catego r ies of financial r isk (e.g. credit r isk, mark et r isk, counter par ty credit r isk and liquidity r isk, mark et conduct

− r isk), the y did not compreh ensively tackle, at the time of their adoption, all compo nents of operational resilience.

− The operational r isk r ules, when fur ther developed in those Union legal acts, of ten f av oured a traditional

− quantitative approach to addressing r isk (namely setting a capital requirement to co ver ICT r isk) rather than target ed

− qualitative r ules f or the protection, det ection, containment, reco ver y and repair capabilities against ICT -relat ed

− (

− 6

− ) Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European

− Super visor y Authorit y (European Secur ities and Mark ets Autho r ity), amending Decision No 716/2009/EC and repealing Commission

− Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84).

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/3

− incidents, or f or repor ting and digital te sting capabilities. Those acts were pr imar ily meant to cover and update

− essential r ules on pr udential super vision, mark et integr ity or conduct. By consolidating and upgrading the different

− r ules on ICT r isk, all provisions addressing digital r isk in the fi nancial sector should f or the first time be brought

− tog ether in a consiste nt manner in one sing le legislative act. Theref ore, this Regulation f ills in the gaps or remedies

− inconsiste ncies in some of the pr ior legal acts, including in relation to the term inology used therein, and explicitly

− refers to ICT r isk via target ed r ules on ICT r isk -manage ment capabilities, incident repor ting, operational resilience

− test ing and ICT third-par ty r isk monitori ng. This Regulation should thus also raise awareness of ICT r isk and

− ackn owledg e that ICT incidents and a lack of operational resilience hav e the possibility to jeopardise the soundness

− of fi nancial entities.

− (13) Financial entities should f ollo w the same approach and the same pr inciple-based r ules when addressing ICT r isk

− taking into account their size and o verall r isk prof ile, and the nature, scale and compl exity of their ser vices,

− activities and operations. Consisten cy contr ibut es to enhancing confidence in the financial syste m and preser ving its

− stability especially in times of high reliance on ICT systems, platf or ms and infrastr uctures, whic h entails increased

− digital r isk. Obser ving basic cyber hy giene should also av oid imposin g heavy costs on the economy by minimising

− the im pact and costs of ICT disr upti ons.

− (14) A Regulation helps reduce regulatory complexity , f osters super visor y converg ence and increases legal cer tainty , and

− also contr ibutes to limiting compl iance costs, especially f or fi nancial entities operating across borders, and to

− reducing compe titive distor tions. Theref ore, the choice of a Regulation f or the establishment of a common

− framewor k f or the digital operational resilience of financia l entities is the most appropr iate wa y to guarantee a

− homog enous and coherent application of all compo nents of ICT r isk management by the Union financia l sector .

− (15) Directive (EU) 2016/1148 of the European P arliament and of the Council (

− 7

− ) was the fi rst hor izontal cybersecur ity

− framewor k enacted at U nion level, applying also to three types of financial entities, namely credit institutions,

− trading venues and central counte r par ties. Howe ver , since Directive (EU) 2016/1148 set out a mechanism of

− identif ication at national level of operat ors of essential ser vices, only cer tain credit institutions, trading venues and

− central count er par ties that were identif ied by the Member Stat es, ha ve been brought into its scope in practice, and

− hence required to compl y with the ICT secur ity and incident notification requirements laid down in it. Directive

− (EU) 2022/2555 of the European P arliament and of the Council (

− 8

− ) sets a unif or m cr iter ion to det er mine the entities

− fa lling within its scope of application (size-cap r ule) while also kee ping the three types of fi nancial entities in its

− scope.

− (16) However , as this Regulation increases the level of har monisation of the var ious digital resilience components, by

− introducing requirements on ICT r isk manage ment and ICT -relat ed incident repor ting that are more str ingent in

− compari son to those laid down in the cur rent U nion fi nancial ser vices la w , this higher level constitute s an increased

− har monisation also in compar ison with the requirements laid down in Directive (EU) 2022/2555. Consequently , this

− Regulation constitutes lex specialis with regar d to Directive (EU) 2022/2555. At the same time, it is cr ucial to

− maintain a strong relationship between the fi nancial sector and the U nion hor izontal cybersecur ity framework as

− cur rently laid out in Directive (EU) 2022/2555 to ensure consist ency with the cyber secur ity strategies adopt ed by

− Member Stat es and to allow financia l super visors to be made awar e of cyber incidents affe cting other sectors

− co vered by that Directive.

− (

− 7

− ) Directive (EU) 2016/1148 of the European Pa rliament and of the Council of 6 July 2016 concer ning measures f or a high common

− level of secur ity of netwo rk and inf or mation systems across the Union (OJ L 194, 19.7.2016, p. 1).

− (

− 8

− ) Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures f or a high common level

− of cybersecur ity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive

− (EU) 2016/1148 (NIS 2 Directive) (see page 80 of this Offi cial Jour nal).

− Offi cial Jour nal of the European Uni on L 333/4 27.12.2022

− (17) In accordance with Ar ticle 4(2) of the T reaty on European Union and without prejudice to the judicial review by the

− Cour t of Justice, this Regulation should not aff ect the responsibility of Member Stat es with regar d to essential Stat e

− functions concer ning public secur ity , defe nce and the safeg uarding of national secur ity , f or example concer ning the

− supply of inf or mation which would be contrar y to the safeguarding of national secur ity .

− (18) T o enable cross-sect or lear ning and to effectively dra w on exper iences of other sector s in dealing with cyber threats,

− the fi nancial entities refer red to in Directive (EU) 2022/2555 should remain par t of the ‘ecosyst em’ of that Directive

− (f or examp le, Cooperation Group and comput er secur ity incident response teams (CSIRT s)).The ESA s and national

− compet ent author ities should be able to par ticipat e in the strategic policy discussions and the tec hnical w orkings of

− the Cooperation Group under that Directive, and to exc hang e inf or mation and fur ther cooperate with the sing le

− points of contact designat ed or established in accordance with that Directive. The compet ent author ities under this

− Regulation should also consult and cooperate with the CSIRT s. The compet ent author ities should also be able to

− request tec hnical advice from the compet ent author ities designat ed or established in accordance with Directive (EU)

− 2022/2555 and establish cooperation ar rangements that aim to ensure effe ctive and fast-response coordination

− mechani sms.

− (19) Given the strong inter linkages between the digital resilience and the phy sical resilience of fi nancial entities, a

− coherent approach with regar d to the resilience of cr itical entities is necessar y in this Regulation and Directive (EU)

− 2022/2557 of the European P arliament and the Council (

− 9

− ) . Given that the phy sical resilience of financial entities is

− addressed in a compreh ensive manner by the ICT r isk management and repor ting oblig ations co vered by this

− Regulation, the oblig ations laid down in Chapt ers III and IV of Directive (EU) 2022/2557 should not apply to

− fi nancial entities f alling within the scope of that Directive.

− (20) Cloud computi ng ser vice provid ers are one catego r y of digital infrastr ucture covered by Directive (EU) 2022/2555.

− The Union Oversight Framew ork (‘Oversight Framework’) established by this Regulation applies to all cr itical ICT

− third-par ty ser vice provid ers, including cloud computing ser vice providers providing ICT ser vices to financial

− entities, and should be considered compl ementar y to the super vision car r ied out pursuant to Directive (EU) 2022/

− 2555. Moreover , the Oversight Framew ork established by this Regulation should co ver cloud computi ng ser vice

− provid ers in the absence of a U nion hor izontal framew ork establishing a digital oversight author ity .

− (21) In order to maintain full control over ICT r isk, fi nancial entities need to have comprehensive capabilities to enable a

− strong and eff ective ICT r isk manage ment, as well as specif ic mechanisms and policies f or handling all ICT -relat ed

− incidents and f or repor ting major ICT -related incidents. Likewise, fi nancial entities should have policies in place f or

− the te sting of ICT system s, controls and processes, as well as f or managing ICT third-par ty r isk. The digital

− operational resilience baseline f or financia l entities should be increased while also allowing f or a propor tionate

− application of requirements f or cer tain financial entities, par ticularly microent er pr ises, as well as fi nancial entities

− subject to a sim plif ied ICT r isk management framework. T o facilitat e an efficient super vision of institutions f or

− occupational retirement provision that is propor tionate and addresses the need to reduce administrative burdens on

− the compet ent author ities, the relevant national super visor y ar rang ements in respect of such fi nancial entities should

− take into account their size and overall r isk prof ile, and the nature, scale and complexity of their ser vices, activities

− and operations even when the relevant thresholds established in Ar ticle 5 of Directive (EU) 2016/2341 of the

− European Parliament and of the Council (

− 10

− ) are excee ded. In par ticular , super visor y activities should f ocus pr imar ily

− on the need to address ser ious r isks associated with the ICT r isk manag ement of a par ticular entity .

− (

− 9

− ) Directive (EU) 2022/2557 of the European P arliament and of the Council of 14 December 2022 on the resilience of cr itical entities

− and repealing Council Directive 2008/114/EC (see page 164 of this Offi cial Jour nal).

− (

− 10

− ) Directive (EU) 2016/2341 of the European Parliament and of the Council of 14 December 2016 on the activities and super vision of

− institutions f or occupational retirement provisi on (IORPs) (OJ L 354, 23.12.2016, p. 37).

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/5

− Com petent author ities should also maintain a vigilant but propor tionate approach in relation to the super vision of

− institutions f or occupational retirement provision which, in accordance with Ar ticle 31 of Directive (EU)

− 2016/2341, outsource a signif icant par t of their core business, such as asset manage ment, actuar ial calculations,

− accounting and data management , to ser vice providers.

− (22) ICT -relat ed incident repor ting thresholds and tax onomies var y significantly at national level. While common ground

− ma y be achi eved through the relevant w ork under taken by the European Union Agen cy f or Cybersecur ity (ENIS A)

− established by Regulation (EU) 2019/881 of the European P arliament and of the Council (

− 11

− ) and the Cooperation

− Group under Directive (EU) 2022/2555, diverge nt approach es on setting the thresholds and use of tax onomies still

− exist, or can emerg e, f or the remainder of fi nancial entities. Due to those diverg ences, there are multiple

− requirements that fi nancial entities must compl y with, especially when operating across several Member State s and

− when par t of a fi nancial group. Moreover , such diverg ences hav e the poten tial to hinder the creation of fur ther

− unif or m or centralised U nion mechani sms that speed up the repor ting process and suppor t a quic k and smooth

− exc hange of inf or mation between compet ent author ities, whic h is cr ucial f or addressing ICT r isk in the event of

− larg e-scale attac k s with poten tially systemic consequences.

− (23) T o reduce the administrative burden and poten tially duplicative repor ting oblig ations f or cer tain financial entities,

− the requirement f or the incident repor ting pursuant to Directive (EU) 2015/2366 of the European Parliament and

− of the Council (

− 12

− ) should cease to apply to pa yment ser vice pro viders that fall within the scope of this Regulation.

− Consequently , credit institutions, e-money institutions, pa yment institutions and account inf or mation ser vice

− provid ers, as refer red to in Ar ticle 33(1) of that Directive, should, from the date of application of this Regulation,

− repor t pursuant to this Regulation, all operational or secur ity pa yment-related incidents which have been previously

− repor ted pursuant to that Directive, ir respective of whether such incidents are ICT -relate d.

− (24) T o enable compet ent author ities to fulf il super visor y roles by acquir ing a compl ete over view of the nature,

− frequency , signif icance and impact of ICT -related incidents and to enhance the exc hange of inf or mation between

− relevant public author ities, including la w enf orcement author ities and resolution author ities, this Regulation should

− la y down a robust ICT -relate d incident repor ting regime whereby the relevant requirements address cur rent gaps in

− fi nancial ser vices la w , and remove existing o verlaps and duplications to alleviate costs. It is essential to har monise

− the ICT -related incident repor ting regime by requir ing all fi nancial entities to repor t to their compet ent author ities

− through a sing le streamlined framewor k as set out in this Regulation. In addition, the ESA s should be em powered to

− fur ther specify relevant elements f or the ICT -relate d incident repor ting framework, such as tax onomy , timeframes,

− data sets, tem plates and applicable thresholds. T o ensure full consist ency with Directive (EU) 2022/2555, financial

− entities should be allowed, on a v oluntar y basis, to notify signif icant cyber threats to the relevant compet ent

− author ity , when the y consider that the cyber threat is of relevance to the fi nancial system , ser vice users or clients.

− (25) Digital operational resilience te sting requirements hav e been developed in cer tain financia l subsect ors setting out

− framewor k s that are not alwa ys fully aligned. This leads to a poten tial duplication of costs f or cross-border fi nancial

− entities and mak es the mutual recognition of the results of digital operational resilience testing compl ex which, in

− tur n, can fragment the intern al market.

− (

− 11

− ) Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 Apr il 2019 on ENISA (the European Union Agency

− f or Cybersecur ity) and on inf or mation and communications tec hnology cybersecur ity cer tification and repealing Regulation (EU)

− No 526/2013 (Cybersecur ity A ct) (OJ L 151, 7.6.2019, p. 15).

− (

− 12

− ) Directive (EU) 2015/2366 of the European P arliament and of the Council of 25 November 2015 on pa yment ser vices in the inter nal

− market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing

− Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35).

− Offi cial Jour nal of the European Uni on L 333/6 27.12.2022

− (26) In addition, where no ICT test ing is required, vulnerabilities remain undete cted and result in exposing a financia l

− entity to ICT r isk and ultimat ely creat e a higher r isk to the stability and inte gr ity of the financial sector . Without

− U nion inter vention, digital operational resilience testing would continue to be inconsistent and w ould lack a system

− of mutual recognition of ICT test ing results across diff erent jur isdictions. In addition, as it is unlikely that other

− fi nancial subsect ors w ould adop t testing sche mes on a meaningful scale, the y would miss out on the poten tial

− benefits of a tes ting framework, in term s of revealing ICT vulnerabilities and r isks , and test ing def ence capabilities

− and business continuity , which contr ibutes to increasing the tr ust of customer s, suppliers and business par tners. T o

− remedy those overlaps, diverg ences and gaps, it is necessar y to la y down r ules f or a coordinated test ing regime and

− thereby f acilitate the mutual recognition of advanced testing f or financial entities meeting the cr ite r ia set out in this

− Regulation.

− (27) Financial entities’ reliance on the use of ICT ser vices is par tly dr iven by their need to adapt to an emerging

− competitive digital g lobal economy , to boost their business efficiency and to meet consumer demand. The nature

− and extent of such reliance has been continuously evolving in recent y ears, dr iving cost reduction in financial

− interm ediation, enabling business expansion and scalability in the deplo yment of financial activities while offe r ing a

− wide rang e of ICT too ls to manage compl ex inte r nal processes.

− (28) The exte nsive use of ICT ser vices is evidenced by complex contractual ar rangements, whereby financia l entities of ten

− encounter difficulties in negotiating contractual te r ms that are tailored to the pr udential standards or other

− regulatory requirements to whic h they are subject, or other wise in enf orcing specifi c r ights, such as access or audit

− r ights, even when the latter are enshr ined in their contractual ar rang ements. Moreover , many of those contractual

− ar range ments do not provid e f or suffi cient safeg uards allo wing f or the fully-f ledged monitor ing of subcontracting

− processes, thus depr iving the fi nancial entity of its ability to assess the associate d r isks. In addition, as ICT third-

− par ty ser vice providers of ten provide standardised ser vices to diffe rent types of clients, such contractual

− ar range ments do not alwa ys cater adequately f or the individual or specific needs of fi nancial industr y actors.

− (29) Even though U nion financia l ser vices la w contains cer tain g eneral r ules on outsourcing, monitoring of the

− contractual dimension is not fully anchored into U nion la w . In the absence of clear and bespoke U nion standards

− applying to the contractual ar range ments concluded with ICT third-par ty ser vice providers, the extern al source of

− ICT r isk is not compreh ensively addressed. Consequently , it is necessar y to set out cer tain ke y pr inciples to guide

− fi nancial entities ’ manag ement of ICT third-par ty r isk, whic h are of par ticular impor tance when financia l entities

− resor t to ICT third-par ty ser vice provid ers to suppor t their cr itical or im por tant functions. Those pr inciples should

− be accompan ied by a set of core contractual r ights in relation to several elements in the per f or mance and

− term ination of contractual ar rangements with a view to providin g cer tain minimum safeg uards in order to

− strengthen financia l entities’ ability to eff ectively monitor all ICT r isk emerging at the level of third-par ty ser vice

− provid ers. Those pr inciples are compl ementar y to the sect oral la w applicable to outsourcing.

− (30) A cer tain lack of homogeneity and converg ence regarding the monitori ng of ICT third-par ty r isk and ICT third-par ty

− dependencies is evident toda y . Despite eff or ts to address outsourcing, such as EBA Guidelines on outsourcing of

− 2019 and ESMA Guidelines on outsourcing to cloud ser vice providers of 2021 the broader issue of counteracting

− systemic r isk which ma y be tr igge red by the financial sector ’s exposure to a limited number of cr itical ICT third-

− par ty ser vice providers is not suffi ciently addressed by Uni on la w . The lack of r ules at Union level is compo unded

− by the absence of national r ules on mandates and too ls that allow fi nancial super visors to acquire a good

− understanding of ICT third-par ty dependencies and to monitor adequat ely r isks ar ising from the concentration of

− ICT third-par ty dependencies.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/7

− (31) T aking into account the poten tial systemic r isk entailed by increased outsourcing practices and by the ICT third-

− par ty concentration, and mindful of the insufficiency of national mechani sms in providing fi nancial super visors

− with adequate too ls to quantify , qualify and redress the consequences of ICT r isk occur r ing at cr itical ICT third-par ty

− ser vice providers, it is necessar y to establish an appropr iate Oversight Framew ork allowing f or a continuous

− monitori ng of the activities of ICT third-par ty ser vice provid ers that are cr itical ICT third-par ty ser vice providers to

− fi nancial entities, while ensur ing that the conf identiality and secur ity of custome rs other than financia l entities is

− preser ved. While intra-group provision of ICT ser vices entails specific r isks and benefits, it should not be

− automatical ly considered less r isky than the provision of ICT ser vices by pro viders outside of a fi nancial group and

− should theref ore be subject to the same regulator y framew ork . Howe ver , when ICT ser vices are provid ed from

− within the same financial group, fi nancial entities might hav e a higher level of control over intra-group pro viders,

− which ought to be take n into account in the o verall r isk assessment.

− (32) With ICT r isk becoming more and more compl ex and sophisticat ed, good measures f or the det ection and prevention

− of ICT r isk depend to a great extent on the regular shar ing between fi nancial entities of threat and vulnerability

− intellig ence. Inf or mation shar ing contr ibut es to creating increased awareness of cyber threats. In tur n, this enhances

− the capacity of fi nancial entities to prevent cyber threats from becoming real ICT -relat ed incidents and enables

− fi nancial entities to more eff ectively contain the impa ct of ICT -relat ed incidents and to recover fa ster . In the absence

− of guidance at Union level, several f actors seem to have inhibite d such inte lligence shar ing, in par ticular uncer tainty

− about its compati bility with data prote ction, anti-tr ust and liability r ules.

− (33) In addition, doubts about the type of inf or mation that can be shared with other mark et par ticipants, or with non-

− super visor y author ities (suc h as ENISA, f or analytical input, or Europol, f or la w enf orcement pur poses) lead to

− useful inf or mation being withheld. Theref ore, the extent and quality of inf or mation shar ing cur rently remains

− limited and fragmented, with relevant exc hang es mostly being local (b y wa y of national initiatives) and with no

− consistent U nion-wide inf or mation-shar ing ar range ments tailored to the needs of an integrat ed fi nancial system. It

− is theref ore impor tant to strengthen those communication c hannels.

− (34) Financial entities should be encouraged to exc hange among themselves cyber threat inf or mation and inte lligence,

− and to collectively leverage their individual knowledg e and practical exper ience at strateg ic, tactical and operational

− levels with a view to enhancing their capabilities to adequately assess, monitor , defend aga inst, and respond to cyber

− threats, by par ticipating in inf or mation shar ing ar range ments. It is theref ore necessar y to enable the emerge nce at

− U nion level of mechanisms f or v oluntar y inf or mation-shar ing ar rangements whic h, when conducted in tr ust ed

− en vironments, w ould help the community of the financia l industr y to prevent and collectively respond to cyber

− threats by quickly limiting the spread of ICT r isk and impedi ng poten tial contagion throughout the fi nancial

− c hannels. Those mechanis ms should compl y with the applicable competiti on la w r ules of the U nion set out in the

− Communication from the Commission of 14 Januar y 2011 entitled ‘Guidelines on the applicability of Ar ticle 101

− of the T reaty on the Functioning of the European U nion to hor izontal cooperation agreements’, as well as with

− U nion data prote ction r ules, in par ticular Regulation (EU) 2016/679 of the European P arliament and of the

− Council (

− 13

− ) . They should operat e based on the use of one or more of the leg al bases that are laid down in Ar ticle 6

− of that Regulation, such as in the conte xt of the processing of personal data that is necessar y f or the pur poses of the

− legitimate inte rest pursued by the controller or by a third par ty , as refer red to in Ar ticle 6(1), point (f), of that

− Regulation, as well as in the context of the processing of personal data necessar y f or compliance with a legal

− oblig ation to which the controller is subject, necessar y f or the performa nce of a task car r ied out in the public

− inter est or in the exer cise of off icial author ity vested in the controller , as refer red to in Ar ticle 6(1), points (c) and (e),

− respectively , of that Regulation.

− (

− 13

− ) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 Apr il 2016 on the prot ection of natural persons with

− regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data

− Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

− Offi cial Jour nal of the European Uni on L 333/8 27.12.2022

− (35) In order to maintain a high level of digital operational resilience f or the whole financia l sect or , and at the same time

− to kee p pace with tec hnological developments, this Regulation should address r isk stemming from all types of ICT

− ser vices. T o that end, the definit ion of ICT ser vices in the context of this Regulation should be underst ood in a

− broad manner , encompassing digital and data ser vices provid ed through ICT systems to one or more intern al or

− external users on an ongoing basis. That definition should, f or instance, include so called ‘over the top’ ser vices,

− which f all within the cate gor y of electronic communications ser vices. It should excl ude only the limited catego r y of

− traditional analogue telephone ser vices qualifying as Public Switc hed T elephone Network (PSTN) ser vices, landline

− ser vices, Plain Old T elephone Ser vice (POTS), or fi x ed-line telep hone ser vices.

− (36) Notwithstanding the broad co verag e en visaged by this Regulation, the application of the digital operational resilience

− r ules should take into account the significant diff erences between financia l entities in te r ms of their size and o verall

− r isk prof ile. As a g eneral pr inciple, when distr ibuting resources and capabilities f or the im plementation of the ICT

− r isk management framework, financia l entities should duly balance their ICT -relate d needs to their size and o verall

− r isk profile, and the nature, scale and complexity of their ser vices, activities and operations, while compet ent

− author ities should continue to assess and review the approach of such distr ibution.

− (37) A ccount inf or mation ser vice provi ders, refer red to in Ar ticle 33(1) of Directive (EU) 2015/2366, are explicitly

− included in the scope of this Regulation, taking into account the specifi c nature of their activities and the r isks

− ar ising therefrom. In addition, electronic money institutions and pa yment institutions exem pt ed pursuant to Ar ticle

− 9(1) of Directive 2009/110/EC of the European P arliament and of the Council (

− 14

− ) and Ar ticle 32(1) of Directive (EU)

− 2015/2366 are included in the scope of this Regulation even if the y hav e not been granted author isation in

− accordance Directive 2009/110/EC to issue electronic money , or if the y ha ve not been granted author isation in

− accordance with Directive (EU) 2015/2366 to provid e and execut e pa yment ser vices. However , post office giro

− institutions, refer red to in Ar ticle 2(5), point (3), of Directive 2013/36/EU of the European P arliament and of the

− Council (

− 15

− ) , are excluded from the scope of this Regulation. The compe tent author ity f or pa yment institutions

− exem pt ed pursuant to Directive (EU) 2015/2366, electronic money institutions exem pt ed pursuant to Directive

− 2009/110/EC and account inf or mation ser vice providers as refer red to in Ar ticle 33(1) of Directive (EU)

− 2015/2366, should be the compet ent author ity designat ed in accordance with Ar ticle 22 of Directive (EU)

− 2015/2366.

− (38) As larg er fi nancial entities might enjo y wider resources and can swif tly deplo y funds to develop governance

− str uctures and set up var ious cor porat e strateg ies, only fi nancial entities that are not microenter pr ises in the sense

− of this Regulation should be required to establish more compl ex go ver nance ar rang ements. Such entities are bett er

− equipped in par ticular to set up dedicat ed management functions f or super vising ar rangements with ICT third-par ty

− ser vice provi ders or f or dealing with cr isis management, to org anise their ICT r isk management according to the

− three lines of defence model, or to set up an internal r isk managemen t and control model, and to submit their ICT

− r isk manage ment framew ork to intern al audits.

− (39) Some fi nancial entities benefit from exem pti ons or are subject to a ver y light regulatory framewor k under the

− relevant sector -specific U nion law . Such fi nancial entities include managers of alte r native investment funds refer red

− to in Ar ticle 3(2) of Directive 2011/61/EU of the European P arliament and of the Council (

− 16

− ) , insurance and

− reinsurance under takings refe r red to in Ar ticle 4 of Directive 2009/138/EC of the European P arliament and of the

− Council (

− 17

− ) , and institutions f or occupational retirement provision whic h operat e pension sche mes whic h tog ether

− (

− 14

− ) Directive 2009/110/EC of the European Pa rliament and of the Council of 16 Sept ember 2009 on the taking up, pursuit and

− pr udential super vision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and

− repealing Directive 2000/46/EC (OJ L 267, 10.10.2009, p. 7).

− (

− 15

− ) Directive 2013/36/EU of the European P arliament and of the Council of 26 June 2013 on access to the activity of credit institutions

− and the pr udential super vision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC

− and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).

− (

− 16

− ) Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and

− amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010 (OJ L 174,

− 1.7.2011, p. 1).

− (

− 17

− ) Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the

− business of Insurance and Reinsurance (Solvency II) (OJ L 335, 17.12.2009, p. 1).

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/9

− do not hav e more than 15 members in total. In light of those exe mp tions it w ould not be propor tionate to include

− such financia l entities in the scope of this Regulation. In addition, this Regulation ackn o wledges the specifi cities of

− the insurance interm ediation market str ucture, with the result that insurance interm ediar ies, reinsurance

− interm ediar ies and ancillar y insurance interm ediar ies qualifying as microent er pr ises or as small or medium-sized

− ent er pr ises should not be subject to this Regulation.

− (40) Since the entities refe r red to in Ar ticle 2(5), points (4) to (23), of Directive 2013/36/EU are excluded from the scope

− of that Directive, Member States should consequently be able to c hoose to exem pt from the application of this

− Regulation such entities located within their respective terr it or ies.

− (41) Similarly , in order to align this Regulation to the scope of Directive 2014/65/EU of the European Parliament and of

− the Council (

− 18

− ) , it is also appropr iat e to excl ude from the scope of this Regulation natural and legal persons refer red

− in Ar ticles 2 and 3 of that Directive which are allo wed to provide inve stment ser vices without hav ing to obtain an

− author isation under Directive 2014/65/EU. However , Ar ticle 2 of Directive 2014/65/EU also excludes from the

− scope of that Directive entities whic h qualify as f inancial entities f or the pur poses of this Regulation such as, central

− secur ities deposit or ies, collective inv estment under takings or insurance and reinsurance under takings. The excl usion

− from the scope of this Regulation of the persons and entities refer red to in Ar ticles 2 and 3 of that Directive should

− not encom pass those central secur ities depositories, collective inv estment under takings or insurance and reinsurance

− under takings.

− (42) U nder sector -specifi c U nion la w , some fi nancial entities are subject to lighter requirements or exe mp tions f or reasons

− associated with their size or the ser vices they pro vide. That catego r y of financia l entities includes small and non-

− inter connected inv estment fi r ms, small institutions f or occupational retirement provision which ma y be excluded

− from the scope of Directive (EU) 2016/2341 under the conditions laid down in Ar ticle 5 of that Directive by the

− Member State concer ned and operat e pension schemes whic h tog ether do not have more than 100 members in

− total, as well as institutions exem pt ed pursuant to Directive 2013/36/EU. Theref ore, in accordance with the

− pr inciple of propor tionality and to preser ve the spir it of sector -specifi c Uni on law , it is also appropr iat e to subject

− those fi nancial entities to a sim plified ICT r isk management framew ork under this Regulation. The propor tionate

− c haracter of the ICT r isk manage ment framework co ver ing those financial entities should not be alter ed by the

− regulatory te chnical standards that are to be developed by the ESA s. Moreo ver , in accordance with the pr inciple of

− propor tionality , it is appropr iate to also subject pa yment institutions ref er red to in Ar ticle 32(1) of Directive (EU)

− 2015/2366 and electronic mone y institutions refer red to in Ar ticle 9 of Directive 2009/110/EC exem pt ed in

− accordance with national law transposing those U nion legal acts to a sim plified ICT r isk manage ment framew ork

− under this Regulation, while pa yment institutions and electronic mone y institutions whic h hav e not been exem pt ed

− in accordance with their respective national la w transposing sectoral U nion la w should compl y with the g eneral

− framewor k laid do wn by this Regulation.

− (43) Similarly , fi nancial entities whic h qualify as microent er pr ises or are subject to the sim plif ied ICT r isk management

− framewor k under this Regulation should not be required to establish a role to monitor their ar rang ements

− concluded with ICT third-par ty ser vice provid ers on the use of ICT ser vices; or to designat e a member of senior

− manage ment to be responsible f or o verseeing the relat ed r isk exposure and relevant documentation; to assign the

− responsibility f or managing and overseein g ICT r isk to a control function and ensure an appropr iate level of

− independence of such control function in order to av oid conf licts of inter est ; to document and review at least once

− a y ear the ICT r isk manage ment framework; to subject to internal audit on a regular basis the ICT r isk management

− framewor k; to perform in-dept h assessments af ter maj or c hanges in their netw ork and inf or mation system

− infrastr uctures and processes; to regularly conduct r isk analyses on lega cy ICT syste ms; to subject the

− imp lementation of the ICT Response and Recove r y plans to independent internal audit reviews; to hav e a cr isis

− manage ment function, to expand the te sting of business continuity and response and recovery plans to capture

− switc hover scenar ios between pr imar y ICT infrastr ucture and redundant facilities; to repor t to compet ent

− author ities, upon their request, an estimation of aggrega ted annual costs and losses caused by maj or ICT -relat ed

− incidents, to maintain redundant ICT capacities; to communicate to national compet ent author ities im plemented

− (

− 18

− ) Directive 2014/65/EU of the European Parliament and of the Council of 15 Ma y 2014 on markets in financia l instr uments and

− amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).

− Offi cial Jour nal of the European Uni on L 333/10 27.12.2022

− c hanges f ollowing post ICT -relat ed incident reviews; to monitor on a continuous basis relevant tec hnological

− developments, to establish a comprehensive digital operational resilience testing programme as an integral par t of

− the ICT r isk manage ment framew ork provi ded f or in this Regulation, or to adopt and regularly review a strategy on

− ICT third-par ty r isk. In addition, microenter pr ises should only be required to assess the need to maintain such

− redundant ICT capacities based on their r isk prof ile. Microenter pr ises should benefit from a more f lexible regime as

− regards digital operational resilience tes ting programmes. When consider ing the type and frequency of te sting to be

− performe d, they should properly balance the objective of maintaining a high digital operational resilience, the

− av ailable resources and their o verall r isk profile. Microente r pr ises and financial entities subject to the sim plif ied ICT

− r isk management framework under this Regulation should be exem pt ed from the requirement to perf or m advanced

− test ing of ICT tools, syste ms and processes based on threat-led penetration test ing (TLPT), as only fi nancial entities

− meeting the cr ite r ia set out in this Regulation should be required to car r y out such te sting. In light of their limited

− capabilities, microenter pr ises should be able to agree with the ICT third-par ty ser vice pro vider to delegat e the

− fi nancial entity’s r ights of access, inspection and audit to an independent third-par ty , to be appointed by the ICT

− third-par ty ser vice provi der , pro vided that the financial entity is able to request, at an y time, all relevant inf or mation

− and assurance on the ICT third-par ty ser vice provider ’s performa nce from the respective independent third-par ty .

− (44) As only those financia l entities identified f or the pur poses of the advanced digital resilience test ing should be

− required to conduct threat-led penetration tests, the administrative processes and fi nancial costs entailed in the

− performa nce of such tests should be bor ne by a small percentage of financial entities.

− (45) T o ensure full alignment and o verall consist ency between financial entities’ business strateg ies, on the one hand, and

− the conduct of ICT r isk manag ement, on the other hand, the fi nancial entities ’ management bodies should be

− required to maintain a pivotal and active role in ste er ing and adapt ing the ICT r isk manage ment framework and the

− o verall digital operational resilience strateg y . The approach to be tak en by manage ment bodies should not only f ocus

− on the means of ensur ing the resilience of the ICT systems, but should also co ver people and processes through a set

− of policies whic h cultivate, at each cor porat e la yer , and f or all staff, a strong sense of aware ness about cyber r isks and

− a commitment to obser ve a str ict cyber hygiene at all levels. The ultimat e responsibility of the management body in

− managing a financia l entity’s ICT r isk should be an o verarching pr inciple of that comprehensive approach, fur ther

− translate d into the continuous eng agement of the management body in the control of the monit or ing of the ICT

− r isk manage ment.

− (46) Moreover , the pr inciple of the manage ment body’s full and ultimat e responsibility f or the management of the ICT

− r isk of the fi nancial entity goes hand in hand with the need to secure a level of ICT -relate d inve stments and an

− o verall budget f or the fi nancial entity that w ould enable the fi nancial entity to achi eve a high level of digital

− operational resilience.

− (47) Inspired by relevant international, national and industr y best practices, guidelines, recommendations and

− approach es to the manage ment of cyber r isk, this Regulation promot es a set of pr inciples that f acilitate the o verall

− str ucture of ICT r isk management. Consequently , as long as the main capabilities which financial entities put in

− place address the var ious functions in the ICT r isk manag ement (identification, prot ection and prevention,

− det ection, response and reco ver y , lear ning and ev olving and communication) set out in this Regulation, financia l

− entities should remain free to use ICT r isk management models that are differ ently framed or catego r ised.

− (48) T o kee p pace with an evolving cyber threat landscape, financial entities should maintain updat ed ICT systems that are

− reliable and capable, not only f or guaranteeing the processing of data required f or their ser vices, but also f or ensur ing

− suffi cient tec hnological resilience to allow them to deal adequate ly with additional processing needs due to stressed

− mark et conditions or other adverse situations.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/11

− (49) Effi cient business continuity and recovery plans are necessar y to allow f inancial entities to promp tly and quickly

− resolve ICT -related incidents, in par ticular cyber -attacks, by limiting damage and giving pr ior ity to the resum pti on

− of activities and reco ver y actions in accordance with their back -up policies. However , such resum pti on should in no

− wa y jeopardise the integrit y and secur ity of the netw ork and inf or mation system s or the availability , authenticity ,

− integrit y or conf identiality of data.

− (50) While this Regulation allows financial entities to det er mine their reco ver y time and recovery point objectives in a

− f lexible manner and hence to set such objectives by fully taking into account the nature and the cr iticality of the

− relevant functions and an y specific business needs, it should never theless require them to car r y out an assessment of

− the poten tial overall impa ct on market effi ciency when determi ning such objectives.

− (51) The propagat ors of cyber -attacks tend to pursue financial g ains directly at the source, thus exposing financial entities

− to significant consequences. T o prevent ICT systems from losing integr ity or becoming una vailable, and hence to

− av oid data breac hes and damag e to phy sical ICT infrastr ucture, the repor ting of maj or ICT -related incidents by

− fi nancial entities should be signif icantly im proved and streamlined. ICT -related incident repor ting should be

− har monised through the introduction of a requirement f or all fi nancial entities to repor t directly to their relevant

− compet ent author ities. Where a fi nancial entity is subject to super vision by more than one national compet ent

− author ity , Member States should designate a sing le compet ent author ity as the addressee of such repor ting. Credit

− institutions classif ied as significant in accordance with Ar ticle 6(4) of Council Regulation (EU) No 1024/2013 (

− 19

− )

− should submit such repor ting to the national compet ent author ities, whic h should subsequently transmit the repor t

− to the European Central Bank (ECB).

− (52) The direct repor ting should enable financial super visors to hav e immediate access to inf or mation about maj or ICT -

− relat ed incidents. Financial super visors should in tur n pass on details of maj or ICT -related incidents to public non-

− fi nancial author ities (suc h as compet ent author ities and sing le points of contact under Directive (EU) 2022/2555,

− national data prot ection author ities, and to la w enf orcement author ities f or ma jor ICT -related incidents of a

− cr iminal nature) in order to enhance such author ities awar eness of such incidents and, in the case of CSIRT s, to

− fa cilitate prom pt assistance that ma y be given to financia l entities, as appropr iat e. Member States should, in

− addition, be able to deter mine that fi nancial entities themselves should provide such inf or mation to public

− author ities outside the fi nancial ser vices area. Those inf or mation f lo ws should allo w fi nancial entities to swif tly

− benefit from an y relevant tec hnical input, advice about remedies, and subsequent f ollo w-up from such author ities.

− The inf or mation on maj or ICT -relat ed incidents should be mutually c hannelled: fi nancial super visors should

− provid e all necessar y f eedback or guidance to the financial entity , while the ESA s should share anonymised data on

− cyber threats and vulnerabilities relating to an incident, to aid wider collective defence.

− (53) While all financia l entities should be required to car r y out incident repor ting, that requirement is not expect ed to

− affe ct all of them in the same manner . Indeed, relevant mate r iality thresholds, as well as repor ting timelines, should

− be duly adjusted, in the conte xt of delegat ed acts based on the regulatory te chnical standards to be developed by the

− ESA s, with a view to cover ing only maj or ICT -relat ed incidents. In addition, the specifi cities of fi nancial entities

− should be taken into account when setting timelines f or repor ting obligations.

− (54) This Regulation should require credit institutions, pa yment institutions, account inf or mation ser vice provid ers and

− electronic mone y institutions to repor t all operational or secur ity pa yment-relate d incidents – previously repor ted

− under Directive (EU) 2015/2366 – ir respective of the ICT nature of the incident.

− (

− 19

− ) Council Regulation (EU) No 1024/2013 of 15 Octo ber 2013 conf er r ing specific tasks on the European Central Bank concer ning

− policies relating to the pr udential super vision of credit institutions (OJ L 287, 29.10.2013, p. 63).

− Offi cial Jour nal of the European Uni on L 333/12 27.12.2022

− (55) The ESAs should be task ed with assessing the feasibility and conditions f or a possible centralisation of ICT -relate d

− incident repor ts at Union level. Such centralisation could consist of a sing le EU Hub f or major ICT -relate d incident

− repor ting either directly receiving relevant repor ts and automatical ly notifying national compe tent author ities, or

− merely centralising relevant repor ts f or warded by the national compe tent author ities and thus fulf illing a

− coordination role. The ESA s should be taske d with prepar ing, in consultation with the ECB and ENISA, a joint

− repor t explor ing the fe asibility of setting up a sing le EU Hub.

− (56) In order to achieve a high level of digital operational resilience, and in line with both the relevant intern ational

− standards (e.g. the G7 Fundamental Elements f or Threat-Led P enetration T esting) and with the frameworks applied

− in the U nion, such as the TIBER -EU, financial entities should regularly test their ICT systems and staff hav ing ICT -

− relat ed responsibilities with rega rd to the eff ectiveness of their preventive, det ection, response and reco ver y

− capabilities, to uncov er and address pote ntial ICT vulnerabilities. T o ref lect differ ences that exist across, and within,

− the var ious financial subsectors as regards financia l entities ’ level of cybersecur ity preparedness, tes ting should

− include a wide var iety of too ls and actions, ranging from the assessment of basic requirements (e.g. vulnerability

− assessments and scans, open source analyses, network secur ity assessments, ga p analyses, phy sical secur ity reviews,

− questionnaires and scanning sof tware solutions, source code reviews where f easible, scenar io-based tes ts,

− compati bility testing, performance te sting or end-to- end tes ting) to more advanced testing by means of TLPT . Such

− advanced test ing should be required only of f inancial entities that are mature enough from an ICT perspective to

− reasonably car r y it out. The digital operational resilience testing required by this Regulation should thus be more

− demanding f or those financia l entities meeting the cr iter ia set out in this Regulation (f or example, larg e, syste mic

− and ICT -mature credit institutions, st ock exc hanges , central secur ities depositori es and central count er par ties) than

− f or other financia l entities. At the same time, the digital operational resilience te sting by means of TLPT should be

− more relevant f or financial entities operating in core financia l ser vices subsect ors and pla ying a systemic role (f or

− example, pa yments, banking, and clear ing and settlement), and less relevant f or other subsect ors (f or example, asset

− manage rs and credit rating ag encies).

− (57) Financial entities inv olved in cross-border activities and exercising the freedoms of establishment, or of pro vision of

− ser vices within the Union, should compl y with a sing le set of advanced tes ting requirements (i.e. TLPT) in their home

− Member Stat e, whic h should include the ICT infrastr uctures in all jur isdictions where the cross-border financial

− group operat es within the U nion, thus allo wing such cross-border fi nancial groups to incur relat ed ICT test ing costs

− in one jur isdiction only .

− (58) T o dra w on the exper tise already acquired by cer tain compet ent author ities, in par ticular with regar d to

− imp lementing the TIBER -EU framework, this Regulation should allow Member States to designate a sing le public

− author ity as responsible in the fi nancial sector , at national level, f or all TLPT matt ers, or compet ent author ities, to

− delegat e, in the absence of such designation, the exercise of TLPT related tasks to another national fi nancial

− compet ent author ity .

− (59) Since this Regulation does not require financia l entities to co ver all cr itical or im por tant functions in one sing le

− threat-led penetration test , financia l entities should be free to deter mine whic h and how many cr itical or impor tant

− functions should be included in the scope of such a test.

− (60) P ooled testing within the meaning of this Regulation – inv olving the par ticipation of several financial entities in a

− TLPT and f or whic h an ICT third-par ty ser vice provider can directly ent er into contractual ar rang ements with an

− external te ster – should be allo wed only where the quality or secur ity of ser vices delivered by the ICT third-par ty

− ser vice provid er to customers that are entities falling outside the scope of this Regulation, or the conf identiality of

− the data relat ed to such ser vices, are reasonably expect ed to be adversely im pacted . P ooled tes ting should also be

− subject to safeg uards (direction by one designated financia l entity , calibration of the number of par ticipating

− fi nancial entities) to ensure a r igorous testing exercise f or the financia l entities inv olved whic h meet the objectives of

− the TLPT pursuant to this Regulation.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/13

− (61) In order to take advantag e of internal resources available at cor porat e level, this Regulation should allow the use of

− internal test ers f or the pur poses of car r ying out TLPT , provid ed there is super visor y appro val, no conf licts of

− inter est, and per iodical alternation of the use of internal and external test ers (ever y three tests ), while also requir ing

− the provid er of the threat intellig ence in the TLPT to alwa ys be external to the fi nancial entity . The responsibility f or

− conducting TLPT should remain fully with the fi nancial entity . A ttest ations provid ed by author ities should be solely

− f or the pur pose of mutual recognition and should not preclude an y f ollow-up action needed to address the ICT r isk

− to which the fi nancial entity is exposed, nor should the y be seen as a super visor y endorsement of a fi nancial entity’s

− ICT r isk manag ement and mitig ation capabilities.

− (62) T o ensure a sound monitoring of ICT third-par ty r isk in the financial sector , it is necessar y to la y down a set of

− pr inciple-based r ules to guide financia l entities ’ when monitori ng r isk ar ising in the context of functions outsourced

− to ICT third-par ty ser vice provi ders, par ticularly f or ICT ser vices suppor ting cr itical or imp or tant functions, as well

− as more general ly in the context of all ICT third-par ty dependencies.

− (63) T o address the compl exity of the var ious sources of ICT r isk, while taking into account the multitude and diversity of

− provid ers of tec hnological solutions which enable a smooth provision of fi nancial ser vices, this Regulation should

− co ver a wide rang e of ICT third-par ty ser vice pro viders, including provi ders of cloud computing ser vices, sof tware,

− data analytics ser vices and provid ers of data centre ser vices. Similarly , since fi nancial entities should effe ctively and

− coherently identify and manage all types of r isk, including in the conte xt of ICT ser vices procured within a fi nancial

− group, it should be clar if ied that under takings whic h are par t of a fi nancial group and provi de ICT ser vices

− predominantly to their parent under taking, or to subsidiar ies or branches of their parent under taking, as well as

− fi nancial entities provid ing ICT ser vices to other fi nancial entities, should also be considered as ICT third-par ty

− ser vice provid ers under this Regulation. Lastly , in light of the ev olving pa yment ser vices mark et becoming

− increasing ly dependent on compl ex tec hnical solutions, and in view of emerging types of pa yment ser vices and

− pa yment-related solutions, par ticipants in the pa yment ser vices ecosystem , providing pa yment-processing activities,

− or operating pa yment infrastr uctures, should also be considered to be ICT third-par ty ser vice providers under this

− Regulation, with the exce ption of central banks when operating pa yment or secur ities settlement systems , and

− public author ities when provi ding ICT relat ed ser vices in the context of fulfilling Stat e functions.

− (64) A fi nancial entity should at all times remain fully responsible f or compl ying with its oblig ations set out in this

− Regulation. Financial entities should apply a propor tionat e approach to the monitori ng of r isks emerging at the

− level of the ICT third-par ty ser vice pro viders, by duly consider ing the nature, scale, compl exity and impor tance of

− their ICT -relat ed dependencies, the cr iticality or im por tance of the ser vices, processes or functions subject to the

− contractual ar rang ements and, ultimat ely , on the basis of a careful assessment of an y potential im pact on the

− continuity and quality of financial ser vices at individual and at group level, as appropr iate.

− (65) The conduct of such monitori ng should f ollow a strategic approach to ICT third-par ty r isk f or malised through the

− adoptio n by the financial entity’s managemen t body of a dedicated ICT third-par ty r isk strateg y , rooted in a

− continuous screening of all ICT third-par ty dependencies. T o enhance super visor y awareness of ICT third-par ty

− dependencies, and with a view to fur ther suppor ting the w ork in the cont ext of the Oversight Framew ork

− established by this Regulation, all fi nancial entities should be required to maintain a register of inf or mation with all

− contractual ar rang ements about the use of ICT ser vices provi ded by ICT third-par ty ser vice provid ers. Financial

− super visors should be able to request the full register , or to ask f or specifi c sections thereof, and thus to obtain

− essential inf or mation f or acquir ing a broader understanding of the ICT dependencies of fi nancial entities.

− (66) A thorough pre-contracting analysis should under pin and precede the f or mal conclusion of contractual

− ar range ments, in par ticular by f ocusing on elements such as the cr iticality or impor tance of the ser vices suppor ted

− by the envisag ed ICT contract, the necessar y super visor y approvals or other conditions, the possible concentration

− r isk entailed, as well as applying due diligence in the process of selection and assessment of ICT third-par ty ser vice

− provid ers and assessing pote ntial conf licts of inter est. For contractual ar range ments concer ning cr itical or

− imp or tant functions, fi nancial entities should tak e into consideration the use by ICT third-par ty ser vice provi ders of

− the most up-to -date and highest inf or mation secur ity standards. T er mination of contractual ar rang ements could be

− promp ted at least by a ser ies of circumstances showing shor tf alls at the ICT third-par ty ser vice pro vider level, in

− Offi cial Jour nal of the European Uni on L 333/14 27.12.2022

− par ticular signif icant breac hes of la ws or contractual term s, circumstances revealing a poten tial alteration of the

− performa nce of the functions provid ed f or in the contractual ar rang ements, evidence of weaknesses of the ICT

− third-par ty ser vice pro vider in its overall ICT r isk management, or circumstances indicating the inability of the

− relevant compet ent author ity to eff ectively super vise the fi nancial entity .

− (67) T o address the systemic im pact of ICT third-par ty concentration r isk, this Regulation promotes a balanced solution

− by means of taking a f lexible and gradual approach to such concentration r isk since the imp osition of an y r igid caps

− or str ict limitations might hinder the conduct of business and restrain the contractual freedom. Financial entities

− should thoroughly assess their envisag ed contractual ar rang ements to identify the lik elihood of such r isk emerging,

− including by means of in-depth analyses of subcontracting ar rangements, in par ticular when concluded with ICT

− third-par ty ser vice provid ers established in a third countr y . At this stage, and with a view to str iking a fa ir balance

− between the im perative of preser ving contractual freedom and that of guarant eeing fi nancial stability , it is not

− considered appropr iat e to set out r ules on str ict caps and limits to ICT third-par ty exposures. In the conte xt of the

− Oversight Framew ork, a Lead Overseer , appointed pursuant to this Regulation, should, in respect to cr itical ICT

− third-par ty ser vice providers, pa y par ticular att ention to fully grasp the magnitude of interdependences, disco ver

− specifi c instances where a high degree of concentration of cr itical ICT third-par ty ser vice provi ders in the Union is

− like ly to put a strain on the U nion financial system’s stability and integrit y and maintain a dialogue with cr itical ICT

− third-par ty ser vice provid ers where that specif ic r isk is identified.

− (68) T o evaluate and monitor on a regular basis the ability of an ICT third par ty ser vice provi der to securely provide

− ser vices to a fi nancial entity without adverse eff ects on a financial entity’s digital operational resilience, several ke y

− contractual elements with ICT third-par ty ser vice pro viders should be har monised. Such har monisation should

− co ver minimum areas whic h are cr ucial f or enabling a full monitori ng by the financial entity of the r isks that could

− emerge from the ICT third-par ty ser vice provider , from the perspective of a financial entity’s need to secure its

− digital resilience because it is deeply dependent on the stability , functionality , availability and secur ity of the ICT

− ser vices received.

− (69) When renegotiating contractual ar range ments to seek alignment with the requirements of this Regulation, financial

− entities and ICT third-par ty ser vice provid ers should ensure the coverag e of the ke y contractual provis ions as

− provid ed f or in this Regulation.

− (70) The def inition of ‘cr itical or im por tant function’ provided f or in this Regulation encompasses the ‘cr itical functions’

− as defined in Ar ticle 2(1), point (35), of Directive 2014/59/EU of the European Parliament and of the Council (

− 20

− ) .

− A ccording ly , functions deemed to be cr itical pursuant to Directive 2014/59/EU are included in the def inition of

− cr itical functions within the meaning of this Regulation.

− (71) Ir respective of the cr iticality or im por tance of the function suppor te d by the ICT ser vices, contractual ar range ments

− should, in par ticular , provide f or a specif ication of the compl ete descr iptions of functions and ser vices, of the

− locations where such functions are provided and where data is to be processed, as well as an indication of ser vice

− level descr ip tions. Other essential elements to enable a fi nancial entity’s monitori ng of ICT third par ty r isk are:

− contractual pro visions specifying how the accessibility , av ailability , integr ity , secur ity and prot ection of personal

− data are ensured by the ICT third-par ty ser vice provider , provis ions la ying down the relevant guarantees f or

− enabling the access, recovery and retur n of data in the case of insolvency , resolution or discontinuation of the

− business operations of the ICT third-par ty ser vice provider , as well as provisions requir ing the ICT third-par ty

− ser vice provid er to provid e assistance in case of ICT incidents in connection with the ser vices provid ed, at no

− additional cost or at a cost deter mined ex-ante; provi sions on the obligation of the ICT third-par ty ser vice provid er

− (

− 20

− ) Directive 2014/59/EU of the European P arliament and of the Council of 15 Ma y 2014 establishing a framework f or the recover y and

− resolution of credit institutions and investment fir ms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC,

− 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU)

− No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190).

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/15

− to fully cooperate with the compet ent author ities and resolution author ities of the financial entity ; and provisions on

− term ination r ights and relat ed minimum notice per iods f or the term ination of the contractual ar range ments, in

− accordance with the expectations of compe tent author ities and resolution author ities.

− (72) In addition to such contractual provisions, and with a view to ensur ing that fi nancial entities remain in full control of

− all developments occur r ing at third-par ty level whic h ma y im pair their ICT secur ity , the contracts f or the provis ion

− of ICT ser vices suppor ting cr itical or im por tant functions should also provide f or the f ollo wing: the specifi cation of

− the full ser vice level descr iptions, with precise quantitative and qualitative perf or mance targets , to enable without

− undue dela y appropr iat e cor rective actions when the agreed ser vice levels are not met ; the relevant notice per iods

− and repor ting oblig ations of the ICT third-par ty ser vice provid er in the event of developments with a potential

− mater ial impa ct on the ICT third-par ty ser vice provi der ’s ability to eff ectively provid e their respective ICT ser vices; a

− requirement upon the ICT third-par ty ser vice provid er to im plement and te st business continge ncy plans and have

− ICT secur ity measures, too ls and policies allowing f or the secure provision of ser vices, and to par ticipat e and fully

− cooperate in the TLPT car r ied out by the fi nancial entity .

− (73) Contracts f or the provi sion of ICT ser vices suppor ting cr itical or impor tant functions should also contain provi sions

− enabling the r ights of access, inspection and audit by the financial entity , or an appointed third par ty , and the r ight to

− take copies as cr ucial instr uments in the financial entities’ ongoing monitori ng of the ICT third-par ty ser vice

− provid er ’s perf or mance, coupled with the ser vice provider ’s full cooperation dur ing inspections. Similarly , the

− compet ent author ity of the financial entity should have the r ight, based on notices, to inspect and audit the ICT

− third-par ty ser vice provid er , subject to the prote ction of conf idential inf or mation.

− (74) Such contractual ar rang ements should also provide f or dedicat ed exit strate gies to enable, in par ticular , mandatory

− transition per iods dur ing which ICT third-par ty ser vice pro viders should continue provid ing the relevant ser vices

− with a view to reducing the r isk of disr uptions at the level of the financia l entity , or to allow the latte r eff ectively to

− switc h to the use of other ICT third-par ty ser vice providers or , altern atively , to chang e to in-house solutions,

− consistent with the complexity of the provid ed ICT ser vice. Moreover , fi nancial entities within the scope of Directive

− 2014/59/EU should ensure that the relevant contracts f or ICT ser vices are robust and fully enf orceable in the event of

− resolution of those financial entities. Theref ore, in line with the expectations of the resolution author ities, those

− fi nancial entities should ensure that the relevant contracts f or ICT ser vices are resolution resilient. As long as the y

− continue meeting their pa yment oblig ations, those fi nancial entities should ensure, among other requirements, that

− the relevant contracts f or ICT ser vices contain clauses f or non-termina tion, non-suspension and non-modif ication

− on grounds of restr uctur ing or resolution.

− (75) Moreover , the v oluntar y use of standard contractual clauses developed by public author ities or U nion institutions, in

− par ticular the use of contractual clauses developed by the Commission f or cloud computing ser vices could provid e

− fur ther comf or t to the fi nancial entities and ICT third-par ty ser vice provid ers, by enhancing their level of leg al

− cer tainty rega rding the use of cloud computing ser vices in the financial sector , in full alignment with the

− requirements and expectations set out by the U nion fi nancial ser vices la w . The development of standard contractual

− clauses builds on measures already envisag ed in the 2018 Fintec h A ction Plan that announced the Commission’s

− intenti on to encourage and f acilitate the development of standard contractual clauses f or the use of cloud

− computi ng ser vices outsourcing by fi nancial entities, drawing on cross-sector ial cloud computing ser vices

− stake holders ’ eff or ts, whic h the Commission has f acilitated with the help of the fi nancial sector ’s inv olvement.

− (76) With a view to promoting conver gence and effi ciency in relation to super visor y approac hes when addressing ICT

− third-par ty r isk in the fi nancial sector , as well as to strengthening the digital operational resilience of financial

− entities which rely on cr itical ICT third-par ty ser vice pro viders f or the pro vision of ICT ser vices that suppor t the

− supply of financial ser vices, and thereby to contr ibuting to the preser vation of the U nion’s fi nancial system stability

− and the inte gr ity of the intern al market f or financia l ser vices, cr itical ICT third-par ty ser vice providers should be

− subject to a Uni on Oversight Framew ork. While the set-up of the Oversight Framew ork is justified by the added

− value of taking action at U nion level and by vir tue of the inherent role and specific ities of the use of ICT ser vices in

− Offi cial Jour nal of the European Uni on L 333/16 27.12.2022

− the provision of financia l ser vices, it should be recalled, at the same time, that this solution appears suitable only in

− the context of this Regulation specifi cally dealing with digital operational resilience in the financial sector . However ,

− such Oversight Framew ork should not be regarded as a new model f or U nion super vision in other areas of fi nancial

− ser vices and activities.

− (77) The Oversight Framework should apply only to cr itical ICT third-par ty ser vice provi ders. There should theref ore be a

− designation mech anism to take into account the dimension and nature of the financia l sector ’s reliance on such ICT

− third-par ty ser vice pro viders. That mec hanism should inv olve a set of quantitative and qualitative cr it er ia to set the

− cr iticality paramete rs as a basis f or inclusion in the Oversight Framew ork. In order to ensure the accuracy of that

− assessment, and regardl ess of the cor porate str ucture of the ICT third-par ty ser vice provider , such cr iter ia should, in

− the case of a ICT third-par ty ser vice provid er that is par t of a wider group, take into consideration the entire ICT

− third-par ty ser vice pro vider ’s group str ucture. On the one hand, cr itical ICT third-par ty ser vice provid ers, which are

− not automatically designated by vir tue of the application of those cr it er ia, should hav e the possibility to op t in to the

− Oversight Framew ork on a v oluntar y basis, on the other hand, ICT third-par ty ser vice pro viders, that are already

− subject to o versight mechanism framew ork s suppor ting the fulfilment of the tasks of the European System of

− Central Banks as refer red to in Ar ticle 127(2) TFEU, should be exem pt ed.

− (78) Similarly , fi nancial entities provi ding ICT ser vices to other financia l entities, while belonging to the categor y of ICT

− third-par ty ser vice provid ers under this Regulation, should also be exem pt ed from the Oversight Framew ork since

− they are already subject to super visor y mechanisms established by the relevant Union financia l ser vices la w . Where

− applicable, compe tent author ities should take into account, in the conte xt of their super visor y activities, the ICT r isk

− posed to fi nancial entities by fi nancial entities providin g ICT ser vices. Likewise, due to the existing r isk monitori ng

− mechani sms at group level, the same exem ption should be introduced f or ICT third-par ty ser vice provid ers

− deliver ing ser vices predominantly to the entities of their o wn group. ICT third-par ty ser vice provid ers provid ing

− ICT ser vices solely in one Member Stat e to financial entities that are active only in that Member Stat e should also be

− exem pt ed from the designation mechanism because of their limited activities and lac k of cross-border impact.

− (79) The digital transf or mation exper ienced in financial ser vices has brought about an un precedented level of use of, and

− reliance upon, ICT ser vices. Since it has become inconceivable to provid e fi nancial ser vices without the use of cloud

− computi ng ser vices, sof tware solutions and data-relate d ser vices, the Union fi nancial ecosystem has become

− intr insically co-dependent on cer tain ICT ser vices pro vided by ICT ser vice suppliers. Some of those suppliers,

− innovat ors in developing and applying ICT -based tec hnologies, pla y a signif icant role in the deliver y of financia l

− ser vices, or hav e become integrat ed into the financia l ser vices value chain. They hav e thus become cr itical to the

− stability and inte gr ity of the Union fi nancial system. This widespread reliance on ser vices supplied by cr itical ICT

− third-par ty ser vice provi ders, combined with the inter dependence of the inf or mation systems of var ious mark et

− operat ors, creat e a direct, and poten tially severe, r isk to the Uni on fi nancial ser vices syste m and to the continuity of

− deliver y of fi nancial ser vices if cr itical ICT third-par ty ser vice provid ers were to be affe cted by operational

− disr uptions or maj or cyber incidents. Cyber incidents hav e a distinctive ability to multiply and propagat e

− throughout the financial system at a considerably fast er pace than other types of r isk monitor ed in the financial

− sector and can extend across sectors and bey ond g eographical borders. They hav e the poten tial to ev olve into a

− systemic cr isis, where tr ust in the financial system has been eroded due to the disr uption of functions suppor ting

− the real economy , or to substantial fi nancial losses, reac hing a level which the financial syste m is unable to

− withstand, or whic h requires the deplo yment of heavy shock absor ption measures. T o prevent these scenar ios from

− taking place and thereb y endange r ing the fi nancial stability and inte gr ity of the Union, it is essential to provide the

− converg ence of super visor y practices relating to ICT third-par ty r isk in fi nance, in par ticular through new r ules

− enabling the Uni on o versight of cr itical ICT third-par ty ser vice provid ers.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/17

− (80) The Oversight Framew ork larg ely depends on the degree of collaboration between the Lead Overseer and the cr itical

− ICT third-par ty ser vice pro vider deliver ing to financia l entities ser vices affect ing the supply of fi nancial ser vices.

− Successful o versight is predicat ed, inter alia, upon the ability of the Lead Overseer to effectively conduct monitor ing

− missions and inspections to assess the r ules, controls and processes used by the cr itical ICT third-par ty ser vice

− provid ers, as well as to assess the potential cumulative impact of their activities on fi nancial stability and the

− integrit y of the fi nancial syste m. At the same time, it is cr ucial that cr itical ICT third-par ty ser vice providers f ollow

− the Lead Overseer ’s recommendations and address its concer ns. Since a lac k of cooperation by a cr itical ICT third-

− par ty ser vice pro vider provid ing ser vices that aff ect the supply of fi nancial ser vices, such as the refusal to grant

− access to its premises or to submit inf or mation, w ould ultimat ely depr ive the Lead Overseer of its essential too ls in

− appraising ICT third-par ty r isk, and could adversely imp act the fi nancial stability and the integrity of the financial

− system, it is necessar y to also provid e f or a commensurate sanctioning regime.

− (81) Agai nst this backg round, the need of the Lead Overseer to impose penalty pa yments to compel cr itical ICT third-

− par ty ser vice pro viders to compl y with the transparency and access-related oblig ations set out in this Regulation

− should not be jeopardised by difficulties raised by the enf orcement of those penalty pa yments in relation to cr itical

− ICT third-par ty ser vice providers established in third countr ies. In order to ensure the enf orceability of such

− penalties, and to allo w a swif t roll out of procedures upholding the cr itical ICT third-par ty ser vice provid ers’ r ights

− of def ence in the context of the designation mechanism and the issuance of recommendations, those cr itical ICT

− third-par ty ser vice provi ders, provid ing ser vices to fi nancial entities that aff ect the supply of financia l ser vices,

− should be required to maintain an adequate business presence in the Union. Due to the nature of the oversight, and

− the absence of compar able ar rangements in other jur isdictions, there are no suitable alternative mech anisms

− ensur ing this objective by wa y of eff ective cooperation with fi nancial super visors in third countr ies in relation to the

− monitori ng of the im pact of digital operational r isks posed by systemic ICT third-par ty ser vice providers, qualifying

− as cr itical ICT third-par ty ser vice provi ders established in third countr ies. Theref ore, in order to continue its

− provision of ICT ser vices to fi nancial entities in the U nion, an ICT third-par ty ser vice provid er established in a third

− countr y which has been designat ed as cr itical in accordance with this Regulation should under take , within 12

− months of such designation, all necessar y ar rang ements to ensure its incor poration within the Union, by means of

− establishing a subsidiar y , as defined throughout the U nion acquis, namely in Directive 2013/34/EU of the European

− P arliament and of the Council (

− 21

− ) .

− (82) The requirement to set up a subsidiar y in the Union should not prevent the cr itical ICT third-par ty ser vice provi der

− from supplying ICT ser vices and related te chnical suppor t from facilities and infrastr ucture located outside the

− U nion. This Regulation does not im pose a data localisation oblig ation as it does not require data stor age or

− processing to be under take n in the U nion.

− (83) Cr itical ICT third-par ty ser vice providers should be able to provi de ICT ser vices from anywhere in the world, not

− necessar ily or not only from premises locat ed in the U nion. Oversight activities should be first conduct ed on

− premises locat ed in the Union and by interacting with entities locat ed in the U nion, including the subsidiar ies

− established by cr itical ICT third-par ty ser vice providers pursuant to this Regulation. However , such actions within

− the Union might be insuffi cient to allow the Lead Overseer to fully and effectively perform its duties under this

− Regulation. The Lead Overseer should theref ore also be able to exercise its relevant oversight po wers in third

− countr ies. Ex ercising those po wers in third countr ies should allo w the Lead Overseer to examine the f acilities from

− which the ICT ser vices or the tec hnical suppor t ser vices are actually provid ed or manage d by the cr itical ICT third-

− par ty ser vice provider , and should give the Lead Overseer a comprehensive and operational understanding of the

− ICT r isk manag ement of the cr itical ICT third-par ty ser vice provid er . The possibility f or the Lead Overseer , as a

− U nion ag ency , to exercise po wers outside the terr it or y of the U nion should be duly framed by relevant conditions,

− in par ticular the consent of the cr itical ICT third-par ty ser vice provi der concer ned. Similarly , the relevant author ities

− of the third countr y should be inf or med of, and not hav e objected to, the exercise on their own terr itory of the

− activities of the Lead Overseer . Ho wever , in order to ensure efficient implementation, and without prejudice to the

− respective compet ences of the U nion institutions and the Member Stat es, such powers also need to be fully

− anch ored in the conclusion of administrative cooperation ar rang ements with the relevant author ities of the third

− (

− 21

− ) Directive 2013/34/EU of the European P arliament and of the Council of 26 June 2013 on the annual financial statements,

− consolidated f inancial statements and related repor ts of cer tain types of under takings, amending Directive 2006/43/EC of the

− European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC (OJ L 182, 29.6.2013, p. 19).

− Offi cial Jour nal of the European Uni on L 333/18 27.12.2022

− countr y concer ned. This Regulation should theref ore enable the ESAs to conclude administrative cooperation

− ar range ments with the relevant author ities of third countr ies, whic h should not other wise create legal oblig ations in

− respect of the Union and its Member States.

− (84) T o f acilitate communication with the Lead Overseer and to ensure adequate representation, cr itical ICT third-par ty

− ser vice provi ders which are par t of a group should designat e one leg al person as their coordination point.

− (85) The Oversight Framew ork should be without prejudice to Member Stat es ’ compet ence to conduct their o wn

− o versight or monitoring missions in respect to ICT third-par ty ser vice provi ders whic h are not designate d as cr itical

− under this Regulation, but whic h are rega rded as imp or tant at national level.

− (86) T o leverage the multi-la yered institutional archit ecture in the financial ser vices area, the Joint Committ ee of the ESA s

− should continue to ensure o verall cross-sect oral coordination in relation to all matte rs per taining to ICT r isk, in

− accordance with its tasks on cybersecur ity . It should be suppor te d by a new Subcommitt ee (the ‘Oversight For um’)

− car r ying out preparatory w ork both f or the individual decisions addressed to cr itical ICT third-par ty ser vice

− provid ers, and f or the issuing of collective recommendations, in par ticular in relation to benc hmarking the

− o versight programmes f or cr itical ICT third-par ty ser vice provid ers, and identifying best practices f or addressing ICT

− concentration r isk issues.

− (87) T o ensure that cr itical ICT third-par ty ser vice provi ders are appropr iat ely and eff ectively o verseen on a Union level,

− this Regulation provides that any of the three ESA s could be designate d as a Lead Overseer . The individual

− assignment of a cr itical ICT third-par ty ser vice provid er to one of the three ESAs should result from an assessment

− of the preponderance of financia l entities operating in the financia l sect ors f or which that ESA has responsibilities.

− This approach should lead to a balanced allocation of tasks and responsibilities between the three ESA s, in the

− conte xt of exe rcising the oversight functions, and should make the best use of the human resources and te chnical

− exper tise av ailable in each of the three ESA s.

− (88) Lead Overseers should be grant ed the necessar y po wers to conduct investig ations, to car r y out onsit e and offsite

− inspections at the premises and locations of cr itical ICT third-par ty ser vice provid ers and to obtain compl ete and

− update d inf or mation. Those po wers should enable the Lead Overseer to acquire real insight into the type,

− dimension and im pact of the ICT third-par ty r isk posed to financia l entities and ultimat ely to the Uni on’s fi nancial

− system. Entr usting the ESA s with the lead oversight role is a prerequisite f or understanding and addressing the

− systemic dimension of ICT r isk in fi nance. The im pact of cr itical ICT third-par ty ser vice providers on the U nion

− fi nancial sector and the potential issues caused by the ICT concentration r isk entailed call f or taking a collective

− approach at Union level. The simultaneous car r ying out of multiple audits and access r ights, performed separate ly

− by numerous compe tent author ities, with little or no coordination among them, w ould prevent fi nancial

− super visors from obtaining a compl ete and compre hensive o ver view of ICT third-par ty r isk in the U nion, while also

− creating redundancy , burden and compl exity f or cr itical ICT third-par ty ser vice provid ers if they were subject to

− numerous monitori ng and inspection requests.

− (89) Due to the signif icant impact of being designated as cr itical, this Regulation should ensure that the r ights of cr itical

− ICT third-par ty ser vice provi ders are obser ved throughout the implementation of the Oversight Framew ork. Pr ior

− to being designated as cr itical, such provid ers should, f or example, hav e the r ight to submit to the Lead Overseer a

− reasoned statement containing any relevant inf or mation f or the pur poses of the assessment related to their

− designation. Since the Lead Overseer should be em powered to submit recommendations on ICT r isk matte rs and

− suitable remedies theret o, which include the po wer to oppose cer tain contractual ar rangements ultimat ely affect ing

− the stability of the fi nancial entity or the fi nancial syste m, cr itical ICT third-par ty ser vice provi ders should also be

− given the oppor tunity to provide, pr ior to the fi nalisation of those recommendations, explanations regarding the

− expecte d im pact of the solutions, en visaged in the recommendations, on customers that are entities falling outside

− the scope of this Regulation and to f or mulate solutions to mitig ate r isks . Cr itical ICT third-par ty ser vice provid ers

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/19

− disagreeing with the recommendations should submit a reasoned explanation of their intention not to endorse the

− recommendation. Where such reasoned explanation is not submitted or where it is considered to be insuffic ient, the

− Lead Overseer should issue a public notice summar ily descr ibing the matte r of non-com pliance.

− (90) Com petent author ities should duly include the task of ver ifying substantive compl iance with recommendations

− issued by the Lead Overseer in their functions with regar d to pr udential super vision of financial entities. Com petent

− author ities should be able to require fi nancial entities to take additional measures to address the r isks identified in the

− Lead Overseer ’s recommendations, and should, in due course, issue notifi cations to that eff ect. Where the Lead

− Overseer addresses recommendations to cr itical ICT third-par ty ser vice providers that are super vised under

− Directive (EU) 2022/2555, the compe tent author ities should be able, on a voluntary basis and bef ore adopt ing

− additional measures, to consult the compet ent author ities under that Directive in order to f oster a coordinat ed

− approach to dealing with the cr itical ICT third-par ty ser vice providers in question.

− (91) The exercise of the oversight should be guided by three operational pr inciples seeking to ensure: (a) close

− coordination among the ESAs in their Lead Overseer roles, through a joint o versight netw ork (JON), (b) consist ency

− with the framewor k established by Directive (EU) 2022/2555 (through a v oluntar y consultation of bodies under that

− Directive to av oid duplication of measures direct ed at cr itical ICT third-par ty ser vice providers), and (c) applying

− dilig ence to minimise the pote ntial r isk of disr uption to ser vices provided by the cr itical ICT third-par ty ser vice

− provid ers to customer s that are entities f alling outside the scope of this Regulation.

− (92) The Oversight Framew ork should not replace, or in an y wa y or f or any par t substitute f or , the requirement f or

− fi nancial entities to manage themselves the r isks entailed by the use of ICT third-par ty ser vice provid ers, including

− their obligation to maintain an ongoing monitori ng of contractual ar rang ements concluded with cr itical ICT third-

− par ty ser vice provid ers. Similarly , the Oversight Framew ork should not affect the full responsibility of financia l

− entities f or compl ying with, and disc harging, all the legal oblig ations laid down in this Regulation and in the

− relevant fi nancial ser vices la w .

− (93) T o av oid duplications and o verlaps, compet ent author ities should refrain from taking individually any measures

− aiming to monitor the cr itical ICT third-par ty ser vice provider ’s r isks and should, in that respect, rely on the

− relevant Lead Overseer ’s assessment. Any measures should in any case be coordinat ed and agreed in advance with

− the Lead Overseer in the cont ext of the exercise of tasks in the Oversight Framew ork.

− (94) T o promot e converg ence at inte r national level as regar ds the use of best practices in the review and monitori ng of

− ICT third-par ty ser vice provid ers’ digital r isk -manage ment, the ESAs should be encourag ed to conclude cooperation

− ar range ments with relevant super visor y and regulatory third-countr y author ities.

− (95) T o leverage the specif ic compe tences, tec hnical skills and exper tise of staff specialising in operational and ICT r isk

− within the compet ent author ities, the three ESA s and, on a v oluntar y basis, the compe tent author ities under

− Directive (EU) 2022/2555, the Lead Overseer should draw on national super visor y capabilities and kno wledge and

− set up dedicated examination teams f or each cr itical ICT third-par ty ser vice provider , pooling multidisciplinar y

− teams in suppor t of the preparation and execution of oversight activities, including general inve stigations and

− inspections of cr itical ICT third-par ty ser vice provid ers, as well as f or any necessar y f ollow-up thereto.

− (96) Whereas costs resulting from oversight task s w ould be fully funded from fees levied on cr itical ICT third-par ty

− ser vice provid ers, the ESA s are. however , like ly to incur , bef ore the star t of the Oversight Framew ork, costs f or the

− imp lementation of dedicat ed ICT syste ms suppor ting the upcoming o versight, since dedicat ed ICT syste ms would

− need to be developed and deplo y ed bef orehand. This Regulation theref ore provi des f or a hy br id funding model,

− whereby the Oversight Framew ork w ould, as such, be fully f ee-funded, while the development of the ESAs’ ICT

− systems w ould be funded from U nion and national compet ent author ities’ contr ibutions.

− Offi cial Jour nal of the European Uni on L 333/20 27.12.2022

− (97) Com petent author ities should hav e all required super visor y , investig ative and sanctioning powers to ensure the

− proper exercise of their duties under this Regulation. They should, in pr inciple, publish notices of the administrative

− penalties they im pose. Since financial entities and ICT third-par ty ser vice providers can be established in different

− Member State s and super vised by differ ent compe tent author ities, the application of this Regulation should be

− fa cilitated by , on the one hand, close cooperation among relevant compe tent author ities, including the ECB with

− regard to specific tasks conferred on it by Council Regulation (EU) No 1024/2013, and, on the other hand, by

− consultation with the ESA s through the mutual exc hange of inf or mation and the provision of assistance in the

− conte xt of relevant super visor y activities.

− (98) In order to fur ther quantify and qualify the cr it er ia f or the designation of ICT third-par ty ser vice provid ers as cr itical

− and to har monise o versight fees, the po wer to adopt acts in accordance with Ar ticle 290 TFEU should be delegat ed

− to the Commission to supplement this Regulation by fur ther specifying the system ic impa ct that a failure or

− operational outage of an ICT third-par ty ser vice pro vider could hav e on the fi nancial entities it provides ICT ser vices

− to, the number of g lobal systemically impor tant institutions (G-SIIs), or other syste mically impor tant institutions

− (O-SIIs), that rely on the ICT third-par ty ser vice provid er in question, the number of ICT third-par ty ser vice

− provid ers active on a given mark et, the costs of migrating data and ICT w orkloads to other ICT third-par ty ser vice

− provid ers, as well as the amount of the o versight f ees and the wa y in which the y are to be paid. It is of par ticular

− imp or tance that the Commission car r y out appropr iat e consultations dur ing its preparatory work, including at

− exper t level, and that those consultations be conduct ed in accordance with the pr inciples laid down in the Interin sti

− tutional Agreement of 13 Apr il 2016 on Better La w-Making (

− 22

− ) . In par ticular , to ensure equal par ticipation in the

− preparation of delega ted acts, the European P arliament and the Council should receive all documents at the same

− time as Member State s ’ exper ts, and their exper ts should syste matically hav e access to meetings of Commission

− exper t groups dealing with the preparation of delega ted acts.

− (99) Regulat or y tec hnical standards should ensure the consistent har monisation of the requirements laid down in this

− Regulation. In their roles as bodies endowed with highly specialised exper tise, the ESAs should develop draf t

− regulatory tec hnical standards which do not inv olve policy choices, f or submission to the Commission. Regulat or y

− tec hnical standards should be developed in the areas of ICT r isk manag ement, maj or ICT -related incident repor ting,

− test ing, as well as in relation to ke y requirements f or a sound monitoring of ICT third-par ty r isk. The Commission

− and the ESA s should ensure that those standards and requirements can be applied by all financia l entities in a

− manner that is propor tionate to their size and overall r isk prof ile, and the nature, scale and complexity of their

− ser vices, activities and operations. The Commission should be empo wered to adop t those regulator y tec hnical

− standards by means of delega ted acts pursuant to Ar ticle 290 TFEU and in accordance with Ar ticles 10 to 14 of

− Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

− (100) T o f acilitate the compar ability of repor ts on maj or ICT -relat ed incidents and major operational or secur ity pa yment-

− relat ed incidents, as well as to ensure transparency regar ding contractual ar rangements f or the use of ICT ser vices

− provid ed by ICT third-par ty ser vice providers, the ESA s should develop draf t im plementing tec hnical standards

− establishing standardised te mplat es, f or ms and procedures f or f inancial entities to repor t a maj or ICT -relat ed

− incident and a maj or operational or secur ity pa yment-relate d incident, as well as standardised te mplat es f or the

− register of inf or mation. When developing those standards, the ESA s should take into account the size and the

− o verall r isk prof ile of the financia l entity , and the nature, scale and complexity of its ser vices, activities and

− operations. The Commission should be em powered to adopt those imple menting tec hnical standards by means of

− imp lementing acts pursuant to Ar ticle 291 TFEU and in accordance with Ar ticle 15 of Regulations (EU)

− No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

− (

− 22

− ) OJ L 123, 12.5.2016, p. 1.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/21

− (101) Since fur ther requirements hav e already been specifi ed through delegat ed and imple menting acts based on tec hnical

− regulatory and im plementing tec hnical standards in Regulations (EC) No 1060/2009 (

− 23

− ) , (EU) No 648/2012 (

− 24

− ) ,

− (EU) No 600/2014 (

− 25

− ) and (EU) No 909/2014 (

− 26

− ) of the European P arliament and of the Council, it is appropr iate

− to mandate the ESAs, either individually or jointly through the Joint Committee, to submit regulator y and

− imp lementing tec hnical standards to the Commission f or adop tion of delegat ed and implementing acts car r ying

− o ver and updating existing ICT r isk management r ules.

− (102) Since this Regulation, tog ether with Directive (EU) 2022/2556 of the European Parliament and of the Council (

− 27

− ) ,

− entails a consolidation of the ICT r isk manag ement provi sions across multiple regulations and directives of the

− U nion’s fi nancial ser vices acquis, including Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014

− and (EU) No 909/2014, and Regulation (EU) 2016/1011 of the European P arliament and of the Council (

− 28

− ) , in

− order to ensure full consiste ncy , those Regulations should be amended to clar ify that the applicable ICT r isk -relat ed

− provisions are laid down in this Regulation.

− (103) Consequently , the scope of the relevant ar ticles related to operational r isk, upon which empo wer ments laid down in

− Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014, and (EU) 2016/1011

− had mandated the adop tion of delegat ed and implementing acts, should be nar rowed down with a view to car r y

− o ver into this Regulation all provisions co ver ing the digital operational resilience aspects whic h toda y are par t of

− those Regulations.

− (104) The poten tial syste mic cyber r isk associate d with the use of ICT infrastr uctures that enable the operation of pa yment

− systems and the provis ion of pa yment processing activities should be duly addressed at Uni on level through

− har monised digital resilience r ules. T o that effect, the Commission should swif tly assess the need f or reviewing the

− scope of this Regulation while aligning such review with the outcome of the compreh ensive review en visaged under

− Directive (EU) 2015/2366. Numerous larg e-scale attacks over the past decade demonstrate how pa yment systems

− hav e become exposed to cyber threats. Placed at the core of the pa yment ser vices c hain and showing strong

− inter connections with the o verall financial system, pa yment systems and pa yment processing activities acquired a

− cr itical signif icance f or the functioning of the U nion financia l mark ets. Cyber -attacks on such systems can cause

− severe operational business disr uptions with direct repercussions on ke y economic functions, such as the f acilitation

− of pa yments, and indirect effe cts on relat ed economic processes. U ntil a har monised regime and the super vision of

− operat ors of pa yment systems and processing entities are put in place at U nion level, Member Stat es ma y , with a

− view to applying similar market practices, dra w inspiration from the digital operational resilience requirements laid

− down by this Regulation, when applying r ules to operators of pa yment syste ms and processing entities super vised

− under their own jur isdictions.

− (

− 23

− ) Regulation (EC) No 1060/2009 of the European P arliament and of the Council of 16 Sep tember 2009 on credit rating agen cies

− (OJ L 302, 17.11.2009, p. 1).

− (

− 24

− ) Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC der ivatives, central

− counterpar ties and trade repositor ies (OJ L 201, 27.7.2012, p. 1).

− (

− 25

− ) Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 Ma y 2014 on markets in f inancial instr uments

− and amending Regulation (EU) No 648/2012 (OJ L 173, 12.6.2014, p. 84).

− (

− 26

− ) Regulation (EU) No 909/2014 of the European P arliament and of the Council of 23 July 2014 on impr oving secur ities settlement in

− the European Union and on central secur ities deposit or ies and amending Directives 98/26/EC and 2014/65/EU and Regulation (EU)

− No 236/2012 (OJ L 257, 28.8.2014, p. 1).

− (

− 27

− ) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,

− 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital

− operational resilience f or the f inancial sector (see page 153 of this Official Jour nal).

− (

− 28

− ) Regulation (EU) 2016/1011 of the European P arliament and of the Council of 8 June 2016 on indices used as benchm ark s in financial

− instr uments and financial contracts or to measure the perfor mance of investment funds and amending Directives 2008/48/EC

− and 2014/17/EU and Regulation (EU) No 596/2014 (OJ L 171, 29.6.2016, p. 1).

− Offi cial Jour nal of the European Uni on L 333/22 27.12.2022

− (105) Since the objective of this Regulation, namely to achieve a high level of digital operational resilience f or regulated

− fi nancial entities, cannot be suffi ciently achieved by the Member Stat es because it requires har monisation of var ious

− differ ent r ules in Union and national la w , but can rather , by reason of its scale and eff ects, be better achieved at Union

− level, the Union ma y adopt measures in accordance with the pr inciple of subsidiar ity as set out in Ar ticle 5 of the

− T reaty on European U nion. In accordance with the pr inciple of propor tionality as set out in that Ar ticle, this

− Regulation does not go bey ond what is necessar y in order to achi eve that objective.

− (106) The European Data Prote ction Super visor was consulted in accordance with Ar ticle 42(1) of Regulation (EU)

− 2018/1725 of the European Parliament and of the Council (

− 29

− ) and delivered an opinion on 10 Ma y 2021 (

− 30

− ) ,

− HA VE ADOPTED THIS REGUL A TION:

− CHAPTE R I

− Gener al provisions

− Ar ticle 1

− 1. In order to achieve a high common level of digital operational resilience, this Regulation la ys down unif or m

− requirements concer ning the secur ity of netw ork and inf or mation system s suppor ting the business processes of financia l

− entities as f ollows:

− (a) requirements applicable to financia l entities in relation to:

− (i) inf or mation and communication tec hnology (ICT) r isk management;

− (ii) repor ting of maj or ICT -relate d incidents and notifying, on a v oluntar y basis, significant cyber threats to the

− compet ent author ities;

− (iii) repor ting of maj or operational or secur ity pa yment-related incidents to the compet ent author ities by financia l

− entities refer red to in Ar ticle 2(1), points (a) to (d);

− (iv) digital operational resilience testing;

− (v) inf or mation and intelli gence shar ing in relation to cyber threats and vulnerabilities;

− (vi) measures f or the sound management of ICT third-par ty r isk;

− (b) requirements in relation to the contractual ar range ments concluded between ICT third-par ty ser vice provi ders and

− fi nancial entities;

− (c) r ules f or the establishment and conduct of the Oversight Framew ork f or cr itical ICT third-par ty ser vice providers when

− providing ser vices to fi nancial entities;

− (d) r ules on cooperation among compet ent author ities, and r ules on super vision and enf orcement by compet ent

− author ities in relation to all matte rs co vered by this Regulation.

− 2. In relation to financial entities identif ied as essential or impor tant entities pursuant to national r ules transposing

− Ar ticle 3 of Directive (EU) 2022/2555, this Regulation shall be considered a sector -specifi c U nion leg al act f or the

− pur poses of Ar ticle 4 of that Directive.

− 3. This Regulation is without prejudice to the responsibility of Member State s ’ regar ding essential Stat e functions

− concer ning public secur ity , defence and national secur ity in accordance with U nion la w .

− (

− 29

− ) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons

− with regar d t o the processing of personal data by the Uni on institutions, bodies, offices and agencies and on the free mo vement of

− such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

− (

− 30

− ) OJ C 229, 15.6.2021, p. 16.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/23

− Ar ticle 2

− 1. Without prejudice to paragraphs 3 and 4, this Regulation applies to the f ollowi ng entities:

− (a) credit institutions;

− (b) pa yment institutions, including pa yment institutions exem pt ed pursuant to Directive (EU) 2015/2366;

− (c) account inf or mation ser vice provid ers;

− (d) electronic mone y institutions, including electronic money institutions exem pt ed pursuant to Directive 2009/110/EC;

− (e) inve stment fir ms;

− (f) cr ypt o-asset ser vice pro viders as author ised under a Regulation of the European Parliament and of the Council on

− markets in cr yp to-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives

− 2013/36/EU and (EU) 2019/1937 (‘the Regulation on markets in cr ypt o-assets’) and issuers of asset-refer enced tok ens;

− (g) central secur ities depositori es;

− (h) central count er par ties;

− (i) trading venues;

− (j) trade reposit or ies;

− (k) managers of alternati ve investment funds;

− (l) management companies;

− (m) data repor ting ser vice provid ers;

− (n) insurance and reinsurance under takings;

− (o) insurance interm ediar ies, reinsurance intermediar ies and ancillar y insurance interm ediar ies;

− (p) institutions f or occupational retirement provi sion;

− (q) credit rating ag encies;

− (r) administrators of cr itical benc hmark s;

− (s) crowdfunding ser vice provid ers;

− (t) secur itisation repositori es;

− (u) ICT third-par ty ser vice provi ders.

− 2. For the pur poses of this Regulation, entities refer red to in paragraph 1, points (a) to (t), shall collectively be refer red to

− as ‘f inancial entities’.

− 3. This Regulation does not apply to:

− (a) managers of alternati ve investment funds as refe r red to in Ar ticle 3(2) of Directive 2011/61/EU;

− (b) insurance and reinsurance under takings as refer red to in Ar ticle 4 of Directive 2009/138/EC;

− (c) institutions f or occupational retirement provision whic h operat e pension schemes whic h tog ether do not hav e more

− than 15 members in tota l;

− (d) natural or legal persons exem pt ed pursuant to Ar ticles 2 and 3 of Directive 2014/65/EU;

− (e) insurance inte r mediar ies, reinsurance interm ediar ies and ancillar y insurance inte r mediar ies whic h are microent er pr ises

− or small or medium-sized ent er pr ises;

− (f) post office giro institutions as refer red to in Ar ticle 2(5), point (3), of Directive 2013/36/EU.

− Offi cial Jour nal of the European Uni on L 333/24 27.12.2022

− 4. Member Stat es ma y excl ude from the scope of this Regulation entities refer red to in Ar ticle 2(5), points (4) to (23), of

− Directive 2013/36/EU that are locat ed within their respective te r r it or ies. Where a Member Stat e makes use of such op tion,

− it shall inf or m the Commission thereof as well as of an y subsequent c hanges theret o. The Commission shall make that

− inf or mation publicly av ailable on its website or other easily accessible means.

− Ar ticle 3

− Def initions

− For the pur poses of this Regulation, the f ollowi ng definitions shall apply:

− (1) ‘digital operational resilience’ means the ability of a fi nancial entity to build, assure and review its operational integrit y

− and reliability by ensur ing, either directly or indirectly through the use of ser vices provid ed by ICT third-par ty ser vice

− provid ers, the full range of ICT -relate d capabilities needed to address the secur ity of the network and inf or mation

− systems which a fi nancial entity uses, and which suppor t the continued provision of financial ser vices and their

− quality , including throughout disr upti ons;

− (2) ‘networ k and inf or mation system’ means a netw ork and inf or mation system as defined in Ar ticle 6, point 1, of

− Directive (EU) 2022/2555;

− (3) ‘legacy ICT system’ means an ICT system that has reached the end of its lifecy cle (end-of-life ), that is not suitable f or

− upgrades or fi x es, f or te chnological or commercial reasons, or is no long er suppor ted by its supplier or by an ICT

− third-par ty ser vice provi der , but that is still in use and suppor ts the functions of the financia l entity ;

− (4) ‘secur ity of netw ork and inf or mation systems’ means secur ity of network and inf or mation systems as defined in

− Ar ticle 6, point 2, of Directive (EU) 2022/2555;

− (5) ‘ICT r isk’ means any reasonably identif iable circumstance in relation to the use of netw ork and inf or mation systems

− which , if mat er ialised, ma y compromise the secur ity of the netw ork and inf or mation systems, of an y tec hnology

− dependent too l or process, of operations and processes, or of the provis ion of ser vices by producing adverse eff ects

− in the digital or phy sical envi ronment ;

− (6) ‘inf or mation asset’ means a collection of inf or mation, either tangible or intangible, that is w or th protecting;

− (7) ‘ICT asset’ means a sof tware or hardware asset in the netw ork and inf or mation systems used by the fi nancial entity ;

− (8) ‘ICT -related incident’ means a sing le event or a ser ies of linke d events unp lanned by the financia l entity that

− compromises the secur ity of the netw ork and inf or mation systems, and hav e an adverse imp act on the av ailability ,

− authenticity , integr ity or confidentiality of data, or on the ser vices provided by the financial entity ;

− (9) ‘operational or secur ity pa yment-relat ed incident’ means a sing le event or a ser ies of linked events unplanne d by the

− financia l entities refer red to in Ar ticle 2(1), points (a) to (d), whether ICT -relate d or not, that has an adverse impact

− on the availability , authenticity , integr ity or conf identiality of pa yment-relate d data, or on the pa yment-relat ed

− ser vices pro vided by the financia l entity ;

− (10) ‘ma jor ICT -relate d incident’ means an ICT -relate d incident that has a high adverse impact on the netw ork and

− inf or mation systems that suppor t cr itical or im por tant functions of the fi nancial entity ;

− (11) ‘ma jor operational or secur ity pa yment-related incident’ means an operational or secur ity pa yment-related incident

− that has a high adverse imp act on the pa yment-relat ed ser vices provid ed;

− (12) ‘cyber threat’ means ‘cyber threat’ as defined in Ar ticle 2, point (8), of Regulation (EU) 2019/881;

− (13) ‘signifi cant cyber threat’ means a cyber threat the tec hnical charact er istics of which indicate that it could hav e the

− poten tial to result in a maj or ICT -related incident or a maj or operational or secur ity pa yment-relate d incident ;

− (14) ‘cyber -attack’ means a malicious ICT -relat ed incident caused by means of an attem pt per petrated by an y threat actor to

− destro y , expose, alter , disable, steal or gain unauthor ised access to, or make unauthor ised use of, an asset ;

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/25

− (15) ‘threat intellig ence’ means inf or mation that has been aggregat ed, transf or med, analysed, interpr et ed or enr iched to

− provid e the necessar y context f or decision-making and to enable relevant and sufficient understanding in order to

− mitig ate the impact of an ICT -related incident or of a cyber threat, including the tec hnical details of a cyber -attack,

− those responsible f or the attac k and their modus operandi and motivations;

− (16) ‘vulnerability’ means a weakness, suscep tibility or f la w of an asset, syste m, process or control that can be exploit ed;

− (17) ‘threat-led penetration test ing (TLPT)’ means a framew ork that mimics the tactics, tec hniques and procedures of real-

− life threat actors perceived as posing a ge nuine cyber threat, that delivers a controlled, bespok e, inte lligence-led (red

− team ) test of the fi nancial entity’s cr itical live production systems;

− (18) ‘ICT third-par ty r isk’ means an ICT r isk that ma y ar ise f or a financial entity in relation to its use of ICT ser vices

− provid ed by ICT third-par ty ser vice provi ders or by subcontract ors of the latte r , including through outsourcing

− ar range ments;

− (19) ‘ICT third-par ty ser vice provid er ’ means an under taking providing ICT ser vices;

− (20) ‘ICT intra-group ser vice pro vider ’ means an under taking that is par t of a fi nancial group and that provid es

− predominantly ICT ser vices to f inancial entities within the same group or to fi nancial entities belonging to the same

− institutional protection scheme, including to their parent under takings, subsidiar ies, branches or other entities that

− are under common o wnership or control;

− (21) ‘ICT ser vices’ means digital and data ser vices provid ed through ICT syste ms to one or more internal or ext er nal users

− on an ongoing basis, including hardware as a ser vice and hardware ser vices which includes the provision of tec hnical

− suppor t via sof tware or fi r mwar e update s by the hardware provid er , excl uding traditional analogue telephone

− ser vices;

− (22) ‘cr itical or im por tant function’ means a function, the disr upti on of which w ould mate r ially im pair the fi nancial

− performa nce of a fi nancial entity , or the soundness or continuity of its ser vices and activities, or the discontinued,

− defect ive or f ailed performa nce of that function w ould mate r ially impa ir the continuing compl iance of a financial

− entity with the conditions and obligations of its author isation, or with its other oblig ations under applicable fi nancial

− ser vices la w ;

− (23) ‘cr itical ICT third-par ty ser vice provid er ’ means an ICT third-par ty ser vice provider designate d as cr itical in

− accordance with Ar ticle 31;

− (24) ‘ICT third-par ty ser vice provider established in a third countr y’ means an ICT third-par ty ser vice provi der that is a

− leg al person established in a third-countr y and that has ent ered into a contractual ar rang ement with a fi nancial entity

− f or the provision of ICT ser vices;

− (25) ‘subsidiar y’ means a subsidiar y under taking within the meaning of Ar ticle 2, point (10), and Ar ticle 22 of Directive

− 2013/34/EU;

− (26) ‘group’ means a group as def ined in Ar ticle 2, point (11), of Directive 2013/34/EU;

− (27) ‘parent under taking’ means a parent under taking within the meaning of Ar ticle 2, point (9), and Ar ticle 22 of

− Directive 2013/34/EU;

− (28) ‘ICT subcontractor established in a third countr y’ means an ICT subcontractor that is a leg al person established in a

− third-countr y and that has entered int o a contractual ar rangement either with an ICT third-par ty ser vice provider , or

− with an ICT third-par ty ser vice provid er established in a third countr y ;

− (29) ‘ICT concentration r isk’ means an exposure to individual or multiple related cr itical ICT third-par ty ser vice providers

− creating a degree of dependency on such providers so that the una vailability , fa ilure or other type of shor tfall of such

− provid er ma y potentially endange r the ability of a fi nancial entity to deliver cr itical or impor tant functions, or cause it

− to suffer other types of adverse effe cts, including larg e losses, or endange r the fi nancial stability of the U nion as a

− whole;

− Offi cial Jour nal of the European Uni on L 333/26 27.12.2022

− (30) ‘manageme nt body’ means a management body as defined in Ar ticle 4(1), point (36), of Directive 2014/65/EU,

− Ar ticle 3(1), point (7), of Directive 2013/36/EU, Ar ticle 2(1), point (s), of Directive 2009/65/EC of the European

− P arliament and of the Council (

− 31

− ) , Ar ticle 2(1), point (45), of Regulation (EU) No 909/2014, Ar ticle 3(1), point (20),

− of Regulation (EU) 2016/1011, and in the relevant provision of the Regulation on mark ets in cr yp to-assets, or the

− equivalent persons who effectively r un the entity or have ke y functions in accordance with relevant U nion or

− national la w ;

− (31) ‘credit institution’ means a credit institution as defined in Ar ticle 4(1), point (1), of Regulation (EU) No 575/2013 of

− the European Parliament and of the Council (

− 32

− ) ;

− (32) ‘institution exem pt ed pursuant to Directive 2013/36/EU’ means an entity as ref er red to in Ar ticle 2(5), points (4) to

− (23), of Directive 2013/36/EU;

− (33) ‘inves tment fir m’ means an investment fir m as def ined in Ar ticle 4(1), point (1), of Directive 2014/65/EU;

− (34) ‘small and non-inter connected inv estment fi r m’ means an inv estment fir m that meets the conditions laid out in

− Ar ticle 12(1) of Regulation (EU) 2019/2033 of the European P arliament and of the Council (

− 33

− ) ;

− (35) ‘pa yment institution’ means a pa yment institution as defined in Ar ticle 4, point (4), of Directive (EU) 2015/2366;

− (36) ‘pa yment institution exem pt ed pursuant to Directive (EU) 2015/2366’ means a pa yment institution exem pt ed

− pursuant to Ar ticle 32(1) of Directive (EU) 2015/2366;

− (37) ‘account inf or mation ser vice provi der ’ means an account inf or mation ser vice provid er as refer red to in Ar ticle 33(1)

− of Directive (EU) 2015/2366;

− (38) ‘electronic mone y institution’ means an electronic mone y institution as defined in Ar ticle 2, point (1), of Directive

− 2009/110/EC of the European P arliament and of the Council;

− (39) ‘electronic mone y institution exem pt ed pursuant to Directive 2009/110/EC’ means an electronic mone y institution

− benefitting from a waiver as refer red to in Ar ticle 9(1) of Directive 2009/110/EC;

− (40) ‘central counter par ty’ means a central counter par ty as defined in Ar ticle 2, point (1), of Regulation (EU)

− No 648/2012;

− (41) ‘trade reposit or y’ means a trade repository as defined in Ar ticle 2, point (2), of Regulation (EU) No 648/2012;

− (42) ‘central secur ities depository’ means a central secur ities depository as defined in Ar ticle 2(1), point (1), of Regulation

− (EU) No 909/2014;

− (43) ‘trading venue’ means a trading venue as def ined in Ar ticle 4(1), point (24), of Directive 2014/65/EU;

− (44) ‘manager of altern ative inve stment funds’ means a manager of alternati ve inv estment funds as defined in Ar ticle 4(1),

− point (b), of Directive 2011/61/EU;

− (45) ‘manageme nt compan y’ means a management compan y as defined in Ar ticle 2(1), point (b), of Directive 2009/65/EC;

− (46) ‘data repor ting ser vice provider ’ means a data repor ting ser vice provid er within the meaning of Regulation (EU)

− No 600/2014, as refe r red to in Ar ticle 2(1), points (34) to (36) thereof;

− (47) ‘insurance under taking’ means an insurance under taking as defined in Ar ticle 13, point (1), of Directive 2009/138/EC;

− (48) ‘reinsurance under taking’ means a reinsurance under taking as defined in Ar ticle 13, point (4), of Directive

− 2009/138/EC;

− (

− 31

− ) Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and

− administrative provisions relating to under takings f or collective in vestment in transferable secur ities (UCITS) (OJ L 302, 17.11.2009,

− p. 32).

− (

− 32

− ) Regulation (EU) No 575/2013 of the European P arliament and of the Council of 26 June 2013 on pr udential requirements f or credit

− institutions and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1).

− (

− 33

− ) Regulation (EU) 2019/2033 of the European Parliament and of the Council of 27 November 2019 on the pr udential requirements of

− investment fir ms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No 806/2014

− (OJ L 314, 5.12.2019, p. 1).

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/27

− (49) ‘insurance interm ediar y’ means an insurance interm ediar y as defined in Ar ticle 2(1), point (3), of Directive (EU)

− 2016/97 of the European P arliament and of the Council (

− 34

− ) ;

− (50) ‘ancillar y insurance interm ediar y’ means an ancillar y insurance intermediar y as defined in Ar ticle 2(1), point (4), of

− Directive (EU) 2016/97;

− (51) ‘reinsurance interm ediar y’ means a reinsurance intermediar y as defined in Ar ticle 2(1), point (5), of Directive (EU)

− 2016/97;

− (52) ‘institution f or occupational retirement provi sion’ means an institution f or occupational retirement provision as

− defined in Ar ticle 6, point (1), of Directive (EU) 2016/2341;

− (53) ‘small institution f or occupational retirement provision’ means an institution f or occupational retirement provision

− which operat es pension schem es whic h tog ether hav e less than 100 members in total;

− (54) ‘credit rating ag ency’ means a credit rating agency as def ined in Ar ticle 3(1), point (b), of Regulation (EC)

− No 1060/2009;

− (55) ‘cr yp to- asset ser vice provider ’ means a cr yp to-asset ser vice pro vider as defined in the relevant provision of the

− Regulation on mark ets in cr yp to-assets;

− (56) ‘issuer of asset-refer enced tok ens’ means an issuer of asset-refer enced tok ens as defined in the relevant provision of the

− Regulation on mark ets in cr yp to-assets;

− (57) ‘administrat or of cr itical benc hmark s’ means an administrator of ‘cr itical benchmarks ’ as def ined in Ar ticle 3(1), point

− (25), of Regulation (EU) 2016/1011;

− (58) ‘cro wdfunding ser vice provider ’ means a crowdfunding ser vice provider as def ined in Ar ticle 2(1), point (e), of

− Regulation (EU) 2020/1503 of the European P arliament and of the Council (

− 35

− ) ;

− (59) ‘secur itisation repository ’ means a secur itisation reposit or y as defined in Ar ticle 2, point (23), of Regulation (EU)

− 2017/2402 of the European P arliament and of the Council (

− 36

− ) ;

− (60) ‘microente r pr ise’ means a financia l entity , other than a trading venue, a central count er par ty , a trade repository or a

− central secur ities depository , which emplo ys f ewer than 10 persons and has an annual tur nover and/or annual

− balance sheet total that does not exceed EUR 2 million;

− (61) ‘Lead Overseer ’ means the European Super visor y A uthor ity appoint ed in accordance with Ar ticle 31(1), point (b) of

− this Regulation;

− (62) ‘Joint Committ ee ’ means the committee refer red to in Ar ticle 54 of Regulations (EU) No 1093/2010, (EU)

− No 1094/2010 and (EU) No 1095/2010;

− (63) ‘small ent er pr ise’ means a fi nancial entity that emplo ys 10 or more persons, but fewer than 50 persons, and has an

− annual tur nover and/or annual balance sheet total that exceed s EUR 2 million, but does not exceed EUR 10 million;

− (64) ‘medium-sized enter pr ise’ means a fi nancial entity that is not a small ent er pr ise and em plo ys fe wer than 250 persons

− and has an annual tur nover that does not excee d EUR 50 million and/or an annual balance sheet that does not excee d

− EUR 43 million;

− (65) ‘public author ity’ means any government or other public administration entity , including national central banks .

− (

− 34

− ) Directive (EU) 2016/97 of the European Pa rliament and of the Council of 20 Januar y 2016 on insurance distr ibution (OJ L 26,

− 2.2.2016, p. 19).

− (

− 35

− ) Regulation (EU) 2020/1503 of the European Parliament and of the Council of 7 October 2020 on European crowd funding ser vice

− providers f or business, and amending Regulation (EU) 2017/1129 and Directive (EU) 2019/1937 (OJ L 347, 20.10.2020, p. 1).

− (

− 36

− ) Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 la ying down a general framework

− f or secur itisation and creating a specific framewo rk f or simple, transparent and standardised secur itisation, and amending Directives

− 2009/65/EC, 2009/138/EC and 2011/61/EU and Regulations (EC) No 1060/2009 and (EU) No 648/2012 (OJ L 347, 28.12.2017,

− p. 35).

− Offi cial Jour nal of the European Uni on L 333/28 27.12.2022

− Ar ticle 4

− Propor tionality pr inciple

− 1. Financial entities shall im plement the r ules laid down in Chapt er II in accordance with the pr inciple of

− propor tionality , taking into account their size and overall r isk prof ile, and the nature, scale and compl exity of their

− ser vices, activities and operations.

− 2. In addition, the application by fi nancial entities of Chapt ers III, IV and V , Section I, shall be propor tionate to their size

− and o verall r isk profile, and to the nature, scale and compl exity of their ser vices, activities and operations, as specifically

− provid ed f or in the relevant r ules of those Chapt ers.

− 3. The compet ent author ities shall consider the application of the propor tionality pr inciple by financial entities when

− reviewing the consiste ncy of the ICT r isk management framew ork on the basis of the repor ts submitted upon the request

− of compet ent author ities pursuant to Ar ticle 6(5) and Ar ticle 16(2).

− ICT r isk manag ement

− Ar ticle 5

− Go v er nance and organisation

− 1. Financial entities shall hav e in place an internal govern ance and control framewor k that ensures an effe ctive and

− pr udent management of ICT r isk, in accordance with Ar ticle 6(4), in order to achi eve a high level of digital operational

− resilience.

− 2. The management body of the fi nancial entity shall define, approve, oversee and be responsible f or the

− imp lementation of all ar rang ements related to the ICT r isk manage ment framew ork ref er red to in Ar ticle 6(1).

− For the pur poses of the fi rst subparagraph, the manag ement body shall:

− (a) bear the ultimat e responsibility f or managing the financial entity’s ICT r isk;

− (b) put in place policies that aim to ensure the maint enance of high standards of av ailability , authenticity , integrity and

− conf identiality , of data;

− (c) set clear roles and responsibilities f or all ICT -relat ed functions and establish appropr iat e governance ar rangements to

− ensure effe ctive and timely communication, cooperation and coordination among those functions;

− (d) bear the o verall responsibility f or setting and approvi ng the digital operational resilience strateg y as refer red to in

− Ar ticle 6(8), including the det er mination of the appropr iat e r isk tol erance level of ICT r isk of the fi nancial entity , as

− refer red to in Ar ticle 6(8), point (b);

− (e) approve, oversee and per iodically review the imp lementation of the financia l entity’s ICT business continuity policy

− and ICT response and recovery plans, refer red to, respectively , in Ar ticle 11(1) and (3), which ma y be adopt ed as a

− dedicated specifi c policy f or ming an integral par t of the financia l entity’s o verall business continuity policy and

− response and reco ver y plan;

− (f) approve and per iodically review the fi nancial entity’s ICT inte r nal audit plans, ICT audits and mater ial modifi cations to

− them;

− (g) allocate and per iodically review the appropr iat e budget to fulfil the financia l entity’s digital operational resilience needs

− in respect of all types of resources, including relevant ICT secur ity awar eness programmes and digital operational

− resilience training refer red to in Ar ticle 13(6), and ICT skills f or all staff;

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/29

− (h) approve and per iodically review the f inancial entity’s policy on ar rang ements regarding the use of ICT ser vices provided

− by ICT third-par ty ser vice provid ers;

− (i) put in place, at cor porate level, repor ting c hannels enabling it to be duly inf or med of the f ollo wing:

− (i) ar range ments concluded with ICT third-par ty ser vice providers on the use of ICT ser vices,

− (ii) any relevant planned mate r ial c hanges regar ding the ICT third-par ty ser vice pro viders,

− (iii) the pote ntial impact of such c hange s on the cr itical or impor tant functions subject to those ar rangements,

− including a r isk analysis summar y to assess the im pact of those chang es, and at least maj or ICT -relat ed incidents

− and their impact, as well as response, recovery and cor rective measures.

− 3. Financial entities, other than microenter pr ises, shall establish a role in order to monit or the ar range ments concluded

− with ICT third-par ty ser vice provid ers on the use of ICT ser vices, or shall designat e a member of senior manag ement as

− responsible f or overseeing the relat ed r isk exposure and relevant documentation.

− 4. Members of the manage ment body of the fi nancial entity shall actively keep up to date with suff icient knowledg e and

− skills to understand and assess ICT r isk and its impa ct on the operations of the fi nancial entity , including by f ollowi ng

− specifi c training on a regular basis, commensurat e to the ICT r isk being managed.

− Ar ticle 6

− ICT r isk management framew ork

− 1. Financial entities shall hav e a sound, compreh ensive and well-documente d ICT r isk management framew ork as par t

− of their o verall r isk manage ment system, which enables them to address ICT r isk quic kly , effi ciently and compr ehensively

− and to ensure a high level of digital operational resilience.

− 2. The ICT r isk management framework shall include at least strategies, policies, procedures, ICT protocols and too ls

− that are necessar y to duly and adequat ely prot ect all inf or mation assets and ICT assets, including comput er sof tware,

− hardware, ser vers, as well as to prote ct all relevant phy sical compo nents and infrastr uctures, such as premises, data centres

− and sensitive designated areas, to ensure that all inf or mation assets and ICT assets are adequately prot ected from r isks

− including damage and unauthor ised access or usage.

− 3. In accordance with their ICT r isk management framew ork, fi nancial entities shall minimise the im pact of ICT r isk by

− deplo ying appropr iat e strate gies, policies, procedures, ICT protocols and too ls. They shall provid e complet e and update d

− inf or mation on ICT r isk and on their ICT r isk management framewor k to the compet ent author ities upon their request.

− 4. Financial entities, other than microenter pr ises, shall assign the responsibility f or managing and o verseeing ICT r isk to

− a control function and ensure an appropr iat e level of independence of such control function in order to av oid conf licts of

− inter est. Financial entities shall ensure appropr iat e segregati on and independence of ICT r isk manage ment functions,

− control functions, and internal audit functions, according to the three lines of defence model, or an intern al r isk

− manage ment and control model.

− 5. The ICT r isk manage ment framew ork shall be documente d and reviewed at least once a y ear , or per iodically in the

− case of microent er pr ises, as well as upon the occur rence of maj or ICT -relat ed incidents, and f ollowi ng super visor y

− instr uctions or conclusions der ived from relevant digital operational resilience testin g or audit processes. It shall be

− continuously im proved on the basis of lessons der ived from implemen tation and monitoring. A repor t on the review of

− the ICT r isk manag ement framework shall be submitt ed to the compet ent author ity upon its request.

− Offi cial Jour nal of the European Uni on L 333/30 27.12.2022

− 6. The ICT r isk management framew ork of financial entities, other than microenter pr ises, shall be subject to inte r nal

− audit by auditors on a regular basis in line with the financia l entities’ audit plan. Those auditors shall possess suff icient

− knowledg e, skills and exper tise in ICT r isk, as well as appropr iat e independence. The frequency and f ocus of ICT audits

− shall be commensurat e to the ICT r isk of the financial entity .

− 7. Based on the conclusions from the internal audit review , financial entities shall establish a f or mal f ollow-up process,

− including r ules f or the timely ver ification and remediation of cr itical ICT audit findings.

− 8. The ICT r isk manage ment framework shall include a digital operational resilience strateg y setting out how the

− framewor k shall be im plemented. T o that end, the digital operational resilience strategy shall include methods to address

− ICT r isk and attain specifi c ICT objectives, by:

− (a) explaining how the ICT r isk management framewor k suppor ts the financial entity’s business strategy and objectives;

− (b) establishing the r isk tol erance level f or ICT r isk, in accordance with the r isk appetite of the financia l entity , and

− analysing the im pact tol erance f or ICT disr upti ons;

− (c) setting out clear inf or mation secur ity objectives, including ke y performance indicators and ke y r isk metr ics;

− (d) explaining the ICT ref erence archit ecture and an y c hanges needed to reach specif ic business objectives;

− (e) outlining the different mech anisms put in place to det ect ICT -relat ed incidents, prevent their im pact and provide

− protection from it ;

− (f) evidencing the cur rent digital operational resilience situation on the basis of the number of maj or ICT -relat ed incidents

− repor ted and the effe ctiveness of preventive measures;

− (g) implementing digital operational resilience te sting, in accordance with Chapt er IV of this Regulation;

− (h) outlining a communication strateg y in the event of ICT -relat ed incidents the disclosure of which is required in

− accordance with Ar ticle 14.

− 9. Financial entities ma y , in the conte xt of the digital operational resilience strateg y ref er red to in paragraph 8, define a

− holistic ICT multi-vendor strategy , at group or entity level, showi ng ke y dependencies on ICT third-par ty ser vice providers

− and explaining the rationale behind the procurement mix of ICT third-par ty ser vice provid ers.

− 10. Financial entities ma y , in accordance with U nion and national sectora l law , outsource the task s of ver ifying

− compl iance with ICT r isk manage ment requirements to intra-group or external under takings. In case of such outsourcing,

− the fi nancial entity remains fully responsible f or the ver if ication of compl iance with the ICT r isk manag ement requirements.

− Ar ticle 7

− In order to address and manage ICT r isk, financia l entities shall use and maintain update d ICT systems, prot ocols and too ls

− that are:

− (a) appropr iat e to the magnitude of operations suppor ting the conduct of their activities, in accordance with the

− propor tionality pr inciple as refer red to in Ar ticle 4;

− (c) equipped with suffi cient capacity to accurately process the data necessar y f or the performance of activities and the

− timely provis ion of ser vices, and to deal with peak orders, message or transaction v olumes, as needed, including where

− new tec hnology is introduced;

− (d) tec hnologically resilient in order to adequately deal with additional inf or mation processing needs as required under

− stressed mark et conditions or other adverse situations.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/31

− Ar ticle 8

− Identif ication

− 1. As par t of the ICT r isk manag ement framewor k ref er red to in Ar ticle 6(1), fi nancial entities shall identify , classify and

− adequately document all ICT suppor ted business functions, roles and responsibilities, the inf or mation assets and ICT assets

− suppor ting those functions, and their roles and dependencies in relation to ICT r isk. Financial entities shall review as

− needed, and at least yearly , the adequacy of this classif ication and of any relevant documentation.

− 2. Financial entities shall, on a continuous basis, identify all sources of ICT r isk, in par ticular the r isk exposure to and

− from other fi nancial entities, and assess cyber threats and ICT vulnerabilities relevant to their ICT suppor ted business

− functions, inf or mation assets and ICT assets. Financial entities shall review on a regular basis, and at least ye arly , the r isk

− scenar ios impa cting them.

− 3. Financial entities, other than microent er pr ises, shall perform a r isk assessment upon each maj or c hange in the

− netw ork and inf or mation system infrastr ucture, in the processes or procedures affecting their ICT suppor ted business

− functions, inf or mation assets or ICT assets.

− 4. Financial entities shall identify all inf or mation assets and ICT assets, including those on remote sites, netw ork

− resources and hardware equipment, and shall map those considered cr itical. They shall map the conf iguration of the

− inf or mation assets and ICT assets and the link s and inte rdependencies between the differ ent inf or mation assets and ICT

− assets.

− 5. Financial entities shall identify and document all processes that are dependent on ICT third-par ty ser vice pro viders,

− and shall identify inte rconnections with ICT third-par ty ser vice provi ders that pro vide ser vices that suppor t cr itical or

− imp or tant functions.

− 6. For the pur poses of paragraphs 1, 4 and 5, financia l entities shall maintain relevant inv entor ies and update them

− per iodically and ever y time an y major c hange as refe r red to in paragraph 3 occurs.

− 7. Financial entities, other than microent er pr ises, shall on a regular basis, and at least y early , conduct a specific ICT r isk

− assessment on all leg acy ICT systems and, in an y case bef ore and af ter connecting te chnologies, applications or systems.

− Ar ticle 9

− Protection and prev ention

− 1. For the pur poses of adequately protecting ICT systems and with a view to organising response measures, financia l

− entities shall continuously monitor and control the secur ity and functioning of ICT system s and tools and shall minimise

− the im pact of ICT r isk on ICT systems through the deplo yment of appropr iate ICT secur ity too ls, policies and procedures.

− 2. Financial entities shall design, procure and im plement ICT secur ity policies, procedures, prot ocols and tools that aim

− to ensure the resilience, continuity and av ailability of ICT syste ms, in par ticular f or those suppor ting cr itical or impor tant

− functions, and to maintain high standards of av ailability , authenticity , integr ity and confidentiality of data, whether at rest,

− in use or in transit.

− 3. In order to achi eve the objectives refer red to in paragraph 2, fi nancial entities shall use ICT solutions and processes

− that are appropr iate in accordance with Ar ticle 4. Those ICT solutions and processes shall:

− (a) ensure the secur ity of the means of transfer of data;

− (b) minimise the r isk of cor r uption or loss of data, unauthor ised access and tec hnical f la ws that ma y hinder business

− activity ;

− (c) prevent the lac k of av ailability , the im pair ment of the authenticity and inte gr ity , the breaches of conf identiality and the

− loss of data;

− Offi cial Jour nal of the European Uni on L 333/32 27.12.2022

− (d) ensure that data is prot ected from r isks ar ising from data manag ement, including poor administration, processing-

− related r isks and human er ror .

− 4. As par t of the ICT r isk management framewor k refe r red to in Ar ticle 6(1), financia l entities shall:

− (a) develop and document an inf or mation secur ity policy def ining r ules to protect the av ailability , authenticity , integrity

− and conf identiality of data, inf or mation assets and ICT assets, including those of their customers, where applicable;

− (b) f ollowi ng a r isk -based approach , establish a sound network and infrastr ucture management str ucture using appropr iat e

− tec hniques, methods and protocols that ma y include im plementing automat ed mec hanisms to isolat e aff ected

− inf or mation assets in the event of cyber -attac k s;

− (c) implement policies that limit the phy sical or logical access to inf or mation assets and ICT assets to what is required f or

− legitimate and approved functions and activities only , and establish to that end a set of policies, procedures and

− controls that address access r ights and ensure a sound administration thereof;

− (d) implement policies and protocols f or strong authentication mech anisms, based on relevant standards and dedicat ed

− control system s, and protection measures of cr ypt ographic ke ys whereby data is encr ypt ed based on results of

− approved data classif ication and ICT r isk assessment processes;

− (e) implement documented policies, procedures and controls f or ICT chang e manage ment, including c hanges to sof tware,

− hardware, fi r mwar e compo nents, systems or secur ity paramete rs, that are based on a r isk assessment approach and are

− an integral par t of the financial entity’s o verall chang e manag ement process, in order to ensure that all chang es to ICT

− systems are recorded, tes ted, assessed, approved , im plemented and ver ifie d in a controlled manner ;

− (f) have appropr iate and compre hensive documented policies f or patches and updat es.

− For the pur poses of the first subparagraph, point (b), financial entities shall design the network connection infrastr ucture in

− a wa y that allo ws it to be instantaneously severed or segmented in order to minimise and prevent contagion, especially f or

− inter connected fi nancial processes.

− For the pur poses of the first subparagraph, point (e), the ICT chang e manag ement process shall be approved by appropr iat e

− lines of management and shall hav e specific protocols in place.

− Ar ticle 10

− 1. Financial entities shall hav e in place mechanisms to promp tly det ect anomalous activities, in accordance with

− Ar ticle 17, including ICT netw ork performance issues and ICT -relat ed incidents, and to identify pote ntial mater ial sing le

− points of failure.

− All detection mechanis ms ref er red to in the fi rst subparagraph shall be regularly test ed in accordance with Ar ticle 25.

− 2. The det ection mec hanisms refer red to in paragraph 1 shall enable multiple la y ers of control, def ine aler t thresholds

− and cr iter ia to tr igge r and initiat e ICT -relate d incident response processes, including automa tic aler t mechani sms f or

− relevant staff in charg e of ICT -relat ed incident response.

− 3. Financial entities shall devot e suffic ient resources and capabilities to monitor user activity , the occur rence of ICT

− anomalies and ICT -related incidents, in par ticular cyber -attacks.

− 4. Data repor ting ser vice provid ers shall, in addition, hav e in place systems that can effectively c heck trade repor ts f or

− compl eteness, identify omissions and obvious er rors, and request re-transmission of those repor ts.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/33

− Ar ticle 11

− Response and reco v er y

− 1. As par t of the ICT r isk manag ement framew ork refer red to in Ar ticle 6(1) and based on the identification

− requirements set out in Ar ticle 8, financial entities shall put in place a compr ehensive ICT business continuity policy ,

− which ma y be adop ted as a dedicat ed specifi c policy , f or ming an inte gral par t of the o verall business continuity policy of

− the financia l entity .

− 2. Financial entities shall im plement the ICT business continuity policy through dedicat ed, appropr iate and documente d

− ar range ments, plans, procedures and mechanisms aiming to:

− (a) ensure the continuity of the financia l entity’s cr itical or im por tant functions;

− (b) quickly , appropr iat ely and effe ctively respond to, and resolve, all ICT -relate d incidents in a wa y that limits damage and

− pr ior itises the resum ption of activities and recovery actions;

− (c) activate, without dela y , dedicat ed plans that enable containment measures, processes and te chnologies suited to each

− type of ICT -relat ed incident and prevent fur ther damage , as well as tailored response and reco ver y procedures

− established in accordance with Ar ticle 12;

− (d) estimate preliminar y im pacts, damages and losses;

− (e) set out communication and cr isis manage ment actions that ensure that updat ed inf or mation is transmitted to all

− relevant intern al staff and extern al stak eholders in accordance with Ar ticle 14, and repor t to the compet ent author ities

− in accordance with Ar ticle 19.

− 3. As par t of the ICT r isk management framewor k refer red to in Ar ticle 6(1), financia l entities shall implement

− associated ICT response and recovery plans whic h, in the case of financial entities other than microenterpr ises, shall be

− subject to independent internal audit reviews.

− 4. Financial entities shall put in place, maintain and per iodically test appropr iate ICT business continuity plans, notably

− with regar d to cr itical or imp or tant functions outsourced or contracted through ar rang ements with ICT third-par ty ser vice

− provid ers.

− 5. As par t of the o verall business continuity policy , fi nancial entities shall conduct a business impact analysis (BIA) of

− their exposures to severe business disr upti ons. U nder the BIA, financial entities shall assess the poten tial impact of severe

− business disr uptions by means of quantitative and qualitative cr ite r ia, using internal and external data and scenar io

− analysis, as appropr iat e. The BIA shall consider the cr iticality of identif ied and mapped business functions, suppor t

− processes, third-par ty dependencies and inf or mation assets, and their inter dependencies. Financial entities shall ensure that

− ICT assets and ICT ser vices are designed and used in full alignment with the BIA, in par ticular with regar d to adequat ely

− ensur ing the redundancy of all cr itical compo nents.

− 6. As par t of their compre hensive ICT r isk manage ment, fi nancial entities shall:

− (a) test the ICT business continuity plans and the ICT response and recovery plans in relation to ICT syste ms suppor ting all

− functions at least y early , as well as in the event of an y substantive c hange s to ICT syste ms suppor ting cr itical or

− impor tant functions;

− (b) test the cr isis communication plans established in accordance with Ar ticle 14.

− For the pur poses of the first subparagraph, point (a), financial entities, other than microent er pr ises, shall include in the

− test ing plans scenar ios of cyber -attac k s and switch overs between the pr imar y ICT infrastr ucture and the redundant

− capacity , backups and redundant f acilities necessar y to meet the oblig ations set out in Ar ticle 12.

− Financial entities shall regularly review their ICT business continuity policy and ICT response and recovery plans, taking

− into account the results of test s car r ied out in accordance with the first subparagraph and recommendations stem ming

− from audit c hecks or super visor y reviews.

− Offi cial Jour nal of the European Uni on L 333/34 27.12.2022

− 7. Financial entities, other than microent er pr ises, shall ha ve a cr isis management function, which , in the event of

− activation of their ICT business continuity plans or ICT response and reco ver y plans, shall, inter alia, set out clear

− procedures to manag e internal and extern al cr isis communications in accordance with Ar ticle 14.

− 8. Financial entities shall keep readily accessible records of activities bef ore and dur ing disr uption events when their ICT

− business continuity plans and ICT response and recovery plans are activat ed.

− 9. Central secur ities deposit or ies shall provid e the compet ent author ities with copies of the results of the ICT business

− continuity tes ts, or of similar exercises.

− 10. Financial entities, other than microent er pr ises, shall repor t to the compet ent author ities, upon their request, an

− estimation of aggregat ed annual costs and losses caused by major ICT -relat ed incidents.

− 11. In accordance with Ar ticle 16 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, the

− ESA s, through the Joint Committ ee, shall by 17 July 2024 develop common guidelines on the estimation of aggregat ed

− annual costs and losses refer red to in paragraph 10.

− Ar ticle 12

− Backup policies and procedures, res t oration and reco v er y procedures and methods

− 1. For the pur pose of ensur ing the rest oration of ICT system s and data with minimum downt ime, limited disr upti on and

− loss, as par t of their ICT r isk management framewor k , fi nancial entities shall develop and document:

− (a) backup policies and procedures specifying the scope of the data that is subject to the backup and the minimum

− frequency of the backup, based on the cr iticality of inf or mation or the conf identiality level of the data;

− 2. Financial entities shall set up backup system s that can be activat ed in accordance with the backup policies and

− procedures, as well as rest oration and recovery procedures and methods. The activation of backup systems shall not

− jeopardise the secur ity of the network and inf or mation systems or the av ailability , authenticity , integrit y or confidentiality

− of data. T esting of the backup procedures and rest oration and recovery procedures and methods shall be under take n

− per iodically .

− 3. When restor ing backup data using o wn syste ms, financia l entities shall use ICT systems that are physically and

− logically segregat ed from the source ICT system. The ICT systems shall be securely protect ed from an y unauthor ised access

− or ICT cor r upti on and allow f or the timely rest oration of ser vices making use of data and system backups as necessar y .

− For central counter par ties, the reco ver y plans shall enable the recovery of all transactions at the time of disr uption to allow

− the central counter par ty to continue to operat e with cer tainty and to compl ete settlement on the scheduled dat e.

− Data repor ting ser vice pro viders shall additionally maintain adequate resources and have back -up and rest oration fa cilities

− in place in order to offer and maintain their ser vices at all times.

− 4. Financial entities, other than microent er pr ises, shall maintain redundant ICT capacities equipped with resources,

− capabilities and functions that are adequate to ensure business needs. Microenter pr ises shall assess the need to maintain

− such redundant ICT capacities based on their r isk profile.

− 5. Central secur ities deposit or ies shall maintain at least one secondar y processing sit e endowed with adequat e resources,

− capabilities, functions and staffing ar rang ements to ensure business needs.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/35

− The secondar y processing site shall be:

− (a) located at a ge ographical distance from the pr imar y processing sit e to ensure that it bears a distinct r isk prof ile and to

− prevent it from being aff ected by the event which has affect ed the pr imar y sit e;

− (b) capable of ensur ing the continuity of cr itical or impor tant functions identically to the pr imar y site, or provi ding the

− level of ser vices necessar y to ensure that the financia l entity performs its cr itical operations within the reco ver y

− objectives;

− (c) immediately accessible to the financial entity’s staff to ensure continuity of cr itical or im por tant functions in the event

− that the pr imar y processing sit e has become una vailable.

− 6. In deter mining the recovery time and reco ver y point objectives f or each function, financia l entities shall take into

− account whether it is a cr itical or impor tant function and the potential o verall imp act on mark et efficiency . Such time

− objectives shall ensure that, in extreme scenar ios, the agreed ser vice levels are met.

− 7. When recoveri ng from an ICT -relat ed incident, fi nancial entities shall perf or m necessar y c hecks, including an y

− multiple c hecks and reconciliations, in order to ensure that the highest level of data integr ity is maintained. These c hecks

− shall also be per f or med when reconstr ucting data from ext er nal stakeho lders, in order to ensure that all data is consiste nt

− between systems .

− Ar ticle 13

− Lear ning and ev olving

− 1. Financial entities shall hav e in place capabilities and staff to gather inf or mation on vulnerabilities and cyber threats,

− ICT -relat ed incidents, in par ticular cyber -attacks, and analyse the im pact they are likely to hav e on their digital operational

− resilience.

− 2. Financial entities shall put in place post ICT -relate d incident reviews af ter a maj or ICT -related incident disr upts their

− core activities, analysing the causes of disr upti on and identifying required im provements to the ICT operations or within

− the ICT business continuity policy refe r red to in Ar ticle 11.

− Financial entities, other than microent er pr ises, shall, upon request, communicat e to the compet ent author ities, the chang es

− that were im plemented f ollowi ng post ICT -relat ed incident reviews as refe r red to in the f irst subparagraph.

− The post ICT -related incident reviews refer red to in the first subparagraph shall determi ne whether the established

− procedures were f ollowed and the actions taken were eff ective, including in relation to the f ollowing:

− (a) the promp tness in responding to secur ity aler ts and det er mining the im pact of ICT -relat ed incidents and their sever ity ;

− (b) the quality and speed of performi ng a f orensic analysis, where deemed appropr iat e;

− (c) the effectiveness of incident escalation within the fi nancial entity ;

− (d) the effectiveness of intern al and exte r nal communication.

− 3. Lessons der ived from the digital operational resilience test ing car r ied out in accordance with Ar ticles 26 and 27 and

− from real life ICT -related incidents, in par ticular cyber -attacks, along with c hallenge s f aced upon the activation of ICT

− business continuity plans and ICT response and recovery plans, tog ether with relevant inf or mation exc hanged with

− counte r par ts and assessed dur ing super visor y reviews, shall be duly incor porat ed on a continuous basis into the ICT r isk

− assessment process. Those fi ndings shall f or m the basis f or appropr iat e reviews of relevant components of the ICT r isk

− manage ment framew ork ref er red to in Ar ticle 6(1).

− Offi cial Jour nal of the European Uni on L 333/36 27.12.2022

− 4. Financial entities shall monitor the eff ectiveness of the implementation of their digital operational resilience strateg y

− set out in Ar ticle 6(8). They shall map the evolution of ICT r isk o ver time, analyse the frequency , types, magnitude and

− ev olution of ICT -related incidents, in par ticular cyber -attacks and their patter ns, with a view to understanding the level of

− ICT r isk exposure, in par ticular in relation to cr itical or impor tant functions, and enhance the cyber matur ity and

− preparedness of the fi nancial entity .

− 5. Senior ICT staff shall repor t at least ye arly to the manag ement body on the findings ref er red to in paragraph 3 and put

− f or ward recommendations.

− 6. Financial entities shall develop ICT secur ity awar eness programmes and digital operational resilience training as

− compul sor y modules in their staff training sche mes. Those programmes and training shall be applicable to all emplo y ees

− and to senior manage ment staff, and shall hav e a level of compl exity commensurat e to the remit of their functions. Where

− appropr iat e, financia l entities shall also include ICT third-par ty ser vice providers in their relevant training schemes in

− accordance with Ar ticle 30(2), point (i).

− 7. Financial entities, other than microent er pr ises, shall monitor relevant tec hnological developments on a continuous

− basis, also with a view to understanding the possible impact of the deplo yment of such new tec hnologies on ICT secur ity

− requirements and digital operational resilience. They shall keep up-to -date with the latest ICT r isk manage ment processes,

− in order to eff ectively combat cur rent or new f or ms of cyber -attacks.

− Ar ticle 14

− 1. As par t of the ICT r isk manage ment framework ref er red to in Ar ticle 6(1), financial entities shall have in place cr isis

− communication plans enabling a responsible disclosure of, at least, major ICT -related incidents or vulnerabilities to clients

− and count er par ts as well as to the public, as appropr iate.

− 2. As par t of the ICT r isk management framew ork , financia l entities shall implement communication policies f or

− internal staff and f or external stak eholders. Communication policies f or staff shall take into account the need to

− differ entiate between staff inv olved in ICT r isk manag ement, in par ticular the staff responsible f or response and recovery ,

− and staff that needs to be inf or med.

− 3. At least one person in the financia l entity shall be taske d with im plementing the communication strateg y f or ICT -

− relat ed incidents and fulfil the public and media function f or that pur pose.

− Ar ticle 15

− F ur ther har monisation of ICT r isk management tools, methods, processes and policies

− The ESA s shall, through the Joint Committ ee, in consultation with the European Uni on Agen cy on Cybersecur ity (ENIS A),

− develop common draf t regulatory tec hnical standards in order to:

− (a) specify fur ther elements to be included in the ICT secur ity policies, procedures, prot ocols and too ls refer red to in

− Ar ticle 9(2), with a view to ensur ing the secur ity of networks, enable adequate safeg uards ag ainst intr usions and data

− misuse, preser ve the availability , authenticity , integrit y and conf identiality of data, including cr yp tographic tec hniques,

− and guarant ee an accurate and promp t data transmission without maj or disr upti ons and undue dela ys;

− (b) develop fur ther compo nents of the controls of access manag ement r ights refer red to in Ar ticle 9(4), point (c), and

− associated human resource policy specifying access r ights, procedures f or granting and revoking r ights, monitori ng

− anomalous beha viour in relation to ICT r isk through appropr iate indicators , including f or netw ork use patter ns, hours,

− IT activity and unknown devices;

− (c) develop fur ther the mech anisms specified in Ar ticle 10(1) enabling a promp t det ection of anomalous activities and the

− cr it er ia set out in Ar ticle 10(2) tr igger ing ICT -relat ed incident det ection and response processes;

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/37

− (d) specify fur ther the compo nents of the ICT business continuity policy refer red to in Ar ticle 11(1);

− (e) specify fur ther the tes ting of ICT business continuity plans refer red to in Ar ticle 11(6) to ensure that such testing duly

− takes into account scenar ios in which the quality of the provision of a cr itical or imp or tant function deter iorate s to an

− unacceptable level or f ails, and duly considers the potential impa ct of the insolvency , or other failures, of any relevant

− ICT third-par ty ser vice provid er and, where relevant, the political r isks in the respective provi ders ’ jur isdictions;

− (f) specify fur ther the compo nents of the ICT response and recovery plans refer red to in Ar ticle 11(3);

− (g) specifying fur ther the cont ent and f or mat of the repor t on the review of the ICT r isk manage ment framew ork refer red

− to in Ar ticle 6(5);

− When developing those draf t regulator y tec hnical standards, the ESA s shall tak e into account the size and the o verall r isk

− prof ile of the fi nancial entity , and the nature, scale and compl exity of its ser vices, activities and operations, while duly

− taking into consideration an y specific f eature ar ising from the distinct nature of activities across differ ent financia l ser vices

− sector s.

− The ESAs shall submit those draf t regulator y te chnical standards to the Commission by 17 Januar y 2024 .

− P o wer is delegat ed to the Commission to supplement this Regulation by adop ting the regulatory tec hnical standards

− refer red to in the fi rst paragraph in accordance with Ar ticles 10 to 14 of Regulations (EU) No 1093/2010, (EU)

− No 1094/2010 and (EU) No 1095/2010.

− Ar ticle 16

− Simplif ied ICT r isk management framew ork

− 1. Ar ticles 5 to 15 of this Regulation shall not apply to small and non-interconne cted inve stment fi r ms, pa yment

− institutions exe mp te d pursuant to Directive (EU) 2015/2366; institutions exem pt ed pursuant to Directive 2013/36/EU in

− respect of whic h Member Stat es ha ve decided not to apply the op tion refe r red to in Ar ticle 2(4) of this Regulation;

− electronic mone y institutions exem pt ed pursuant to Directive 2009/110/EC; and small institutions f or occupational

− retirement provision.

− Without prejudice to the fi rst subparagraph, the entities listed in the first subparagraph shall:

− (a) put in place and maintain a sound and documented ICT r isk management framew ork that details the mecha nisms and

− measures aimed at a quic k , effi cient and comprehensive manage ment of ICT r isk, including f or the prot ection of

− relevant phy sical compo nents and infrastr uctures;

− (b) continuously monitor the secur ity and functioning of all ICT systems;

− (c) minimise the im pact of ICT r isk through the use of sound, resilient and updat ed ICT systems, protocols and too ls whic h

− are appropr iate to suppor t the performa nce of their activities and the pro vision of ser vices and adequately protect

− availabi lity , authenticity , integrit y and conf identiality of data in the netw ork and inf or mation system s;

− (d) allow sources of ICT r isk and anomalies in the netw ork and inf or mation system s to be promp tly identified and detect ed

− and ICT -relat ed incidents to be swif tly handled;

− (e) identify ke y dependencies on ICT third-par ty ser vice provid ers;

− (f) ensure the continuity of cr itical or impor tant functions, through business continuity plans and response and recovery

− measures, which include, at least, back -up and rest oration measures;

− (g) test, on a regular basis, the plans and measures refe r red to in point (f), as well as the eff ectiveness of the controls

− implement ed in accordance with points (a) and (c);

− Offi cial Jour nal of the European Uni on L 333/38 27.12.2022

− (h) implement, as appropr iate, relevant operational conclusions resulting from the te sts refe r red to in point (g) and from

− post-incident analysis into the ICT r isk assessment process and develop, according to needs and ICT r isk profile, ICT

− secur ity awareness programmes and digital operational resilience training f or staff and management .

− 2. The ICT r isk managemen t framework refer red to in paragraph 1, second subparagraph, point (a), shall be documente d

− and reviewed per iodically and upon the occur rence of maj or ICT -related incidents in compl iance with super visor y

− instr uctions. It shall be continuously imp roved on the basis of lessons der ived from im plementation and monitoring. A

− repor t on the review of the ICT r isk manag ement framew ork shall be submitted to the compet ent author ity upon its

− request.

− 3. The ESAs shall, through the Joint Committ ee, in consultation with the ENISA, develop common draf t regulatory

− tec hnical standards in order to:

− (a) specify fur ther the elements to be included in the ICT r isk manage ment framewor k refer red to in paragraph 1, second

− subparagraph, point (a);

− (b) specify fur ther the elements in relation to systems , protocols and tools to minimise the impact of ICT r isk refe r red to in

− paragraph 1, second subparagraph, point (c), with a view to ensur ing the secur ity of networks, enabling adequate

− safeguards again st intr usions and data misuse and preser ving the availability , authenticity , integrit y and confidentiality

− of data;

− (c) specify fur ther the compo nents of the ICT business continuity plans refer red to in paragraph 1, second subparagraph,

− point (f);

− (d) specify fur ther the r ules on the testing of business continuity plans and ensure the effectiveness of the controls refer red

− to in paragraph 1, second subparagraph, point (g) and ensure that such testing duly takes into account scenar ios in

− which the quality of the provision of a cr itical or im por tant function det er iorates to an unacceptable level or f ails;

− (e) specify fur ther the content and f or mat of the repor t on the review of the ICT r isk manage ment framework refe r red to in

− paragraph 2.

− When developing those draf t regulator y tec hnical standards, the ESA s shall tak e into account the size and the o verall r isk

− prof ile of the fi nancial entity , and the nature, scale and complexity of its ser vices, activities and operations.

− The ESAs shall submit those draf t regulator y te chnical standards to the Commission by 17 Januar y 2024 .

− P o wer is delegat ed to the Commission to supplement this Regulation by adop ting the regulatory tec hnical standards

− refer red to in the first subparagraph in accordance with Ar ticles 10 to 14 of Regulations (EU) No 1093/2010, (EU)

− No 1094/2010 and (EU) No 1095/2010.

− ICT -r elated incident manag ement, classification and r epor ting

− Ar ticle 17

− ICT -related incident management process

− 1. Financial entities shall define, establish and im plement an ICT -related incident management process to det ect, manag e

− and notify ICT -related incidents.

− 2. Financial entities shall record all ICT -relat ed incidents and signif icant cyber threats. Financial entities shall establish

− appropr iat e procedures and processes to ensure a consist ent and integrat ed monitor ing, handling and f ollow-up of ICT -

− relat ed incidents, to ensure that root causes are identified, documente d and addressed in order to prevent the occur rence of

− such incidents.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/39

− 3. The ICT -related incident manag ement process refer red to in paragraph 1 shall:

− (a) put in place early war ning indicators ;

− (b) establish procedures to identify , track, log, categor ise and classify ICT -relat ed incidents according to their pr ior ity and

− sever ity and according to the cr iticality of the ser vices impact ed, in accordance with the cr it er ia set out in Ar ticle 18(1);

− (c) assign roles and responsibilities that need to be activated f or diffe rent ICT -relat ed incident types and scenar ios;

− (d) set out plans f or communication to staff, external stak eholders and media in accordance with Ar ticle 14 and f or

− notifi cation to clients, f or intern al escalation procedures, including ICT -relat ed customer compl aints, as well as f or the

− provision of inf or mation to fi nancial entities that act as counter par ts, as appropr iat e;

− (e) ensure that at least maj or ICT -relate d incidents are repor te d to relevant senior manag ement and inf or m the

− management body of at least maj or ICT -relate d incidents, explaining the impact, response and additional controls to

− be established as a result of such ICT -related incidents;

− (f) establish ICT -related incident response procedures to mitig ate im pacts and ensure that ser vices become operational and

− secure in a timely manner .

− Ar ticle 18

− Classif ication of ICT -related incidents and cyber threats

− 1. Financial entities shall classify ICT -related incidents and shall deter mine their impact based on the f ollo wing cr it er ia:

− (a) the number and/or relevance of clients or financia l count er par ts aff ected and, where applicable, the amount or number

− of transactions affe cted by the ICT -relat ed incident, and whether the ICT -relat ed incident has caused reputational

− impact;

− (b) the duration of the ICT -related incident, including the ser vice down time;

− (c) the ge ographical spread with rega rd to the areas aff ected by the ICT -related incident, par ticularly if it affe cts more than

− two Member States;

− (d) the data losses that the ICT -relate d incident entails, in relation to availabi lity , authenticity , integr ity or conf identiality of

− data;

− (e) the cr iticality of the ser vices affect ed, including the fi nancial entity’s transactions and operations;

− (f) the economic impact, in par ticular direct and indirect costs and losses, of the ICT -related incident in both absolute and

− relative term s.

− 2. Financial entities shall classify cyber threats as signif icant based on the cr iticality of the ser vices at r isk, including the

− fi nancial entity’s transactions and operations, number and/or relevance of clients or fi nancial count er par ts target ed and the

− ge ographical spread of the areas at r isk.

− 3. The ESA s shall, through the Joint Committee and in consultation with the ECB and ENISA, develop common draf t

− regulatory tec hnical standards fur ther specifying the f ollowi ng:

− (a) the cr it er ia set out in paragraph 1, including mater iality thresholds f or det er mining maj or ICT -relate d incidents or , as

− applicable, maj or operational or secur ity pa yment-related incidents, that are subject to the repor ting oblig ation laid

− down in Ar ticle 19(1);

− (b) the cr it er ia to be applied by compet ent author ities f or the pur pose of assessing the relevance of maj or ICT -relate d

− incidents or , as applicable, maj or operational or secur ity pa yment-related incidents, to relevant compet ent author ities

− in other Member States’, and the details of repor ts of maj or ICT -relat ed incidents or , as applicable, maj or operational

− or secur ity pa yment-related incidents, to be shared with other compet ent author ities pursuant to Ar ticle 19(6) and (7);

− (c) the cr iter ia set out in paragraph 2 of this Ar ticle, including high mater iality thresholds f or det er mining significant cyber

− threats.

− Offi cial Jour nal of the European Uni on L 333/40 27.12.2022

− 4. When developing the common draf t regulatory te chnical standards refe r red to in paragraph 3 of this Ar ticle, the

− ESA s shall tak e into account the cr it er ia set out in Ar ticle 4(2), as well as internati onal standards, guidance and

− specifi cations developed and published by ENIS A, including, where appropr iat e, specif ications f or other economic sector s.

− For the pur poses of applying the cr it er ia set out in Ar ticle 4(2), the ESAs shall duly consider the need f or microent er pr ises

− and small and medium-sized ent er pr ises to mobilise suff icient resources and capabilities to ensure that ICT -related incidents

− are manage d swif tly .

− The ESAs shall submit those common draf t regulator y te chnical standards to the Commission by 17 Januar y 2024 .

− P o wer is delegat ed to the Commission to supplement this Regulation by adop ting the regulatory tec hnical standards

− refer red to in paragraph 3 in accordance with Ar ticles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010

− and (EU) No 1095/2010.

− Ar ticle 19

− Repor ting of major ICT -related incidents and v oluntar y notif ication of signif icant cyber threats

− 1. Financial entities shall repor t major ICT -relate d incidents to the relevant compet ent author ity as refer red to in

− Ar ticle 46 in accordance with paragraph 4 of this Ar ticle.

− Where a fi nancial entity is subject to super vision by more than one national compe tent author ity refer red to in Ar ticle 46,

− Member State s shall designat e a sing le compet ent author ity as the relevant compet ent author ity responsible f or car r ying out

− the functions and duties provid ed f or in this Ar ticle.

− Credit institutions classif ied as signif icant, in accordance with Ar ticle 6(4) of Regulation (EU) No 1024/2013, shall repor t

− maj or ICT -relate d incidents to the relevant national compet ent author ity designated in accordance with Ar ticle 4 of

− Directive 2013/36/EU, which shall immediately transmit that repor t to the ECB.

− For the pur pose of the first subparagraph, financia l entities shall produce, af ter collecting and analysing all relevant

− inf or mation, the initial notific ation and repor ts refer red to in paragraph 4 of this Ar ticle using the te mplat es refer red to in

− Ar ticle 20 and submit them to the compe tent author ity . In the event that a tec hnical im possibility prevents the submission

− of the initial notific ation using the tem plate, fi nancial entities shall notify the compet ent author ity about it via alternative

− means.

− The initial notifi cation and repor ts refe r red to in paragraph 4 shall include all inf or mation necessar y f or the compet ent

− author ity to det er mine the signif icance of the maj or ICT -related incident and assess possible cross-border im pacts.

− Without prejudice to the repor ting pursuant to the fi rst subparagraph by the financial entity to the relevant compet ent

− author ity , Member State s ma y additionally det er mine that some or all financial entities shall also pro vide the initial

− notificati on and each repor t refer red to in paragraph 4 of this Ar ticle using the tem plate s refe r red to in Ar ticle 20 to the

− compet ent author ities or the comput er secur ity incident response teams (CSIRT s) designat ed or established in accordance

− with Directive (EU) 2022/2555.

− 2. Financial entities ma y , on a voluntary basis, notify signif icant cyber threats to the relevant compet ent author ity when

− they deem the threat to be of relevance to the financia l syste m, ser vice users or clients. The relevant compet ent author ity

− ma y provid e such inf or mation to other relevant author ities refe r red to in paragraph 6.

− Credit institutions classified as signif icant, in accordance with Ar ticle 6(4) of Regulation (EU) No 1024/2013, ma y , on a

− volun tar y basis, notify signif icant cyber threats to relevant national compet ent author ity , designate d in accordance with

− Ar ticle 4 of Directive 2013/36/EU, which shall immediately transmit the notification to the ECB.

− Member State s ma y det er mine that those fi nancial entities that on a v oluntar y basis notify in accordance with the fi rst

− subparagraph ma y also transmit that notificati on to the CSIRT s designated or established in accordance with Directive (EU)

− 2022/2555.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/41

− 3. Where a maj or ICT -relat ed incident occurs and has an im pact on the financial interests of clients, fi nancial entities

− shall, without undue dela y as soon as they become aware of it, inf or m their clients about the maj or ICT -related incident

− and about the measures that hav e been taken to mitigat e the adverse effects of such incident.

− In the case of a significant cyber threat, fi nancial entities shall, where applicable, inf or m their clients that are potentially

− affe cted of an y appropr iat e prot ection measures whic h the latte r ma y consider taking.

− 4. Financial entities shall, within the time limits to be laid down in accordance with Ar ticle 20, fi rst paragraph, point (a),

− point (ii), submit the f ollowing to the relevant compet ent author ity:

− (b) an interm ediate repor t af ter the initial notificati on refe r red to in point (a), as soon as the status of the or iginal incident

− has c hanged signif icantly or the handling of the maj or ICT -relat ed incident has chang ed based on new inf or mation

− available, f ollowed, as appropr iate, by updated notifi cations ever y time a relevant status updat e is ava ilable, as well as

− upon a specifi c request of the compet ent author ity ;

− (c) a final repor t, when the root cause analysis has been compl eted, regar dless of whether mitig ation measures ha ve

− already been im plemented , and when the actual impact fi gures are av ailable to replace estimate s.

− 5. Financial entities ma y outsource, in accordance with U nion and national sectoral la w , the repor ting oblig ations under

− this Ar ticle to a third-par ty ser vice provid er . In case of such outsourcing, the fi nancial entity remains fully responsible f or

− the fulfilme nt of the incident repor ting requirements.

− 6. Upon receip t of the initial notificati on and of each repor t refer red to in paragraph 4, the compe tent author ity shall, in

− a timely manner , provide details of the major ICT -relat ed incident to the f ollowing recipients based, as applicable, on their

− respective compet ences:

− (a) EBA, ESMA or EIOP A;

− (b) the ECB, in the case of fi nancial entities refer red to in Ar ticle 2(1), points (a), (b) and (d);

− (c) the compe tent author ities, sing le points of contact or CSIRT s designated or established in accordance with Directive

− (EU) 2022/2555;

− (d) the resolution author ities, as refer red to in Ar ticle 3 of Directive 2014/59/EU, and the Sing le Resolution Board (SRB)

− with respect to entities refer red to in Ar ticle 7(2) of Regulation (EU) No 806/2014 of the European P arliament and of

− the Council (

− 37

− ) , and with respect to entities and groups refer red to in Ar ticle 7(4)(b) and (5) of Regulation (EU)

− No 806/2014 if such details concer n incidents that pose a r isk to ensur ing cr itical functions within the meaning of

− Ar ticle 2(1), point (35), of Directive 2014/59/EU; and

− (e) other relevant public author ities under national law .

− 7. Following receipt of inf or mation in accordance with paragraph 6, EBA, ESMA or EIOP A and the ECB, in consultation

− with ENISA and in cooperation with the relevant compet ent author ity , shall assess whether the maj or ICT -relate d incident is

− relevant f or compe tent author ities in other Member States. Following that assessment, EBA , ESMA or EIOP A shall, as soon

− as possible, notify relevant compet ent author ities in other Member Stat es according ly . The ECB shall notify the members of

− the European System of Central Bank s on issues relevant to the pa yment system. Based on that notification, the compet ent

− author ities shall, where appropr iate, take all of the necessar y measures to prote ct the immediate stability of the fi nancial

− system.

− (

− 37

− ) Regulation (EU) No 806/2014 of the European P arliament and of the Council of 15 July 2014 establishing unif or m r ules and a

− unif or m procedure f or the resolution of credit institutions and cer tain investment fir ms in the framework of a Sing le Resolution

− Mechanism and a Sing le Resolution Fund and amending Regulation (EU) No 1093/2010 (OJ L 225, 30.7.2014, p. 1).

− Offi cial Jour nal of the European Uni on L 333/42 27.12.2022

− 8. The notifi cation to be done by ESMA pursuant to paragraph 7 of this Ar ticle shall be without prejudice to the

− responsibility of the compe tent author ity to urg ently transmit the details of the maj or ICT -related incident to the relevant

− author ity in the host Member Stat e, where a central secur ities deposit or y has signif icant cross-border activity in the host

− Member State , the maj or ICT -related incident is lik ely to ha ve severe consequences f or the fi nancial markets of the host

− Member Stat e and where there are cooperation ar rang ements among compet ent author ities relat ed to the super vision of

− fi nancial entities.

− Ar ticle 20

− Har monisation of repor ting content and templates

− (a) common draf t regulatory tec hnical standards in order to:

− (i) establish the content of the repor ts f or major ICT -relat ed incidents in order to ref lect the cr it er ia laid down in

− Ar ticle 18(1) and incor porate fur ther elements, such as details f or establishing the relevance of the repor ting f or

− other Member States and whether it constitutes a maj or operational or secur ity pa yment-relate d incident or not ;

− (ii) deter mine the time limits f or the initial notificati on and f or each repor t ref er red to in Ar ticle 19(4);

− (iii) establish the content of the notifi cation f or signif icant cyber threats.

− When developing those draf t regulator y tec hnical standards, the ESAs shall take into account the size and the overall

− r isk profile of the financial entity , and the nature, scale and complexity of its ser vices, activities and operations, and in

− par ticular , with a view to ensur ing that, f or the pur poses of this paragraph, point (a), point (ii), diffe rent time limits

− ma y ref lect, as appropr iat e, specifi cities of fi nancial sect ors, without prejudice to maintaining a consistent approac h to

− ICT -related incident repor ting pursuant to this Regulation and to Directive (EU) 2022/2555. The ESA s shall, as

− applicable, provid e justification when deviating from the approaches take n in the conte xt of that Directive;

− (b) common draf t im plementing tec hnical standards in order to establish the standard f or ms, tem plate s and procedures f or

− fi nancial entities to repor t a maj or ICT -related incident and to notify a significant cyber threat.

− The ESA s shall submit the common draf t regulatory tec hnical standards refe r red to in the first paragraph, point (a), and the

− common draf t implementing te chnical standards ref er red to in the first paragraph, point (b), to the Commission by 17 July

− 2024 .

− P o wer is delegat ed to the Commission to supplement this Regulation by adopt ing the common regulator y te chnical

− standards refer red to in the first paragraph, point (a), in accordance with Ar ticles 10 to 14 of Regulations (EU)

− No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

− P o wer is conferr ed on the Commission to adopt the common im plementing te chnical standards refer red to in the fi rst

− paragraph, point (b), in accordance with Ar ticle 15 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU)

− No 1095/2010.

− Ar ticle 21

− Centralisation of repor ting of major ICT -related incidents

− 1. The ESAs, through the Joint Committ ee, and in consultation with the ECB and ENIS A, shall prepare a joint repor t

− assessing the feasibility of fur ther centralisation of incident repor ting through the establishment of a sing le EU Hub f or

− maj or ICT -related incident repor ting by financia l entities. The joint repor t shall explore wa ys to f acilitate the f lo w of ICT -

− relat ed incident repor ting, reduce associated costs and under pin thematic analyses with a view to enhancing super visor y

− converg ence.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/43

− 2. The joint repor t refer red to in paragraph 1 shall comprise at least the f ollowi ng elements:

− (a) prerequisites f or the establishment of a sing le EU Hub;

− (b) benefi ts, limitations and r isks , including r isks associate d with the high concentration of sensitive inf or mation;

− (c) the necessar y capability to ensure inter operability with regard to other relevant repor ting schemes;

− (d) elements of operational manag ement ;

− (e) conditions of membership;

− (f) tec hnical ar range ments f or fi nancial entities and national compet ent author ities to access the sing le EU Hub;

− (g) a preliminar y assessment of fi nancial costs incur red by setting-up the operational platf or m suppor ting the sing le EU

− Hub, including the requisit e exper tise.

− 3. The ESA s shall submit the repor t refe r red to in paragraph 1 to the European Parliament, to the Council and to the

− Commission by 17 Januar y 2025 .

− Ar ticle 22

− Super visor y f eedback

− 1. Without prejudice to the tec hnical input, advice or remedies and subsequent f ollow-up which ma y be provid ed,

− where applicable, in accordance with national la w , by the CSIRT s under Directive (EU) 2022/2555, the compet ent

− author ity shall, upon receipt of the initial notific ation and of each repor t as ref er red to in Ar ticle 19(4), ackno wledge

− receipt and ma y , where feasible , provi de in a timely manner relevant and propor tionate fe edback or high-level guidance to

− the financia l entity , in par ticular by making available an y relevant anony mised inf or mation and inte lligence on similar

− threats, and ma y discuss remedies applied at the level of the financia l entity and wa ys to minimise and mitig ate adverse

− imp act across the financia l sector . Without prejudice to the super visor y feedbac k received, fi nancial entities shall remain

− fully responsible f or the handling and f or consequences of the ICT -related incidents repor ted pursuant to Ar ticle 19(1).

− 2. The ESAs shall, through the Joint Committee, on an anony mised and aggregat ed basis, repor t ye arly on maj or ICT -

− relat ed incidents, the details of which shall be provided by compet ent author ities in accordance with Ar ticle 19(6), setting

− out at least the number of ma jor ICT -related incidents, their nature and their im pact on the operations of financial entities

− or clients, remedial actions taken and costs incur red.

− The ESAs shall issue war nings and produce high-level statistics to suppor t ICT threat and vulnerability assessments.

− Ar ticle 23

− Operational or secur ity pay ment-related incidents concer ning credit insti tutions, payment inst itutions, account

− inf or mation ser vice pro viders, and electronic money institutions

− The requirements laid down in this Chapt er shall also apply to operational or secur ity pa yment-related incidents and to

− maj or operational or secur ity pa yment-related incidents, where they concer n credit institutions, pa yment institutions,

− account inf or mation ser vice provid ers, and electronic money institutions.

− Offi cial Jour nal of the European Uni on L 333/44 27.12.2022

− CH APTER IV

− Digital oper ational r esilience testing

− Ar ticle 24

− General requirements f or the perfor mance of digital operational resilience testin g

− 1. For the pur pose of assessing preparedness f or handling ICT -related incidents, of identifying weaknesses, deficien cies

− and gaps in digital operational resilience, and of promp tly im plementing cor rective measures, financial entities, other than

− microent er pr ises, shall, taking into account the cr it er ia set out in Ar ticle 4(2), establish, maintain and review a sound and

− compreh ensive digital operational resilience testing programme as an integral par t of the ICT r isk -management framew ork

− refer red to in Ar ticle 6.

− 2. The digital operational resilience testing programme shall include a rang e of assessments, tests , methodologies,

− practices and too ls to be applied in accordance with Ar ticles 25 and 26.

− 3. When conducting the digital operational resilience test ing programme refe r red to in paragraph 1 of this Ar ticle,

− fi nancial entities, other than microent er pr ises, shall f ollow a r isk -based approach taking into account the cr it er ia set out in

− Ar ticle 4(2) duly consider ing the ev olving landscape of ICT r isk, an y specific r isks to which the fi nancial entity concer ned is

− or might be exposed, the cr iticality of inf or mation assets and of ser vices provided, as well as an y other fact or the fi nancial

− entity deems appropr iate.

− 4. Financial entities, other than microent er pr ises, shall ensure that tests are under taken by independent par ties, whether

− internal or external. Where tests are under tak en by an internal tes ter , financia l entities shall dedicat e suffi cient resources and

− ensure that conf licts of interest are av oided throughout the design and execution phases of the test .

− 5. Financial entities, other than microent er pr ises, shall establish procedures and policies to pr ior itise, classify and

− remedy all issues revealed throughout the perf or mance of the tes ts and shall establish intern al validation methodologies to

− ascer tain that all identified weaknesses, deficien cies or g aps are fully addressed.

− 6. Financial entities, other than microent er pr ises, shall ensure, at least yearly , that appropr iate test s are conducted on all

− ICT systems and applications suppor ting cr itical or impor tant functions.

− Ar ticle 25

− T est ing of ICT t ools and systems

− 1. The digital operational resilience test ing programme refer red to in Ar ticle 24 shall provid e, in accordance with the

− cr iter ia set out in Ar ticle 4(2), f or the exe cution of appropr iat e tes ts, such as vulnerability assessments and scans, open

− source analyses, netw ork secur ity assessments, gap analyses, physical secur ity reviews, questionnaires and scanning

− sof tware solutions, source code reviews where fe asible, scenar io-based tests , compati bility tes ting, performa nce testing,

− end-to- end tes ting and penetration tes ting.

− 2. Central secur ities deposit or ies and central counter par ties shall perform vulnerability assessments bef ore an y

− deplo yment or redeplo yment of new or existing applications and infrastr ucture compo nents, and ICT ser vices suppor ting

− cr itical or im por tant functions of the fi nancial entity .

− 3. Microent er pr ises shall perform the tes ts refer red to in paragraph 1 by combining a r isk -based approach with a

− strateg ic planning of ICT test ing, by duly consider ing the need to maintain a balanced approach between the scale of

− resources and the time to be allocat ed to the ICT testing provid ed f or in this Ar ticle, on the one hand, and the urg ency ,

− type of r isk, cr iticality of inf or mation assets and of ser vices provid ed, as well as an y other relevant fa ctor , including the

− fi nancial entity’s ability to tak e calculat ed r isks , on the other hand.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/45

− Ar ticle 26

− Ad vanced testin g of ICT tools, sys tems and processes based on TLPT

− 1. Financial entities, other than entities refe r red to in Ar ticle 16(1), fi rst subparagraph, and other than microent er pr ises,

− which are identif ied in accordance with paragraph 8, third subparagraph, of this Ar ticle, shall car r y out at least ever y 3

− ye ars advanced te sting by means of TLPT . Based on the r isk prof ile of the fi nancial entity and taking into account

− operational circumstances, the compet ent author ity ma y , where necessar y , request the fi nancial entity to reduce or

− increase this frequency .

− 2. Each threat-led penetration test shall cover several or all cr itical or im por tant functions of a financia l entity , and shall

− be performe d on live production systems suppor ting such functions.

− Financial entities shall identify all relevant underlying ICT systems, processes and te chnologies suppor ting cr itical or

− imp or tant functions and ICT ser vices, including those suppor ting the cr itical or im por tant functions which hav e been

− outsourced or contracted to ICT third-par ty ser vice providers.

− Financial entities shall assess whic h cr itical or impor tant functions need to be co vered by the TLPT . The result of this

− assessment shall det er mine the precise scope of TLPT and shall be validat ed by the compe tent author ities.

− 3. Where ICT third-par ty ser vice provi ders are included in the scope of TLPT , the fi nancial entity shall take the necessar y

− measures and safeg uards to ensure the par ticipation of such ICT third-par ty ser vice provi ders in the TLPT and shall retain at

− all times full responsibility f or ensur ing compliance with this Regulation.

− 4. Without prejudice to paragraph 2, fi rst and second subparagraphs, where the par ticipation of an ICT third-par ty

− ser vice provider in the TLPT , refer red to in paragraph 3, is reasonably expecte d to hav e an adverse im pact on the quality or

− secur ity of ser vices delivered by the ICT third-par ty ser vice provider to customers that are entities f alling outside the scope

− of this Regulation, or on the conf identiality of the data related to such ser vices, the financia l entity and the ICT third-par ty

− ser vice provi der ma y agree in wr iting that the ICT third-par ty ser vice provid er directly ent ers into contractual ar range ments

− with an extern al test er , f or the pur pose of conducting, under the direction of one designated financia l entity , a pooled TLPT

− inv olving several fi nancial entities (pooled testing) to which the ICT third-par ty ser vice provider provides ICT ser vices.

− That pooled testin g shall cover the relevant range of ICT ser vices suppor ting cr itical or im por tant functions contracted to

− the respective ICT third-par ty ser vice provid er by the financia l entities. The pooled testing shall be considered TLPT car r ied

− out by the financial entities par ticipating in the pooled testing.

− The number of financia l entities par ticipating in the pooled testing shall be duly calibrated taking into account the

− compl exity and types of ser vices inv olved.

− 5. Financial entities shall, with the cooperation of ICT third-par ty ser vice provid ers and other par ties inv olved, including

− the test ers but excluding the compet ent author ities, apply eff ective r isk management controls to mitig ate the r isks of an y

− poten tial impact on data, damage to assets, and disr upti on to cr itical or im por tant functions, ser vices or operations at the

− fi nancial entity itself, its counter par ts or to the fi nancial sect or .

− 6. At the end of the testing, af ter repor ts and remediation plans have been agreed, the financial entity and, where

− applicable, the extern al test ers shall provide to the author ity , designat ed in accordance with paragraph 9 or 10, a summar y

− of the relevant fi ndings, the remediation plans and the documentation demonstrating that the TLPT has been conduct ed in

− accordance with the requirements.

− 7. Aut hor ities shall provide fi nancial entities with an attes tation conf ir ming that the test was performe d in accordance

− with the requirements as evidenced in the documentation in order to allow f or mutual recognition of threat led

− penetration te sts between compet ent author ities. The fi nancial entity shall notify the relevant compet ent author ity of the

− attes tation, the summar y of the relevant fi ndings and the remediation plans.

− Offi cial Jour nal of the European Uni on L 333/46 27.12.2022

− Without prejudice to such attestation, fi nancial entities shall remain at all times fully responsible f or the impact of the tes ts

− refer red to in paragraph 4.

− 8. Financial entities shall contract test ers f or the pur poses of under taking TLPT in accordance with Ar ticle 27. When

− fi nancial entities use internal test ers f or the pur poses of under taking TLPT , they shall contract extern al test ers ever y three

− test s.

− Credit institutions that are classifie d as significant in accordance with Ar ticle 6(4) of Regulation (EU) No 1024/2013, shall

− only use external tes ters in accordance with Ar ticle 27(1), points (a) to (e).

− Com petent author ities shall identify financia l entities that are required to perform TLPT taking into account the cr iter ia set

− out in Ar ticle 4(2), based on an assessment of the f ollowi ng:

− (a) impact-relat ed fact ors, in par ticular the extent to which the ser vices provid ed and activities under take n by the fi nancial

− entity im pact the f inancial sector;

− (b) possible fi nancial stability concer ns, including the systemic c haract er of the fi nancial entity at Uni on or national level,

− as applicable;

− (c) specifi c ICT r isk prof ile, level of ICT matur ity of the financia l entity or tec hnology fe atures inv olved.

− 9. Member States ma y designat e a sing le public author ity in the fi nancial sector to be responsible f or TLPT -relat ed

− matte rs in the financia l sector at national level and shall entr ust it with all compet ences and task s to that effe ct.

− 10. In the absence of a designation in accordance with paragraph 9 of this Ar ticle, and without prejudice to the po wer

− to identify the financia l entities that are required to perform TLPT , a compet ent author ity ma y delegat e the exe rcise of

− some or all of the tasks refer red to in this Ar ticle and Ar ticle 27 to another national author ity in the fi nancial sector .

− 11. The ESA s shall, in agreement with the ECB, develop joint draf t regulatory tec hnical standards in accordance with the

− TIBER -EU framewor k in order to specify fur ther :

− (a) the cr iter ia used f or the pur pose of the application of paragraph 8, second subparagraph;

− (b) the requirements and standards governing the use of intern al test ers;

− (i) the scope of TLPT refer red to in paragraph 2;

− (ii) the testing methodology and approach to be f ollo wed f or each specifi c phase of the testing process;

− (iii) the results, closure and remediation stages of the te sting;

− (d) the type of super visor y and other relevant cooperation which are needed f or the im plementation of TLPT , and f or the

− facilitation of mutual recognition of that test ing, in the conte xt of fi nancial entities that operat e in more than one

− Member State, to allow an appropr iat e level of super visor y inv olvement and a f lexible im plementation to cate r f or

− specifi cities of financia l sub-sectors or local financial mark ets.

− When developing those draf t regulatory tec hnical standards, the ESA s shall give due consideration to an y specifi c f eature

− ar ising from the distinct nature of activities across differ ent financia l ser vices sector s.

− The ESAs shall submit those draf t regulator y te chnical standards to the Commission by 17 July 2024 .

− P o wer is delegat ed to the Commission to supplement this Regulation by adop ting the regulatory tec hnical standards

− refer red to in the first subparagraph in accordance with Ar ticles 10 to 14 of Regulations (EU) No 1093/2010, (EU)

− No 1094/2010 and (EU) No 1095/2010.

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/47

− Ar ticle 27

− Requirements f or tes ters for the car r ying out of TLPT

− 1. Financial entities shall only use tes ters f or the car r ying out of TLPT , that:

− (a) are of the highest suitability and reputability ;

− (b) possess tec hnical and organisational capabilities and demonstrate specifi c exper tise in threat intellig ence, penetration

− testing and red team testing;

− (c) are cer tified by an accreditation body in a Member Stat e or adhere to f or mal codes of conduct or ethical framewor k s;

− (d) provide an independent assurance, or an audit repor t, in relation to the sound manage ment of r isks associated with the

− car r ying out of TLPT , including the due prot ection of the financial entity’s confidential inf or mation and redress f or the

− business r isks of the financia l entity ;

− (e) are duly and fully covered by relevant profess ional indemnity insurances, including against r isks of misconduct and

− neg ligence.

− 2. When using internal test ers, financia l entities shall ensure that, in addition to the requirements in paragraph 1, the

− f ollo wing conditions are met :

− (a) such use has been approved by the relevant compet ent author ity or by the sing le public author ity designate d in

− accordance with Ar ticle 26(9) and (10);

− (b) the relevant compet ent author ity has ver ified that the financial entity has sufficient dedicat ed resources and ensured

− that conf licts of interest are av oided throughout the design and exe cution phases of the test; and

− (c) the threat inte lligence provider is external to the financia l entity .

− 3. Financial entities shall ensure that contracts concluded with extern al te sters require a sound management of the TLPT

− results and that any data processing thereof, including an y generation, store , aggregat ion, draf t, repor t, communication or

− destr uction, do not creat e r isks to the financia l entity .

− CH APTER V

− Managing of ICT thir d-par ty r isk

− Ke y pr inciples f or a sound management of ICT third-par ty r isk

− Ar ticle 28

− General pr inciples

− 1. Financial entities shall manage ICT third-par ty r isk as an integral component of ICT r isk within their ICT r isk

− manage ment framew ork as refer red to in Ar ticle 6(1), and in accordance with the f ollowi ng pr inciples:

− (a) fi nancial entities that hav e in place contractual ar range ments f or the use of ICT ser vices to r un their business operations

− shall, at all times, remain fully responsible f or compliance with, and the disc harge of, all oblig ations under this

− Regulation and applicable fi nancial ser vices la w ;

− Offi cial Jour nal of the European Uni on L 333/48 27.12.2022

− (b) fi nancial entities’ manag ement of ICT third-par ty r isk shall be implement ed in light of the pr inciple of propor tionality ,

− taking into account:

− (i) the nature, scale, compl exity and im por tance of ICT -related dependencies,

− (ii) the r isks ar ising from contractual ar rang ements on the use of ICT ser vices concluded with ICT third-par ty ser vice

− provi ders, taking into account the cr iticality or imp or tance of the respective ser vice, process or function, and the

− poten tial impact on the continuity and availabi lity of financia l ser vices and activities, at individual and at group

− level.

− 2. As par t of their ICT r isk manage ment framewor k , financial entities, other than entities refe r red to in Ar ticle 16(1),

− fi rst subparagraph, and other than microenterpr ises, shall adopt, and regularly review , a strateg y on ICT third-par ty r isk,

− taking into account the multi-vendor strategy refer red to in Ar ticle 6(9), where applicable. The strateg y on ICT third-par ty

− r isk shall include a policy on the use of ICT ser vices suppor ting cr itical or impor tant functions provi ded by ICT third-par ty

− ser vice provid ers and shall apply on an individual basis and, where relevant, on a sub-consolidat ed and consolidated basis.

− The managemen t body shall, on the basis of an assessment of the overall r isk prof ile of the fi nancial entity and the scale

− and compl exity of the business ser vices, regularly review the r isks identified in respect to contractual ar range ments on the

− use of ICT ser vices suppor ting cr itical or im por tant functions.

− 3. As par t of their ICT r isk manag ement framework, fi nancial entities shall maintain and update at entity level, and at

− sub-consolidate d and consolidated levels, a register of inf or mation in relation to all contractual ar range ments on the use of

− ICT ser vices provided by ICT third-par ty ser vice providers.

− The contractual ar range ments ref er red to in the fi rst subparagraph shall be appropr iat ely documented, distinguishing

− between those that co ver ICT ser vices suppor ting cr itical or impor tant functions and those that do not.

− Financial entities shall repor t at least y early to the compet ent author ities on the number of new ar rang ements on the use of

− ICT ser vices, the catego r ies of ICT third-par ty ser vice provid ers, the type of contractual ar rang ements and the ICT ser vices

− and functions whic h are being provid ed.

− Financial entities shall make ava ilable to the compe tent author ity , upon its request, the full register of inf or mation or , as

− requeste d, specifi ed sections thereof, along with an y inf or mation deemed necessar y to enable the effe ctive super vision of

− the financia l entity .

− Financial entities shall inf or m the compet ent author ity in a timely manner about an y planned contractual ar rang ement on

− the use of ICT ser vices suppor ting cr itical or im por tant functions as well as when a function has become cr itical or

− imp or tant.

− 4. Bef ore enteri ng into a contractual ar rangement on the use of ICT ser vices, financia l entities shall:

− (a) assess whether the contractual ar rang ement co vers the use of ICT ser vices suppor ting a cr itical or im por tant function;

− (b) assess if super visor y conditions f or contracting are met ;

− (c) identify and assess all relevant r isks in relation to the contractual ar rang ement, including the possibility that such

− contractual ar range ment ma y contr ibut e to reinf orcing ICT concentration r isk as refer red to in Ar ticle 29;

− (d) under take all due dilig ence on prospective ICT third-par ty ser vice provid ers and ensure throughout the selection and

− assessment processes that the ICT third-par ty ser vice provider is suitable;

− (e) identify and assess conf licts of inte rest that the contractual ar rangement ma y cause.

− 5. Financial entities ma y only enter into contractual ar rangements with ICT third-par ty ser vice providers that compl y

− with appropr iate inf or mation secur ity standards. When those contractual ar rangements concer n cr itical or im por tant

− functions, fi nancial entities shall, pr ior to concluding the ar rangements, take due consideration of the use, by ICT third-

− par ty ser vice providers, of the most up-to -date and highest quality inf or mation secur ity standards.

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/49

− 6. In exer cising access, inspection and audit r ights o ver the ICT third-par ty ser vice pro vider , financia l entities shall, on

− the basis of a r isk -based approach, pre-determ ine the frequency of audits and inspections as well as the areas to be audited

− through adher ing to commonly accept ed audit standards in line with any super visor y instr uction on the use and

− incor poration of such audit standards.

− Where contractual ar range ments concluded with ICT third-par ty ser vice providers on the use of ICT ser vices entail high

− tec hnical complexity , the f inancial entity shall ver ify that auditors, whether intern al or extern al, or a pool of auditors,

− possess appropr iate skills and kno wledge to eff ectively perform the relevant audits and assessments.

− 7. Financial entities shall ensure that contractual ar rang ements on the use of ICT ser vices ma y be term inat ed in an y of

− the f ollo wing circumstances:

− (a) signif icant breach by the ICT third-par ty ser vice provi der of applicable la ws, regulations or contractual te r ms;

− (b) circumstances identif ied throughout the monitori ng of ICT third-par ty r isk that are deemed capable of altering the

− performa nce of the functions provid ed through the contractual ar rangement, including mater ial c hange s that aff ect

− the ar rangement or the situation of the ICT third-par ty ser vice provider;

− (c) ICT third-par ty ser vice provi der ’s evidenced weaknesses per taining to its o verall ICT r isk management and in par ticular

− in the wa y it ensures the av ailability , authenticity , inte gr ity and, conf identiality , of data, whether personal or other wise

− sensitive data, or non-personal data;

− (d) where the compet ent author ity can no long er eff ectively super vise the financial entity as a result of the conditions of, or

− circumstances relat ed to, the respective contractual ar rangement.

− 8. For ICT ser vices suppor ting cr itical or impor tant functions, financial entities shall put in place exit strategies. The exit

− strateg ies shall take into account r isks that ma y emerge at the level of ICT third-par ty ser vice provid ers, in par ticular a

− possible failure on their par t, a deter ioration of the quality of the ICT ser vices provid ed, any business disr uption due to

− inappropr iate or f ailed provi sion of ICT ser vices or any mat er ial r isk ar ising in relation to the appropr iat e and continuous

− deplo yment of the respective ICT ser vice, or the termination of contractual ar rangements with ICT third-par ty ser vice

− provid ers under any of the circumstances liste d in paragraph 7.

− Financial entities shall ensure that the y are able to exit contractual ar rang ements without:

− (a) disr uption to their business activities,

− (b) limiting compl iance with regulatory requirements,

− (c) detr iment to the continuity and quality of ser vices pro vided to clients.

− Exit plans shall be compre hensive, documente d and, in accordance with the cr iter ia set out in Ar ticle 4(2), shall be

− suffi ciently test ed and reviewed per iodically .

− Financial entities shall identify alte r native solutions and develop transition plans enabling them to remove the contracted

− ICT ser vices and the relevant data from the ICT third-par ty ser vice provi der and to securely and inte grally transfer them to

− alternati ve providers or reincor porate them in-house.

− Financial entities shall hav e appropr iate contingency measures in place to maintain business continuity in the event of the

− circumstances refer red to in the fi rst subparagraph.

− 9. The ESA s shall, through the Joint Committ ee, develop draf t im plementing tec hnical standards to establish the

− standard tem plates f or the pur poses of the register of inf or mation refe r red to in paragraph 3, including inf or mation that is

− common to all contractual ar rang ements on the use of ICT ser vices. The ESA s shall submit those draf t imp lementing

− tec hnical standards to the Commission by 17 Januar y 2024 .

− P o wer is conferred on the Commission to adopt the implementing tec hnical standards ref er red to in the fi rst subparagraph

− in accordance with Ar ticle 15 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

− EN

− Offi cial Jour nal of the European Uni on L 333/50 27.12.2022

− 10. The ESA s shall, through the Joint Committ ee, develop draf t regulatory tec hnical standards to fur ther specify the

− detailed conte nt of the policy refer red to in paragraph 2 in relation to the contractual ar range ments on the use of ICT

− ser vices suppor ting cr itical or im por tant functions provid ed by ICT third-par ty ser vice provid ers.

− When developing those draf t regulator y tec hnical standards, the ESA s shall tak e into account the size and the o verall r isk

− prof ile of the fi nancial entity , and the nature, scale and compl exity of its ser vices, activities and operations. The ESAs shall

− submit those draf t regulatory tec hnical standards to the Commission by 17 Januar y 2024 .

− P o wer is delegat ed to the Commission to supplement this Regulation by adop ting the regulatory tec hnical standards

− refer red to in the first subparagraph in accordance with Ar ticles 10 to 14 of Regulations (EU) No 1093/2010, (EU)

− No 1094/2010 and (EU) No 1095/2010.

− Ar ticle 29

− Preliminar y assessment of ICT concentration r isk at entity lev el

− 1. When perf or ming the identif ication and assessment of r isks ref er red to in Ar ticle 28(4), point (c), fi nancial entities

− shall also tak e into account whether the en visaged conclusion of a contractual ar range ment in relation to ICT ser vices

− suppor ting cr itical or impor tant functions would lead to any of the f ollowi ng:

− (a) contracting an ICT third-par ty ser vice provid er that is not easily substitutable; or

− (b) having in place multiple contractual ar rangements in relation to the provision of ICT ser vices suppor ting cr itical or

− impor tant functions with the same ICT third-par ty ser vice provid er or with closely connected ICT third-par ty ser vice

− providers.

− Financial entities shall weigh the benefits and costs of alternati ve solutions, such as the use of diffe rent ICT third-par ty

− ser vice provid ers, taking into account if and how envisag ed solutions match the business needs and objectives set out in

− their digital resilience strateg y .

− 2. Where the contractual ar range ments on the use of ICT ser vices suppor ting cr itical or im por tant functions include the

− possibility that an ICT third-par ty ser vice provi der fur ther subcontracts ICT ser vices suppor ting a cr itical or imp or tant

− function to other ICT third-par ty ser vice provid ers, fi nancial entities shall weigh benefits and r isks that ma y ar ise in

− connection with such subcontracting, in par ticular in the case of an ICT subcontract or established in a third-countr y .

− Where contractual ar rang ements concer n ICT ser vices suppor ting cr itical or impor tant functions, fi nancial entities shall

− duly consider the insolvency la w provisions that w ould apply in the event of the ICT third-par ty ser vice provider ’s

− bankr uptcy as well as an y constraint that ma y ar ise in respect to the urgent recovery of the fi nancial entity’s data.

− Where contractual ar range ments on the use of ICT ser vices suppor ting cr itical or im por tant functions are concluded with

− an ICT third-par ty ser vice provider established in a third countr y , fi nancial entities shall, in addition to the considerations

− refer red to in the second subparagraph, also consider the compl iance with U nion data protection r ules and the eff ective

− enf orcement of the la w in that third countr y .

− Where the contractual ar rang ements on the use of ICT ser vices suppor ting cr itical or imp or tant functions provide f or

− subcontracting, financial entities shall assess whether and how potentially long or compl ex chains of subcontracting ma y

− imp act their ability to fully monitor the contracted functions and the ability of the compet ent author ity to effectively

− super vise the fi nancial entity in that respect.

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/51

− Ar ticle 30

− Key contractual pro visions

− 1. The r ights and oblig ations of the financial entity and of the ICT third-par ty ser vice provi der shall be clearly allocated

− and set out in wr iting. The full contract shall include the ser vice level agreements and be documente d in one wr itten

− document whic h shall be available to the par ties on paper , or in a document with another down loadable, durable and

− accessible f or mat.

− 2. The contractual ar range ments on the use of ICT ser vices shall include at least the f ollowi ng elements:

− (a) a clear and compl ete descr ip tion of all functions and ICT ser vices to be provi ded by the ICT third-par ty ser vice provi der ,

− indicating whether subcontracting of an ICT ser vice suppor ting a cr itical or im por tant function, or mate r ial par ts

− thereof, is per mitted and, when that is the case, the conditions applying to such subcontracting;

− (b) the locations, namely the regions or countr ies, where the contracted or subcontract ed functions and ICT ser vices are to

− be provided and where data is to be processed, including the st orage location, and the requirement f or the ICT third-

− par ty ser vice pro vider to notify the fi nancial entity in advance if it envisag es c hanging such locations;

− (c) provisions on av ailability , authenticity , integr ity and conf identiality in relation to the protect ion of data, including

− personal data;

− (d) provisions on ensur ing access, recovery and retur n in an easily accessible f or mat of personal and non-personal data

− processed by the financia l entity in the event of the insolvency , resolution or discontinuation of the business

− operations of the ICT third-par ty ser vice provid er , or in the event of the te r mination of the contractual ar rang ements;

− (e) ser vice level descr iptions, including updat es and revisions thereof;

− (f) the oblig ation of the ICT third-par ty ser vice provid er to provid e assistance to the financial entity at no additional cost,

− or at a cost that is det er mined ex-ante, when an ICT incident that is relat ed to the ICT ser vice provi ded to the fi nancial

− entity occurs;

− (g) the obligation of the ICT third-par ty ser vice provider to fully cooperate with the compe tent author ities and the

− resolution author ities of the fi nancial entity , including persons appointed by them;

− (h) term ination r ights and relat ed minimum notice per iods f or the term ination of the contractual ar rangements, in

− accordance with the expectations of compet ent author ities and resolution author ities;

− (i) the conditions f or the par ticipation of ICT third-par ty ser vice provid ers in the fi nancial entities’ ICT secur ity awar eness

− programmes and digital operational resilience training in accordance with Ar ticle 13(6).

− 3. The contractual ar rang ements on the use of ICT ser vices suppor ting cr itical or im por tant functions shall include, in

− addition to the elements refe r red to in paragraph 2, at least the f ollowi ng:

− (a) full ser vice level descr iptions , including updat es and revisions thereof with precise quantitative and qualitative

− performa nce targets within the agreed ser vice levels to allo w effe ctive monit or ing by the fi nancial entity of ICT ser vices

− and enable appropr iat e cor rective actions to be take n, without undue dela y , when agreed ser vice levels are not met ;

− (b) notice per iods and repor ting oblig ations of the ICT third-par ty ser vice provider to the financia l entity , including

− notifi cation of any development that might ha ve a mat er ial im pact on the ICT third-par ty ser vice provid er ’s ability to

− effectively provide the ICT ser vices suppor ting cr itical or im por tant functions in line with agreed ser vice levels;

− (c) requirements f or the ICT third-par ty ser vice provider to implement and te st business contingenc y plans and to hav e in

− place ICT secur ity measures, too ls and policies that provi de an appropr iat e level of secur ity f or the provision of ser vices

− by the fi nancial entity in line with its regulatory framew ork;

− (d) the obligation of the ICT third-par ty ser vice provider to par ticipate and fully cooperate in the fi nancial entity’s TLPT as

− refer red to in Ar ticles 26 and 27;

− (e) the r ight to monitor , on an ongoing basis, the ICT third-par ty ser vice pro vider ’s performa nce, whic h entails the

− f ollowi ng:

− EN

− Offi cial Jour nal of the European Uni on L 333/52 27.12.2022

− (i) unrestr ict ed r ights of access, inspection and audit by the financial entity , or an appointe d third par ty , and by the

− compet ent author ity , and the r ight to take copies of relevant documentation on-site if the y are cr itical to the

− operations of the ICT third-par ty ser vice provi der , the eff ective exercise of which is not impeded or limited by

− other contractual ar rangements or im plementation policies;

− (ii) the r ight to agree on altern ative assurance levels if other clients’ r ights are affect ed;

− (iii) the obligation of the ICT third-par ty ser vice provid er to fully cooperat e dur ing the onsite inspections and audits

− performe d by the compet ent author ities, the Lead Overseer , fi nancial entity or an appointed third par ty ; and

− (iv) the oblig ation to provid e details on the scope, procedures to be f ollowed and frequency of such inspections and

− audits;

− (f) exit strategies, in par ticular the establishment of a mandatory adequate transition per iod:

− (i) dur ing which the ICT third-par ty ser vice provider will continue provi ding the respective functions, or ICT ser vices,

− with a view to reducing the r isk of disr uption at the f inancial entity or to ensure its eff ective resolution and

− restr uctur ing;

− (ii) allo wing the fi nancial entity to migrat e to another ICT third-par ty ser vice provid er or c hange to in-house solutions

− consiste nt with the compl exity of the ser vice provid ed.

− By wa y of derog ation from point (e), the ICT third-par ty ser vice provi der and the financial entity that is a microent er pr ise

− ma y agree that the financial entity’s r ights of access, inspection and audit can be delegat ed to an independent third par ty ,

− appointed by the ICT third-par ty ser vice provid er , and that the fi nancial entity is able to request inf or mation and assurance

− on the ICT third-par ty ser vice provi der ’s perf or mance from the third par ty at any time.

− 4. When negotiating contractual ar rangements, financia l entities and ICT third-par ty ser vice providers shall consider the

− use of standard contractual clauses developed by public author ities f or specifi c ser vices.

− 5. The ESAs shall, through the Joint Committee, develop draf t regulatory tec hnical standards to specify fur ther the

− elements ref er red to in paragraph 2, point (a), whic h a f inancial entity needs to det er mine and assess when subcontracting

− ICT ser vices suppor ting cr itical or im por tant functions.

− When developing those draf t regulatory tec hnical standards, the ESA s shall take into consideration the size and o verall r isk

− prof ile of the fi nancial entity , and the nature, scale and complexity of its ser vices, activities and operations.

− The ESAs shall submit those draf t regulator y te chnical standards to the Commission by 17 July 2024 .

− P o wer is delegat ed to the Commission to supplement this Regulation by adop ting the regulatory tec hnical standards

− refer red to in the first subparagraph in accordance with Ar ticles 10 to 14 of Regulations (EU) No 1093/2010, (EU)

− No 1094/2010 and (EU) No 1095/2010.

− Section II

− Ov ersight Framewo rk of cr itical ICT third-par ty ser vice pro viders

− Ar ticle 31

− Designation of cr itical ICT third-par ty ser vice pro viders

− 1. The ESAs, through the Joint Committ ee and upon recommendation from the Oversight For um established pursuant

− to Ar ticle 32(1), shall:

− (a) designate the ICT third-par ty ser vice provi ders that are cr itical f or fi nancial entities, f ollo wing an assessment that tak es

− into account the cr iter ia specified in paragraph 2;

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/53

− (b) appoint as Lead Overseer f or eac h cr itical ICT third-par ty ser vice provider the ESA that is responsible, in accordance

− with Regulations (EU) No 1093/2010, (EU) No 1094/2010 or (EU) No 1095/2010, f or the financia l entities having

− tog ether the largest share of tota l assets out of the value of tota l assets of all fi nancial entities using the ser vices of the

− relevant cr itical ICT third-par ty ser vice pro vider , as evidenced by the sum of the individual balance sheets of those

− fi nancial entities.

− 2. The designation refe r red to in paragraph 1, point (a), shall be based on all of the f ollowi ng cr iter ia in relation to ICT

− ser vices pro vided by the ICT third-par ty ser vice pro vider :

− (a) the systemic impact on the stability , continuity or quality of the provi sion of fi nancial ser vices in the event that the

− relevant ICT third-par ty ser vice provider w ould face a large scale operational f ailure to provide its ser vices, taking into

− account the number of financia l entities and the total value of assets of financial entities to which the relevant ICT

− third-par ty ser vice provid er provid es ser vices;

− (b) the system ic c haracter or impor tance of the fi nancial entities that rely on the relevant ICT third-par ty ser vice provi der ,

− assessed in accordance with the f ollowing parameter s:

− (i) the number of g lobal systemical ly impor tant institutions (G-SIIs) or other systemical ly impor tant institutions

− (O-SIIs) that rely on the respective ICT third-par ty ser vice provid er;

− (ii) the inte rdependence between the G-SIIs or O-SIIs refer red to in point (i) and other fi nancial entities, including

− situations where the G-SIIs or O-SIIs provid e financial infrastr ucture ser vices to other fi nancial entities;

− (c) the reliance of financia l entities on the ser vices provid ed by the relevant ICT third-par ty ser vice provi der in relation to

− cr itical or impor tant functions of financial entities that ultimat ely inv olve the same ICT third-par ty ser vice pro vider ,

− ir respective of whether fi nancial entities rely on those ser vices directly or indirectly , through subcontracting

− ar rangements;

− (d) the degree of substitutability of the ICT third-par ty ser vice pro vider , taking into account the f ollo wing parameters:

− (i) the lac k of real altern atives, even par tial, due to the limited number of ICT third-par ty ser vice pro viders active on a

− specific market, or the mark et share of the relevant ICT third-par ty ser vice provid er , or the tec hnical compl exity or

− sophistication inv olved, including in relation to any propr ietar y tec hnology , or the specifi c f eatures of the ICT

− third-par ty ser vice provider ’s organisation or activity ;

− (ii) difficulties in relation to par tially or fully migrating the relevant data and w orkloads from the relevant ICT third-

− par ty ser vice provid er to another ICT third-par ty ser vice pro vider , due either to signif icant fi nancial costs, time or

− other resources that the migration process ma y entail, or to increased ICT r isk or other operational r isks to which

− the financial entity ma y be exposed through such migration.

− 3. Where the ICT third-par ty ser vice provi der belongs to a group, the cr iter ia refer red to in paragraph 2 shall be

− considered in relation to the ICT ser vices pro vided by the group as a whole.

− 4. Cr itical ICT third-par ty ser vice provid ers which are par t of a group shall designat e one leg al person as a coordination

− point to ensure adequate representation and communication with the Lead Overseer .

− 5. The Lead Overseer shall notify the ICT third-par ty ser vice provid er of the outcome of the assessment leading to the

− designation refer red in paragraph 1, point (a). Within 6 weeks from the date of the notification, the ICT third-par ty ser vice

− provid er ma y submit to the Lead Overseer a reasoned statement with an y relevant inf or mation f or the pur poses of the

− assessment. The Lead Overseer shall consider the reasoned statement and ma y request additional inf or mation to be

− submitted within 30 calendar da ys of the receipt of such statemen t.

− EN

− Offi cial Jour nal of the European Uni on L 333/54 27.12.2022

− Af ter designating an ICT third-par ty ser vice provid er as cr itical, the ESAs, through the Joint Committee, shall notify the ICT

− third-par ty ser vice provid er of such designation and the star ting dat e as from whic h they will effectively be subject to

− o versight activities. That star ting dat e shall be no later than one month af ter the notific ation. The ICT third-par ty ser vice

− provid er shall notify the financia l entities to which they provid e ser vices of their designation as cr itical.

− 6. The Commission is em powered to adopt a delegat ed act in accordance with Ar ticle 57 to supplement this Regulation

− by specifying fur ther the cr ite r ia refer red to in paragraph 2 of this Ar ticle, by 17 July 2024 .

− 7. The designation refer red to in paragraph 1, point (a), shall not be used until the Commission has adop ted a delega ted

− act in accordance with paragraph 6.

− 8. The designation refer red to in paragraph 1, point (a), shall not apply to the f ollowing:

− (i) financia l entities providing ICT ser vices to other f inancial entities;

− (ii) ICT third-par ty ser vice provi ders that are subject to o versight framew orks established f or the pur poses of suppor ting

− the tasks refer red to in Ar ticle 127(2) of the T reaty on the Functioning of the European U nion;

− (iii) ICT intra-group ser vice pro viders;

− (iv) ICT third-par ty ser vice providers provi ding ICT ser vices solely in one Member State to fi nancial entities that are only

− active in that Member Stat e.

− 9. The ESAs, through the Joint Committ ee, shall establish, publish and update yearly the list of cr itical ICT third-par ty

− ser vice provi ders at Union level.

− 10. For the pur poses of paragraph 1, point (a), compet ent author ities shall, on a y early and aggreg ated basis, transmit

− the repor ts ref er red to in Ar ticle 28(3), third subparagraph, to the Oversight For um established pursuant to Ar ticle 32. The

− Oversight For um shall assess the ICT third-par ty dependencies of financial entities based on the inf or mation received from

− the compet ent author ities.

− 11. The ICT third-par ty ser vice providers that are not included in the list refer red to in paragraph 9 ma y request to be

− designate d as cr itical in accordance with paragraph 1, point (a).

− For the pur pose of the first subparagraph, the ICT third-par ty ser vice provi der shall submit a reasoned application to EBA ,

− ESMA or EIOP A, whic h, through the Joint Committee, shall decide whether to designat e that ICT third-par ty ser vice

− provid er as cr itical in accordance with paragraph 1, point (a).

− The decision refer red to in the second subparagraph shall be adop ted and notified to the ICT third-par ty ser vice provi der

− within 6 months of receipt of the application.

− 12. Financial entities shall only mak e use of the ser vices of an ICT third-par ty ser vice provi der established in a third

− countr y and which has been designate d as cr itical in accordance with paragraph 1, point (a), if the latter has established a

− subsidiar y in the U nion within the 12 months f ollowing the designation.

− 13. The cr itical ICT third-par ty ser vice provider refer red to in paragraph 12 shall notify the Lead Overseer of an y

− c hanges to the str ucture of the management of the subsidiar y established in the Union.

− Ar ticle 32

− Str ucture of the Ov ersight Framew ork

− 1. The Joint Committee, in accordance with Ar ticle 57(1) of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and

− (EU) No 1095/2010, shall establish the Oversight For um as a sub-committee f or the pur poses of suppor ting the w ork of

− the Joint Committee and of the Lead Overseer refer red to in Ar ticle 31(1), point (b), in the area of ICT third-par ty r isk

− across fi nancial sectors . The Oversight For um shall prepare the draf t joint positions and the draf t common acts of the Joint

− Committ ee in that area.

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/55

− The Oversight For um shall regularly discuss relevant developments on ICT r isk and vulnerabilities and promote a consistent

− approach in the monit or ing of ICT third-par ty r isk at U nion level.

− 2. The Oversight For um shall, on a y early basis, under tak e a collective assessment of the results and findings of the

− o versight activities conduct ed f or all cr itical ICT third-par ty ser vice providers and promote coordination measures to

− increase the digital operational resilience of financia l entities, f oster best practices on addressing ICT concentration r isk and

− explore mitig ants f or cross-sect or r isk transfer s.

− 3. The Oversight For um shall submit compreh ensive benc hmark s f or cr itical ICT third-par ty ser vice provid ers to be

− adopt ed by the Joint Committee as joint positions of the ESA s in accordance with Ar ticle 56(1) of Regulations (EU)

− No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

− 4. The Oversight For um shall be composed of:

− (a) the Chair persons of the ESAs;

− (b) one high-level representative from the cur rent staff of the relevant compet ent author ity refer red to in Ar ticle 46 from

− each Member State ;

− (c) the Executive Direct ors of each ESA and one representative from the Commission, from the ESRB, from ECB and from

− ENISA as obser vers;

− (d) where appropr iate, one additional representative of a compet ent author ity ref er red to in Ar ticle 46 from each Member

− State as obser ver ;

− (e) where applicable, one representative of the compe tent author ities designated or established in accordance with

− Directive (EU) 2022/2555 responsible f or the super vision of an essential or im por tant entity subject to that Directive,

− which has been designat ed as a cr itical ICT third-par ty ser vice provider , as obser ver .

− The Oversight For um ma y , where appropr iate, seek the advice of independent exper ts appointed in accordance with

− paragraph 6.

− 5. Each Member State shall designat e the relevant compet ent author ity whose staff member shall be the high-level

− representative refer red in paragraph 4, first subparagraph, point (b), and shall inf or m the Lead Overseer thereof.

− The ESAs shall publish on their website the list of high-level representatives from the cur rent staff of the relevant compet ent

− author ity designate d by Member State s.

− 6. The independent exper ts refer red to in paragraph 4, second subparagraph, shall be appointed by the Oversight For um

− from a pool of exper ts select ed f ollowi ng a public and transparent application process.

− The independent exper ts shall be appointed on the basis of their exper tise in fi nancial stability , digital operational resilience

− and ICT secur ity matt ers. They shall act independently and objectively in the sole inter est of the Union as a whole and shall

− neither seek nor take instr uctions from Union institutions or bodies, from any government of a Member State or from any

− other public or pr ivate body .

− 7. In accordance with Ar ticle 16 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, the

− ESA s shall by 17 July 2024 issue, f or the pur poses of this Section, guidelines on the cooperation between the ESA s and the

− compet ent author ities cover ing the detailed procedures and conditions f or the allocation and executi on of tasks between

− compet ent author ities and the ESA s and the details on the exc hang es of inf or mation whic h are necessar y f or compet ent

− author ities to ensure the f ollow-up of recommendations pursuant to Ar ticle 35(1), point (d), addressed to cr itical ICT

− third-par ty ser vice provid ers.

− 8. The requirements set out in this Section shall be without prejudice to the application of Directive (EU) 2022/2555

− and of other U nion r ules on o versight applicable to pro viders of cloud computing ser vices.

− 9. The ESA s, through the Joint Committee and based on preparat or y w ork conducted by the Oversight For um, shall, on

− ye arly basis, submit a repor t on the application of this Section to the European P arliament, the Council and the

− Commission.

− EN

− Offi cial Jour nal of the European Uni on L 333/56 27.12.2022

− Ar ticle 33

− T ask s of the Lead Ov erseer

− 1. The Lead Overseer , appointe d in accordance with Ar ticle 31(1), point (b), shall conduct the o versight of the assigned

− cr itical ICT third-par ty ser vice provi ders and shall be, f or the pur poses of all matters relat ed to the oversight, the pr imar y

− point of contact f or those cr itical ICT third-par ty ser vice provid ers.

− 2. For the pur poses of paragraph 1, the Lead Overseer shall assess whether each cr itical ICT third-par ty ser vice provider

− has in place comprehensive, sound and eff ective r ules, procedures, mechani sms and ar range ments to manag e the ICT r isk

− which it ma y pose to fi nancial entities.

− The assessment ref er red to in the first subparagraph shall f ocus mainly on ICT ser vices provid ed by the cr itical ICT third-

− par ty ser vice provid er suppor ting the cr itical or impor tant functions of financial entities. Where necessar y to address all

− relevant r isks , that assessment shall exte nd to ICT ser vices suppor ting functions other than those that are cr itical or

− imp or tant.

− 3. The assessment refe r red to in paragraph 2 shall co ver:

− (a) ICT requirements to ensure, in par ticular , the secur ity , av ailability , continuity , scalability and quality of ser vices which

− the cr itical ICT third-par ty ser vice provider pro vides to fi nancial entities, as well as the ability to maintain at all times

− high standards of av ailability , authenticity , inte gr ity or conf identiality of data;

− (b) the physical secur ity contr ibuting to ensur ing the ICT secur ity , including the secur ity of premises, facilities, data centres;

− (c) the r isk manage ment processes, including ICT r isk manag ement policies, ICT business continuity policy and ICT

− response and reco ver y plans;

− (d) the governance ar range ments, including an org anisational str ucture with clear , transparent and consistent lines of

− responsibility and accountability r ules enabling eff ective ICT r isk management;

− (e) the identification, monitori ng and promp t repor ting of mate r ial ICT -relat ed incidents to fi nancial entities, the

− management and resolution of those incidents, in par ticular cyber -attacks;

− (f) the mechanis ms f or data por tability , application por tability and interoperability , whic h ensure an eff ective exercise of

− term ination r ights by the fi nancial entities;

− (g) the testing of ICT syste ms, infrastr ucture and controls;

− (h) the ICT audits;

− (i) the use of relevant national and inte r national standards applicable to the provision of its ICT ser vices to the financial

− entities.

− 4. Based on the assessment refer red to in paragraph 2, and in coordination with the Joint Oversight Network (JON)

− refer red to in Ar ticle 34(1), the Lead Overseer shall adopt a clear , detailed and reasoned individual oversight plan

− descr ibing the annual o versight objectives and the main oversight actions planned f or each cr itical ICT third-par ty ser vice

− provid er . That plan shall be communicate d y early to the cr itical ICT third-par ty ser vice provi der .

− Pr ior to the adoptio n of the o versight plan, the Lead Overseer shall communicate the draf t o versight plan to the cr itical ICT

− third-par ty ser vice provid er .

− Upon receipt of the draf t o versight plan, the cr itical ICT third-par ty ser vice provid er ma y submit a reasoned statement

− within 15 calendar da ys evidencing the expected im pact on custome rs which are entities f alling outside of the scope of this

− Regulation and where appropr iate, f or mulating solutions to mitig ate r isks .

− 5. Once the annual oversight plans refer red to in paragraph 4 hav e been adop ted and notifi ed to the cr itical ICT third-

− par ty ser vice provi ders, compet ent author ities ma y take measures concer ning such cr itical ICT third-par ty ser vice

− provid ers only in agreement with the Lead Overseer .

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/57

− Ar ticle 34

− Operational coordination betw een Lead Ov erseers

− 1. T o ensure a consistent approach to o versight activities and with a view to enabling coordinated ge neral oversight

− strateg ies and cohesive operational approaches and w ork methodologies, the three Lead Overseers appoint ed in

− accordance with Ar ticle 31(1), point (b), shall set up a JON to coordinat e among themselves in the preparatory stages and

− to coordinat e the conduct of o versight activities o ver their respective overseen cr itical ICT third-par ty ser vice provid ers, as

− well as in the course of an y action that ma y be needed pursuant to Ar ticle 42.

− 2. For the pur poses of paragraph 1, the Lead Overseers shall draw up a common o versight protocol specifying the

− detailed procedures to be f ollo wed f or car r ying out the da y-t o-da y coordination and f or ensur ing swif t exc hang es and

− reactions. The protocol shall be per iodically revised to ref lect operational needs, in par ticular the evolution of practical

− o versight ar range ments.

− 3. The Lead Overseers ma y , on an ad-hoc basis, call on the ECB and ENIS A to provide tec hnical advice, share hands-on

− exper ience or join specific coordination meetings of the JON.

− Ar ticle 35

− Po w ers of the Lead Ov erseer

− 1. For the pur poses of car r ying out the duties laid down in this Section, the Lead Overseer shall hav e the f ollowi ng

− po wers in respect of the cr itical ICT third-par ty ser vice provid ers:

− (a) to request all relevant inf or mation and documentation in accordance with Ar ticle 37;

− (b) to conduct ge neral inv estigations and inspections in accordance with Ar ticles 38 and 39, respectively ;

− (c) to request, af ter the compl etion of the o versight activities, repor ts specifying the actions that hav e been take n or the

− remedies that ha ve been im plemented by the cr itical ICT third-par ty ser vice provid ers in relation to the

− recommendations refer red to in point (d) of this paragraph;

− (d) to issue recommendations on the areas ref er red to in Ar ticle 33(3), in par ticular concer ning the f ollowi ng:

− (i) the use of specifi c ICT secur ity and quality requirements or processes, in par ticular in relation to the roll-out of

− patches, update s, encr ypt ion and other secur ity measures whic h the Lead Overseer deems relevant f or ensur ing

− the ICT secur ity of ser vices provided to fi nancial entities;

− (ii) the use of conditions and te r ms, including their tec hnical im plementation, under whic h the cr itical ICT third-par ty

− ser vice provid ers provid e ICT ser vices to fi nancial entities, which the Lead Overseer deems relevant f or preventing

− the generation of sing le points of f ailure, the ampli fi cation thereof, or f or minimising the possible system ic im pact

− across the Union’ s financia l sector in the event of ICT concentration r isk;

− (iii) any planned subcontracting, where the Lead Overseer deems that fur ther subcontracting, including subcontracting

− ar rangements whic h the cr itical ICT third-par ty ser vice providers plan to enter into with ICT third-par ty ser vice

− providers or with ICT subcontractors established in a third countr y , ma y tr igg er r isks f or the provision of ser vices

− by the fi nancial entity , or r isks to the fi nancial stability , based on the examination of the inf or mation gat hered in

− accordance with Ar ticles 37 and 38;

− (iv) refraining from ent er ing into a fur ther subcontracting ar rang ement, where the f ollowing cumulative conditions

− are met:

− — the en visaged subcontractor is an ICT third-par ty ser vice pro vider or an ICT subcontractor established in a

− third countr y ;

− — the subcontracting concer ns cr itical or im por tant functions of the fi nancial entity ; and

− EN

− Offi cial Jour nal of the European Uni on L 333/58 27.12.2022

− — the Lead Overseer deems that the use of such subcontracting poses a clear and ser ious r isk to the financia l

− stability of the U nion or to financia l entities, including to the ability of fi nancial entities to compl y with

− super visor y requirements.

− For the pur pose of point (iv) of this point, ICT third-par ty ser vice pro viders shall, using the tem plate refe r red to in

− Ar ticle 41(1), point (b), transmit the inf or mation regarding subcontracting to the Lead Overseer .

− 2. When exer cising the po wers refe r red to in this Ar ticle, the Lead Overseer shall:

− (a) ensure regular coordination within the JON, and in par ticular shall seek consiste nt approaches, as appropr iat e, with

− regard to the o versight of cr itical ICT third-par ty ser vice providers;

− (b) take due account of the framew ork established by Directive (EU) 2022/2555 and, where necessar y , consult the relevant

− compet ent author ities designate d or established in accordance with that Directive, in order to av oid duplication of

− tec hnical and organisational measures that might apply to cr itical ICT third-par ty ser vice provi ders pursuant to that

− Directive;

− (c) seek to minimise, to the exte nt possible, the r isk of disr upti on to ser vices provided by cr itical ICT third-par ty ser vice

− providers to customers that are entities f alling outside the scope of this Regulation.

− 3. The Lead Overseer shall consult the Oversight For um bef ore exercisi ng the po wers refer red to in paragraph 1.

− Bef ore issuing recommendations in accordance with paragraph 1, point (d), the Lead Overseer shall give the oppor tunity to

− the ICT third-par ty ser vice provider to provide, within 30 calendar da ys, relevant inf or mation evidencing the expect ed

− imp act on customer s that are entities falling outside the scope of this Regulation and, where appropr iat e, f or mulating

− solutions to mitig ate r isks .

− 4. The Lead Overseer shall inf or m the JON of the outcome of the exercise of the po wers ref er red to in paragraph 1,

− points (a) and (b). The Lead Overseer shall, without undue dela y , transmit the repor ts ref er red to in paragraph 1, point (c),

− to the JON and to the compet ent author ities of the financia l entities using the ICT ser vices of that cr itical ICT third-par ty

− ser vice provi der .

− 5. Cr itical ICT third-par ty ser vice provid ers shall cooperat e in good f aith with the Lead Overseer , and assist it in the

− fulfilme nt of its tasks.

− 6. In the event of whole or par tial non-compliance with the measures required to be tak en pursuant to the exer cise of

− the po wers under paragraph 1, points (a), (b) and (c), and af te r the expir y of a per iod of at least 30 calendar da ys from the

− date on which the cr itical ICT third-par ty ser vice provider received notificati on of the respective measures, the Lead

− Overseer shall adopt a decision imposing a per iodic penalty pa yment to compel the cr itical ICT third-par ty ser vice

− provid er to comply with those measures.

− 7. The per iodic penalty pa yment refer red to in paragraph 6 shall be im posed on a daily basis until compl iance is

− achi eved and f or no more than a per iod of six months f ollowi ng the notification of the decision to im pose a per iodic

− penalty pa yment to the cr itical ICT third-par ty ser vice provid er .

− 8. The amount of the per iodic penalty pa yment, calculat ed from the date stipulat ed in the decision imposing the

− per iodic penalty pa yment, shall be up to 1 % of the av erage daily w orldwide tur no ver of the cr itical ICT third-par ty ser vice

− provid er in the preceding business y ear . When det er mining the amount of the penalty pa yment, the Lead Overseer shall

− take into account the f ollo wing cr it er ia regarding non-comp liance with the measures refe r red to in paragraph 6:

− (a) the gravity and the duration of non-compliance;

− (b) whether non-com pliance has been committed intentionally or neg lig ently ;

− (c) the level of cooperation of the ICT third-par ty ser vice provid er with the Lead Overseer .

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/59

− For the pur poses of the first subparagraph, in order to ensure a consistent approach, the Lead Overseer shall eng age in

− consultation within the JON.

− 9. P enalty pa yments shall be of an administrative nature and shall be enf orceable. Enf orcement shall be go ver ned by the

− r ules of civil procedure in f orce in the Member Stat e on the terr itory of which inspections and access shall be car r ied out.

− Cour ts of the Member State concer ned shall hav e jur isdiction o ver compl aints related to ir regular conduct of enf orcement.

− The amounts of the penalty pa yments shall be allocat ed to the general budget of the European U nion.

− 10. The Lead Overseer shall disclose to the public ever y per iodic penalty pa yment that has been impos ed, unless such

− disclosure w ould ser iously jeopardise the fi nancial mark ets or cause dispropor tionate damage to the par ties inv olved.

− 11. Bef ore imp osing a per iodic penalty pa yment under paragraph 6, the Lead Overseer shall give the representatives of

− the cr itical ICT third-par ty ser vice provider subject to the proceedings the oppor tunity to be heard on the findings and

− shall base its decisions only on fi ndings on whic h the cr itical ICT third-par ty ser vice provid er subject to the proceedings

− has had an oppor tunity to comment.

− The r ights of the defe nce of the persons subject to the proceedings shall be fully respected in the proceedings. The cr itical

− ICT third-par ty ser vice provider subject to the proceedings shall be entitled to have access to the fi le, subject to the

− legitimate int erest of other persons in the prote ction of their business secrets. The r ight of access to the file shall not extend

− to confidential inf or mation or to the Lead Overseer ’s intern al preparatory documents.

− Ar ticle 36

− Ex ercise of the po w ers of the Lead Ov erseer outside the Union

− 1. When o versight objectives cannot be attained by means of inte racting with the subsidiar y set up f or the pur pose of

− Ar ticle 31(12), or by exer cising o versight activities on premises locat ed in the Union, the Lead Overseer ma y exe rcise the

− po wers, refer red to in the f ollowi ng provisions, on any premises located in a third-countr y which is o wned, or used in any

− wa y , f or the pur poses of provid ing ser vices to U nion financia l entities, by a cr itical ICT third-par ty ser vice provi der , in

− connection with its business operations, functions or ser vices, including any administrative, business or operational

− office s, premises, lands, buildings or other proper ties:

− (a) in Ar ticle 35(1), point (a); and

− (b) in Ar ticle 35(1), point (b), in accordance with Ar ticle 38(2), points (a), (b) and (d), and in Ar ticle 39(1) and (2), point (a).

− The powers ref er red to in the fi rst subparagraph ma y be exercised subject to all of the f ollowing conditions:

− (i) the conduct of an inspection in a third-countr y is deemed necessar y by the Lead Overseer to allow it to fully and

− eff ectively perform its duties under this Regulation;

− (ii) the inspection in a third-countr y is directly related to the provi sion of ICT ser vices to fi nancial entities in the Union;

− (iii) the cr itical ICT third-par ty ser vice pro vider concer ned consents to the conduct of an inspection in a third-countr y ; and

− (iv) the relevant author ity of the third-countr y concer ned has been off icially notified by the Lead Overseer and raised no

− objection theret o.

− EN

− Offi cial Jour nal of the European Uni on L 333/60 27.12.2022

− 2. Without prejudice to the respective compet ences of the Uni on institutions and of Member State s, f or the pur poses of

− paragraph 1, EBA, ESMA or EIOP A shall conclude administrative cooperation ar rangements with the relevant author ity of

− the third countr y in order to enable the smooth conduct of inspections in the third countr y concer ned by the Lead

− Overseer and its designat ed team f or its mission in that third countr y . Those cooperation ar rangements shall not create

− lega l oblig ations in respect of the Union and its Member States nor shall they prevent Member State s and their compet ent

− author ities from concluding bilat eral or multilat eral ar rangements with those third countr ies and their relevant author ities.

− Those cooperation ar rangements shall specify at least the f ollowi ng elements:

− (a) the procedures f or the coordination of oversight activities car r ied out under this Regulation and an y analogous

− monitori ng of ICT third-par ty r isk in the fi nancial sector exercised by the relevant author ity of the third countr y

− concer ned, including details f or transmitting the agreement of the latter to allow the conduct, by the Lead Overseer

− and its designat ed team, of general inve stigations and on-site inspections as ref er red to in paragraph 1, first

− subparagraph, on the terr it or y under its jur isdiction;

− (b) the mechanis m f or the transmission of an y relevant inf or mation between EBA, ESMA or EIOP A and the relevant

− author ity of the third countr y concer ned, in par ticular in connection with inf or mation that ma y be requeste d by the

− Lead Overseer pursuant to Ar ticle 37;

− (c) the mecha nisms f or the prom pt notification by the relevant author ity of the third-countr y concer ned to EBA , ESMA or

− EIOP A of cases where an ICT third-par ty ser vice provider established in a third countr y and designat ed as cr itical in

− accordance with Ar ticle 31(1), point (a), is deemed to hav e infr inged the requirements to which it is obliged to adhere

− pursuant to the applicable law of the third countr y concer ned when provid ing ser vices to financial institutions in that

− third countr y , as well as the remedies and penalties applied;

− (d) the regular transmission of updates on regulatory or super visor y developments on the monitoring of ICT third-par ty

− r isk of financial institutions in the third countr y concer ned;

− (e) the details f or allowing, if needed, the par ticipation of one representative of the relevant third-countr y author ity in the

− inspections conducted by the Lead Overseer and the designat ed team.

− 3. When the Lead Overseer is not able to conduct o versight activities outside the U nion, refe r red to in paragraphs 1

− and 2, the Lead Overseer shall:

− (a) exercise its powers under Ar ticle 35 on the basis of all facts and documents av ailable to it ;

− (b) document and explain an y consequence of its inability to conduct the en visaged o versight activities as refer red to in this

− Ar ticle.

− The poten tial consequences ref er red to in point (b) of this paragraph shall be taken into consideration in the Lead Overseer ’s

− recommendations issued pursuant to Ar ticle 35(1), point (d).

− Ar ticle 37

− Request f or inf or mation

− 1. The Lead Overseer ma y , by simp le request or by decision, require cr itical ICT third-par ty ser vice providers to provid e

− all inf or mation that is necessar y f or the Lead Overseer to car r y out its duties under this Regulation, including all relevant

− business or operational documents, contracts, policies, documentation, ICT secur ity audit repor ts, ICT -related incident

− repor ts, as well as any inf or mation relating to par ties to whom the cr itical ICT third-par ty ser vice provider has outsourced

− operational functions or activities.

− 2. When sending a simple request f or inf or mation under paragraph 1, the Lead Overseer shall:

− (a) refer to this Ar ticle as the legal basis of the request ;

− (b) state the pur pose of the request ;

− (c) specify what inf or mation is required;

− (d) set a time limit within whic h the inf or mation is to be pro vided;

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/61

− (e) inf or m the representative of the cr itical ICT third-par ty ser vice provi der from whom the inf or mation is requeste d that

− he or she is not oblig ed to provide the inf or mation, but in the event of a v oluntar y reply to the request the inf or mation

− provided must not be incor rect or misleading.

− 3. When requir ing by decision to supply inf or mation under paragraph 1, the Lead Overseer shall:

− (a) refer to this Ar ticle as the legal basis of the request ;

− (b) state the pur pose of the request ;

− (c) specify what inf or mation is required;

− (d) set a time limit within whic h the inf or mation is to be pro vided;

− (e) indicate the per iodic penalty pa yments provi ded f or in Ar ticle 35(6) where the production of the required inf or mation

− is incomplet e or when such inf or mation is not provided within the time limit refer red to in point (d) of this paragraph;

− (f) indicate the r ight to appeal the decision to ESA ’s Board of Appeal and to hav e the decision reviewed by the Cour t of

− Justice of the European U nion (Cour t of Justice) in accordance with Ar ticles 60 and 61 of Regulations (EU)

− No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

− 4. The representatives of the cr itical ICT third-par ty ser vice provid ers shall supply the inf or mation request ed. La wyers

− duly author ised to act ma y supply the inf or mation on behalf of their clients. The cr itical ICT third-par ty ser vice provid er

− shall remain fully responsible if the inf or mation supplied is incomplet e, incor rect or misleading.

− 5. The Lead Overseer shall, without dela y , transmit a cop y of the decision to supply inf or mation to the compet ent

− author ities of the financial entities using the ser vices of the relevant cr itical ICT third-par ty ser vice provi ders and to the

− JON.

− Ar ticle 38

− General inv est igations

− 1. In order to car r y out its duties under this Regulation, the Lead Overseer , assiste d by the joint examination team

− refer red to in Ar ticle 40(1), ma y , where necessar y , conduct investig ations of cr itical ICT third-par ty ser vice provid ers.

− 2. The Lead Overseer shall have the po wer to:

− (a) examine records, data, procedures and an y other mater ial relevant to the executi on of its task s, ir respective of the

− medium on whic h the y are stored;

− (b) take or obtain cer tified copies of, or extracts from, such records, data, documented procedures and an y other mate r ial;

− (c) summon representatives of the cr itical ICT third-par ty ser vice provid er f or oral or wr itten explanations on facts or

− documents relating to the subject matt er and pur pose of the inv estigation and to record the answers;

− (d) inter view an y other natural or leg al person who consents to be inter viewed f or the pur pose of collecting inf or mation

− relating to the subject matt er of an investig ation;

− (e) request records of teleph one and data traffic.

− 3. The officials and other persons author ised by the Lead Overseer f or the pur poses of the inv estigation refe r red to in

− paragraph 1 shall exer cise their po wers upon production of a wr itten author isation specifying the subject matte r and

− pur pose of the inv estigation.

− That author isation shall also indicate the per iodic penalty pa yments provided f or in Ar ticle 35(6) where the production of

− the required records, data, documented procedures or an y other mate r ial, or the answers to questions asked to

− representatives of the ICT third-par ty ser vice provider are not provided or are incomplet e.

− EN

− Offi cial Jour nal of the European Uni on L 333/62 27.12.2022

− 4. The representatives of the cr itical ICT third-par ty ser vice provid ers are required to submit to the investig ations on the

− basis of a decision of the Lead Overseer . The decision shall specify the subject matt er and pur pose of the inv estigation, the

− per iodic penalty pa yments provided f or in Ar ticle 35(6), the legal remedies ava ilable under Regulations (EU)

− No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, and the r ight to ha ve the decision reviewed by the Cour t of

− Justice.

− 5. In good time bef ore the star t of the inve stigation, the Lead Overseer shall inf or m compet ent author ities of the

− fi nancial entities using the ICT ser vices of that cr itical ICT third-par ty ser vice provider of the en visaged inv estigation and of

− the identity of the author ised persons.

− The Lead Overseer shall communicate to the JON all inf or mation transmitt ed pursuant to the fi rst subparagraph.

− Ar ticle 39

− Inspections

− 1. In order to car r y out its duties under this Regulation, the Lead Overseer , assiste d by the joint examination teams

− refer red to in Ar ticle 40(1), ma y ent er in, and conduct all necessar y onsite inspections on, any business premises, land or

− proper ty of the ICT third-par ty ser vice providers, such as head office s, operation centres, secondar y premises, as well as to

− conduct off-site inspections.

− For the pur poses of exer cising the po wers refe r red to in the fi rst subparagraph, the Lead Overseer shall consult the JON.

− 2. The off icials and other persons author ised by the Lead Overseer to conduct an on-site inspection shall hav e the power

− to:

− (a) enter an y such business premises, land or proper ty ; and

− (b) seal an y such business premises, books or records, f or the per iod of, and to the ext ent necessar y f or , the inspection.

− The off icials and other persons author ised by the Lead Overseer shall exercise their po wers upon production of a wr itten

− author isation specifying the subject matter and the pur pose of the inspection, and the per iodic penalty pa yments provided

− f or in Ar ticle 35(6) where the representatives of the cr itical ICT third-par ty ser vice pro viders concer ned do not submit to

− the inspection.

− 3. In good time bef ore the star t of the inspection, the Lead Overseer shall inf or m the compet ent author ities of the

− fi nancial entities using that ICT third-par ty ser vice provid er .

− 4. Inspections shall co ver the full rang e of relevant ICT systems , networks, devices, inf or mation and data either used f or ,

− or contr ibuting to, the pro vision of ICT ser vices to fi nancial entities.

− 5. Bef ore any planned on-site inspection, the Lead Overseer shall give reasonable notice to the cr itical ICT third-par ty

− ser vice providers, unless such notice is not possible due to an emergency or cr isis situation, or if it w ould lead to a

− situation where the inspection or audit w ould no long er be eff ective.

− 6. The cr itical ICT third-par ty ser vice provider shall submit to on-site inspections ordered by decision of the Lead

− Overseer . The decision shall specify the subject matte r and pur pose of the inspection, fix the date on which the inspection

− shall begin and shall indicate the per iodic penalty pa yments provid ed f or in Ar ticle 35(6), the leg al remedies av ailable

− under Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, as well as the r ight to ha ve the

− decision reviewed by the Cour t of Justice.

− 7. Where the officials and other persons author ised by the Lead Overseer fi nd that a cr itical ICT third-par ty ser vice

− provid er opposes an inspection ordered pursuant to this Ar ticle, the Lead Overseer shall inf or m the cr itical ICT third-par ty

− ser vice provid er of the consequences of such opposition, including the possibility f or compet ent author ities of the relevant

− fi nancial entities to require fi nancial entities to term inate the contractual ar range ments concluded with that cr itical ICT

− third-par ty ser vice provid er .

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/63

− Ar ticle 40

− Ongoing o v ersight

− 1. When conducting o versight activities, in par ticular g eneral investig ations or inspections, the Lead Overseer shall be

− assisted by a joint examination te am established f or each cr itical ICT third-par ty ser vice provid er .

− 2. The joint examination team refer red to in paragraph 1 shall be composed of staff members from:

− (a) the ESAs;

− (b) the relevant compet ent author ities super vising the financia l entities to which the cr itical ICT third-par ty ser vice

− provider provides ICT ser vices;

− (c) the national compet ent author ity refe r red to in Ar ticle 32(4), point (e), on a volun tar y basis;

− (d) one national compet ent author ity from the Member Stat e where the cr itical ICT third-par ty ser vice provid er is

− established, on a voluntar y basis.

− Members of the joint examination team shall hav e exper tise in ICT matt ers and in operational r isk. The joint examination

− team shall w ork under the coordination of a designat ed Lead Overseer staff member (the ‘Lead Overseer coordinat or ’).

− 3. Within 3 months of the completion of an inv estigation or inspection, the Lead Overseer , af ter consulting the

− Oversight For um, shall adop t recommendations to be addressed to the cr itical ICT third-par ty ser vice provider pursuant to

− the po wers refer red to in Ar ticle 35.

− 4. The recommendations refer red to in paragraph 3 shall be immediately communicated to the cr itical ICT third-par ty

− ser vice provi der and to the compet ent author ities of the fi nancial entities to whic h it provid es ICT ser vices.

− For the pur poses of fulfilling the o versight activities, the Lead Overseer ma y take into consideration an y relevant third-par ty

− cer tifications and ICT third-par ty internal or exte r nal audit repor ts made available by the cr itical ICT third-par ty ser vice

− provid er .

− Ar ticle 41

− Har monisation of conditions enabling the conduct of the o v ersight activities

− 1. The ESAs shall, through the Joint Committ ee, develop draf t regulatory tec hnical standards to specify :

− (a) the inf or mation to be provided by an ICT third-par ty ser vice provid er in the application f or a voluntar y request to be

− designated as cr itical under Ar ticle 31(11);

− (b) the content, str ucture and f or mat of the inf or mation to be submitted , disclosed or repor te d by the ICT third-par ty

− ser vice providers pursuant to Ar ticle 35(1), including the te mplat e f or provi ding inf or mation on subcontracting

− ar rangements;

− (c) the cr iter ia f or det er mining the composition of the joint examination team ensur ing a balanced par ticipation of staff

− members from the ESA s and from the relevant compet ent author ities, their designation, tasks, and working

− ar rangements.

− (d) the details of the compet ent author ities’ assessment of the measures tak en by cr itical ICT third-par ty ser vice provid ers

− based on the recommendations of the Lead Overseer pursuant to Ar ticle 42(3).

− 2. The ESAs shall submit those draf t regulator y te chnical standards to the Commission by 17 July 2024 .

− P o wer is delegat ed to the Commission to supplement this Regulation by adop ting the regulatory tec hnical standards

− refer red to in paragraph 1 in accordance with the procedure laid down in Ar ticles 10 to 14 of Regulations (EU)

− No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

− EN

− Offi cial Jour nal of the European Uni on L 333/64 27.12.2022

− Ar ticle 42

− Follo w -up by competent author ities

− 1. Within 60 calendar da ys of the receip t of the recommendations issued by the Lead Overseer pursuant to Ar ticle

− 35(1), point (d), cr itical ICT third-par ty ser vice providers shall either notify the Lead Overseer of their inte ntion to f ollo w

− the recommendations or provide a reasoned explanation f or not f ollowi ng such recommendations. The Lead Overseer

− shall immediately transmit this inf or mation to the compet ent author ities of the financial entities concer ned.

− 2. The Lead Overseer shall publicly disclose where a cr itical ICT third-par ty ser vice provid er f ails to notify the Lead

− Overseer in accordance with paragraph 1 or where the explanation provided by the cr itical ICT third-par ty ser vice

− provid er is not deemed suffi cient. The inf or mation published shall disclose the identity of the cr itical ICT third-par ty

− ser vice provi der as well as inf or mation on the type and nature of the non-com pliance. Such inf or mation shall be limited to

− what is relevant and propor tionate f or the pur pose of ensur ing public awar eness, unless such publication w ould cause

− dispropor tionat e damage to the par ties inv olved or could ser iously jeopardise the orderly functioning and inte gr ity of

− fi nancial mark ets or the stability of the whole or par t of the fi nancial syste m of the Union.

− The Lead Overseer shall notify the ICT third-par ty ser vice provid er of that public disclosure.

− 3. Com petent author ities shall inf or m the relevant financia l entities of the r isks identified in the recommendations

− addressed to cr itical ICT third-par ty ser vice providers in accordance with Ar ticle 35(1), point (d).

− When managing ICT third-par ty r isk, f inancial entities shall take into account the r isks ref er red to in the fi rst subparagraph.

− 4. Where a compet ent author ity deems that a fi nancial entity f ails to take into account or to suffi ciently address within

− its manage ment of ICT third-par ty r isk the specific r isks identified in the recommendations, it shall notify the financia l

− entity of the possibility of a decision being taken, within 60 calendar da ys of the receipt of such notification, pursuant to

− paragraph 6, in the absence of appropr iat e contractual ar range ments aiming to address such r isks .

− 5. Upon receiving the repor ts refer red to in Ar ticle 35(1), point (c), and pr ior to taking a decision as ref er red to in

− paragraph 6 of this Ar ticle, compet ent author ities ma y , on a voluntar y basis, consult the compet ent author ities designat ed

− or established in accordance with Directive (EU) 2022/2555 responsible f or the super vision of an essential or impor tant

− entity subject to that Directive, whic h has been designate d as a cr itical ICT third-par ty ser vice provi der .

− 6. Com petent author ities ma y , as a measure of last resor t, f ollo wing the notifi cation and, if appropr iate, the consultation

− as set out in paragraph 4 and 5 of this Ar ticle, in accordance with Ar ticle 50, take a decision requir ing fi nancial entities to

− tem porar ily suspend, either in par t or compl etely , the use or deplo yment of a ser vice provid ed by the cr itical ICT third-par ty

− ser vice provid er until the r isks identified in the recommendations addressed to cr itical ICT third-par ty ser vice provid ers

− hav e been addressed. Where necessar y , they ma y require fi nancial entities to term inate , in par t or complet ely , the relevant

− contractual ar rang ements concluded with the cr itical ICT third-par ty ser vice provi ders.

− 7. Where a cr itical ICT third-par ty ser vice provid er refuses to endorse recommendations, based on a diverge nt approac h

− from the one advised by the Lead Overseer , and such a divergent approach ma y adversely impact a large number of

− fi nancial entities, or a signif icant par t of the fi nancial sect or , and individual war nings issued by compet ent author ities hav e

− not result ed in consistent approac hes mitig ating the poten tial r isk to fi nancial stability , the Lead Overseer ma y , af ter

− consulting the Oversight For um, issue non-binding and non-public opinions to compet ent author ities, in order to

− promote consistent and converg ent super visor y f ollow-up measures, as appropr iate.

− 8. Upon receiving the repor ts refe r red to in Ar ticle 35(1), point (c), compet ent author ities, when taking a decision as

− refer red to in paragraph 6 of this Ar ticle, shall take into account the type and magnitude of r isk that is not addressed by

− the cr itical ICT third-par ty ser vice provider , as well as the ser iousness of the non-com pliance, having regard to the

− f ollo wing cr it er ia:

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/65

− (a) the gravity and the duration of the non-com pliance;

− (b) whether the non-com pliance has revealed ser ious weaknesses in the cr itical ICT third-par ty ser vice pro vider ’s

− procedures, manage ment system s, r isk management and internal controls;

− (c) whether a financia l cr ime was f acilitated , occasioned or is other wise attr ibutable to the non-com pliance;

− (d) whether the non-com pliance has been intenti onal or neg lig ent ;

− (e) whether the suspension or term ination of the contractual ar rangements introduces a r isk f or continuity of the fi nancial

− entity’s business operations notwithstanding the fi nancial entity’s eff or ts to av oid disr uption in the provision of its

− ser vices;

− (f) where applicable, the opinion of the compet ent author ities designat ed or established in accordance with Directive (EU)

− 2022/2555 responsible f or the super vision of an essential or imp or tant entity subject to that Directive, which has been

− designated as a cr itical ICT third-par ty ser vice provid er , request ed on a voluntar y basis in accordance with paragraph 5

− of this Ar ticle.

− Com petent author ities shall grant fi nancial entities the necessar y per iod of time to enable them to adjust the contractual

− ar range ments with cr itical ICT third-par ty ser vice pro viders in order to av oid detr imental effects on their digital

− operational resilience and to allow them to deplo y exit strateg ies and transition plans as ref er red to in Ar ticle 28.

− 9. The decision ref er red to in paragraph 6 of this Ar ticle shall be notified to the members of the Oversight For um

− refer red to in Ar ticle 32(4), points (a), (b) and (c), and to the JON.

− The cr itical ICT third-par ty ser vice provid ers affect ed by the decisions provided f or in paragraph 6 shall fully cooperat e with

− the financia l entities impact ed, in par ticular in the cont ext of the process of suspension or te r mination of their contractual

− ar range ments.

− 10. Compet ent author ities shall regularly inf or m the Lead Overseer on the approach es and measures tak en in their

− super visor y tasks in relation to fi nancial entities as well as on the contractual ar rang ements concluded by f inancial entities

− where cr itical ICT third-par ty ser vice providers hav e not endorsed in par t or entirely recommendations addressed to them

− by the Lead Overseer .

− 11. The Lead Overseer ma y , upon request, provid e fur ther clar if ications on the recommendations issued to guide the

− compet ent author ities on the f ollow-up measures.

− Ar ticle 43

− Ov ersight fees

− 1. The Lead Overseer shall, in accordance with the delegat ed act refer red to in paragraph 2 of this Ar ticle, c harge cr itical

− ICT third-par ty ser vice providers fe es that fully cover the Lead Overseer ’s necessar y expenditure in relation to the conduct

− of oversight tasks pursuant to this Regulation, including the reimbursement of any costs which ma y be incur red as a result

− of w ork car r ied out by the joint examination team refe r red to in Ar ticle 40, as well as the costs of advice provided by the

− independent exper ts as refer red to in Ar ticle 32(4), second subparagraph, in relation to matt ers falling under the remit of

− direct oversight activities.

− The amount of a fee charg ed to a cr itical ICT third-par ty ser vice provider shall co ver all costs der ived from the executi on of

− the duties set out in this Section and shall be propor tionate to its tur no ver .

− 2. The Commission is em powered to adopt a delegat ed act in accordance with Ar ticle 57 to supplement this Regulation

− by determi ning the amount of the f ees and the wa y in whic h the y are to be paid by 17 July 2024 .

− EN

− Offi cial Jour nal of the European Uni on L 333/66 27.12.2022

− Ar ticle 44

− Inter national cooperation

− 1. Without prejudice to Ar ticle 36, EBA , ESMA and EIOP A ma y , in accordance with Ar ticle 33 of Regulations (EU)

− No 1093/2010, (EU) No 1095/2010 and (EU) No 1094/2010, respectively , conclude administrative ar rangements with

− third-countr y regulatory and super visor y author ities to f oster international cooperation on ICT third-par ty r isk across

− differ ent fi nancial sector s, in par ticular by developing best practices f or the review of ICT r isk management practices and

− controls, mitigation measures and incident responses.

− 2. The ESAs shall, through the Joint Committ ee, submit ever y five ye ars a joint conf idential repor t to the European

− P arliament, to the Council and to the Commission, summar ising the fi ndings of relevant discussions held with the third

− countr ies’ author ities refe r red to in paragraph 1, f ocusing on the ev olution of ICT third-par ty r isk and the implications f or

− fi nancial stability , mark et integr ity , inv estor prote ction and the functioning of the intern al market.

− C HAPTER VI

− Inf or mation-shar ing ar r ang ements

− Ar ticle 45

− Informa tion-shar ing ar rangements on cyber threat inf or mation and intelligence

− 1. Financial entities ma y exc hange amongst themselves cyber threat inf or mation and intelli gence, including indicator s of

− compromise, tactics, tec hniques, and procedures, cyber secur ity aler ts and conf iguration too ls, to the exte nt that such

− inf or mation and inte lligence shar ing:

− (a) aims to enhance the digital operational resilience of fi nancial entities, in par ticular through raising aware ness in relation

− to cyber threats, limiting or im peding the cyber threats’ ability to spread, suppor ting defence capabilities, threat

− detection tec hniques, mitigation strateg ies or response and recovery stages;

− (b) takes places within tr usted communities of fi nancial entities;

− (c) is implement ed through inf or mation-shar ing ar range ments that prote ct the potentially sensitive nature of the

− inf or mation shared, and that are governed by r ules of conduct in full respect of business conf identiality , protection of

− personal data in accordance with Regulation (EU) 2016/679 and guidelines on competition policy .

− 2. For the pur pose of paragraph 1, point (c), the inf or mation-shar ing ar rang ements shall def ine the conditions f or

− par ticipation and, where appropr iate, shall set out the details on the inv olvement of public author ities and the capacity in

− which the y ma y be associated to the inf or mation-shar ing ar rang ements, on the inv olvement of ICT third-par ty ser vice

− provid ers, and on operational elements, including the use of dedicate d IT platf or ms.

− 3. Financial entities shall notify compet ent author ities of their par ticipation in the inf or mation-shar ing ar range ments

− refer red to in paragraph 1, upon validation of their membership, or , as applicable, of the cessation of their membership,

− once it take s eff ect.

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/67

− CHAPTE R VII

− Competent author ities

− Ar ticle 46

− Competent author ities

− Without prejudice to the pro visions on the Oversight Framew ork f or cr itical ICT third-par ty ser vice providers refe r red to in

− Chapt er V , Section II, of this Regulation, compliance with this Regulation shall be ensured by the f ollowi ng compet ent

− author ities in accordance with the po wers granted by the respective leg al acts:

− (a) f or credit institutions and f or institutions exem pt ed pursuant to Directive 2013/36/EU, the compet ent author ity

− designate d in accordance with Ar ticle 4 of that Directive, and f or credit institutions classif ied as significant in

− accordance with Ar ticle 6(4) of Regulation (EU) No 1024/2013, the ECB in accordance with the po wers and tasks

− conferr ed by that Regulation;

− (b) f or pa yment institutions, including pa yment institutions exem pt ed pursuant to Directive (EU) 2015/2366, electronic

− money institutions, including those exem pt ed pursuant to Directive 2009/110/EC, and account inf or mation ser vice

− providers as ref er red to in Ar ticle 33(1) of Directive (EU) 2015/2366, the compet ent author ity designated in

− accordance with Ar ticle 22 of Directive (EU) 2015/2366;

− (c) f or inv estment fir ms, the compe tent author ity designat ed in accordance with Ar ticle 4 of Directive (EU) 2019/2034 of

− the European P arliament and of the Council (

− 38

− ) ;

− (d) f or cr ypt o-asset ser vice providers as author ised under the Regulation on mark ets in cr ypt o-assets and issuers of asset-

− referenced tok ens, the compet ent author ity designat ed in accordance with the relevant provision of that Regulation;

− (e) f or central secur ities depositories, the compet ent author ity designated in accordance with Ar ticle 11 of Regulation

− (EU) No 909/2014;

− (f) f or central counter par ties, the compet ent author ity designat ed in accordance with Ar ticle 22 of Regulation (EU)

− No 648/2012;

− (g) f or trading venues and data repor ting ser vice providers, the compet ent author ity designat ed in accordance with

− Ar ticle 67 of Directive 2014/65/EU, and the compet ent author ity as def ined in Ar ticle 2(1), point (18), of Regulation

− (EU) No 600/2014;

− (h) f or trade repositori es, the compet ent author ity designated in accordance with Ar ticle 22 of Regulation (EU)

− No 648/2012;

− (i) f or managers of altern ative investment funds, the compet ent author ity designate d in accordance with Ar ticle 44 of

− Directive 2011/61/EU;

− (j) f or management compan ies, the compet ent author ity designate d in accordance with Ar ticle 97 of Directive

− 2009/65/EC;

− (k) f or insurance and reinsurance under takings, the compet ent author ity designated in accordance with Ar ticle 30 of

− Directive 2009/138/EC;

− (l) f or insurance interm ediar ies, reinsurance interm ediar ies and ancillar y insurance interm ediar ies, the compe tent

− author ity designated in accordance with Ar ticle 12 of Directive (EU) 2016/97;

− (m) f or institutions f or occupational retirement provi sion, the compet ent author ity designated in accordance with

− Ar ticle 47 of Directive (EU) 2016/2341;

− (n) f or credit rating ag encies, the compet ent author ity designat ed in accordance with Ar ticle 21 of Regulation (EC)

− No 1060/2009;

− (o) f or administrator s of cr itical benchmarks, the compet ent author ity designated in accordance with Ar ticles 40 and 41

− of Regulation (EU) 2016/1011;

− (

− 38

− ) Directive (EU) 2019/2034 of the European P arliament and of the Council of 27 November 2019 on the pr udential super vision of

− investment fir ms and amending Directives 2002/87/EC, 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU

− (OJ L 314, 5.12.2019, p. 64).

− EN

− Offi cial Jour nal of the European Uni on L 333/68 27.12.2022

− (p) f or crowdfunding ser vice providers, the compet ent author ity designated in accordance with Ar ticle 29 of Regulation

− (EU) 2020/1503;

− (q) f or secur itisation repositori es, the compet ent author ity designated in accordance with Ar ticles 10 and 14(1) of

− Regulation (EU) 2017/2402.

− Ar ticle 47

− Cooperation with st r uctures and author ities est ablished by Directiv e (EU) 2022/2555

− 1. T o f oster cooperation and enable super visor y exc hanges between the compe tent author ities designat ed under this

− Regulation and the Cooperation Group established by Ar ticle 14 of Directive (EU) 2022/2555, the ES As and the

− compet ent author ities ma y par ticipate in the activities of the Cooperation Group f or matt ers that concer n their

− super visor y activities in relation to fi nancial entities. The ESA s and the compet ent author ities ma y request to be inv ite d to

− par ticipate in the activities of the Cooperation Group f or matte rs in relation to essential or impor tant entities subject to

− Directive (EU) 2022/2555 that hav e also been designat ed as cr itical ICT third-par ty ser vice provid ers pursuant to

− Ar ticle 31 of this Regulation.

− 2. Where appropr iat e, compet ent author ities ma y consult and share inf or mation with the sing le points of contact and

− the CSIRT s designat ed or established in accordance with Directive (EU) 2022/2555.

− 3. Where appropr iat e, compet ent author ities ma y request any relevant te chnical advice and assistance from the

− compet ent author ities designate d or established in accordance with Directive (EU) 2022/2555 and establish cooperation

− ar range ments to allow eff ective and f ast-response coordination mechanisms to be set up.

− 4. The ar rang ements refer red to in paragraph 3 of this Ar ticle ma y , inter alia, specify the procedures f or the coordination

− of super visor y and oversight activities in relation to essential or im por tant entities subject to Directive (EU) 2022/2555 that

− hav e been designated as cr itical ICT third-par ty ser vice provi ders pursuant to Ar ticle 31 of this Regulation, including f or the

− conduct, in accordance with national la w , of inv estiga tions and on-site inspections, as well as f or mechanisms f or the

− exc hange of inf or mation between the compet ent author ities under this Regulation and the compet ent author ities

− designate d or established in accordance with that Directive which includes access to inf or mation requeste d by the latter

− author ities.

− Ar ticle 48

− Cooperation betw een author ities

− 1. Com petent author ities shall cooperate closely among themselves and, where applicable, with the Lead Overseer .

− 2. Com petent author ities and the Lead Overseer shall, in a timely manner , mutually exc hange all relevant inf or mation

− concer ning cr itical ICT third-par ty ser vice provi ders which is necessar y f or them to car r y out their respective duties under

− this Regulation, in par ticular in relation to identified r isks , approac hes and measures tak en as par t of the Lead Overseer ’s

− o versight tasks.

− Ar ticle 49

− Financial cross-sector ex ercises, communication and cooperation

− 1. The ESAs, through the Joint Committ ee and in collaboration with compet ent author ities, resolution author ities as

− refer red to in Ar ticle 3 of Directive 2014/59/EU, the ECB, the Sing le Resolution Board as regar ds inf or mation relating to

− entities falling under the scope of Regulation (EU) No 806/2014, the ESRB and ENIS A, as appropr iate, ma y establish

− mechani sms to enable the shar ing of eff ective practices across financial sector s to enhance situational awareness and

− identify common cyber vulnerabilities and r isks across sect ors.

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/69

− They ma y develop cr isis manag ement and contingenc y exercises inv olving cyber -attack scenar ios with a view to developing

− communication channels and gradually enabling an eff ective coordinat ed response at U nion level in the event of a maj or

− cross-border ICT -relat ed incident or related threat hav ing a system ic im pact on the U nion’s financial sector as a whole.

− Those exercises ma y , as appropr iate, also test the financial sector ’s dependencies on other economic sector s.

− 2. Com petent author ities, ESA s and the ECB shall cooperate closely with each other and exc hange inf or mation to car r y

− out their duties pursuant to Ar ticles 47 to 54. They shall closely coordinat e their super vision in order to identify and

− remedy breac hes of this Regulation, develop and promot e best practices, facilitat e collaboration, f oster consiste ncy of

− interpretat ion and provid e cross-jur isdictional assessments in the event of an y disagreements.

− Ar ticle 50

− Ad minist rativ e penalties and remedial measures

− 1. Com petent author ities shall have all super visor y , inv estigat or y and sanctioning po wers necessar y to fulfil their duties

− under this Regulation.

− 2. The powers refer red to in paragraph 1 shall include at least the f ollo wing powers to:

− (a) have access to an y document or data held in an y f or m that the compet ent author ity considers relevant f or the

− performa nce of its duties and receive or take a cop y of it ;

− (b) car r y out on-site inspections or inv estigations, whic h shall include but shall not be limited to;

− (i) summoning representatives of the financia l entities f or oral or wr itten explanations on fact s or documents relating

− to the subject matt er and pur pose of the inv estigation and to record the answers;

− (ii) inte r viewing an y other natural or legal person who consents to be inter viewed f or the pur pose of collecting

− inf or mation relating to the subject matte r of an inv estigation;

− (c) require cor rective and remedial measures f or breac hes of the requirements of this Regulation.

− 3. Without prejudice to the r ight of Member Stat es to impose cr iminal penalties in accordance with Ar ticle 52, Member

− State s shall la y down r ules establishing appropr iate administrative penalties and remedial measures f or breac hes of this

− Regulation and shall ensure their eff ective implementation.

− Those penalties and measures shall be effective, propor tionate and dissuasive.

− 4. Member States shall confer on compet ent author ities the po wer to apply at least the f ollo wing administrative

− penalties or remedial measures f or breaches of this Regulation:

− (a) issue an order requir ing the natural or leg al person to cease conduct that is in breac h of this Regulation and to desist

− from a repetition of that conduct ;

− (b) require the tem porar y or per manent cessation of any practice or conduct that the compet ent author ity considers to be

− contrar y to the provisions of this Regulation and prevent repetition of that practice or conduct ;

− (c) adopt an y type of measure, including of pecuniar y nature, to ensure that fi nancial entities continue to compl y with legal

− requirements;

− (d) require, insof ar as per mitted by national law , existing data traff ic records held by a telecommunication operat or , where

− there is a reasonable suspicion of a breach of this Regulation and where such records ma y be relevant to an

− investig ation into breaches of this Regulation; and

− (e) issue public notices, including public statements indicating the identity of the natural or leg al person and the nature of

− the breach.

− EN

− Offi cial Jour nal of the European Uni on L 333/70 27.12.2022

− 5. Where paragraph 2, point (c), and paragraph 4 apply to leg al persons, Member Stat es shall confer on compet ent

− author ities the power to apply the administrative penalties and remedial measures, subject to the conditions provided f or

− in national law , to members of the management body , and to other individuals who under national la w are responsible f or

− the breac h.

− 6. Member Stat es shall ensure that an y decision im posing administrative penalties or remedial measures set out in

− paragraph 2, point (c), is properly reasoned and is subject to a r ight of appeal.

− Ar ticle 51

− Ex ercise of the po w er t o impose administ rativ e penalties and remedial measures

− 1. Com petent author ities shall exe rcise the po wers to im pose administrative penalties and remedial measures refer red to

− in Ar ticle 50 in accordance with their national leg al framewor k s, where appropr iate, as f ollo ws:

− (a) directly ;

− (b) in collaboration with other author ities;

− (c) under their responsibility by delegatio n to other author ities; or

− (d) by application to the compet ent judicial author ities.

− 2. Com petent author ities, when det er mining the type and level of an administrative penalty or remedial measure to be

− imp osed under Ar ticle 50, shall take into account the extent to which the breach is intentional or results from neg lig ence,

− and all other relevant circumstances, including the f ollo wing, where appropr iat e:

− (a) the mater iality , grav ity and the duration of the breach;

− (b) the degree of responsibility of the natural or legal person responsible f or the breac h;

− (c) the fi nancial strength of the responsible natural or leg al person;

− (d) the im por tance of prof its gained or losses av oided by the responsible natural or legal person, insof ar as the y can be

− deter mined;

− (e) the losses f or third par ties caused by the breac h, insofar as they can be det er mined;

− (f) the level of cooperation of the responsible natural or leg al person with the compet ent author ity , without prejudice to

− the need to ensure disgorgement of prof its ga ined or losses av oided by that natural or leg al person;

− (g) previous breac hes by the responsible natural or leg al person.

− Ar ticle 52

− Cr iminal penalties

− 1. Member States ma y decide not to la y down r ules f or administrative penalties or remedial measures f or breac hes that

− are subject to cr iminal penalties under their national la w .

− 2. Where Member State s have chosen to la y down cr iminal penalties f or breaches of this Regulation, they shall ensure

− that appropr iate measures are in place so that compet ent author ities have all the necessar y po wers to liaise with judicial,

− prosecuting, or cr iminal justice author ities within their jur isdiction to receive specifi c inf or mation relat ed to cr iminal

− inve stigations or proceedings commenced f or breaches of this Regulation, and to provide the same inf or mation to other

− compet ent author ities, as well as EBA, ESMA or EIOP A to fulf il their oblig ations to cooperate f or the pur poses of this

− Regulation.

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/71

− Ar ticle 53

− Notif ication duties

− Member Stat es shall notify the la ws, regulations and administrative provisions implementing this Chapt er , including an y

− relevant cr iminal la w provis ions, to the Commission, ESMA, the EBA and EIOP A by 17 Januar y 2025 . Member States shall

− notify the Commission, ESMA, the EBA and EIOP A without undue dela y of an y subsequent amendments thereto.

− Ar ticle 54

− Publication of administrativ e penalties

− 1. Com petent author ities shall publish on their official websites, without undue dela y , an y decision im posing an

− administrative penalty ag ainst which there is no appeal af te r the addressee of the penalty has been notified of that decision.

− 2. The publication refe r red to in paragraph 1 shall include inf or mation on the type and nature of the breach, the identity

− of the persons responsible and the penalties imposed.

− 3. Where the compet ent author ity , f ollowi ng a case-by- case assessment, considers that the publication of the identity , in

− the case of legal persons, or of the identity and personal data, in the case of natural persons, w ould be dispropor tionate,

− including r isks in relation to the protect ion of personal data, jeopardise the stability of fi nancial markets or the pursuit of

− an ongoing cr iminal inv estigation, or cause, insofa r as these can be deter mined, dispropor tionate damages to the person

− inv olved, it shall adopt one of the f ollowi ng solutions in respect of the decision imposing an administrative penalty:

− (a) defer its publication until all reasons f or non-publication cease to exist ;

− (b) publish it on an anonymous basis, in accordance with national la w ; or

− (c) refrain from publishing it, where the op tions set out in points (a) and (b) are deemed either insuffi cient to guarantee a

− lack of any dang er f or the stability of fi nancial mark ets, or where such a publication w ould not be propor tionate to the

− leniency of the imposed penalty .

− 4. In the case of a decision to publish an administrative penalty on an anony mous basis in accordance with paragraph 3,

− point (b), the publication of the relevant data ma y be postponed.

− 5. Where a compe tent author ity publishes a decision imposing an administrative penalty against whic h there is an

− appeal bef ore the relevant judicial author ities, compet ent author ities shall immediately add on their official website that

− inf or mation and, at later stages , any subsequent relat ed inf or mation on the outcome of such appeal. Any judicial decision

− annulling a decision imposing an administrative penalty shall also be published.

− 6. Com petent author ities shall ensure that any publication refer red to in paragraphs 1 to 4 shall remain on their off icial

− website only f or the per iod whic h is necessar y to br ing f or th this Ar ticle. This per iod shall not exceed five years af ter its

− publication.

− Ar ticle 55

− Professiona l secrecy

− 1. Any conf idential inf or mation received, exc hanged or transmitted pursuant to this Regulation shall be subject to the

− conditions of professiona l secrecy laid down in paragraph 2.

− 2. The oblig ation of profes sional secrecy applies to all persons who w ork , or who hav e w orked, f or the compe tent

− author ities pursuant to this Regulation, or f or any author ity or market under taking or natural or legal person to whom

− those compet ent author ities have delegat ed their powers, including auditors and exper ts contracted by them.

− EN

− Offi cial Jour nal of the European Uni on L 333/72 27.12.2022

− 3. Inf or mation co vered by professiona l secrecy , including the exc hang e of inf or mation among compet ent author ities

− under this Regulation and compet ent author ities designat ed or established in accordance with Directive (EU) 2022/2555,

− shall not be disclosed to an y other person or author ity excep t by vir tue of provisions laid down by Union or national law;

− 4. All inf or mation exc hang ed between the compet ent author ities pursuant to this Regulation that concer ns business or

− operational conditions and other economic or personal affairs shall be considered conf idential and shall be subject to the

− requirements of profe ssional secrecy , excep t where the compet ent author ity states, at the time of communication, that

− such inf or mation ma y be disclosed or where such disclosure is necessar y f or leg al proceedings.

− Ar ticle 56

− Data Protection

− 1. The ESAs and the compet ent author ities shall be allo wed to process personal data only where necessar y f or the

− pur pose of car r ying out their respective oblig ations and duties pursuant to this Regulation, in par ticular f or investig ation,

− inspection, request f or inf or mation, communication, publication, evaluation, ver ification, assessment and draf ting of

− o versight plans. The personal data shall be processed in accordance with Regulation (EU) 2016/679 or Regulation (EU)

− 2018/1725, which ever is applicable.

− 2. Ex cept where other wise provid ed in other sector al acts, the personal data refe r red to in paragraph 1 shall be retained

− until the disc harge of the applicable super visor y duties and in an y case f or a maximum per iod of 15 years, exce pt in the

− event of pending cour t proceedings requir ing fur ther ret ention of such data.

− CHAPTER VIII

− Deleg ated acts

− Ar ticle 57

− Ex ercise of the delegation

− 1. The po wer to adopt delegat ed acts is conferr ed on the Commission subject to the conditions laid down in this Ar ticle.

− 2. The power to adop t delegat ed acts refe r red to in Ar ticles 31(6) and 43(2) shall be conferred on the Commission f or a

− per iod of five yea rs from 17 Januar y 2024 . The Commission shall dra w up a repor t in respect of the delegat ion of po wer

− not later than nine months bef ore the end of the five-year per iod. The delegation of power shall be tacitly extended f or

− per iods of an identical duration, unless the European P arliament or the Council opposes such extension not later than

− three months bef ore the end of each per iod.

− 3. The delegation of power refer red to in Ar ticles 31(6) and 43(2) ma y be revok ed at any time by the European

− P arliament or by the Council. A decision to revok e shall put an end to the delegat ion of the po wer specified in that

− decision. It shall take eff ect the da y f ollowi ng the publication of the decision in the Off icial Jour nal of the European Union or

− at a later date specifi ed therein. It shall not aff ect the validity of any delegat ed acts already in f orce.

− 4. Bef ore adop ting a delegat ed act, the Commission shall consult exper ts designate d by each Member Stat e in accordance

− with the pr inciples laid down in the Interin stitutional Agreement of 13 Apr il 2016 on Better La w-Making.

− 5. As soon as it adopts a deleg ated act, the Commission shall notify it simultaneously to the European P arliament and to

− the Council.

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/73

− 6. A delega ted act adop ted pursuant to Ar ticles 31(6) and 43(2) shall ent er into f orce only if no objection has been

− expressed either by the European P arliament or by the Council within a per iod of three months of notificati on of that act

− to the European Parliament and the Council or if, bef ore the expir y of that per iod, the European P arliament and the

− Council have both inf or med the Commission that they will not object. That per iod shall be extended by three months at

− the initiative of the European Parliament or of the Council.

− CHAPTER IX

− T r ansitional and final provisions

− Section I

− Ar ticle 58

− Review clause

− 1. By 17 Januar y 2028 , the Commission shall, af te r consulting the ESAs and the ESRB, as appropr iat e, car r y out a

− review and submit a repor t to the European P arliament and the Council, accompanied, where appropr iat e, by a legislative

− proposal. The review shall include at least the f ollo wing:

− (a) the cr iter ia f or the designation of cr itical ICT third-par ty ser vice providers in accordance with Ar ticle 31(2);

− (b) the voluntary nature of the notific ation of signif icant cyber threats refe r red to in Ar ticle 19;

− (c) the regime ref er red to in Ar ticle 31(12) and the po wers of the Lead Overseer provi ded f or in Ar ticle 35(1), point (d),

− point (iv), fi rst indent, with a view to evaluating the effectiveness of those provisions with regar d to ensur ing effe ctive

− oversight of cr itical ICT third-par ty ser vice providers established in a third countr y , and the necessity to establish a

− subsidiar y in the U nion.

− For the pur poses of the fi rst subparagraph of this point, the review shall include an analysis of the regime refe r red to in

− Ar ticle 31(12), including in term s of access f or Uni on financial entities to ser vices from third countr ies and av ailability

− of such ser vices on the Union market and it shall take into account fur ther developments in the mark ets f or the ser vices

− covered by this Regulation, the practical exper ience of fi nancial entities and fi nancial super visors with regar d to the

− application and, respectively , super vision of that regime, and any relevant regulatory and super visor y developments

− taking place at inte r national level.

− (d) the appropr iateness of including in the scope of this Regulation financial entities refer red to in Ar ticle 2(3), point (e),

− making use of automat ed sales systems, in light of future mark et developments on the use of such syste ms;

− (e) the functioning and effe ctiveness of the JON in suppor ting the consistency of the o versight and the efficiency of the

− exc hang e of inf or mation within the Oversight Framew ork .

− 2. In the conte xt of the review of Directive (EU) 2015/2366, the Commission shall assess the need f or increased cyber

− resilience of pa yment syste ms and pa yment-processing activities and the appropr iateness of extending the scope of this

− Regulation to operat ors of pa yment systems and entities inv olved in pa yment-processing activities. In light of this

− assessment, the Commission shall submit, as par t of the review of Directive (EU) 2015/2366, a repor t to the European

− P arliament and the Council no later than 17 July 2023 .

− Based on that review repor t, and af ter consulting ESAs, ECB and the ESRB, the Commission ma y submit, where appropr iat e

− and as par t of the legislative proposal that it ma y adopt pursuant to Ar ticle 108, second paragraph, of Directive (EU)

− 2015/2366, a proposal to ensure that all operat ors of pa yment systems and entities inv olved in pa yment-processing

− activities are subject to an appropr iate o versight, while taking into account existing o versight by the central bank.

− EN

− Offi cial Jour nal of the European Uni on L 333/74 27.12.2022

− 3. By 17 Januar y 2026 , the Commission shall, af ter consulting the ESA s and the Committ ee of European Aud iting

− Oversight Bodies, car r y out a review and submit a repor t to the European P arliament and the Council, accompanied, where

− appropr iat e, by a legislative proposal, on the appropr iat eness of strengthened requirements f or statut or y auditors and audit

− fi r ms as regar ds digital operational resilience, by means of the inclusion of statutor y auditors and audit fi r ms into the scope

− of this Regulation or by means of amendments to Directive 2006/43/EC of the European P arliament and of the Council (

− 39

− ) .

− Ar ticle 59

− Regulation (EC) No 1060/2009 is amended as f ollows :

− (1) in Annex I, Section A, point 4, the fi rst subparagraph is replaced by the f ollowing:

− ‘ A credit rating age ncy shall have sound administrative and accounting procedures, internal control mechanis ms,

− eff ective procedures f or r isk assessment, and effe ctive control and safeguard ar range ments f or managing ICT systems

− in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*).

− _____________

− (*) Regulation (EU) 2022/2554 of the European P arliament and of the Council of 14 December 2022 on digital

− operational resilience f or the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012,

− (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).’;

− (2) in Annex III, point 12 is replaced by the f ollowing:

− ‘12. The credit rating ag ency infr inge s Ar ticle 6(2), in conjunction with point 4 of Section A of Annex I, by not having

− sound administrative or accounting procedures, intern al control mec hanisms, effective procedures f or r isk

− assessment, or eff ective control or safeg uard ar rangements f or managing ICT systems in accordance with

− Regulation (EU) 2022/2554; or by not im plementing or maintaining decision-making procedures or

− organisational str uctures as required by that point.’.

− Ar ticle 60

− Amendments t o Regulation (EU) No 648/2012

− Regulation (EU) No 648/2012 is amended as f ollows:

− (1) Ar ticle 26 is amended as f ollo ws:

− (a) paragraph 3 is replaced by the f ollo wing:

− ‘3. A CCP shall maintain and operat e an org anisational str ucture that ensures continuity and orderly

− functioning in the performa nce of its ser vices and activities. It shall emplo y appropr iate and propor tionate

− systems , resources and procedures, including ICT systems manage d in accordance with Regulation (EU) 2022/

− 2554 of the European Parliament and of the Council (*).

− _____________

− (*) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital

− operational resilience f or the financial sector and amending Regulations (EC) No 1060/2009, (EU)

− No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).’;

− (

− 39

− ) Directive 2006/43/EC of the European P arliament and of the Council of 17 Ma y 2006 on statut or y audits of annual accounts and

− consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC

− (OJ L 157, 9.6.2006, p. 87).

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/75

− (2) Ar ticle 34 is amended as f ollo ws:

− (a) paragraph 1 is replaced by the f ollo wing:

− ‘1. A CCP shall establish, implement and maintain an adequate business continuity policy and disaster reco ver y

− plan, which shall include ICT business continuity policy and ICT response and recovery plans put in place and

− im plemented in accordance with Regulation (EU) 2022/2554, aiming to ensure the preser vation of its functions,

− the timely recovery of operations and the fulf ilment of the CCP’s oblig ations.’;

− (b) in paragraph 3, the first subparagraph is replaced by the f ollowi ng:

− ‘3. In order to ensure consistent application of this Ar ticle, ESMA shall, af ter consulting the members of the

− ESCB, develop draf t regulatory tec hnical standards specifying the minimum conte nt and requirements of the

− business continuity policy and of the disaster recovery plan, excl uding ICT business continuity policy and disaster

− recovery plans.’;

− (3) in Ar ticle 56(3), the first subparagraph is replaced by the f ollowi ng:

− ‘3. In order to ensure consistent application of this Ar ticle, ESMA shall develop draf t regulatory tec hnical standards

− specifying the details, other than f or requirements relat ed to ICT r isk manage ment, of the application f or registration

− refe r red to in paragraph 1.’;

− (4) in Ar ticle 79, paragraphs 1 and 2 are replaced by the f ollowi ng:

− ‘1. A trade reposit or y shall identify sources of operational r isk and minimise them also through the development of

− appropr iate systems , controls and procedures, including ICT system s manage d in accordance with Regulation (EU)

− 2022/2554.

− 2. A trade repository shall establish, implement and maintain an adequat e business continuity policy and disaster

− reco ver y plan including ICT business continuity policy and ICT response and reco ver y plans established in accordance

− with Regulation (EU) 2022/2554, aiming to ensure the maintenance of its functions, the timely recovery of operations

− and the fulf ilment of the trade repository’s oblig ations.’;

− (5) in Ar ticle 80, paragraph 1 is delet ed.

− (6) in Annex I, Section II is amended as f ollows :

− (a) points (a) and (b) are replaced by the f ollowi ng:

− ‘(a) a trade repository infr inges Ar ticle 79(1) by not identifying sources of operational r isk or by not minimising

− those r isks through the development of appropr iate syste ms, controls and procedures including ICT systems

− manag ed in accordance with Regulation (EU) 2022/2554;

− (b) a trade repository infr inge s Ar ticle 79(2) by not establishing, im plementing or maintaining an adequate

− business continuity policy and disaster recovery plan established in accordance with Regulation (EU) 2022/

− 2554, aiming to ensure the maintenanc e of its functions, the timely recovery of operations and the fulfilment

− of the trade reposit or y’s oblig ations;’;

− (7) Annex III is amended as f ollows :

− (a) Section II is amended as f ollows:

− (i) point (c) is replaced by the f ollowi ng:

− ‘(c) a Tier 2 CCP infr ing es Ar ticle 26(3) by not maintaining or operating an org anisational str ucture that

− ensures continuity and orderly functioning in the performa nce of its ser vices and activities or by not

− emplo ying appropr iate and propor tionat e systems, resources or procedures including ICT systems

− managed in accordance with Regulation (EU) 2022/2554;’;

− (ii) point (f) is delet ed.

− Offi cial Jour nal of the European Uni on L 333/76 27.12.2022

− (b) in Section III, point (a) is replaced by the f ollo wing:

− ‘(a) a Tier 2 CCP infr ing es Ar ticle 34(1) by not establishing, implementing or maintaining an adequate business

− continuity policy and response and recovery plan set up in accordance with Regulation (EU) 2022/2554,

− aiming to ensure the preser vation of its functions, the timely recovery of operations and the fulfilment of the

− CCP’s obligations, whic h at least allows f or the recovery of all transactions at the time of disr upti on to allow

− the CCP to continue to operate with cer tainty and to complet e settlement on the sched uled date;’ .

− Ar ticle 61

− Amendments t o Regulation (EU) No 909/2014

− Ar ticle 45 of Regulation (EU) No 909/2014 is amended as f ollo ws:

− (1) paragraph 1 is replaced by the f ollowing:

− ‘1. A CSD shall identify sources of operational r isk, both intern al and extern al, and minimise their impact also

− through the deplo yment of appropr iat e ICT too ls, processes and policies set up and manag ed in accordance with

− Regulation (EU) 2022/2554 of the European P arliament and of the Council (*), as well as through an y other relevant

− appropr iate too ls, controls and procedures f or other types of operational r isk, including f or all the secur ities

− settlement systems it operates.

− _____________

− (*) Regulation (EU) 2022/2554 of the European P arliament and of the Council of 14 December 2022 on digital

− operational resilience f or the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012,

− (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).’;

− (2) paragraph 2 is delet ed;

− (3) paragraphs 3 and 4 are replaced by the f ollo wing:

− ‘3. For ser vices that it provid es as well as f or each secur ities settlement system that it operates, a CSD shall establish,

− im plement and maintain an adequate business continuity policy and disaster recovery plan, including ICT business

− continuity policy and ICT response and reco ver y plans established in accordance with Regulation (EU) 2022/2554, to

− ensure the preser vation of its ser vices, the timely recovery of operations and the fulfilme nt of the CSD’s obligations in

− the case of events that pose a signif icant r isk to disr upting operations.

− 4. The plan refer red to in paragraph 3 shall provid e f or the reco ver y of all transactions and par ticipants ’ positions at

− the time of disr uption to allo w the par ticipants of a CSD to continue to operat e with cer tainty and to compl ete

− settlement on the schedule d date, including by ensur ing that cr itical IT systems can resume operations from the time

− of disr upti on as provi ded f or in Ar ticle 12(5) and (7) of Regulation (EU) 2022/2554.’;

− (4) paragraph 6 is replaced by the f ollowing:

− ‘6. A CSD shall identify , monitor and manage the r isks that ke y par ticipants in the secur ities settlement systems it

− operat es, as well as ser vice and utility pro viders, and other CSDs or other mark et infrastr uctures might pose to its

− operations. It shall, upon request, provide compet ent and relevant author ities with inf or mation on an y such r isk

− identified. It shall also inf or m the compet ent author ity and relevant author ities without dela y of an y operational

− incidents, other than in relation to ICT r isk, resulting from such r isks .’;

− (5) in paragraph 7, the first subparagraph is replaced by the f ollowing:

− ‘7. ESMA shall, in close cooperation with the members of the ESCB, develop draf t regulatory tec hnical standards to

− specify the operational r isks refer red to in paragraphs 1 and 6, other than ICT r isk, and the methods to test, to address

− or to minimise those r isks , including the business continuity policies and disaster recover y plans refer red to in

− paragraphs 3 and 4 and the methods of assessment thereof.’ .

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/77

− Ar ticle 62

− Amendments t o Regulation (EU) No 600/2014

− Regulation (EU) No 600/2014 is amended as f ollows:

− (1) Ar ticle 27g is amended as f ollows:

− (a) paragraph 4 is replaced by the f ollo wing:

− ‘4. An AP A shall compl y with the requirements concer ning the secur ity of netw ork and inf or mation systems set

− out in Regulation (EU) 2022/2554 of the European P arliament and of the Council (*).

− _____________

− (*) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital

− operational resilience f or the financial sector and amending Regulations (EC) No 1060/2009, (EU)

− No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).’;

− (b) in paragraph 8, point (c) is replaced by the f ollo wing:

− ‘(c) the concrete organisational requirements laid down in paragraphs 3 and 5.’;

− (2) Ar ticle 27h is amended as f ollows:

− (a) paragraph 5 is replaced by the f ollo wing:

− ‘5. A CTP shall comply with the requirements concer ning the secur ity of netw ork and inf or mation syste ms set

− out in Regulation (EU) 2022/2554.’.

− (b) in paragraph 8, point (e) is replaced by the f ollowing:

− ‘(e) the concrete org anisational requirements laid down in paragraph 4.’;

− (3) Ar ticle 27i is amended as f ollows:

− (a) paragraph 3 is replaced by the f ollo wing:

− ‘3. An ARM shall compl y with the requirements concer ning the secur ity of netw ork and inf or mation systems

− set out in Regulation (EU) 2022/2554.’;

− (b) in paragraph 5, point (b) is replaced by the f ollowing:

− ‘(b) the concrete orga nisational requirements laid down in paragraphs 2 and 4.’.

− Ar ticle 63

− In Ar ticle 6 of Regulation (EU) 2016/1011, the f ollowing paragraph is added:

− ‘6. For cr itical benc hmark s, an administrator shall hav e sound administrative and accounting procedures, intern al control

− mechanisms, effe ctive procedures f or r isk assessment, and eff ective control and safeg uard ar rangements f or managing

− ICT systems in accordance with Regulation (EU) 2022/2554 of the European P arliament and of the Council (*).

− _____________

− (*) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital

− operational resilience f or the financia l sect or and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU)

− No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).’.

− Offi cial Jour nal of the European Uni on L 333/78 27.12.2022

− Ar ticle 64

− Entr y int o f orce and application

− This Regulation shall ent er into f orce on the twentieth da y f ollowi ng that of its publication in the Off icial Jour nal of the

− Eur opean Union.

− It shall apply from 17 Januar y 2025 .

− This Regulation shall be binding in its entirety and directly applicable in all Member States.

− Done at Strasbourg, 14 December 2022 .

− For the Europ ean P arliament

− The Pr esident

− R. METSOL A

− For the Council

− The Pr esident

− EN

− Offi cial Jour nal of the European Uni on 27.12.2022 L 333/79

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/1

+ REGULATIONS

+ REGULATION (EU) 2022/2554 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 14 December 2022

+ on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011

+ (Text with EEA relevance)

+ THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

+ Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof,

+ Having regard to the proposal from the European Commission,

+ After transmission of the draft legislative act to the national parliaments,

+ Having regard to the opinion of the European Central Bank (1),

+ Having regard to the opinion of the European Economic and Social Committee (2),

+ Acting in accordance with the ordinary legislative procedure (3),

+ (1) In the digital age, information and communication technology (ICT) supports complex systems used for everyday activities. It keeps our economies running in key sectors, including the financial sector, and enhances the functioning of the internal market. Increased digitalisation and interconnectedness also amplify ICT risk, making society as a whole, and the financial system in particular, more vulnerable to cyber threats or ICT disruptions. While the ubiquitous use of ICT systems and high digitalisation and connectivity are today core features of the activities of Union financial entities, their digital resilience has yet to be better addressed and integrated into their broader operational frameworks.

+ (2) The use of ICT has in the past decades gained a pivotal role in the provision of financial services, to the point where it has now acquired a critical importance in the operation of typical daily functions of all financial entities. Digitalisation now covers, for instance, payments, which have increasingly moved from cash and paper-based methods to the use of digital solutions, as well as securities clearing and settlement, electronic and algorithmic trading, lending and funding operations, peer-to-peer finance, credit rating, claim management and back-office operations. The insurance sector has also been transformed by the use of ICT, from the emergence of insurance

+ (1) OJ C 343, 26.8.2021, p. 1. (2) OJ C 155, 30.4.2021, p. 38. (3) Position of the European Parliament of 10 November 2022 (not yet published in the Official Journal) and decision of the Council of

+ L 333/2

+ Official Journal of the European Union

+ 27.12.2022

+ intermediaries offering their services online operating with InsurTech, to digital insurance underwriting. Finance has not only become largely digital throughout the whole sector, but digitalisation has also deepened interconnections and dependencies within the financial sector and with third-party infrastructure and service providers.

+ (3) The European Systemic Risk Board (ESRB) reaffirmed in a 2020 report addressing systemic cyber risk how the existing high level of interconnectedness across financial entities, financial markets and financial market infrastructures, and particularly the interdependencies of their ICT systems, could constitute a systemic vulnerability because localised cyber incidents could quickly spread from any of the approximately 22 000 Union financial entities to the entire financial system, unhindered by geographical boundaries. Serious ICT breaches that occur in the financial sector do not merely affect financial entities taken in isolation. They also smooth the way for the propagation of localised vulnerabilities across the financial transmission channels and potentially trigger adverse consequences for the stability of the Union's financial system, such as generating liquidity runs and an overall loss of confidence and trust in financial markets.

+ (4) In recent years, ICT risk has attracted the attention of international, Union and national policy makers, regulators and standard-setting bodies in an attempt to enhance digital resilience, set standards and coordinate regulatory or supervisory work. At international level, the Basel Committee on Banking Supervision, the Committee on Payments and Market Infrastructures, the Financial Stability Board, the Financial Stability Institute, as well as the G7 and G20 aim to provide competent authorities and market operators across various jurisdictions with tools to bolster the resilience of their financial systems. That work has also been driven by the need to duly consider ICT risk in the context of a highly interconnected global financial system and to seek more consistency of relevant best practices.

+ (5) Despite Union and national targeted policy and legislative initiatives, ICT risk continues to pose a challenge to the operational resilience, performance and stability of the Union financial system. The reforms that followed the 2008 financial crisis primarily strengthened the financial resilience of the Union financial sector and aimed to safeguard the competitiveness and stability of the Union from economic, prudential and market conduct perspectives. Although ICT security and digital resilience are part of operational risk, they have been less in the focus of the postfinancial crisis regulatory agenda and have developed in only some areas of the Union's financial services policy and regulatory landscape, or in only a few Member States.

+ (6) In its Communication of 8 March 2018 entitled `FinTech Action plan: For a more competitive and innovative European financial sector', the Commission highlighted the paramount importance of making the Union financial sector more resilient, including from an operational perspective to ensure its technological safety and good functioning, its quick recovery from ICT breaches and incidents, ultimately enabling the effective and smooth provision of financial services across the whole Union, including under situations of stress, while also preserving consumer and market trust and confidence.

+ (7) In April 2019, the European Supervisory Authority (European Banking Authority), (EBA) established by Regulation (EU) No 1093/2010 of the European Parliament and of the Council (4), the European Supervisory Authority (European Insurance and Occupational Pensions Authority), (`EIOPA') established by Regulation (EU) No 1094/2010 of the European Parliament and of the Council (5) and the European Supervisory Authority (European Securities and Markets Authority), (`ESMA') established by Regulation (EU) No 1095/2010 of the

+ (4) Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).

+ (5) Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48).

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/3

+ European Parliament and of the Council (6) (known collectively as `European Supervisory Authorities' or `ESAs') jointly issued technical advice calling for a coherent approach to ICT risk in finance and recommending to strengthen, in a proportionate way, the digital operational resilience of the financial services industry through a sector-specific initiative of the Union.

+ (8) The Union financial sector is regulated by a Single Rulebook and governed by a European system of financial supervision. Nonetheless, provisions tackling digital operational resilience and ICT security are not yet fully or consistently harmonised, despite digital operational resilience being vital for ensuring financial stability and market integrity in the digital age, and no less important than, for example, common prudential or market conduct standards. The Single Rulebook and system of supervision should therefore be developed to also cover digital operational resilience, by strengthening the mandates of competent authorities to enable them to supervise the management of ICT risk in the financial sector in order to protect the integrity and efficiency of the internal market, and to facilitate its orderly functioning.

+ (9) Legislative disparities and uneven national regulatory or supervisory approaches with regard to ICT risk trigger obstacles to the functioning of the internal market in financial services, impeding the smooth exercise of the freedom of establishment and the provision of services for financial entities operating on a cross-border basis. Competition between the same type of financial entities operating in different Member States could also be distorted. This is the case, in particular, for areas where Union harmonisation has been very limited, such as digital operational resilience testing, or absent, such as the monitoring of ICT third-party risk. Disparities stemming from developments envisaged at national level could generate further obstacles to the functioning of the internal market to the detriment of market participants and financial stability.

+ (10) To date, due to the ICT risk related provisions being only partially addressed at Union level, there are gaps or overlaps in important areas, such as ICT-related incident reporting and digital operational resilience testing, and inconsistencies as a result of emerging divergent national rules or cost-ineffective application of overlapping rules. This is particularly detrimental for an ICT-intensive user such as the financial sector since technology risks have no borders and the financial sector deploys its services on a wide cross-border basis within and outside the Union. Individual financial entities operating on a cross-border basis or holding several authorisations (e.g. one financial entity can have a banking, an investment firm, and a payment institution licence, each issued by a different competent authority in one or several Member States) face operational challenges in addressing ICT risk and mitigating adverse impacts of ICT incidents on their own and in a coherent cost-effective way.

+ (11) As the Single Rulebook has not been accompanied by a comprehensive ICT or operational risk framework, further harmonisation of key digital operational resilience requirements for all financial entities is required. The development of ICT capabilities and overall resilience by financial entities, based on those key requirements, with a view to withstanding operational outages, would help preserve the stability and integrity of the Union financial markets and thus contribute to ensuring a high level of protection of investors and consumers in the Union. Since this Regulation aims to contribute to the smooth functioning of the internal market, it should be based on the provisions of Article 114 of the Treaty on the Functioning of the European Union (TFEU) as interpreted in accordance with the consistent case law of the Court of Justice of the European Union (Court of Justice).

+ (12) This Regulation aims to consolidate and upgrade ICT risk requirements as part of the operational risk requirements that have, up to this point, been addressed separately in various Union legal acts. While those acts covered the main categories of financial risk (e.g. credit risk, market risk, counterparty credit risk and liquidity risk, market conduct risk), they did not comprehensively tackle, at the time of their adoption, all components of operational resilience. The operational risk rules, when further developed in those Union legal acts, often favoured a traditional quantitative approach to addressing risk (namely setting a capital requirement to cover ICT risk) rather than targeted qualitative rules for the protection, detection, containment, recovery and repair capabilities against ICT-related

+ (6) Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84).

+ L 333/4

+ Official Journal of the European Union

+ 27.12.2022

+ incidents, or for reporting and digital testing capabilities. Those acts were primarily meant to cover and update essential rules on prudential supervision, market integrity or conduct. By consolidating and upgrading the different rules on ICT risk, all provisions addressing digital risk in the financial sector should for the first time be brought together in a consistent manner in one single legislative act. Therefore, this Regulation fills in the gaps or remedies inconsistencies in some of the prior legal acts, including in relation to the terminology used therein, and explicitly refers to ICT risk via targeted rules on ICT risk-management capabilities, incident reporting, operational resilience testing and ICT third-party risk monitoring. This Regulation should thus also raise awareness of ICT risk and acknowledge that ICT incidents and a lack of operational resilience have the possibility to jeopardise the soundness of financial entities.

+ (13) Financial entities should follow the same approach and the same principle-based rules when addressing ICT risk taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations. Consistency contributes to enhancing confidence in the financial system and preserving its stability especially in times of high reliance on ICT systems, platforms and infrastructures, which entails increased digital risk. Observing basic cyber hygiene should also avoid imposing heavy costs on the economy by minimising the impact and costs of ICT disruptions.

+ (14) A Regulation helps reduce regulatory complexity, fosters supervisory convergence and increases legal certainty, and also contributes to limiting compliance costs, especially for financial entities operating across borders, and to reducing competitive distortions. Therefore, the choice of a Regulation for the establishment of a common framework for the digital operational resilience of financial entities is the most appropriate way to guarantee a homogenous and coherent application of all components of ICT risk management by the Union financial sector.

+ (15) Directive (EU) 2016/1148 of the European Parliament and of the Council (7) was the first horizontal cybersecurity framework enacted at Union level, applying also to three types of financial entities, namely credit institutions, trading venues and central counterparties. However, since Directive (EU) 2016/1148 set out a mechanism of identification at national level of operators of essential services, only certain credit institutions, trading venues and central counterparties that were identified by the Member States, have been brought into its scope in practice, and hence required to comply with the ICT security and incident notification requirements laid down in it. Directive (EU) 2022/2555 of the European Parliament and of the Council (8) sets a uniform criterion to determine the entities falling within its scope of application (size-cap rule) while also keeping the three types of financial entities in its scope.

+ (16) However, as this Regulation increases the level of harmonisation of the various digital resilience components, by introducing requirements on ICT risk management and ICT-related incident reporting that are more stringent in comparison to those laid down in the current Union financial services law, this higher level constitutes an increased harmonisation also in comparison with the requirements laid down in Directive (EU) 2022/2555. Consequently, this Regulation constitutes lex specialis with regard to Directive (EU) 2022/2555. At the same time, it is crucial to maintain a strong relationship between the financial sector and the Union horizontal cybersecurity framework as currently laid out in Directive (EU) 2022/2555 to ensure consistency with the cyber security strategies adopted by Member States and to allow financial supervisors to be made aware of cyber incidents affecting other sectors covered by that Directive.

+ (7) Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

+ (8) Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (see page 80 of this Official Journal).

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/5

+ (17) In accordance with Article 4(2) of the Treaty on European Union and without prejudice to the judicial review by the Court of Justice, this Regulation should not affect the responsibility of Member States with regard to essential State functions concerning public security, defence and the safeguarding of national security, for example concerning the supply of information which would be contrary to the safeguarding of national security.

+ (18) To enable cross-sector learning and to effectively draw on experiences of other sectors in dealing with cyber threats, the financial entities referred to in Directive (EU) 2022/2555 should remain part of the `ecosystem' of that Directive (for example, Cooperation Group and computer security incident response teams (CSIRTs)).The ESAs and national competent authorities should be able to participate in the strategic policy discussions and the technical workings of the Cooperation Group under that Directive, and to exchange information and further cooperate with the single points of contact designated or established in accordance with that Directive. The competent authorities under this Regulation should also consult and cooperate with the CSIRTs. The competent authorities should also be able to request technical advice from the competent authorities designated or established in accordance with Directive (EU) 2022/2555 and establish cooperation arrangements that aim to ensure effective and fast-response coordination mechanisms.

+ (19) Given the strong interlinkages between the digital resilience and the physical resilience of financial entities, a coherent approach with regard to the resilience of critical entities is necessary in this Regulation and Directive (EU) 2022/2557 of the European Parliament and the Council (9). Given that the physical resilience of financial entities is addressed in a comprehensive manner by the ICT risk management and reporting obligations covered by this Regulation, the obligations laid down in Chapters III and IV of Directive (EU) 2022/2557 should not apply to financial entities falling within the scope of that Directive.

+ (20) Cloud computing service providers are one category of digital infrastructure covered by Directive (EU) 2022/2555. The Union Oversight Framework (`Oversight Framework') established by this Regulation applies to all critical ICT third-party service providers, including cloud computing service providers providing ICT services to financial entities, and should be considered complementary to the supervision carried out pursuant to Directive (EU) 2022/ 2555. Moreover, the Oversight Framework established by this Regulation should cover cloud computing service providers in the absence of a Union horizontal framework establishing a digital oversight authority.

+ (21) In order to maintain full control over ICT risk, financial entities need to have comprehensive capabilities to enable a strong and effective ICT risk management, as well as specific mechanisms and policies for handling all ICT-related incidents and for reporting major ICT-related incidents. Likewise, financial entities should have policies in place for the testing of ICT systems, controls and processes, as well as for managing ICT third-party risk. The digital operational resilience baseline for financial entities should be increased while also allowing for a proportionate application of requirements for certain financial entities, particularly microenterprises, as well as financial entities subject to a simplified ICT risk management framework. To facilitate an efficient supervision of institutions for occupational retirement provision that is proportionate and addresses the need to reduce administrative burdens on the competent authorities, the relevant national supervisory arrangements in respect of such financial entities should take into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations even when the relevant thresholds established in Article 5 of Directive (EU) 2016/2341 of the European Parliament and of the Council (10) are exceeded. In particular, supervisory activities should focus primarily on the need to address serious risks associated with the ICT risk management of a particular entity.

+ (9) Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC (see page 164 of this Official Journal).

+ (10) Directive (EU) 2016/2341 of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (OJ L 354, 23.12.2016, p. 37).

+ L 333/6

+ Official Journal of the European Union

+ 27.12.2022

+ Competent authorities should also maintain a vigilant but proportionate approach in relation to the supervision of institutions for occupational retirement provision which, in accordance with Article 31 of Directive (EU) 2016/2341, outsource a significant part of their core business, such as asset management, actuarial calculations, accounting and data management, to service providers.

+ (22) ICT-related incident reporting thresholds and taxonomies vary significantly at national level. While common ground may be achieved through the relevant work undertaken by the European Union Agency for Cybersecurity (ENISA) established by Regulation (EU) 2019/881 of the European Parliament and of the Council (11) and the Cooperation Group under Directive (EU) 2022/2555, divergent approaches on setting the thresholds and use of taxonomies still exist, or can emerge, for the remainder of financial entities. Due to those divergences, there are multiple requirements that financial entities must comply with, especially when operating across several Member States and when part of a financial group. Moreover, such divergences have the potential to hinder the creation of further uniform or centralised Union mechanisms that speed up the reporting process and support a quick and smooth exchange of information between competent authorities, which is crucial for addressing ICT risk in the event of large-scale attacks with potentially systemic consequences.

+ (23) To reduce the administrative burden and potentially duplicative reporting obligations for certain financial entities, the requirement for the incident reporting pursuant to Directive (EU) 2015/2366 of the European Parliament and of the Council (12) should cease to apply to payment service providers that fall within the scope of this Regulation. Consequently, credit institutions, e-money institutions, payment institutions and account information service providers, as referred to in Article 33(1) of that Directive, should, from the date of application of this Regulation, report pursuant to this Regulation, all operational or security payment-related incidents which have been previously reported pursuant to that Directive, irrespective of whether such incidents are ICT-related.

+ (24) To enable competent authorities to fulfil supervisory roles by acquiring a complete overview of the nature, frequency, significance and impact of ICT-related incidents and to enhance the exchange of information between relevant public authorities, including law enforcement authorities and resolution authorities, this Regulation should lay down a robust ICT-related incident reporting regime whereby the relevant requirements address current gaps in financial services law, and remove existing overlaps and duplications to alleviate costs. It is essential to harmonise the ICT-related incident reporting regime by requiring all financial entities to report to their competent authorities through a single streamlined framework as set out in this Regulation. In addition, the ESAs should be empowered to further specify relevant elements for the ICT-related incident reporting framework, such as taxonomy, timeframes, data sets, templates and applicable thresholds. To ensure full consistency with Directive (EU) 2022/2555, financial entities should be allowed, on a voluntary basis, to notify significant cyber threats to the relevant competent authority, when they consider that the cyber threat is of relevance to the financial system, service users or clients.

+ (25) Digital operational resilience testing requirements have been developed in certain financial subsectors setting out frameworks that are not always fully aligned. This leads to a potential duplication of costs for cross-border financial entities and makes the mutual recognition of the results of digital operational resilience testing complex which, in turn, can fragment the internal market.

+ (11) Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (OJ L 151, 7.6.2019, p. 15).

+ (12) Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35).

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/7

+ (26) In addition, where no ICT testing is required, vulnerabilities remain undetected and result in exposing a financial entity to ICT risk and ultimately create a higher risk to the stability and integrity of the financial sector. Without Union intervention, digital operational resilience testing would continue to be inconsistent and would lack a system of mutual recognition of ICT testing results across different jurisdictions. In addition, as it is unlikely that other financial subsectors would adopt testing schemes on a meaningful scale, they would miss out on the potential benefits of a testing framework, in terms of revealing ICT vulnerabilities and risks, and testing defence capabilities and business continuity, which contributes to increasing the trust of customers, suppliers and business partners. To remedy those overlaps, divergences and gaps, it is necessary to lay down rules for a coordinated testing regime and thereby facilitate the mutual recognition of advanced testing for financial entities meeting the criteria set out in this Regulation.

+ (27) Financial entities' reliance on the use of ICT services is partly driven by their need to adapt to an emerging competitive digital global economy, to boost their business efficiency and to meet consumer demand. The nature and extent of such reliance has been continuously evolving in recent years, driving cost reduction in financial intermediation, enabling business expansion and scalability in the deployment of financial activities while offering a wide range of ICT tools to manage complex internal processes.

+ (28) The extensive use of ICT services is evidenced by complex contractual arrangements, whereby financial entities often encounter difficulties in negotiating contractual terms that are tailored to the prudential standards or other regulatory requirements to which they are subject, or otherwise in enforcing specific rights, such as access or audit rights, even when the latter are enshrined in their contractual arrangements. Moreover, many of those contractual arrangements do not provide for sufficient safeguards allowing for the fully-fledged monitoring of subcontracting processes, thus depriving the financial entity of its ability to assess the associated risks. In addition, as ICT thirdparty service providers often provide standardised services to different types of clients, such contractual arrangements do not always cater adequately for the individual or specific needs of financial industry actors.

+ (29) Even though Union financial services law contains certain general rules on outsourcing, monitoring of the contractual dimension is not fully anchored into Union law. In the absence of clear and bespoke Union standards applying to the contractual arrangements concluded with ICT third-party service providers, the external source of ICT risk is not comprehensively addressed. Consequently, it is necessary to set out certain key principles to guide financial entities' management of ICT third-party risk, which are of particular importance when financial entities resort to ICT third-party service providers to support their critical or important functions. Those principles should be accompanied by a set of core contractual rights in relation to several elements in the performance and termination of contractual arrangements with a view to providing certain minimum safeguards in order to strengthen financial entities' ability to effectively monitor all ICT risk emerging at the level of third-party service providers. Those principles are complementary to the sectoral law applicable to outsourcing.

+ (30) A certain lack of homogeneity and convergence regarding the monitoring of ICT third-party risk and ICT third-party dependencies is evident today. Despite efforts to address outsourcing, such as EBA Guidelines on outsourcing of 2019 and ESMA Guidelines on outsourcing to cloud service providers of 2021 the broader issue of counteracting systemic risk which may be triggered by the financial sector's exposure to a limited number of critical ICT thirdparty service providers is not sufficiently addressed by Union law. The lack of rules at Union level is compounded by the absence of national rules on mandates and tools that allow financial supervisors to acquire a good understanding of ICT third-party dependencies and to monitor adequately risks arising from the concentration of ICT third-party dependencies.

+ L 333/8

+ Official Journal of the European Union

+ 27.12.2022

+ (31) Taking into account the potential systemic risk entailed by increased outsourcing practices and by the ICT thirdparty concentration, and mindful of the insufficiency of national mechanisms in providing financial supervisors with adequate tools to quantify, qualify and redress the consequences of ICT risk occurring at critical ICT third-party service providers, it is necessary to establish an appropriate Oversight Framework allowing for a continuous monitoring of the activities of ICT third-party service providers that are critical ICT third-party service providers to financial entities, while ensuring that the confidentiality and security of customers other than financial entities is preserved. While intra-group provision of ICT services entails specific risks and benefits, it should not be automatically considered less risky than the provision of ICT services by providers outside of a financial group and should therefore be subject to the same regulatory framework. However, when ICT services are provided from within the same financial group, financial entities might have a higher level of control over intra-group providers, which ought to be taken into account in the overall risk assessment.

+ (32) With ICT risk becoming more and more complex and sophisticated, good measures for the detection and prevention of ICT risk depend to a great extent on the regular sharing between financial entities of threat and vulnerability intelligence. Information sharing contributes to creating increased awareness of cyber threats. In turn, this enhances the capacity of financial entities to prevent cyber threats from becoming real ICT-related incidents and enables financial entities to more effectively contain the impact of ICT-related incidents and to recover faster. In the absence of guidance at Union level, several factors seem to have inhibited such intelligence sharing, in particular uncertainty about its compatibility with data protection, anti-trust and liability rules.

+ (33) In addition, doubts about the type of information that can be shared with other market participants, or with nonsupervisory authorities (such as ENISA, for analytical input, or Europol, for law enforcement purposes) lead to useful information being withheld. Therefore, the extent and quality of information sharing currently remains limited and fragmented, with relevant exchanges mostly being local (by way of national initiatives) and with no consistent Union-wide information-sharing arrangements tailored to the needs of an integrated financial system. It is therefore important to strengthen those communication channels.

+ (34) Financial entities should be encouraged to exchange among themselves cyber threat information and intelligence, and to collectively leverage their individual knowledge and practical experience at strategic, tactical and operational levels with a view to enhancing their capabilities to adequately assess, monitor, defend against, and respond to cyber threats, by participating in information sharing arrangements. It is therefore necessary to enable the emergence at Union level of mechanisms for voluntary information-sharing arrangements which, when conducted in trusted environments, would help the community of the financial industry to prevent and collectively respond to cyber threats by quickly limiting the spread of ICT risk and impeding potential contagion throughout the financial channels. Those mechanisms should comply with the applicable competition law rules of the Union set out in the Communication from the Commission of 14 January 2011 entitled `Guidelines on the applicability of Article 101 of the Treaty on the Functioning of the European Union to horizontal cooperation agreements', as well as with Union data protection rules, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (13). They should operate based on the use of one or more of the legal bases that are laid down in Article 6 of that Regulation, such as in the context of the processing of personal data that is necessary for the purposes of the legitimate interest pursued by the controller or by a third party, as referred to in Article 6(1), point (f), of that Regulation, as well as in the context of the processing of personal data necessary for compliance with a legal obligation to which the controller is subject, necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, as referred to in Article 6(1), points (c) and (e), respectively, of that Regulation.

+ (13) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/9

+ (35) In order to maintain a high level of digital operational resilience for the whole financial sector, and at the same time to keep pace with technological developments, this Regulation should address risk stemming from all types of ICT services. To that end, the definition of ICT services in the context of this Regulation should be understood in a broad manner, encompassing digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis. That definition should, for instance, include so called `over the top' services, which fall within the category of electronic communications services. It should exclude only the limited category of traditional analogue telephone services qualifying as Public Switched Telephone Network (PSTN) services, landline services, Plain Old Telephone Service (POTS), or fixed-line telephone services.

+ (36) Notwithstanding the broad coverage envisaged by this Regulation, the application of the digital operational resilience rules should take into account the significant differences between financial entities in terms of their size and overall risk profile. As a general principle, when distributing resources and capabilities for the implementation of the ICT risk management framework, financial entities should duly balance their ICT-related needs to their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations, while competent authorities should continue to assess and review the approach of such distribution.

+ (37) Account information service providers, referred to in Article 33(1) of Directive (EU) 2015/2366, are explicitly included in the scope of this Regulation, taking into account the specific nature of their activities and the risks arising therefrom. In addition, electronic money institutions and payment institutions exempted pursuant to Article 9(1) of Directive 2009/110/EC of the European Parliament and of the Council (14) and Article 32(1) of Directive (EU) 2015/2366 are included in the scope of this Regulation even if they have not been granted authorisation in accordance Directive 2009/110/EC to issue electronic money, or if they have not been granted authorisation in accordance with Directive (EU) 2015/2366 to provide and execute payment services. However, post office giro institutions, referred to in Article 2(5), point (3), of Directive 2013/36/EU of the European Parliament and of the Council (15), are excluded from the scope of this Regulation. The competent authority for payment institutions exempted pursuant to Directive (EU) 2015/2366, electronic money institutions exempted pursuant to Directive 2009/110/EC and account information service providers as referred to in Article 33(1) of Directive (EU) 2015/2366, should be the competent authority designated in accordance with Article 22 of Directive (EU) 2015/2366.

+ (38) As larger financial entities might enjoy wider resources and can swiftly deploy funds to develop governance structures and set up various corporate strategies, only financial entities that are not microenterprises in the sense of this Regulation should be required to establish more complex governance arrangements. Such entities are better equipped in particular to set up dedicated management functions for supervising arrangements with ICT third-party service providers or for dealing with crisis management, to organise their ICT risk management according to the three lines of defence model, or to set up an internal risk management and control model, and to submit their ICT risk management framework to internal audits.

+ (39) Some financial entities benefit from exemptions or are subject to a very light regulatory framework under the relevant sector-specific Union law. Such financial entities include managers of alternative investment funds referred to in Article 3(2) of Directive 2011/61/EU of the European Parliament and of the Council (16), insurance and reinsurance undertakings referred to in Article 4 of Directive 2009/138/EC of the European Parliament and of the Council (17), and institutions for occupational retirement provision which operate pension schemes which together

+ (14) Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC (OJ L 267, 10.10.2009, p. 7).

+ (15) Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).

+ (16) Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010 (OJ L 174, 1.7.2011, p. 1).

+ (17) Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (OJ L 335, 17.12.2009, p. 1).

+ L 333/10

+ Official Journal of the European Union

+ 27.12.2022

+ do not have more than 15 members in total. In light of those exemptions it would not be proportionate to include such financial entities in the scope of this Regulation. In addition, this Regulation acknowledges the specificities of the insurance intermediation market structure, with the result that insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries qualifying as microenterprises or as small or medium-sized enterprises should not be subject to this Regulation.

+ (40) Since the entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU are excluded from the scope of that Directive, Member States should consequently be able to choose to exempt from the application of this Regulation such entities located within their respective territories.

+ (41) Similarly, in order to align this Regulation to the scope of Directive 2014/65/EU of the European Parliament and of the Council (18), it is also appropriate to exclude from the scope of this Regulation natural and legal persons referred in Articles 2 and 3 of that Directive which are allowed to provide investment services without having to obtain an authorisation under Directive 2014/65/EU. However, Article 2 of Directive 2014/65/EU also excludes from the scope of that Directive entities which qualify as financial entities for the purposes of this Regulation such as, central securities depositories, collective investment undertakings or insurance and reinsurance undertakings. The exclusion from the scope of this Regulation of the persons and entities referred to in Articles 2 and 3 of that Directive should not encompass those central securities depositories, collective investment undertakings or insurance and reinsurance undertakings.

+ (42) Under sector-specific Union law, some financial entities are subject to lighter requirements or exemptions for reasons associated with their size or the services they provide. That category of financial entities includes small and noninterconnected investment firms, small institutions for occupational retirement provision which may be excluded from the scope of Directive (EU) 2016/2341 under the conditions laid down in Article 5 of that Directive by the Member State concerned and operate pension schemes which together do not have more than 100 members in total, as well as institutions exempted pursuant to Directive 2013/36/EU. Therefore, in accordance with the principle of proportionality and to preserve the spirit of sector-specific Union law, it is also appropriate to subject those financial entities to a simplified ICT risk management framework under this Regulation. The proportionate character of the ICT risk management framework covering those financial entities should not be altered by the regulatory technical standards that are to be developed by the ESAs. Moreover, in accordance with the principle of proportionality, it is appropriate to also subject payment institutions referred to in Article 32(1) of Directive (EU) 2015/2366 and electronic money institutions referred to in Article 9 of Directive 2009/110/EC exempted in accordance with national law transposing those Union legal acts to a simplified ICT risk management framework under this Regulation, while payment institutions and electronic money institutions which have not been exempted in accordance with their respective national law transposing sectoral Union law should comply with the general framework laid down by this Regulation.

+ (43) Similarly, financial entities which qualify as microenterprises or are subject to the simplified ICT risk management framework under this Regulation should not be required to establish a role to monitor their arrangements concluded with ICT third-party service providers on the use of ICT services; or to designate a member of senior management to be responsible for overseeing the related risk exposure and relevant documentation; to assign the responsibility for managing and overseeing ICT risk to a control function and ensure an appropriate level of independence of such control function in order to avoid conflicts of interest; to document and review at least once a year the ICT risk management framework; to subject to internal audit on a regular basis the ICT risk management framework; to perform in-depth assessments after major changes in their network and information system infrastructures and processes; to regularly conduct risk analyses on legacy ICT systems; to subject the implementation of the ICT Response and Recovery plans to independent internal audit reviews; to have a crisis management function, to expand the testing of business continuity and response and recovery plans to capture switchover scenarios between primary ICT infrastructure and redundant facilities; to report to competent authorities, upon their request, an estimation of aggregated annual costs and losses caused by major ICT-related incidents, to maintain redundant ICT capacities; to communicate to national competent authorities implemented

+ (18) Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/11

+ changes following post ICT-related incident reviews; to monitor on a continuous basis relevant technological developments, to establish a comprehensive digital operational resilience testing programme as an integral part of the ICT risk management framework provided for in this Regulation, or to adopt and regularly review a strategy on ICT third-party risk. In addition, microenterprises should only be required to assess the need to maintain such redundant ICT capacities based on their risk profile. Microenterprises should benefit from a more flexible regime as regards digital operational resilience testing programmes. When considering the type and frequency of testing to be performed, they should properly balance the objective of maintaining a high digital operational resilience, the available resources and their overall risk profile. Microenterprises and financial entities subject to the simplified ICT risk management framework under this Regulation should be exempted from the requirement to perform advanced testing of ICT tools, systems and processes based on threat-led penetration testing (TLPT), as only financial entities meeting the criteria set out in this Regulation should be required to carry out such testing. In light of their limited capabilities, microenterprises should be able to agree with the ICT third-party service provider to delegate the financial entity's rights of access, inspection and audit to an independent third-party, to be appointed by the ICT third-party service provider, provided that the financial entity is able to request, at any time, all relevant information and assurance on the ICT third-party service provider's performance from the respective independent third-party.

+ (44) As only those financial entities identified for the purposes of the advanced digital resilience testing should be required to conduct threat-led penetration tests, the administrative processes and financial costs entailed in the performance of such tests should be borne by a small percentage of financial entities.

+ (45) To ensure full alignment and overall consistency between financial entities' business strategies, on the one hand, and the conduct of ICT risk management, on the other hand, the financial entities' management bodies should be required to maintain a pivotal and active role in steering and adapting the ICT risk management framework and the overall digital operational resilience strategy. The approach to be taken by management bodies should not only focus on the means of ensuring the resilience of the ICT systems, but should also cover people and processes through a set of policies which cultivate, at each corporate layer, and for all staff, a strong sense of awareness about cyber risks and a commitment to observe a strict cyber hygiene at all levels. The ultimate responsibility of the management body in managing a financial entity's ICT risk should be an overarching principle of that comprehensive approach, further translated into the continuous engagement of the management body in the control of the monitoring of the ICT risk management.

+ (46) Moreover, the principle of the management body's full and ultimate responsibility for the management of the ICT risk of the financial entity goes hand in hand with the need to secure a level of ICT-related investments and an overall budget for the financial entity that would enable the financial entity to achieve a high level of digital operational resilience.

+ (47) Inspired by relevant international, national and industry best practices, guidelines, recommendations and approaches to the management of cyber risk, this Regulation promotes a set of principles that facilitate the overall structure of ICT risk management. Consequently, as long as the main capabilities which financial entities put in place address the various functions in the ICT risk management (identification, protection and prevention, detection, response and recovery, learning and evolving and communication) set out in this Regulation, financial entities should remain free to use ICT risk management models that are differently framed or categorised.

+ (48) To keep pace with an evolving cyber threat landscape, financial entities should maintain updated ICT systems that are reliable and capable, not only for guaranteeing the processing of data required for their services, but also for ensuring sufficient technological resilience to allow them to deal adequately with additional processing needs due to stressed market conditions or other adverse situations.

+ L 333/12

+ Official Journal of the European Union

+ 27.12.2022

+ (49) Efficient business continuity and recovery plans are necessary to allow financial entities to promptly and quickly resolve ICT-related incidents, in particular cyber-attacks, by limiting damage and giving priority to the resumption of activities and recovery actions in accordance with their back-up policies. However, such resumption should in no way jeopardise the integrity and security of the network and information systems or the availability, authenticity, integrity or confidentiality of data.

+ (50) While this Regulation allows financial entities to determine their recovery time and recovery point objectives in a flexible manner and hence to set such objectives by fully taking into account the nature and the criticality of the relevant functions and any specific business needs, it should nevertheless require them to carry out an assessment of the potential overall impact on market efficiency when determining such objectives.

+ (51) The propagators of cyber-attacks tend to pursue financial gains directly at the source, thus exposing financial entities to significant consequences. To prevent ICT systems from losing integrity or becoming unavailable, and hence to avoid data breaches and damage to physical ICT infrastructure, the reporting of major ICT-related incidents by financial entities should be significantly improved and streamlined. ICT-related incident reporting should be harmonised through the introduction of a requirement for all financial entities to report directly to their relevant competent authorities. Where a financial entity is subject to supervision by more than one national competent authority, Member States should designate a single competent authority as the addressee of such reporting. Credit institutions classified as significant in accordance with Article 6(4) of Council Regulation (EU) No 1024/2013 (19) should submit such reporting to the national competent authorities, which should subsequently transmit the report to the European Central Bank (ECB).

+ (52) The direct reporting should enable financial supervisors to have immediate access to information about major ICTrelated incidents. Financial supervisors should in turn pass on details of major ICT-related incidents to public nonfinancial authorities (such as competent authorities and single points of contact under Directive (EU) 2022/2555, national data protection authorities, and to law enforcement authorities for major ICT-related incidents of a criminal nature) in order to enhance such authorities awareness of such incidents and, in the case of CSIRTs, to facilitate prompt assistance that may be given to financial entities, as appropriate. Member States should, in addition, be able to determine that financial entities themselves should provide such information to public authorities outside the financial services area. Those information flows should allow financial entities to swiftly benefit from any relevant technical input, advice about remedies, and subsequent follow-up from such authorities. The information on major ICT-related incidents should be mutually channelled: financial supervisors should provide all necessary feedback or guidance to the financial entity, while the ESAs should share anonymised data on cyber threats and vulnerabilities relating to an incident, to aid wider collective defence.

+ (53) While all financial entities should be required to carry out incident reporting, that requirement is not expected to affect all of them in the same manner. Indeed, relevant materiality thresholds, as well as reporting timelines, should be duly adjusted, in the context of delegated acts based on the regulatory technical standards to be developed by the ESAs, with a view to covering only major ICT-related incidents. In addition, the specificities of financial entities should be taken into account when setting timelines for reporting obligations.

+ (54) This Regulation should require credit institutions, payment institutions, account information service providers and electronic money institutions to report all operational or security payment-related incidents � previously reported under Directive (EU) 2015/2366 � irrespective of the ICT nature of the incident.

+ (19) Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63).

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/13

+ (55) The ESAs should be tasked with assessing the feasibility and conditions for a possible centralisation of ICT-related incident reports at Union level. Such centralisation could consist of a single EU Hub for major ICT-related incident reporting either directly receiving relevant reports and automatically notifying national competent authorities, or merely centralising relevant reports forwarded by the national competent authorities and thus fulfilling a coordination role. The ESAs should be tasked with preparing, in consultation with the ECB and ENISA, a joint report exploring the feasibility of setting up a single EU Hub.

+ (56) In order to achieve a high level of digital operational resilience, and in line with both the relevant international standards (e.g. the G7 Fundamental Elements for Threat-Led Penetration Testing) and with the frameworks applied in the Union, such as the TIBER-EU, financial entities should regularly test their ICT systems and staff having ICTrelated responsibilities with regard to the effectiveness of their preventive, detection, response and recovery capabilities, to uncover and address potential ICT vulnerabilities. To reflect differences that exist across, and within, the various financial subsectors as regards financial entities' level of cybersecurity preparedness, testing should include a wide variety of tools and actions, ranging from the assessment of basic requirements (e.g. vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing or end-to-end testing) to more advanced testing by means of TLPT. Such advanced testing should be required only of financial entities that are mature enough from an ICT perspective to reasonably carry it out. The digital operational resilience testing required by this Regulation should thus be more demanding for those financial entities meeting the criteria set out in this Regulation (for example, large, systemic and ICT-mature credit institutions, stock exchanges, central securities depositories and central counterparties) than for other financial entities. At the same time, the digital operational resilience testing by means of TLPT should be more relevant for financial entities operating in core financial services subsectors and playing a systemic role (for example, payments, banking, and clearing and settlement), and less relevant for other subsectors (for example, asset managers and credit rating agencies).

+ (57) Financial entities involved in cross-border activities and exercising the freedoms of establishment, or of provision of services within the Union, should comply with a single set of advanced testing requirements (i.e. TLPT) in their home Member State, which should include the ICT infrastructures in all jurisdictions where the cross-border financial group operates within the Union, thus allowing such cross-border financial groups to incur related ICT testing costs in one jurisdiction only.

+ (58) To draw on the expertise already acquired by certain competent authorities, in particular with regard to implementing the TIBER-EU framework, this Regulation should allow Member States to designate a single public authority as responsible in the financial sector, at national level, for all TLPT matters, or competent authorities, to delegate, in the absence of such designation, the exercise of TLPT related tasks to another national financial competent authority.

+ (59) Since this Regulation does not require financial entities to cover all critical or important functions in one single threat-led penetration test, financial entities should be free to determine which and how many critical or important functions should be included in the scope of such a test.

+ (60) Pooled testing within the meaning of this Regulation � involving the participation of several financial entities in a TLPT and for which an ICT third-party service provider can directly enter into contractual arrangements with an external tester � should be allowed only where the quality or security of services delivered by the ICT third-party service provider to customers that are entities falling outside the scope of this Regulation, or the confidentiality of the data related to such services, are reasonably expected to be adversely impacted. Pooled testing should also be subject to safeguards (direction by one designated financial entity, calibration of the number of participating financial entities) to ensure a rigorous testing exercise for the financial entities involved which meet the objectives of the TLPT pursuant to this Regulation.

+ L 333/14

+ Official Journal of the European Union

+ 27.12.2022

+ (61) In order to take advantage of internal resources available at corporate level, this Regulation should allow the use of internal testers for the purposes of carrying out TLPT, provided there is supervisory approval, no conflicts of interest, and periodical alternation of the use of internal and external testers (every three tests), while also requiring the provider of the threat intelligence in the TLPT to always be external to the financial entity. The responsibility for conducting TLPT should remain fully with the financial entity. Attestations provided by authorities should be solely for the purpose of mutual recognition and should not preclude any follow-up action needed to address the ICT risk to which the financial entity is exposed, nor should they be seen as a supervisory endorsement of a financial entity's ICT risk management and mitigation capabilities.

+ (62) To ensure a sound monitoring of ICT third-party risk in the financial sector, it is necessary to lay down a set of principle-based rules to guide financial entities' when monitoring risk arising in the context of functions outsourced to ICT third-party service providers, particularly for ICT services supporting critical or important functions, as well as more generally in the context of all ICT third-party dependencies.

+ (63) To address the complexity of the various sources of ICT risk, while taking into account the multitude and diversity of providers of technological solutions which enable a smooth provision of financial services, this Regulation should cover a wide range of ICT third-party service providers, including providers of cloud computing services, software, data analytics services and providers of data centre services. Similarly, since financial entities should effectively and coherently identify and manage all types of risk, including in the context of ICT services procured within a financial group, it should be clarified that undertakings which are part of a financial group and provide ICT services predominantly to their parent undertaking, or to subsidiaries or branches of their parent undertaking, as well as financial entities providing ICT services to other financial entities, should also be considered as ICT third-party service providers under this Regulation. Lastly, in light of the evolving payment services market becoming increasingly dependent on complex technical solutions, and in view of emerging types of payment services and payment-related solutions, participants in the payment services ecosystem, providing payment-processing activities, or operating payment infrastructures, should also be considered to be ICT third-party service providers under this Regulation, with the exception of central banks when operating payment or securities settlement systems, and public authorities when providing ICT related services in the context of fulfilling State functions.

+ (64) A financial entity should at all times remain fully responsible for complying with its obligations set out in this Regulation. Financial entities should apply a proportionate approach to the monitoring of risks emerging at the level of the ICT third-party service providers, by duly considering the nature, scale, complexity and importance of their ICT-related dependencies, the criticality or importance of the services, processes or functions subject to the contractual arrangements and, ultimately, on the basis of a careful assessment of any potential impact on the continuity and quality of financial services at individual and at group level, as appropriate.

+ (65) The conduct of such monitoring should follow a strategic approach to ICT third-party risk formalised through the adoption by the financial entity's management body of a dedicated ICT third-party risk strategy, rooted in a continuous screening of all ICT third-party dependencies. To enhance supervisory awareness of ICT third-party dependencies, and with a view to further supporting the work in the context of the Oversight Framework established by this Regulation, all financial entities should be required to maintain a register of information with all contractual arrangements about the use of ICT services provided by ICT third-party service providers. Financial supervisors should be able to request the full register, or to ask for specific sections thereof, and thus to obtain essential information for acquiring a broader understanding of the ICT dependencies of financial entities.

+ (66) A thorough pre-contracting analysis should underpin and precede the formal conclusion of contractual arrangements, in particular by focusing on elements such as the criticality or importance of the services supported by the envisaged ICT contract, the necessary supervisory approvals or other conditions, the possible concentration risk entailed, as well as applying due diligence in the process of selection and assessment of ICT third-party service providers and assessing potential conflicts of interest. For contractual arrangements concerning critical or important functions, financial entities should take into consideration the use by ICT third-party service providers of the most up-to-date and highest information security standards. Termination of contractual arrangements could be prompted at least by a series of circumstances showing shortfalls at the ICT third-party service provider level, in

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/15

+ particular significant breaches of laws or contractual terms, circumstances revealing a potential alteration of the performance of the functions provided for in the contractual arrangements, evidence of weaknesses of the ICT third-party service provider in its overall ICT risk management, or circumstances indicating the inability of the relevant competent authority to effectively supervise the financial entity.

+ (67) To address the systemic impact of ICT third-party concentration risk, this Regulation promotes a balanced solution by means of taking a flexible and gradual approach to such concentration risk since the imposition of any rigid caps or strict limitations might hinder the conduct of business and restrain the contractual freedom. Financial entities should thoroughly assess their envisaged contractual arrangements to identify the likelihood of such risk emerging, including by means of in-depth analyses of subcontracting arrangements, in particular when concluded with ICT third-party service providers established in a third country. At this stage, and with a view to striking a fair balance between the imperative of preserving contractual freedom and that of guaranteeing financial stability, it is not considered appropriate to set out rules on strict caps and limits to ICT third-party exposures. In the context of the Oversight Framework, a Lead Overseer, appointed pursuant to this Regulation, should, in respect to critical ICT third-party service providers, pay particular attention to fully grasp the magnitude of interdependences, discover specific instances where a high degree of concentration of critical ICT third-party service providers in the Union is likely to put a strain on the Union financial system's stability and integrity and maintain a dialogue with critical ICT third-party service providers where that specific risk is identified.

+ (68) To evaluate and monitor on a regular basis the ability of an ICT third party service provider to securely provide services to a financial entity without adverse effects on a financial entity's digital operational resilience, several key contractual elements with ICT third-party service providers should be harmonised. Such harmonisation should cover minimum areas which are crucial for enabling a full monitoring by the financial entity of the risks that could emerge from the ICT third-party service provider, from the perspective of a financial entity's need to secure its digital resilience because it is deeply dependent on the stability, functionality, availability and security of the ICT services received.

+ (69) When renegotiating contractual arrangements to seek alignment with the requirements of this Regulation, financial entities and ICT third-party service providers should ensure the coverage of the key contractual provisions as provided for in this Regulation.

+ (70) The definition of `critical or important function' provided for in this Regulation encompasses the `critical functions' as defined in Article 2(1), point (35), of Directive 2014/59/EU of the European Parliament and of the Council (20). Accordingly, functions deemed to be critical pursuant to Directive 2014/59/EU are included in the definition of critical functions within the meaning of this Regulation.

+ (71) Irrespective of the criticality or importance of the function supported by the ICT services, contractual arrangements should, in particular, provide for a specification of the complete descriptions of functions and services, of the locations where such functions are provided and where data is to be processed, as well as an indication of service level descriptions. Other essential elements to enable a financial entity's monitoring of ICT third party risk are: contractual provisions specifying how the accessibility, availability, integrity, security and protection of personal data are ensured by the ICT third-party service provider, provisions laying down the relevant guarantees for enabling the access, recovery and return of data in the case of insolvency, resolution or discontinuation of the business operations of the ICT third-party service provider, as well as provisions requiring the ICT third-party service provider to provide assistance in case of ICT incidents in connection with the services provided, at no additional cost or at a cost determined ex-ante; provisions on the obligation of the ICT third-party service provider

+ (20) Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190).

+ L 333/16

+ Official Journal of the European Union

+ 27.12.2022

+ to fully cooperate with the competent authorities and resolution authorities of the financial entity; and provisions on termination rights and related minimum notice periods for the termination of the contractual arrangements, in accordance with the expectations of competent authorities and resolution authorities.

+ (72) In addition to such contractual provisions, and with a view to ensuring that financial entities remain in full control of all developments occurring at third-party level which may impair their ICT security, the contracts for the provision of ICT services supporting critical or important functions should also provide for the following: the specification of the full service level descriptions, with precise quantitative and qualitative performance targets, to enable without undue delay appropriate corrective actions when the agreed service levels are not met; the relevant notice periods and reporting obligations of the ICT third-party service provider in the event of developments with a potential material impact on the ICT third-party service provider's ability to effectively provide their respective ICT services; a requirement upon the ICT third-party service provider to implement and test business contingency plans and have ICT security measures, tools and policies allowing for the secure provision of services, and to participate and fully cooperate in the TLPT carried out by the financial entity.

+ (73) Contracts for the provision of ICT services supporting critical or important functions should also contain provisions enabling the rights of access, inspection and audit by the financial entity, or an appointed third party, and the right to take copies as crucial instruments in the financial entities' ongoing monitoring of the ICT third-party service provider's performance, coupled with the service provider's full cooperation during inspections. Similarly, the competent authority of the financial entity should have the right, based on notices, to inspect and audit the ICT third-party service provider, subject to the protection of confidential information.

+ (74) Such contractual arrangements should also provide for dedicated exit strategies to enable, in particular, mandatory transition periods during which ICT third-party service providers should continue providing the relevant services with a view to reducing the risk of disruptions at the level of the financial entity, or to allow the latter effectively to switch to the use of other ICT third-party service providers or, alternatively, to change to in-house solutions, consistent with the complexity of the provided ICT service. Moreover, financial entities within the scope of Directive 2014/59/EU should ensure that the relevant contracts for ICT services are robust and fully enforceable in the event of resolution of those financial entities. Therefore, in line with the expectations of the resolution authorities, those financial entities should ensure that the relevant contracts for ICT services are resolution resilient. As long as they continue meeting their payment obligations, those financial entities should ensure, among other requirements, that the relevant contracts for ICT services contain clauses for non-termination, non-suspension and non-modification on grounds of restructuring or resolution.

+ (75) Moreover, the voluntary use of standard contractual clauses developed by public authorities or Union institutions, in particular the use of contractual clauses developed by the Commission for cloud computing services could provide further comfort to the financial entities and ICT third-party service providers, by enhancing their level of legal certainty regarding the use of cloud computing services in the financial sector, in full alignment with the requirements and expectations set out by the Union financial services law. The development of standard contractual clauses builds on measures already envisaged in the 2018 Fintech Action Plan that announced the Commission's intention to encourage and facilitate the development of standard contractual clauses for the use of cloud computing services outsourcing by financial entities, drawing on cross-sectorial cloud computing services stakeholders' efforts, which the Commission has facilitated with the help of the financial sector's involvement.

+ (76) With a view to promoting convergence and efficiency in relation to supervisory approaches when addressing ICT third-party risk in the financial sector, as well as to strengthening the digital operational resilience of financial entities which rely on critical ICT third-party service providers for the provision of ICT services that support the supply of financial services, and thereby to contributing to the preservation of the Union's financial system stability and the integrity of the internal market for financial services, critical ICT third-party service providers should be subject to a Union Oversight Framework. While the set-up of the Oversight Framework is justified by the added value of taking action at Union level and by virtue of the inherent role and specificities of the use of ICT services in

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/17

+ the provision of financial services, it should be recalled, at the same time, that this solution appears suitable only in the context of this Regulation specifically dealing with digital operational resilience in the financial sector. However, such Oversight Framework should not be regarded as a new model for Union supervision in other areas of financial services and activities.

+ (77) The Oversight Framework should apply only to critical ICT third-party service providers. There should therefore be a designation mechanism to take into account the dimension and nature of the financial sector's reliance on such ICT third-party service providers. That mechanism should involve a set of quantitative and qualitative criteria to set the criticality parameters as a basis for inclusion in the Oversight Framework. In order to ensure the accuracy of that assessment, and regardless of the corporate structure of the ICT third-party service provider, such criteria should, in the case of a ICT third-party service provider that is part of a wider group, take into consideration the entire ICT third-party service provider's group structure. On the one hand, critical ICT third-party service providers, which are not automatically designated by virtue of the application of those criteria, should have the possibility to opt in to the Oversight Framework on a voluntary basis, on the other hand, ICT third-party service providers, that are already subject to oversight mechanism frameworks supporting the fulfilment of the tasks of the European System of Central Banks as referred to in Article 127(2) TFEU, should be exempted.

+ (78) Similarly, financial entities providing ICT services to other financial entities, while belonging to the category of ICT third-party service providers under this Regulation, should also be exempted from the Oversight Framework since they are already subject to supervisory mechanisms established by the relevant Union financial services law. Where applicable, competent authorities should take into account, in the context of their supervisory activities, the ICT risk posed to financial entities by financial entities providing ICT services. Likewise, due to the existing risk monitoring mechanisms at group level, the same exemption should be introduced for ICT third-party service providers delivering services predominantly to the entities of their own group. ICT third-party service providers providing ICT services solely in one Member State to financial entities that are active only in that Member State should also be exempted from the designation mechanism because of their limited activities and lack of cross-border impact.

+ (79) The digital transformation experienced in financial services has brought about an unprecedented level of use of, and reliance upon, ICT services. Since it has become inconceivable to provide financial services without the use of cloud computing services, software solutions and data-related services, the Union financial ecosystem has become intrinsically co-dependent on certain ICT services provided by ICT service suppliers. Some of those suppliers, innovators in developing and applying ICT-based technologies, play a significant role in the delivery of financial services, or have become integrated into the financial services value chain. They have thus become critical to the stability and integrity of the Union financial system. This widespread reliance on services supplied by critical ICT third-party service providers, combined with the interdependence of the information systems of various market operators, create a direct, and potentially severe, risk to the Union financial services system and to the continuity of delivery of financial services if critical ICT third-party service providers were to be affected by operational disruptions or major cyber incidents. Cyber incidents have a distinctive ability to multiply and propagate throughout the financial system at a considerably faster pace than other types of risk monitored in the financial sector and can extend across sectors and beyond geographical borders. They have the potential to evolve into a systemic crisis, where trust in the financial system has been eroded due to the disruption of functions supporting the real economy, or to substantial financial losses, reaching a level which the financial system is unable to withstand, or which requires the deployment of heavy shock absorption measures. To prevent these scenarios from taking place and thereby endangering the financial stability and integrity of the Union, it is essential to provide the convergence of supervisory practices relating to ICT third-party risk in finance, in particular through new rules enabling the Union oversight of critical ICT third-party service providers.

+ L 333/18

+ Official Journal of the European Union

+ 27.12.2022

+ (80) The Oversight Framework largely depends on the degree of collaboration between the Lead Overseer and the critical ICT third-party service provider delivering to financial entities services affecting the supply of financial services. Successful oversight is predicated, inter alia, upon the ability of the Lead Overseer to effectively conduct monitoring missions and inspections to assess the rules, controls and processes used by the critical ICT third-party service providers, as well as to assess the potential cumulative impact of their activities on financial stability and the integrity of the financial system. At the same time, it is crucial that critical ICT third-party service providers follow the Lead Overseer's recommendations and address its concerns. Since a lack of cooperation by a critical ICT thirdparty service provider providing services that affect the supply of financial services, such as the refusal to grant access to its premises or to submit information, would ultimately deprive the Lead Overseer of its essential tools in appraising ICT third-party risk, and could adversely impact the financial stability and the integrity of the financial system, it is necessary to also provide for a commensurate sanctioning regime.

+ (81) Against this background, the need of the Lead Overseer to impose penalty payments to compel critical ICT thirdparty service providers to comply with the transparency and access-related obligations set out in this Regulation should not be jeopardised by difficulties raised by the enforcement of those penalty payments in relation to critical ICT third-party service providers established in third countries. In order to ensure the enforceability of such penalties, and to allow a swift roll out of procedures upholding the critical ICT third-party service providers' rights of defence in the context of the designation mechanism and the issuance of recommendations, those critical ICT third-party service providers, providing services to financial entities that affect the supply of financial services, should be required to maintain an adequate business presence in the Union. Due to the nature of the oversight, and the absence of comparable arrangements in other jurisdictions, there are no suitable alternative mechanisms ensuring this objective by way of effective cooperation with financial supervisors in third countries in relation to the monitoring of the impact of digital operational risks posed by systemic ICT third-party service providers, qualifying as critical ICT third-party service providers established in third countries. Therefore, in order to continue its provision of ICT services to financial entities in the Union, an ICT third-party service provider established in a third country which has been designated as critical in accordance with this Regulation should undertake, within 12 months of such designation, all necessary arrangements to ensure its incorporation within the Union, by means of establishing a subsidiary, as defined throughout the Union acquis, namely in Directive 2013/34/EU of the European Parliament and of the Council (21).

+ (82) The requirement to set up a subsidiary in the Union should not prevent the critical ICT third-party service provider from supplying ICT services and related technical support from facilities and infrastructure located outside the Union. This Regulation does not impose a data localisation obligation as it does not require data storage or processing to be undertaken in the Union.

+ (83) Critical ICT third-party service providers should be able to provide ICT services from anywhere in the world, not necessarily or not only from premises located in the Union. Oversight activities should be first conducted on premises located in the Union and by interacting with entities located in the Union, including the subsidiaries established by critical ICT third-party service providers pursuant to this Regulation. However, such actions within the Union might be insufficient to allow the Lead Overseer to fully and effectively perform its duties under this Regulation. The Lead Overseer should therefore also be able to exercise its relevant oversight powers in third countries. Exercising those powers in third countries should allow the Lead Overseer to examine the facilities from which the ICT services or the technical support services are actually provided or managed by the critical ICT thirdparty service provider, and should give the Lead Overseer a comprehensive and operational understanding of the ICT risk management of the critical ICT third-party service provider. The possibility for the Lead Overseer, as a Union agency, to exercise powers outside the territory of the Union should be duly framed by relevant conditions, in particular the consent of the critical ICT third-party service provider concerned. Similarly, the relevant authorities of the third country should be informed of, and not have objected to, the exercise on their own territory of the activities of the Lead Overseer. However, in order to ensure efficient implementation, and without prejudice to the respective competences of the Union institutions and the Member States, such powers also need to be fully anchored in the conclusion of administrative cooperation arrangements with the relevant authorities of the third

+ (21) Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC (OJ L 182, 29.6.2013, p. 19).

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/19

+ country concerned. This Regulation should therefore enable the ESAs to conclude administrative cooperation arrangements with the relevant authorities of third countries, which should not otherwise create legal obligations in respect of the Union and its Member States.

+ (84) To facilitate communication with the Lead Overseer and to ensure adequate representation, critical ICT third-party service providers which are part of a group should designate one legal person as their coordination point.

+ (85) The Oversight Framework should be without prejudice to Member States' competence to conduct their own oversight or monitoring missions in respect to ICT third-party service providers which are not designated as critical under this Regulation, but which are regarded as important at national level.

+ (86) To leverage the multi-layered institutional architecture in the financial services area, the Joint Committee of the ESAs should continue to ensure overall cross-sectoral coordination in relation to all matters pertaining to ICT risk, in accordance with its tasks on cybersecurity. It should be supported by a new Subcommittee (the `Oversight Forum') carrying out preparatory work both for the individual decisions addressed to critical ICT third-party service providers, and for the issuing of collective recommendations, in particular in relation to benchmarking the oversight programmes for critical ICT third-party service providers, and identifying best practices for addressing ICT concentration risk issues.

+ (87) To ensure that critical ICT third-party service providers are appropriately and effectively overseen on a Union level, this Regulation provides that any of the three ESAs could be designated as a Lead Overseer. The individual assignment of a critical ICT third-party service provider to one of the three ESAs should result from an assessment of the preponderance of financial entities operating in the financial sectors for which that ESA has responsibilities. This approach should lead to a balanced allocation of tasks and responsibilities between the three ESAs, in the context of exercising the oversight functions, and should make the best use of the human resources and technical expertise available in each of the three ESAs.

+ (88) Lead Overseers should be granted the necessary powers to conduct investigations, to carry out onsite and offsite inspections at the premises and locations of critical ICT third-party service providers and to obtain complete and updated information. Those powers should enable the Lead Overseer to acquire real insight into the type, dimension and impact of the ICT third-party risk posed to financial entities and ultimately to the Union's financial system. Entrusting the ESAs with the lead oversight role is a prerequisite for understanding and addressing the systemic dimension of ICT risk in finance. The impact of critical ICT third-party service providers on the Union financial sector and the potential issues caused by the ICT concentration risk entailed call for taking a collective approach at Union level. The simultaneous carrying out of multiple audits and access rights, performed separately by numerous competent authorities, with little or no coordination among them, would prevent financial supervisors from obtaining a complete and comprehensive overview of ICT third-party risk in the Union, while also creating redundancy, burden and complexity for critical ICT third-party service providers if they were subject to numerous monitoring and inspection requests.

+ (89) Due to the significant impact of being designated as critical, this Regulation should ensure that the rights of critical ICT third-party service providers are observed throughout the implementation of the Oversight Framework. Prior to being designated as critical, such providers should, for example, have the right to submit to the Lead Overseer a reasoned statement containing any relevant information for the purposes of the assessment related to their designation. Since the Lead Overseer should be empowered to submit recommendations on ICT risk matters and suitable remedies thereto, which include the power to oppose certain contractual arrangements ultimately affecting the stability of the financial entity or the financial system, critical ICT third-party service providers should also be given the opportunity to provide, prior to the finalisation of those recommendations, explanations regarding the expected impact of the solutions, envisaged in the recommendations, on customers that are entities falling outside the scope of this Regulation and to formulate solutions to mitigate risks. Critical ICT third-party service providers

+ L 333/20

+ Official Journal of the European Union

+ 27.12.2022

+ disagreeing with the recommendations should submit a reasoned explanation of their intention not to endorse the recommendation. Where such reasoned explanation is not submitted or where it is considered to be insufficient, the Lead Overseer should issue a public notice summarily describing the matter of non-compliance.

+ (90) Competent authorities should duly include the task of verifying substantive compliance with recommendations issued by the Lead Overseer in their functions with regard to prudential supervision of financial entities. Competent authorities should be able to require financial entities to take additional measures to address the risks identified in the Lead Overseer's recommendations, and should, in due course, issue notifications to that effect. Where the Lead Overseer addresses recommendations to critical ICT third-party service providers that are supervised under Directive (EU) 2022/2555, the competent authorities should be able, on a voluntary basis and before adopting additional measures, to consult the competent authorities under that Directive in order to foster a coordinated approach to dealing with the critical ICT third-party service providers in question.

+ (91) The exercise of the oversight should be guided by three operational principles seeking to ensure: (a) close coordination among the ESAs in their Lead Overseer roles, through a joint oversight network (JON), (b) consistency with the framework established by Directive (EU) 2022/2555 (through a voluntary consultation of bodies under that Directive to avoid duplication of measures directed at critical ICT third-party service providers), and (c) applying diligence to minimise the potential risk of disruption to services provided by the critical ICT third-party service providers to customers that are entities falling outside the scope of this Regulation.

+ (92) The Oversight Framework should not replace, or in any way or for any part substitute for, the requirement for financial entities to manage themselves the risks entailed by the use of ICT third-party service providers, including their obligation to maintain an ongoing monitoring of contractual arrangements concluded with critical ICT thirdparty service providers. Similarly, the Oversight Framework should not affect the full responsibility of financial entities for complying with, and discharging, all the legal obligations laid down in this Regulation and in the relevant financial services law.

+ (93) To avoid duplications and overlaps, competent authorities should refrain from taking individually any measures aiming to monitor the critical ICT third-party service provider's risks and should, in that respect, rely on the relevant Lead Overseer's assessment. Any measures should in any case be coordinated and agreed in advance with the Lead Overseer in the context of the exercise of tasks in the Oversight Framework.

+ (94) To promote convergence at international level as regards the use of best practices in the review and monitoring of ICT third-party service providers' digital risk-management, the ESAs should be encouraged to conclude cooperation arrangements with relevant supervisory and regulatory third-country authorities.

+ (95) To leverage the specific competences, technical skills and expertise of staff specialising in operational and ICT risk within the competent authorities, the three ESAs and, on a voluntary basis, the competent authorities under Directive (EU) 2022/2555, the Lead Overseer should draw on national supervisory capabilities and knowledge and set up dedicated examination teams for each critical ICT third-party service provider, pooling multidisciplinary teams in support of the preparation and execution of oversight activities, including general investigations and inspections of critical ICT third-party service providers, as well as for any necessary follow-up thereto.

+ (96) Whereas costs resulting from oversight tasks would be fully funded from fees levied on critical ICT third-party service providers, the ESAs are. however, likely to incur, before the start of the Oversight Framework, costs for the implementation of dedicated ICT systems supporting the upcoming oversight, since dedicated ICT systems would need to be developed and deployed beforehand. This Regulation therefore provides for a hybrid funding model, whereby the Oversight Framework would, as such, be fully fee-funded, while the development of the ESAs' ICT systems would be funded from Union and national competent authorities' contributions.

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/21

+ (97) Competent authorities should have all required supervisory, investigative and sanctioning powers to ensure the proper exercise of their duties under this Regulation. They should, in principle, publish notices of the administrative penalties they impose. Since financial entities and ICT third-party service providers can be established in different Member States and supervised by different competent authorities, the application of this Regulation should be facilitated by, on the one hand, close cooperation among relevant competent authorities, including the ECB with regard to specific tasks conferred on it by Council Regulation (EU) No 1024/2013, and, on the other hand, by consultation with the ESAs through the mutual exchange of information and the provision of assistance in the context of relevant supervisory activities.

+ (98) In order to further quantify and qualify the criteria for the designation of ICT third-party service providers as critical and to harmonise oversight fees, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission to supplement this Regulation by further specifying the systemic impact that a failure or operational outage of an ICT third-party service provider could have on the financial entities it provides ICT services to, the number of global systemically important institutions (G-SIIs), or other systemically important institutions (O-SIIs), that rely on the ICT third-party service provider in question, the number of ICT third-party service providers active on a given market, the costs of migrating data and ICT workloads to other ICT third-party service providers, as well as the amount of the oversight fees and the way in which they are to be paid. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinsti tutional Agreement of 13 April 2016 on Better Law-Making (22). In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council should receive all documents at the same time as Member States' experts, and their experts should systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.

+ (99) Regulatory technical standards should ensure the consistent harmonisation of the requirements laid down in this Regulation. In their roles as bodies endowed with highly specialised expertise, the ESAs should develop draft regulatory technical standards which do not involve policy choices, for submission to the Commission. Regulatory technical standards should be developed in the areas of ICT risk management, major ICT-related incident reporting, testing, as well as in relation to key requirements for a sound monitoring of ICT third-party risk. The Commission and the ESAs should ensure that those standards and requirements can be applied by all financial entities in a manner that is proportionate to their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations. The Commission should be empowered to adopt those regulatory technical standards by means of delegated acts pursuant to Article 290 TFEU and in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

+ (100) To facilitate the comparability of reports on major ICT-related incidents and major operational or security paymentrelated incidents, as well as to ensure transparency regarding contractual arrangements for the use of ICT services provided by ICT third-party service providers, the ESAs should develop draft implementing technical standards establishing standardised templates, forms and procedures for financial entities to report a major ICT-related incident and a major operational or security payment-related incident, as well as standardised templates for the register of information. When developing those standards, the ESAs should take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations. The Commission should be empowered to adopt those implementing technical standards by means of implementing acts pursuant to Article 291 TFEU and in accordance with Article 15 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

+ (22) OJ L 123, 12.5.2016, p. 1.

+ L 333/22

+ Official Journal of the European Union

+ 27.12.2022

+ (101) Since further requirements have already been specified through delegated and implementing acts based on technical regulatory and implementing technical standards in Regulations (EC) No 1060/2009 (23), (EU) No 648/2012 (24), (EU) No 600/2014 (25) and (EU) No 909/2014 (26) of the European Parliament and of the Council, it is appropriate to mandate the ESAs, either individually or jointly through the Joint Committee, to submit regulatory and implementing technical standards to the Commission for adoption of delegated and implementing acts carrying over and updating existing ICT risk management rules.

+ (102) Since this Regulation, together with Directive (EU) 2022/2556 of the European Parliament and of the Council (27), entails a consolidation of the ICT risk management provisions across multiple regulations and directives of the Union's financial services acquis, including Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014 and (EU) No 909/2014, and Regulation (EU) 2016/1011 of the European Parliament and of the Council (28), in order to ensure full consistency, those Regulations should be amended to clarify that the applicable ICT risk-related provisions are laid down in this Regulation.

+ (103) Consequently, the scope of the relevant articles related to operational risk, upon which empowerments laid down in Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014, and (EU) 2016/1011 had mandated the adoption of delegated and implementing acts, should be narrowed down with a view to carry over into this Regulation all provisions covering the digital operational resilience aspects which today are part of those Regulations.

+ (104) The potential systemic cyber risk associated with the use of ICT infrastructures that enable the operation of payment systems and the provision of payment processing activities should be duly addressed at Union level through harmonised digital resilience rules. To that effect, the Commission should swiftly assess the need for reviewing the scope of this Regulation while aligning such review with the outcome of the comprehensive review envisaged under Directive (EU) 2015/2366. Numerous large-scale attacks over the past decade demonstrate how payment systems have become exposed to cyber threats. Placed at the core of the payment services chain and showing strong interconnections with the overall financial system, payment systems and payment processing activities acquired a critical significance for the functioning of the Union financial markets. Cyber-attacks on such systems can cause severe operational business disruptions with direct repercussions on key economic functions, such as the facilitation of payments, and indirect effects on related economic processes. Until a harmonised regime and the supervision of operators of payment systems and processing entities are put in place at Union level, Member States may, with a view to applying similar market practices, draw inspiration from the digital operational resilience requirements laid down by this Regulation, when applying rules to operators of payment systems and processing entities supervised under their own jurisdictions.

+ (23) Regulation (EC) No 1060/2009 of the European Parliament and of the Council of 16 September 2009 on credit rating agencies (OJ L 302, 17.11.2009, p. 1).

+ (24) Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories (OJ L 201, 27.7.2012, p. 1).

+ (25) Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Regulation (EU) No 648/2012 (OJ L 173, 12.6.2014, p. 84).

+ (26) Regulation (EU) No 909/2014 of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives 98/26/EC and 2014/65/EU and Regulation (EU) No 236/2012 (OJ L 257, 28.8.2014, p. 1).

+ (27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital operational resilience for the financial sector (see page 153 of this Official Journal).

+ (28) Regulation (EU) 2016/1011 of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/2014 (OJ L 171, 29.6.2016, p. 1).

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/23

+ (105) Since the objective of this Regulation, namely to achieve a high level of digital operational resilience for regulated financial entities, cannot be sufficiently achieved by the Member States because it requires harmonisation of various different rules in Union and national law, but can rather, by reason of its scale and effects, be better achieved at Union level, the Union may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective.

+ (106) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (29) and delivered an opinion on 10 May 2021 (30),

+ HAVE ADOPTED THIS REGULATION:

+ CHAPTER I

+ General provisions

+ Article 1

+ 1. In order to achieve a high common level of digital operational resilience, this Regulation lays down uniform requirements concerning the security of network and information systems supporting the business processes of financial entities as follows: (a) requirements applicable to financial entities in relation to:

+ (i) information and communication technology (ICT) risk management; (ii) reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the

+ competent authorities; (iii) reporting of major operational or security payment-related incidents to the competent authorities by financial

+ entities referred to in Article 2(1), points (a) to (d); (iv) digital operational resilience testing; (v) information and intelligence sharing in relation to cyber threats and vulnerabilities; (vi) measures for the sound management of ICT third-party risk; (b) requirements in relation to the contractual arrangements concluded between ICT third-party service providers and financial entities; (c) rules for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when providing services to financial entities; (d) rules on cooperation among competent authorities, and rules on supervision and enforcement by competent authorities in relation to all matters covered by this Regulation.

+ 2. In relation to financial entities identified as essential or important entities pursuant to national rules transposing Article 3 of Directive (EU) 2022/2555, this Regulation shall be considered a sector-specific Union legal act for the purposes of Article 4 of that Directive.

+ 3. This Regulation is without prejudice to the responsibility of Member States' regarding essential State functions concerning public security, defence and national security in accordance with Union law.

+ (29) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

+ (30) OJ C 229, 15.6.2021, p. 16.

+ L 333/24

+ Official Journal of the European Union

+ 27.12.2022

+ Article 2

+ 1. Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities: (a) credit institutions; (b) payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366; (c) account information service providers; (d) electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC; (e) investment firms; (f) crypto-asset service providers as authorised under a Regulation of the European Parliament and of the Council on

+ markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (`the Regulation on markets in crypto-assets') and issuers of asset-referenced tokens; (g) central securities depositories; (h) central counterparties; (i) trading venues; (j) trade repositories; (k) managers of alternative investment funds; (l) management companies; (m) data reporting service providers; (n) insurance and reinsurance undertakings; (o) insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries; (p) institutions for occupational retirement provision; (q) credit rating agencies; (r) administrators of critical benchmarks; (s) crowdfunding service providers; (t) securitisation repositories; (u) ICT third-party service providers.

+ 2. For the purposes of this Regulation, entities referred to in paragraph 1, points (a) to (t), shall collectively be referred to as `financial entities'.

+ 3. This Regulation does not apply to: (a) managers of alternative investment funds as referred to in Article 3(2) of Directive 2011/61/EU; (b) insurance and reinsurance undertakings as referred to in Article 4 of Directive 2009/138/EC; (c) institutions for occupational retirement provision which operate pension schemes which together do not have more

+ than 15 members in total; (d) natural or legal persons exempted pursuant to Articles 2 and 3 of Directive 2014/65/EU; (e) insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries which are microenterprises

+ or small or medium-sized enterprises; (f) post office giro institutions as referred to in Article 2(5), point (3), of Directive 2013/36/EU.

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/25

+ 4. Member States may exclude from the scope of this Regulation entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU that are located within their respective territories. Where a Member State makes use of such option, it shall inform the Commission thereof as well as of any subsequent changes thereto. The Commission shall make that information publicly available on its website or other easily accessible means.

+ Article 3

+ Definitions

+ For the purposes of this Regulation, the following definitions shall apply:

+ (1) `digital operational resilience' means the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of the network and information systems which a financial entity uses, and which support the continued provision of financial services and their quality, including throughout disruptions;

+ (2) `network and information system' means a network and information system as defined in Article 6, point 1, of Directive (EU) 2022/2555;

+ (3) `legacy ICT system' means an ICT system that has reached the end of its lifecycle (end-of-life), that is not suitable for upgrades or fixes, for technological or commercial reasons, or is no longer supported by its supplier or by an ICT third-party service provider, but that is still in use and supports the functions of the financial entity;

+ (4) `security of network and information systems' means security of network and information systems as defined in Article 6, point 2, of Directive (EU) 2022/2555;

+ (5) `ICT risk' means any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment;

+ (6) `information asset' means a collection of information, either tangible or intangible, that is worth protecting;

+ (7) `ICT asset' means a software or hardware asset in the network and information systems used by the financial entity;

+ (8) `ICT-related incident' means a single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity;

+ (9) `operational or security payment-related incident' means a single event or a series of linked events unplanned by the financial entities referred to in Article 2(1), points (a) to (d), whether ICT-related or not, that has an adverse impact on the availability, authenticity, integrity or confidentiality of payment-related data, or on the payment-related services provided by the financial entity;

+ (10) `major ICT-related incident' means an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity;

+ (11) `major operational or security payment-related incident' means an operational or security payment-related incident that has a high adverse impact on the payment-related services provided;

+ (12) `cyber threat' means `cyber threat' as defined in Article 2, point (8), of Regulation (EU) 2019/881;

+ (13) `significant cyber threat' means a cyber threat the technical characteristics of which indicate that it could have the potential to result in a major ICT-related incident or a major operational or security payment-related incident;

+ (14) `cyber-attack' means a malicious ICT-related incident caused by means of an attempt perpetrated by any threat actor to destroy, expose, alter, disable, steal or gain unauthorised access to, or make unauthorised use of, an asset;

+ L 333/26

+ Official Journal of the European Union

+ 27.12.2022

+ (15) `threat intelligence' means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations;

+ (16) `vulnerability' means a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited;

+ (17) `threat-led penetration testing (TLPT)' means a framework that mimics the tactics, techniques and procedures of reallife threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity's critical live production systems;

+ (18) `ICT third-party risk' means an ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements;

+ (19) `ICT third-party service provider' means an undertaking providing ICT services;

+ (20) `ICT intra-group service provider' means an undertaking that is part of a financial group and that provides predominantly ICT services to financial entities within the same group or to financial entities belonging to the same institutional protection scheme, including to their parent undertakings, subsidiaries, branches or other entities that are under common ownership or control;

+ (21) `ICT services' means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services;

+ (22) `critical or important function' means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;

+ (23) `critical ICT third-party service provider' means an ICT third-party service provider designated as critical in accordance with Article 31;

+ (24) `ICT third-party service provider established in a third country' means an ICT third-party service provider that is a legal person established in a third-country and that has entered into a contractual arrangement with a financial entity for the provision of ICT services;

+ (25) `subsidiary' means a subsidiary undertaking within the meaning of Article 2, point (10), and Article 22 of Directive 2013/34/EU;

+ (26) `group' means a group as defined in Article 2, point (11), of Directive 2013/34/EU;

+ (27) `parent undertaking' means a parent undertaking within the meaning of Article 2, point (9), and Article 22 of Directive 2013/34/EU;

+ (28) `ICT subcontractor established in a third country' means an ICT subcontractor that is a legal person established in a third-country and that has entered into a contractual arrangement either with an ICT third-party service provider, or with an ICT third-party service provider established in a third country;

+ (29) `ICT concentration risk' means an exposure to individual or multiple related critical ICT third-party service providers creating a degree of dependency on such providers so that the unavailability, failure or other type of shortfall of such provider may potentially endanger the ability of a financial entity to deliver critical or important functions, or cause it to suffer other types of adverse effects, including large losses, or endanger the financial stability of the Union as a whole;

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/27

+ (30) `management body' means a management body as defined in Article 4(1), point (36), of Directive 2014/65/EU, Article 3(1), point (7), of Directive 2013/36/EU, Article 2(1), point (s), of Directive 2009/65/EC of the European Parliament and of the Council (31), Article 2(1), point (45), of Regulation (EU) No 909/2014, Article 3(1), point (20), of Regulation (EU) 2016/1011, and in the relevant provision of the Regulation on markets in crypto-assets, or the equivalent persons who effectively run the entity or have key functions in accordance with relevant Union or national law;

+ (31) `credit institution' means a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council (32);

+ (32) `institution exempted pursuant to Directive 2013/36/EU' means an entity as referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU;

+ (33) `investment firm' means an investment firm as defined in Article 4(1), point (1), of Directive 2014/65/EU;

+ (34) `small and non-interconnected investment firm' means an investment firm that meets the conditions laid out in Article 12(1) of Regulation (EU) 2019/2033 of the European Parliament and of the Council (33);

+ (35) `payment institution' means a payment institution as defined in Article 4, point (4), of Directive (EU) 2015/2366;

+ (36) `payment institution exempted pursuant to Directive (EU) 2015/2366' means a payment institution exempted pursuant to Article 32(1) of Directive (EU) 2015/2366;

+ (37) `account information service provider' means an account information service provider as referred to in Article 33(1) of Directive (EU) 2015/2366;

+ (38) `electronic money institution' means an electronic money institution as defined in Article 2, point (1), of Directive 2009/110/EC of the European Parliament and of the Council;

+ (39) `electronic money institution exempted pursuant to Directive 2009/110/EC' means an electronic money institution benefitting from a waiver as referred to in Article 9(1) of Directive 2009/110/EC;

+ (40) `central counterparty' means a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012;

+ (41) `trade repository' means a trade repository as defined in Article 2, point (2), of Regulation (EU) No 648/2012;

+ (42) `central securities depository' means a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014;

+ (43) `trading venue' means a trading venue as defined in Article 4(1), point (24), of Directive 2014/65/EU;

+ (44) `manager of alternative investment funds' means a manager of alternative investment funds as defined in Article 4(1), point (b), of Directive 2011/61/EU;

+ (45) `management company' means a management company as defined in Article 2(1), point (b), of Directive 2009/65/EC;

+ (46) `data reporting service provider' means a data reporting service provider within the meaning of Regulation (EU) No 600/2014, as referred to in Article 2(1), points (34) to (36) thereof;

+ (47) `insurance undertaking' means an insurance undertaking as defined in Article 13, point (1), of Directive 2009/138/EC;

+ (48) `reinsurance undertaking' means a reinsurance undertaking as defined in Article 13, point (4), of Directive 2009/138/EC;

+ (31) Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS) (OJ L 302, 17.11.2009, p. 32).

+ (32) Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1).

+ (33) Regulation (EU) 2019/2033 of the European Parliament and of the Council of 27 November 2019 on the prudential requirements of investment firms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No 806/2014 (OJ L 314, 5.12.2019, p. 1).

+ L 333/28

+ Official Journal of the European Union

+ 27.12.2022

+ (49) `insurance intermediary' means an insurance intermediary as defined in Article 2(1), point (3), of Directive (EU) 2016/97 of the European Parliament and of the Council (34);

+ (50) `ancillary insurance intermediary' means an ancillary insurance intermediary as defined in Article 2(1), point (4), of Directive (EU) 2016/97;

+ (51) `reinsurance intermediary' means a reinsurance intermediary as defined in Article 2(1), point (5), of Directive (EU) 2016/97;

+ (52) `institution for occupational retirement provision' means an institution for occupational retirement provision as defined in Article 6, point (1), of Directive (EU) 2016/2341;

+ (53) `small institution for occupational retirement provision' means an institution for occupational retirement provision which operates pension schemes which together have less than 100 members in total;

+ (54) `credit rating agency' means a credit rating agency as defined in Article 3(1), point (b), of Regulation (EC) No 1060/2009;

+ (55) `crypto-asset service provider' means a crypto-asset service provider as defined in the relevant provision of the Regulation on markets in crypto-assets;

+ (56) `issuer of asset-referenced tokens' means an issuer of asset-referenced tokens as defined in the relevant provision of the Regulation on markets in crypto-assets;

+ (57) `administrator of critical benchmarks' means an administrator of `critical benchmarks' as defined in Article 3(1), point (25), of Regulation (EU) 2016/1011;

+ (58) `crowdfunding service provider' means a crowdfunding service provider as defined in Article 2(1), point (e), of Regulation (EU) 2020/1503 of the European Parliament and of the Council (35);

+ (59) `securitisation repository' means a securitisation repository as defined in Article 2, point (23), of Regulation (EU) 2017/2402 of the European Parliament and of the Council (36);

+ (60) `microenterprise' means a financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million;

+ (61) `Lead Overseer' means the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation;

+ (62) `Joint Committee' means the committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010;

+ (63) `small enterprise' means a financial entity that employs 10 or more persons, but fewer than 50 persons, and has an annual turnover and/or annual balance sheet total that exceeds EUR 2 million, but does not exceed EUR 10 million;

+ (64) `medium-sized enterprise' means a financial entity that is not a small enterprise and employs fewer than 250 persons and has an annual turnover that does not exceed EUR 50 million and/or an annual balance sheet that does not exceed EUR 43 million;

+ (65) `public authority' means any government or other public administration entity, including national central banks.

+ (34) Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution (OJ L 26, 2.2.2016, p. 19).

+ (35) Regulation (EU) 2020/1503 of the European Parliament and of the Council of 7 October 2020 on European crowdfunding service providers for business, and amending Regulation (EU) 2017/1129 and Directive (EU) 2019/1937 (OJ L 347, 20.10.2020, p. 1).

+ (36) Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation and creating a specific framework for simple, transparent and standardised securitisation, and amending Directives 2009/65/EC, 2009/138/EC and 2011/61/EU and Regulations (EC) No 1060/2009 and (EU) No 648/2012 (OJ L 347, 28.12.2017, p. 35).

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/29

+ Article 4

+ Proportionality principle

+ 1. Financial entities shall implement the rules laid down in Chapter II in accordance with the principle of proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations.

+ 2. In addition, the application by financial entities of Chapters III, IV and V, Section I, shall be proportionate to their size and overall risk profile, and to the nature, scale and complexity of their services, activities and operations, as specifically provided for in the relevant rules of those Chapters.

+ 3. The competent authorities shall consider the application of the proportionality principle by financial entities when reviewing the consistency of the ICT risk management framework on the basis of the reports submitted upon the request of competent authorities pursuant to Article 6(5) and Article 16(2).

+ ICT risk management

+ Article 5

+ Governance and organisation

+ 1. Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with Article 6(4), in order to achieve a high level of digital operational resilience.

+ 2. The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1).

+ For the purposes of the first subparagraph, the management body shall:

+ (a) bear the ultimate responsibility for managing the financial entity's ICT risk;

+ (b) put in place policies that aim to ensure the maintenance of high standards of availability, authenticity, integrity and confidentiality, of data;

+ (c) set clear roles and responsibilities for all ICT-related functions and establish appropriate governance arrangements to ensure effective and timely communication, cooperation and coordination among those functions;

+ (d) bear the overall responsibility for setting and approving the digital operational resilience strategy as referred to in Article 6(8), including the determination of the appropriate risk tolerance level of ICT risk of the financial entity, as referred to in Article 6(8), point (b);

+ (e) approve, oversee and periodically review the implementation of the financial entity's ICT business continuity policy and ICT response and recovery plans, referred to, respectively, in Article 11(1) and (3), which may be adopted as a dedicated specific policy forming an integral part of the financial entity's overall business continuity policy and response and recovery plan;

+ (f) approve and periodically review the financial entity's ICT internal audit plans, ICT audits and material modifications to them;

+ (g) allocate and periodically review the appropriate budget to fulfil the financial entity's digital operational resilience needs in respect of all types of resources, including relevant ICT security awareness programmes and digital operational resilience training referred to in Article 13(6), and ICT skills for all staff;

+ L 333/30

+ Official Journal of the European Union

+ 27.12.2022

+ (h) approve and periodically review the financial entity's policy on arrangements regarding the use of ICT services provided by ICT third-party service providers;

+ (i) put in place, at corporate level, reporting channels enabling it to be duly informed of the following:

+ (i) arrangements concluded with ICT third-party service providers on the use of ICT services,

+ (ii) any relevant planned material changes regarding the ICT third-party service providers,

+ (iii) the potential impact of such changes on the critical or important functions subject to those arrangements, including a risk analysis summary to assess the impact of those changes, and at least major ICT-related incidents and their impact, as well as response, recovery and corrective measures.

+ 3. Financial entities, other than microenterprises, shall establish a role in order to monitor the arrangements concluded with ICT third-party service providers on the use of ICT services, or shall designate a member of senior management as responsible for overseeing the related risk exposure and relevant documentation.

+ 4. Members of the management body of the financial entity shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed.

+ Article 6

+ ICT risk management framework

+ 1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience.

+ 2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools that are necessary to duly and adequately protect all information assets and ICT assets, including computer software, hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks including damage and unauthorised access or usage.

+ 3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.

+ 4. Financial entities, other than microenterprises, shall assign the responsibility for managing and overseeing ICT risk to a control function and ensure an appropriate level of independence of such control function in order to avoid conflicts of interest. Financial entities shall ensure appropriate segregation and independence of ICT risk management functions, control functions, and internal audit functions, according to the three lines of defence model, or an internal risk management and control model.

+ 5. The ICT risk management framework shall be documented and reviewed at least once a year, or periodically in the case of microenterprises, as well as upon the occurrence of major ICT-related incidents, and following supervisory instructions or conclusions derived from relevant digital operational resilience testing or audit processes. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A report on the review of the ICT risk management framework shall be submitted to the competent authority upon its request.

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/31

+ 6. The ICT risk management framework of financial entities, other than microenterprises, shall be subject to internal audit by auditors on a regular basis in line with the financial entities' audit plan. Those auditors shall possess sufficient knowledge, skills and expertise in ICT risk, as well as appropriate independence. The frequency and focus of ICT audits shall be commensurate to the ICT risk of the financial entity.

+ 7. Based on the conclusions from the internal audit review, financial entities shall establish a formal follow-up process, including rules for the timely verification and remediation of critical ICT audit findings.

+ 8. The ICT risk management framework shall include a digital operational resilience strategy setting out how the framework shall be implemented. To that end, the digital operational resilience strategy shall include methods to address ICT risk and attain specific ICT objectives, by:

+ (a) explaining how the ICT risk management framework supports the financial entity's business strategy and objectives;

+ (b) establishing the risk tolerance level for ICT risk, in accordance with the risk appetite of the financial entity, and analysing the impact tolerance for ICT disruptions;

+ (c) setting out clear information security objectives, including key performance indicators and key risk metrics;

+ (d) explaining the ICT reference architecture and any changes needed to reach specific business objectives;

+ (e) outlining the different mechanisms put in place to detect ICT-related incidents, prevent their impact and provide protection from it;

+ (f) evidencing the current digital operational resilience situation on the basis of the number of major ICT-related incidents reported and the effectiveness of preventive measures;

+ (g) implementing digital operational resilience testing, in accordance with Chapter IV of this Regulation;

+ (h) outlining a communication strategy in the event of ICT-related incidents the disclosure of which is required in accordance with Article 14.

+ 9. Financial entities may, in the context of the digital operational resilience strategy referred to in paragraph 8, define a holistic ICT multi-vendor strategy, at group or entity level, showing key dependencies on ICT third-party service providers and explaining the rationale behind the procurement mix of ICT third-party service providers.

+ 10. Financial entities may, in accordance with Union and national sectoral law, outsource the tasks of verifying compliance with ICT risk management requirements to intra-group or external undertakings. In case of such outsourcing, the financial entity remains fully responsible for the verification of compliance with the ICT risk management requirements.

+ Article 7

+ In order to address and manage ICT risk, financial entities shall use and maintain updated ICT systems, protocols and tools that are:

+ (a) appropriate to the magnitude of operations supporting the conduct of their activities, in accordance with the proportionality principle as referred to in Article 4;

+ (c) equipped with sufficient capacity to accurately process the data necessary for the performance of activities and the timely provision of services, and to deal with peak orders, message or transaction volumes, as needed, including where new technology is introduced;

+ (d) technologically resilient in order to adequately deal with additional information processing needs as required under stressed market conditions or other adverse situations.

+ L 333/32

+ Official Journal of the European Union

+ 27.12.2022

+ Article 8

+ Identification

+ 1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and their roles and dependencies in relation to ICT risk. Financial entities shall review as needed, and at least yearly, the adequacy of this classification and of any relevant documentation.

+ 2. Financial entities shall, on a continuous basis, identify all sources of ICT risk, in particular the risk exposure to and from other financial entities, and assess cyber threats and ICT vulnerabilities relevant to their ICT supported business functions, information assets and ICT assets. Financial entities shall review on a regular basis, and at least yearly, the risk scenarios impacting them.

+ 3. Financial entities, other than microenterprises, shall perform a risk assessment upon each major change in the network and information system infrastructure, in the processes or procedures affecting their ICT supported business functions, information assets or ICT assets.

+ 4. Financial entities shall identify all information assets and ICT assets, including those on remote sites, network resources and hardware equipment, and shall map those considered critical. They shall map the configuration of the information assets and ICT assets and the links and interdependencies between the different information assets and ICT assets.

+ 5. Financial entities shall identify and document all processes that are dependent on ICT third-party service providers, and shall identify interconnections with ICT third-party service providers that provide services that support critical or important functions.

+ 6. For the purposes of paragraphs 1, 4 and 5, financial entities shall maintain relevant inventories and update them periodically and every time any major change as referred to in paragraph 3 occurs.

+ 7. Financial entities, other than microenterprises, shall on a regular basis, and at least yearly, conduct a specific ICT risk assessment on all legacy ICT systems and, in any case before and after connecting technologies, applications or systems.

+ Article 9

+ Protection and prevention

+ 1. For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures.

+ 2. Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, in particular for those supporting critical or important functions, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit.

+ 3. In order to achieve the objectives referred to in paragraph 2, financial entities shall use ICT solutions and processes that are appropriate in accordance with Article 4. Those ICT solutions and processes shall:

+ (a) ensure the security of the means of transfer of data;

+ (b) minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity;

+ (c) prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data;

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/33

+ (d) ensure that data is protected from risks arising from data management, including poor administration, processingrelated risks and human error.

+ 4. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall:

+ (a) develop and document an information security policy defining rules to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers, where applicable;

+ (b) following a risk-based approach, establish a sound network and infrastructure management structure using appropriate techniques, methods and protocols that may include implementing automated mechanisms to isolate affected information assets in the event of cyber-attacks;

+ (c) implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof;

+ (d) implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes;

+ (e) implement documented policies, procedures and controls for ICT change management, including changes to software, hardware, firmware components, systems or security parameters, that are based on a risk assessment approach and are an integral part of the financial entity's overall change management process, in order to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner;

+ (f) have appropriate and comprehensive documented policies for patches and updates.

+ For the purposes of the first subparagraph, point (b), financial entities shall design the network connection infrastructure in a way that allows it to be instantaneously severed or segmented in order to minimise and prevent contagion, especially for interconnected financial processes.

+ For the purposes of the first subparagraph, point (e), the ICT change management process shall be approved by appropriate lines of management and shall have specific protocols in place.

+ Article 10

+ 1. Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure.

+ All detection mechanisms referred to in the first subparagraph shall be regularly tested in accordance with Article 25.

+ 2. The detection mechanisms referred to in paragraph 1 shall enable multiple layers of control, define alert thresholds and criteria to trigger and initiate ICT-related incident response processes, including automatic alert mechanisms for relevant staff in charge of ICT-related incident response.

+ 3. Financial entities shall devote sufficient resources and capabilities to monitor user activity, the occurrence of ICT anomalies and ICT-related incidents, in particular cyber-attacks.

+ 4. Data reporting service providers shall, in addition, have in place systems that can effectively check trade reports for completeness, identify omissions and obvious errors, and request re-transmission of those reports.

+ L 333/34

+ Official Journal of the European Union

+ 27.12.2022

+ Article 11

+ Response and recovery

+ 1. As part of the ICT risk management framework referred to in Article 6(1) and based on the identification requirements set out in Article 8, financial entities shall put in place a comprehensive ICT business continuity policy, which may be adopted as a dedicated specific policy, forming an integral part of the overall business continuity policy of the financial entity.

+ 2. Financial entities shall implement the ICT business continuity policy through dedicated, appropriate and documented arrangements, plans, procedures and mechanisms aiming to:

+ (a) ensure the continuity of the financial entity's critical or important functions;

+ (b) quickly, appropriately and effectively respond to, and resolve, all ICT-related incidents in a way that limits damage and prioritises the resumption of activities and recovery actions;

+ (c) activate, without delay, dedicated plans that enable containment measures, processes and technologies suited to each type of ICT-related incident and prevent further damage, as well as tailored response and recovery procedures established in accordance with Article 12;

+ (d) estimate preliminary impacts, damages and losses;

+ (e) set out communication and crisis management actions that ensure that updated information is transmitted to all relevant internal staff and external stakeholders in accordance with Article 14, and report to the competent authorities in accordance with Article 19.

+ 3. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall implement associated ICT response and recovery plans which, in the case of financial entities other than microenterprises, shall be subject to independent internal audit reviews.

+ 4. Financial entities shall put in place, maintain and periodically test appropriate ICT business continuity plans, notably with regard to critical or important functions outsourced or contracted through arrangements with ICT third-party service providers.

+ 5. As part of the overall business continuity policy, financial entities shall conduct a business impact analysis (BIA) of their exposures to severe business disruptions. Under the BIA, financial entities shall assess the potential impact of severe business disruptions by means of quantitative and qualitative criteria, using internal and external data and scenario analysis, as appropriate. The BIA shall consider the criticality of identified and mapped business functions, support processes, third-party dependencies and information assets, and their interdependencies. Financial entities shall ensure that ICT assets and ICT services are designed and used in full alignment with the BIA, in particular with regard to adequately ensuring the redundancy of all critical components.

+ 6. As part of their comprehensive ICT risk management, financial entities shall:

+ (a) test the ICT business continuity plans and the ICT response and recovery plans in relation to ICT systems supporting all functions at least yearly, as well as in the event of any substantive changes to ICT systems supporting critical or important functions;

+ (b) test the crisis communication plans established in accordance with Article 14.

+ For the purposes of the first subparagraph, point (a), financial entities, other than microenterprises, shall include in the testing plans scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities necessary to meet the obligations set out in Article 12.

+ Financial entities shall regularly review their ICT business continuity policy and ICT response and recovery plans, taking into account the results of tests carried out in accordance with the first subparagraph and recommendations stemming from audit checks or supervisory reviews.

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/35

+ 7. Financial entities, other than microenterprises, shall have a crisis management function, which, in the event of activation of their ICT business continuity plans or ICT response and recovery plans, shall, inter alia, set out clear procedures to manage internal and external crisis communications in accordance with Article 14.

+ 8. Financial entities shall keep readily accessible records of activities before and during disruption events when their ICT business continuity plans and ICT response and recovery plans are activated.

+ 9. Central securities depositories shall provide the competent authorities with copies of the results of the ICT business continuity tests, or of similar exercises.

+ 10. Financial entities, other than microenterprises, shall report to the competent authorities, upon their request, an estimation of aggregated annual costs and losses caused by major ICT-related incidents.

+ 11. In accordance with Article 16 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, the ESAs, through the Joint Committee, shall by 17 July 2024 develop common guidelines on the estimation of aggregated annual costs and losses referred to in paragraph 10.

+ Article 12

+ Backup policies and procedures, restoration and recovery procedures and methods

+ 1. For the purpose of ensuring the restoration of ICT systems and data with minimum downtime, limited disruption and loss, as part of their ICT risk management framework, financial entities shall develop and document:

+ (a) backup policies and procedures specifying the scope of the data that is subject to the backup and the minimum frequency of the backup, based on the criticality of information or the confidentiality level of the data;

+ 2. Financial entities shall set up backup systems that can be activated in accordance with the backup policies and procedures, as well as restoration and recovery procedures and methods. The activation of backup systems shall not jeopardise the security of the network and information systems or the availability, authenticity, integrity or confidentiality of data. Testing of the backup procedures and restoration and recovery procedures and methods shall be undertaken periodically.

+ 3. When restoring backup data using own systems, financial entities shall use ICT systems that are physically and logically segregated from the source ICT system. The ICT systems shall be securely protected from any unauthorised access or ICT corruption and allow for the timely restoration of services making use of data and system backups as necessary.

+ For central counterparties, the recovery plans shall enable the recovery of all transactions at the time of disruption to allow the central counterparty to continue to operate with certainty and to complete settlement on the scheduled date.

+ Data reporting service providers shall additionally maintain adequate resources and have back-up and restoration facilities in place in order to offer and maintain their services at all times.

+ 4. Financial entities, other than microenterprises, shall maintain redundant ICT capacities equipped with resources, capabilities and functions that are adequate to ensure business needs. Microenterprises shall assess the need to maintain such redundant ICT capacities based on their risk profile.

+ 5. Central securities depositories shall maintain at least one secondary processing site endowed with adequate resources, capabilities, functions and staffing arrangements to ensure business needs.

+ L 333/36

+ Official Journal of the European Union

+ 27.12.2022

+ The secondary processing site shall be:

+ (a) located at a geographical distance from the primary processing site to ensure that it bears a distinct risk profile and to prevent it from being affected by the event which has affected the primary site;

+ (b) capable of ensuring the continuity of critical or important functions identically to the primary site, or providing the level of services necessary to ensure that the financial entity performs its critical operations within the recovery objectives;

+ (c) immediately accessible to the financial entity's staff to ensure continuity of critical or important functions in the event that the primary processing site has become unavailable.

+ 6. In determining the recovery time and recovery point objectives for each function, financial entities shall take into account whether it is a critical or important function and the potential overall impact on market efficiency. Such time objectives shall ensure that, in extreme scenarios, the agreed service levels are met.

+ 7. When recovering from an ICT-related incident, financial entities shall perform necessary checks, including any multiple checks and reconciliations, in order to ensure that the highest level of data integrity is maintained. These checks shall also be performed when reconstructing data from external stakeholders, in order to ensure that all data is consistent between systems.

+ Article 13

+ Learning and evolving

+ 1. Financial entities shall have in place capabilities and staff to gather information on vulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse the impact they are likely to have on their digital operational resilience.

+ 2. Financial entities shall put in place post ICT-related incident reviews after a major ICT-related incident disrupts their core activities, analysing the causes of disruption and identifying required improvements to the ICT operations or within the ICT business continuity policy referred to in Article 11.

+ Financial entities, other than microenterprises, shall, upon request, communicate to the competent authorities, the changes that were implemented following post ICT-related incident reviews as referred to in the first subparagraph.

+ The post ICT-related incident reviews referred to in the first subparagraph shall determine whether the established procedures were followed and the actions taken were effective, including in relation to the following:

+ (a) the promptness in responding to security alerts and determining the impact of ICT-related incidents and their severity;

+ (b) the quality and speed of performing a forensic analysis, where deemed appropriate;

+ (c) the effectiveness of incident escalation within the financial entity;

+ (d) the effectiveness of internal and external communication.

+ 3. Lessons derived from the digital operational resilience testing carried out in accordance with Articles 26 and 27 and from real life ICT-related incidents, in particular cyber-attacks, along with challenges faced upon the activation of ICT business continuity plans and ICT response and recovery plans, together with relevant information exchanged with counterparts and assessed during supervisory reviews, shall be duly incorporated on a continuous basis into the ICT risk assessment process. Those findings shall form the basis for appropriate reviews of relevant components of the ICT risk management framework referred to in Article 6(1).

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/37

+ 4. Financial entities shall monitor the effectiveness of the implementation of their digital operational resilience strategy set out in Article 6(8). They shall map the evolution of ICT risk over time, analyse the frequency, types, magnitude and evolution of ICT-related incidents, in particular cyber-attacks and their patterns, with a view to understanding the level of ICT risk exposure, in particular in relation to critical or important functions, and enhance the cyber maturity and preparedness of the financial entity.

+ 5. Senior ICT staff shall report at least yearly to the management body on the findings referred to in paragraph 3 and put forward recommendations.

+ 6. Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions. Where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i).

+ 7. Financial entities, other than microenterprises, shall monitor relevant technological developments on a continuous basis, also with a view to understanding the possible impact of the deployment of such new technologies on ICT security requirements and digital operational resilience. They shall keep up-to-date with the latest ICT risk management processes, in order to effectively combat current or new forms of cyber-attacks.

+ Article 14

+ 1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate.

+ 2. As part of the ICT risk management framework, financial entities shall implement communication policies for internal staff and for external stakeholders. Communication policies for staff shall take into account the need to differentiate between staff involved in ICT risk management, in particular the staff responsible for response and recovery, and staff that needs to be informed.

+ 3. At least one person in the financial entity shall be tasked with implementing the communication strategy for ICTrelated incidents and fulfil the public and media function for that purpose.

+ Article 15

+ Further harmonisation of ICT risk management tools, methods, processes and policies

+ The ESAs shall, through the Joint Committee, in consultation with the European Union Agency on Cybersecurity (ENISA), develop common draft regulatory technical standards in order to:

+ (a) specify further elements to be included in the ICT security policies, procedures, protocols and tools referred to in Article 9(2), with a view to ensuring the security of networks, enable adequate safeguards against intrusions and data misuse, preserve the availability, authenticity, integrity and confidentiality of data, including cryptographic techniques, and guarantee an accurate and prompt data transmission without major disruptions and undue delays;

+ (b) develop further components of the controls of access management rights referred to in Article 9(4), point (c), and associated human resource policy specifying access rights, procedures for granting and revoking rights, monitoring anomalous behaviour in relation to ICT risk through appropriate indicators, including for network use patterns, hours, IT activity and unknown devices;

+ (c) develop further the mechanisms specified in Article 10(1) enabling a prompt detection of anomalous activities and the criteria set out in Article 10(2) triggering ICT-related incident detection and response processes;

+ L 333/38

+ Official Journal of the European Union

+ 27.12.2022

+ (d) specify further the components of the ICT business continuity policy referred to in Article 11(1);

+ (e) specify further the testing of ICT business continuity plans referred to in Article 11(6) to ensure that such testing duly takes into account scenarios in which the quality of the provision of a critical or important function deteriorates to an unacceptable level or fails, and duly considers the potential impact of the insolvency, or other failures, of any relevant ICT third-party service provider and, where relevant, the political risks in the respective providers' jurisdictions;

+ (f) specify further the components of the ICT response and recovery plans referred to in Article 11(3);

+ (g) specifying further the content and format of the report on the review of the ICT risk management framework referred to in Article 6(5);

+ When developing those draft regulatory technical standards, the ESAs shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations, while duly taking into consideration any specific feature arising from the distinct nature of activities across different financial services sectors.

+ The ESAs shall submit those draft regulatory technical standards to the Commission by 17 January 2024.

+ Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first paragraph in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

+ Article 16

+ Simplified ICT risk management framework

+ 1. Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366; institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4) of this Regulation; electronic money institutions exempted pursuant to Directive 2009/110/EC; and small institutions for occupational retirement provision.

+ Without prejudice to the first subparagraph, the entities listed in the first subparagraph shall:

+ (a) put in place and maintain a sound and documented ICT risk management framework that details the mechanisms and measures aimed at a quick, efficient and comprehensive management of ICT risk, including for the protection of relevant physical components and infrastructures;

+ (b) continuously monitor the security and functioning of all ICT systems;

+ (c) minimise the impact of ICT risk through the use of sound, resilient and updated ICT systems, protocols and tools which are appropriate to support the performance of their activities and the provision of services and adequately protect availability, authenticity, integrity and confidentiality of data in the network and information systems;

+ (d) allow sources of ICT risk and anomalies in the network and information systems to be promptly identified and detected and ICT-related incidents to be swiftly handled;

+ (e) identify key dependencies on ICT third-party service providers;

+ (f) ensure the continuity of critical or important functions, through business continuity plans and response and recovery measures, which include, at least, back-up and restoration measures;

+ (g) test, on a regular basis, the plans and measures referred to in point (f), as well as the effectiveness of the controls implemented in accordance with points (a) and (c);

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/39

+ (h) implement, as appropriate, relevant operational conclusions resulting from the tests referred to in point (g) and from post-incident analysis into the ICT risk assessment process and develop, according to needs and ICT risk profile, ICT security awareness programmes and digital operational resilience training for staff and management.

+ 2. The ICT risk management framework referred to in paragraph 1, second subparagraph, point (a), shall be documented and reviewed periodically and upon the occurrence of major ICT-related incidents in compliance with supervisory instructions. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A report on the review of the ICT risk management framework shall be submitted to the competent authority upon its request.

+ 3. The ESAs shall, through the Joint Committee, in consultation with the ENISA, develop common draft regulatory technical standards in order to:

+ (a) specify further the elements to be included in the ICT risk management framework referred to in paragraph 1, second subparagraph, point (a);

+ (b) specify further the elements in relation to systems, protocols and tools to minimise the impact of ICT risk referred to in paragraph 1, second subparagraph, point (c), with a view to ensuring the security of networks, enabling adequate safeguards against intrusions and data misuse and preserving the availability, authenticity, integrity and confidentiality of data;

+ (c) specify further the components of the ICT business continuity plans referred to in paragraph 1, second subparagraph, point (f);

+ (d) specify further the rules on the testing of business continuity plans and ensure the effectiveness of the controls referred to in paragraph 1, second subparagraph, point (g) and ensure that such testing duly takes into account scenarios in which the quality of the provision of a critical or important function deteriorates to an unacceptable level or fails;

+ (e) specify further the content and format of the report on the review of the ICT risk management framework referred to in paragraph 2.

+ The ESAs shall submit those draft regulatory technical standards to the Commission by 17 January 2024.

+ Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

+ ICT-related incident management, classification and reporting

+ Article 17

+ ICT-related incident management process

+ 1. Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents.

+ 2. Financial entities shall record all ICT-related incidents and significant cyber threats. Financial entities shall establish appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of ICTrelated incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents.

+ L 333/40

+ Official Journal of the European Union

+ 27.12.2022

+ 3. The ICT-related incident management process referred to in paragraph 1 shall:

+ (a) put in place early warning indicators;

+ (b) establish procedures to identify, track, log, categorise and classify ICT-related incidents according to their priority and severity and according to the criticality of the services impacted, in accordance with the criteria set out in Article 18(1);

+ (c) assign roles and responsibilities that need to be activated for different ICT-related incident types and scenarios;

+ (d) set out plans for communication to staff, external stakeholders and media in accordance with Article 14 and for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate;

+ (e) ensure that at least major ICT-related incidents are reported to relevant senior management and inform the management body of at least major ICT-related incidents, explaining the impact, response and additional controls to be established as a result of such ICT-related incidents;

+ (f) establish ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.

+ Article 18

+ Classification of ICT-related incidents and cyber threats

+ 1. Financial entities shall classify ICT-related incidents and shall determine their impact based on the following criteria:

+ (a) the number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the ICT-related incident, and whether the ICT-related incident has caused reputational impact;

+ (b) the duration of the ICT-related incident, including the service downtime;

+ (c) the geographical spread with regard to the areas affected by the ICT-related incident, particularly if it affects more than two Member States;

+ (d) the data losses that the ICT-related incident entails, in relation to availability, authenticity, integrity or confidentiality of data;

+ (e) the criticality of the services affected, including the financial entity's transactions and operations;

+ (f) the economic impact, in particular direct and indirect costs and losses, of the ICT-related incident in both absolute and relative terms.

+ 2. Financial entities shall classify cyber threats as significant based on the criticality of the services at risk, including the financial entity's transactions and operations, number and/or relevance of clients or financial counterparts targeted and the geographical spread of the areas at risk.

+ 3. The ESAs shall, through the Joint Committee and in consultation with the ECB and ENISA, develop common draft regulatory technical standards further specifying the following:

+ (a) the criteria set out in paragraph 1, including materiality thresholds for determining major ICT-related incidents or, as applicable, major operational or security payment-related incidents, that are subject to the reporting obligation laid down in Article 19(1);

+ (b) the criteria to be applied by competent authorities for the purpose of assessing the relevance of major ICT-related incidents or, as applicable, major operational or security payment-related incidents, to relevant competent authorities in other Member States', and the details of reports of major ICT-related incidents or, as applicable, major operational or security payment-related incidents, to be shared with other competent authorities pursuant to Article 19(6) and (7);

+ (c) the criteria set out in paragraph 2 of this Article, including high materiality thresholds for determining significant cyber threats.

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/41

+ 4. When developing the common draft regulatory technical standards referred to in paragraph 3 of this Article, the ESAs shall take into account the criteria set out in Article 4(2), as well as international standards, guidance and specifications developed and published by ENISA, including, where appropriate, specifications for other economic sectors. For the purposes of applying the criteria set out in Article 4(2), the ESAs shall duly consider the need for microenterprises and small and medium-sized enterprises to mobilise sufficient resources and capabilities to ensure that ICT-related incidents are managed swiftly.

+ The ESAs shall submit those common draft regulatory technical standards to the Commission by 17 January 2024.

+ Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in paragraph 3 in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

+ Article 19

+ Reporting of major ICT-related incidents and voluntary notification of significant cyber threats

+ 1. Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article.

+ Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying out the functions and duties provided for in this Article.

+ Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall report major ICT-related incidents to the relevant national competent authority designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit that report to the ECB.

+ For the purpose of the first subparagraph, financial entities shall produce, after collecting and analysing all relevant information, the initial notification and reports referred to in paragraph 4 of this Article using the templates referred to in Article 20 and submit them to the competent authority. In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entities shall notify the competent authority about it via alternative means.

+ The initial notification and reports referred to in paragraph 4 shall include all information necessary for the competent authority to determine the significance of the major ICT-related incident and assess possible cross-border impacts.

+ Without prejudice to the reporting pursuant to the first subparagraph by the financial entity to the relevant competent authority, Member States may additionally determine that some or all financial entities shall also provide the initial notification and each report referred to in paragraph 4 of this Article using the templates referred to in Article 20 to the competent authorities or the computer security incident response teams (CSIRTs) designated or established in accordance with Directive (EU) 2022/2555.

+ 2. Financial entities may, on a voluntary basis, notify significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.

+ Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, may, on a voluntary basis, notify significant cyber threats to relevant national competent authority, designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit the notification to the ECB.

+ Member States may determine that those financial entities that on a voluntary basis notify in accordance with the first subparagraph may also transmit that notification to the CSIRTs designated or established in accordance with Directive (EU) 2022/2555.

+ L 333/42

+ Official Journal of the European Union

+ 27.12.2022

+ 3. Where a major ICT-related incident occurs and has an impact on the financial interests of clients, financial entities shall, without undue delay as soon as they become aware of it, inform their clients about the major ICT-related incident and about the measures that have been taken to mitigate the adverse effects of such incident.

+ In the case of a significant cyber threat, financial entities shall, where applicable, inform their clients that are potentially affected of any appropriate protection measures which the latter may consider taking.

+ 4. Financial entities shall, within the time limits to be laid down in accordance with Article 20, first paragraph, point (a), point (ii), submit the following to the relevant competent authority:

+ (b) an intermediate report after the initial notification referred to in point (a), as soon as the status of the original incident has changed significantly or the handling of the major ICT-related incident has changed based on new information available, followed, as appropriate, by updated notifications every time a relevant status update is available, as well as upon a specific request of the competent authority;

+ (c) a final report, when the root cause analysis has been completed, regardless of whether mitigation measures have already been implemented, and when the actual impact figures are available to replace estimates.

+ 5. Financial entities may outsource, in accordance with Union and national sectoral law, the reporting obligations under this Article to a third-party service provider. In case of such outsourcing, the financial entity remains fully responsible for the fulfilment of the incident reporting requirements.

+ 6. Upon receipt of the initial notification and of each report referred to in paragraph 4, the competent authority shall, in a timely manner, provide details of the major ICT-related incident to the following recipients based, as applicable, on their respective competences:

+ (a) EBA, ESMA or EIOPA;

+ (b) the ECB, in the case of financial entities referred to in Article 2(1), points (a), (b) and (d);

+ (c) the competent authorities, single points of contact or CSIRTs designated or established in accordance with Directive (EU) 2022/2555;

+ (d) the resolution authorities, as referred to in Article 3 of Directive 2014/59/EU, and the Single Resolution Board (SRB) with respect to entities referred to in Article 7(2) of Regulation (EU) No 806/2014 of the European Parliament and of the Council (37), and with respect to entities and groups referred to in Article 7(4)(b) and (5) of Regulation (EU) No 806/2014 if such details concern incidents that pose a risk to ensuring critical functions within the meaning of Article 2(1), point (35), of Directive 2014/59/EU; and

+ (e) other relevant public authorities under national law.

+ 7. Following receipt of information in accordance with paragraph 6, EBA, ESMA or EIOPA and the ECB, in consultation with ENISA and in cooperation with the relevant competent authority, shall assess whether the major ICT-related incident is relevant for competent authorities in other Member States. Following that assessment, EBA, ESMA or EIOPA shall, as soon as possible, notify relevant competent authorities in other Member States accordingly. The ECB shall notify the members of the European System of Central Banks on issues relevant to the payment system. Based on that notification, the competent authorities shall, where appropriate, take all of the necessary measures to protect the immediate stability of the financial system.

+ (37) Regulation (EU) No 806/2014 of the European Parliament and of the Council of 15 July 2014 establishing uniform rules and a uniform procedure for the resolution of credit institutions and certain investment firms in the framework of a Single Resolution Mechanism and a Single Resolution Fund and amending Regulation (EU) No 1093/2010 (OJ L 225, 30.7.2014, p. 1).

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/43

+ 8. The notification to be done by ESMA pursuant to paragraph 7 of this Article shall be without prejudice to the responsibility of the competent authority to urgently transmit the details of the major ICT-related incident to the relevant authority in the host Member State, where a central securities depository has significant cross-border activity in the host Member State, the major ICT-related incident is likely to have severe consequences for the financial markets of the host Member State and where there are cooperation arrangements among competent authorities related to the supervision of financial entities.

+ Article 20

+ Harmonisation of reporting content and templates

+ (a) common draft regulatory technical standards in order to:

+ (i) establish the content of the reports for major ICT-related incidents in order to reflect the criteria laid down in Article 18(1) and incorporate further elements, such as details for establishing the relevance of the reporting for other Member States and whether it constitutes a major operational or security payment-related incident or not;

+ (ii) determine the time limits for the initial notification and for each report referred to in Article 19(4);

+ (iii) establish the content of the notification for significant cyber threats.

+ When developing those draft regulatory technical standards, the ESAs shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations, and in particular, with a view to ensuring that, for the purposes of this paragraph, point (a), point (ii), different time limits may reflect, as appropriate, specificities of financial sectors, without prejudice to maintaining a consistent approach to ICT-related incident reporting pursuant to this Regulation and to Directive (EU) 2022/2555. The ESAs shall, as applicable, provide justification when deviating from the approaches taken in the context of that Directive;

+ (b) common draft implementing technical standards in order to establish the standard forms, templates and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat.

+ The ESAs shall submit the common draft regulatory technical standards referred to in the first paragraph, point (a), and the common draft implementing technical standards referred to in the first paragraph, point (b), to the Commission by 17 July 2024.

+ Power is delegated to the Commission to supplement this Regulation by adopting the common regulatory technical standards referred to in the first paragraph, point (a), in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

+ Power is conferred on the Commission to adopt the common implementing technical standards referred to in the first paragraph, point (b), in accordance with Article 15 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

+ Article 21

+ Centralisation of reporting of major ICT-related incidents

+ 1. The ESAs, through the Joint Committee, and in consultation with the ECB and ENISA, shall prepare a joint report assessing the feasibility of further centralisation of incident reporting through the establishment of a single EU Hub for major ICT-related incident reporting by financial entities. The joint report shall explore ways to facilitate the flow of ICTrelated incident reporting, reduce associated costs and underpin thematic analyses with a view to enhancing supervisory convergence.

+ L 333/44

+ Official Journal of the European Union

+ 27.12.2022

+ 2. The joint report referred to in paragraph 1 shall comprise at least the following elements: (a) prerequisites for the establishment of a single EU Hub; (b) benefits, limitations and risks, including risks associated with the high concentration of sensitive information; (c) the necessary capability to ensure interoperability with regard to other relevant reporting schemes; (d) elements of operational management; (e) conditions of membership; (f) technical arrangements for financial entities and national competent authorities to access the single EU Hub; (g) a preliminary assessment of financial costs incurred by setting-up the operational platform supporting the single EU

+ Hub, including the requisite expertise.

+ 3. The ESAs shall submit the report referred to in paragraph 1 to the European Parliament, to the Council and to the Commission by 17 January 2025.

+ Article 22

+ Supervisory feedback

+ 1. Without prejudice to the technical input, advice or remedies and subsequent follow-up which may be provided, where applicable, in accordance with national law, by the CSIRTs under Directive (EU) 2022/2555, the competent authority shall, upon receipt of the initial notification and of each report as referred to in Article 19(4), acknowledge receipt and may, where feasible, provide in a timely manner relevant and proportionate feedback or high-level guidance to the financial entity, in particular by making available any relevant anonymised information and intelligence on similar threats, and may discuss remedies applied at the level of the financial entity and ways to minimise and mitigate adverse impact across the financial sector. Without prejudice to the supervisory feedback received, financial entities shall remain fully responsible for the handling and for consequences of the ICT-related incidents reported pursuant to Article 19(1).

+ 2. The ESAs shall, through the Joint Committee, on an anonymised and aggregated basis, report yearly on major ICTrelated incidents, the details of which shall be provided by competent authorities in accordance with Article 19(6), setting out at least the number of major ICT-related incidents, their nature and their impact on the operations of financial entities or clients, remedial actions taken and costs incurred.

+ The ESAs shall issue warnings and produce high-level statistics to support ICT threat and vulnerability assessments.

+ Article 23

+ Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions

+ The requirements laid down in this Chapter shall also apply to operational or security payment-related incidents and to major operational or security payment-related incidents, where they concern credit institutions, payment institutions, account information service providers, and electronic money institutions.

+ 27.12.2022

+ Official Journal of the European Union

+ CHAPTER IV

+ Digital operational resilience testing

+ L 333/45

+ Article 24

+ General requirements for the performance of digital operational resilience testing

+ 1. For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.

+ 2. The digital operational resilience testing programme shall include a range of assessments, tests, methodologies, practices and tools to be applied in accordance with Articles 25 and 26.

+ 3. When conducting the digital operational resilience testing programme referred to in paragraph 1 of this Article, financial entities, other than microenterprises, shall follow a risk-based approach taking into account the criteria set out in Article 4(2) duly considering the evolving landscape of ICT risk, any specific risks to which the financial entity concerned is or might be exposed, the criticality of information assets and of services provided, as well as any other factor the financial entity deems appropriate.

+ 4. Financial entities, other than microenterprises, shall ensure that tests are undertaken by independent parties, whether internal or external. Where tests are undertaken by an internal tester, financial entities shall dedicate sufficient resources and ensure that conflicts of interest are avoided throughout the design and execution phases of the test.

+ 5. Financial entities, other than microenterprises, shall establish procedures and policies to prioritise, classify and remedy all issues revealed throughout the performance of the tests and shall establish internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed.

+ 6. Financial entities, other than microenterprises, shall ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions.

+ Article 25

+ Testing of ICT tools and systems

+ 1. The digital operational resilience testing programme referred to in Article 24 shall provide, in accordance with the criteria set out in Article 4(2), for the execution of appropriate tests, such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.

+ 2. Central securities depositories and central counterparties shall perform vulnerability assessments before any deployment or redeployment of new or existing applications and infrastructure components, and ICT services supporting critical or important functions of the financial entity.

+ 3. Microenterprises shall perform the tests referred to in paragraph 1 by combining a risk-based approach with a strategic planning of ICT testing, by duly considering the need to maintain a balanced approach between the scale of resources and the time to be allocated to the ICT testing provided for in this Article, on the one hand, and the urgency, type of risk, criticality of information assets and of services provided, as well as any other relevant factor, including the financial entity's ability to take calculated risks, on the other hand.

+ L 333/46

+ Official Journal of the European Union

+ 27.12.2022

+ Article 26

+ Advanced testing of ICT tools, systems and processes based on TLPT

+ 1. Financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, which are identified in accordance with paragraph 8, third subparagraph, of this Article, shall carry out at least every 3 years advanced testing by means of TLPT. Based on the risk profile of the financial entity and taking into account operational circumstances, the competent authority may, where necessary, request the financial entity to reduce or increase this frequency.

+ 2. Each threat-led penetration test shall cover several or all critical or important functions of a financial entity, and shall be performed on live production systems supporting such functions.

+ Financial entities shall identify all relevant underlying ICT systems, processes and technologies supporting critical or important functions and ICT services, including those supporting the critical or important functions which have been outsourced or contracted to ICT third-party service providers.

+ Financial entities shall assess which critical or important functions need to be covered by the TLPT. The result of this assessment shall determine the precise scope of TLPT and shall be validated by the competent authorities.

+ 3. Where ICT third-party service providers are included in the scope of TLPT, the financial entity shall take the necessary measures and safeguards to ensure the participation of such ICT third-party service providers in the TLPT and shall retain at all times full responsibility for ensuring compliance with this Regulation.

+ 4. Without prejudice to paragraph 2, first and second subparagraphs, where the participation of an ICT third-party service provider in the TLPT, referred to in paragraph 3, is reasonably expected to have an adverse impact on the quality or security of services delivered by the ICT third-party service provider to customers that are entities falling outside the scope of this Regulation, or on the confidentiality of the data related to such services, the financial entity and the ICT third-party service provider may agree in writing that the ICT third-party service provider directly enters into contractual arrangements with an external tester, for the purpose of conducting, under the direction of one designated financial entity, a pooled TLPT involving several financial entities (pooled testing) to which the ICT third-party service provider provides ICT services.

+ That pooled testing shall cover the relevant range of ICT services supporting critical or important functions contracted to the respective ICT third-party service provider by the financial entities. The pooled testing shall be considered TLPT carried out by the financial entities participating in the pooled testing.

+ The number of financial entities participating in the pooled testing shall be duly calibrated taking into account the complexity and types of services involved.

+ 5. Financial entities shall, with the cooperation of ICT third-party service providers and other parties involved, including the testers but excluding the competent authorities, apply effective risk management controls to mitigate the risks of any potential impact on data, damage to assets, and disruption to critical or important functions, services or operations at the financial entity itself, its counterparts or to the financial sector.

+ 6. At the end of the testing, after reports and remediation plans have been agreed, the financial entity and, where applicable, the external testers shall provide to the authority, designated in accordance with paragraph 9 or 10, a summary of the relevant findings, the remediation plans and the documentation demonstrating that the TLPT has been conducted in accordance with the requirements.

+ 7. Authorities shall provide financial entities with an attestation confirming that the test was performed in accordance with the requirements as evidenced in the documentation in order to allow for mutual recognition of threat led penetration tests between competent authorities. The financial entity shall notify the relevant competent authority of the attestation, the summary of the relevant findings and the remediation plans.

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/47

+ Without prejudice to such attestation, financial entities shall remain at all times fully responsible for the impact of the tests referred to in paragraph 4.

+ 8. Financial entities shall contract testers for the purposes of undertaking TLPT in accordance with Article 27. When financial entities use internal testers for the purposes of undertaking TLPT, they shall contract external testers every three tests.

+ Credit institutions that are classified as significant in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall only use external testers in accordance with Article 27(1), points (a) to (e).

+ Competent authorities shall identify financial entities that are required to perform TLPT taking into account the criteria set out in Article 4(2), based on an assessment of the following:

+ (a) impact-related factors, in particular the extent to which the services provided and activities undertaken by the financial entity impact the financial sector;

+ (b) possible financial stability concerns, including the systemic character of the financial entity at Union or national level, as applicable;

+ (c) specific ICT risk profile, level of ICT maturity of the financial entity or technology features involved.

+ 9. Member States may designate a single public authority in the financial sector to be responsible for TLPT-related matters in the financial sector at national level and shall entrust it with all competences and tasks to that effect.

+ 10. In the absence of a designation in accordance with paragraph 9 of this Article, and without prejudice to the power to identify the financial entities that are required to perform TLPT, a competent authority may delegate the exercise of some or all of the tasks referred to in this Article and Article 27 to another national authority in the financial sector.

+ 11. The ESAs shall, in agreement with the ECB, develop joint draft regulatory technical standards in accordance with the TIBER-EU framework in order to specify further:

+ (a) the criteria used for the purpose of the application of paragraph 8, second subparagraph;

+ (b) the requirements and standards governing the use of internal testers;

+ (i) the scope of TLPT referred to in paragraph 2;

+ (ii) the testing methodology and approach to be followed for each specific phase of the testing process;

+ (iii) the results, closure and remediation stages of the testing;

+ (d) the type of supervisory and other relevant cooperation which are needed for the implementation of TLPT, and for the facilitation of mutual recognition of that testing, in the context of financial entities that operate in more than one Member State, to allow an appropriate level of supervisory involvement and a flexible implementation to cater for specificities of financial sub-sectors or local financial markets.

+ When developing those draft regulatory technical standards, the ESAs shall give due consideration to any specific feature arising from the distinct nature of activities across different financial services sectors.

+ The ESAs shall submit those draft regulatory technical standards to the Commission by 17 July 2024.

+ L 333/48

+ Official Journal of the European Union

+ 27.12.2022

+ Article 27

+ Requirements for testers for the carrying out of TLPT

+ 1. Financial entities shall only use testers for the carrying out of TLPT, that:

+ (a) are of the highest suitability and reputability;

+ (b) possess technical and organisational capabilities and demonstrate specific expertise in threat intelligence, penetration testing and red team testing;

+ (c) are certified by an accreditation body in a Member State or adhere to formal codes of conduct or ethical frameworks;

+ (d) provide an independent assurance, or an audit report, in relation to the sound management of risks associated with the carrying out of TLPT, including the due protection of the financial entity's confidential information and redress for the business risks of the financial entity;

+ (e) are duly and fully covered by relevant professional indemnity insurances, including against risks of misconduct and negligence.

+ 2. When using internal testers, financial entities shall ensure that, in addition to the requirements in paragraph 1, the following conditions are met:

+ (a) such use has been approved by the relevant competent authority or by the single public authority designated in accordance with Article 26(9) and (10);

+ (b) the relevant competent authority has verified that the financial entity has sufficient dedicated resources and ensured that conflicts of interest are avoided throughout the design and execution phases of the test; and

+ (c) the threat intelligence provider is external to the financial entity.

+ 3. Financial entities shall ensure that contracts concluded with external testers require a sound management of the TLPT results and that any data processing thereof, including any generation, store, aggregation, draft, report, communication or destruction, do not create risks to the financial entity.

+ CHAPTER V

+ Managing of ICT third-party risk

+ Section I Key principles for a sound management of ICT third-party risk

+ Article 28

+ General principles

+ 1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles: (a) financial entities that have in place contractual arrangements for the use of ICT services to run their business operations

+ shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law;

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/49

+ (b) financial entities' management of ICT third-party risk shall be implemented in light of the principle of proportionality, taking into account:

+ (i) the nature, scale, complexity and importance of ICT-related dependencies,

+ (ii) the risks arising from contractual arrangements on the use of ICT services concluded with ICT third-party service providers, taking into account the criticality or importance of the respective service, process or function, and the potential impact on the continuity and availability of financial services and activities, at individual and at group level.

+ 2. As part of their ICT risk management framework, financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, shall adopt, and regularly review, a strategy on ICT third-party risk, taking into account the multi-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT third-party risk shall include a policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers and shall apply on an individual basis and, where relevant, on a sub-consolidated and consolidated basis. The management body shall, on the basis of an assessment of the overall risk profile of the financial entity and the scale and complexity of the business services, regularly review the risks identified in respect to contractual arrangements on the use of ICT services supporting critical or important functions.

+ 3. As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers.

+ The contractual arrangements referred to in the first subparagraph shall be appropriately documented, distinguishing between those that cover ICT services supporting critical or important functions and those that do not.

+ Financial entities shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided.

+ Financial entities shall make available to the competent authority, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity.

+ Financial entities shall inform the competent authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions as well as when a function has become critical or important.

+ 4. Before entering into a contractual arrangement on the use of ICT services, financial entities shall:

+ (a) assess whether the contractual arrangement covers the use of ICT services supporting a critical or important function;

+ (b) assess if supervisory conditions for contracting are met;

+ (c) identify and assess all relevant risks in relation to the contractual arrangement, including the possibility that such contractual arrangement may contribute to reinforcing ICT concentration risk as referred to in Article 29;

+ (d) undertake all due diligence on prospective ICT third-party service providers and ensure throughout the selection and assessment processes that the ICT third-party service provider is suitable;

+ (e) identify and assess conflicts of interest that the contractual arrangement may cause.

+ 5. Financial entities may only enter into contractual arrangements with ICT third-party service providers that comply with appropriate information security standards. When those contractual arrangements concern critical or important functions, financial entities shall, prior to concluding the arrangements, take due consideration of the use, by ICT thirdparty service providers, of the most up-to-date and highest quality information security standards.

+ L 333/50

+ EN

+ Official Journal of the European Union

+ 27.12.2022

+ 6. In exercising access, inspection and audit rights over the ICT third-party service provider, financial entities shall, on the basis of a risk-based approach, pre-determine the frequency of audits and inspections as well as the areas to be audited through adhering to commonly accepted audit standards in line with any supervisory instruction on the use and incorporation of such audit standards.

+ Where contractual arrangements concluded with ICT third-party service providers on the use of ICT services entail high technical complexity, the financial entity shall verify that auditors, whether internal or external, or a pool of auditors, possess appropriate skills and knowledge to effectively perform the relevant audits and assessments.

+ 7. Financial entities shall ensure that contractual arrangements on the use of ICT services may be terminated in any of the following circumstances:

+ (a) significant breach by the ICT third-party service provider of applicable laws, regulations or contractual terms;

+ (b) circumstances identified throughout the monitoring of ICT third-party risk that are deemed capable of altering the performance of the functions provided through the contractual arrangement, including material changes that affect the arrangement or the situation of the ICT third-party service provider;

+ (c) ICT third-party service provider's evidenced weaknesses pertaining to its overall ICT risk management and in particular in the way it ensures the availability, authenticity, integrity and, confidentiality, of data, whether personal or otherwise sensitive data, or non-personal data;

+ (d) where the competent authority can no longer effectively supervise the financial entity as a result of the conditions of, or circumstances related to, the respective contractual arrangement.

+ 8. For ICT services supporting critical or important functions, financial entities shall put in place exit strategies. The exit strategies shall take into account risks that may emerge at the level of ICT third-party service providers, in particular a possible failure on their part, a deterioration of the quality of the ICT services provided, any business disruption due to inappropriate or failed provision of ICT services or any material risk arising in relation to the appropriate and continuous deployment of the respective ICT service, or the termination of contractual arrangements with ICT third-party service providers under any of the circumstances listed in paragraph 7.

+ Financial entities shall ensure that they are able to exit contractual arrangements without:

+ (a) disruption to their business activities,

+ (b) limiting compliance with regulatory requirements,

+ (c) detriment to the continuity and quality of services provided to clients.

+ Exit plans shall be comprehensive, documented and, in accordance with the criteria set out in Article 4(2), shall be sufficiently tested and reviewed periodically.

+ Financial entities shall identify alternative solutions and develop transition plans enabling them to remove the contracted ICT services and the relevant data from the ICT third-party service provider and to securely and integrally transfer them to alternative providers or reincorporate them in-house.

+ Financial entities shall have appropriate contingency measures in place to maintain business continuity in the event of the circumstances referred to in the first subparagraph.

+ 9. The ESAs shall, through the Joint Committee, develop draft implementing technical standards to establish the standard templates for the purposes of the register of information referred to in paragraph 3, including information that is common to all contractual arrangements on the use of ICT services. The ESAs shall submit those draft implementing technical standards to the Commission by 17 January 2024.

+ Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/51

+ 10. The ESAs shall, through the Joint Committee, develop draft regulatory technical standards to further specify the detailed content of the policy referred to in paragraph 2 in relation to the contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers.

+ When developing those draft regulatory technical standards, the ESAs shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations. The ESAs shall submit those draft regulatory technical standards to the Commission by 17 January 2024.

+ Article 29

+ Preliminary assessment of ICT concentration risk at entity level

+ 1. When performing the identification and assessment of risks referred to in Article 28(4), point (c), financial entities shall also take into account whether the envisaged conclusion of a contractual arrangement in relation to ICT services supporting critical or important functions would lead to any of the following:

+ (a) contracting an ICT third-party service provider that is not easily substitutable; or

+ (b) having in place multiple contractual arrangements in relation to the provision of ICT services supporting critical or important functions with the same ICT third-party service provider or with closely connected ICT third-party service providers.

+ Financial entities shall weigh the benefits and costs of alternative solutions, such as the use of different ICT third-party service providers, taking into account if and how envisaged solutions match the business needs and objectives set out in their digital resilience strategy.

+ 2. Where the contractual arrangements on the use of ICT services supporting critical or important functions include the possibility that an ICT third-party service provider further subcontracts ICT services supporting a critical or important function to other ICT third-party service providers, financial entities shall weigh benefits and risks that may arise in connection with such subcontracting, in particular in the case of an ICT subcontractor established in a third-country.

+ Where contractual arrangements concern ICT services supporting critical or important functions, financial entities shall duly consider the insolvency law provisions that would apply in the event of the ICT third-party service provider's bankruptcy as well as any constraint that may arise in respect to the urgent recovery of the financial entity's data.

+ Where contractual arrangements on the use of ICT services supporting critical or important functions are concluded with an ICT third-party service provider established in a third country, financial entities shall, in addition to the considerations referred to in the second subparagraph, also consider the compliance with Union data protection rules and the effective enforcement of the law in that third country.

+ Where the contractual arrangements on the use of ICT services supporting critical or important functions provide for subcontracting, financial entities shall assess whether and how potentially long or complex chains of subcontracting may impact their ability to fully monitor the contracted functions and the ability of the competent authority to effectively supervise the financial entity in that respect.

+ L 333/52

+ EN

+ Official Journal of the European Union

+ 27.12.2022

+ Article 30

+ Key contractual provisions

+ 1. The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full contract shall include the service level agreements and be documented in one written document which shall be available to the parties on paper, or in a document with another downloadable, durable and accessible format.

+ 2. The contractual arrangements on the use of ICT services shall include at least the following elements:

+ (a) a clear and complete description of all functions and ICT services to be provided by the ICT third-party service provider, indicating whether subcontracting of an ICT service supporting a critical or important function, or material parts thereof, is permitted and, when that is the case, the conditions applying to such subcontracting;

+ (b) the locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location, and the requirement for the ICT thirdparty service provider to notify the financial entity in advance if it envisages changing such locations;

+ (c) provisions on availability, authenticity, integrity and confidentiality in relation to the protection of data, including personal data;

+ (d) provisions on ensuring access, recovery and return in an easily accessible format of personal and non-personal data processed by the financial entity in the event of the insolvency, resolution or discontinuation of the business operations of the ICT third-party service provider, or in the event of the termination of the contractual arrangements;

+ (e) service level descriptions, including updates and revisions thereof;

+ (f) the obligation of the ICT third-party service provider to provide assistance to the financial entity at no additional cost, or at a cost that is determined ex-ante, when an ICT incident that is related to the ICT service provided to the financial entity occurs;

+ (g) the obligation of the ICT third-party service provider to fully cooperate with the competent authorities and the resolution authorities of the financial entity, including persons appointed by them;

+ (h) termination rights and related minimum notice periods for the termination of the contractual arrangements, in accordance with the expectations of competent authorities and resolution authorities;

+ (i) the conditions for the participation of ICT third-party service providers in the financial entities' ICT security awareness programmes and digital operational resilience training in accordance with Article 13(6).

+ 3. The contractual arrangements on the use of ICT services supporting critical or important functions shall include, in addition to the elements referred to in paragraph 2, at least the following:

+ (a) full service level descriptions, including updates and revisions thereof with precise quantitative and qualitative performance targets within the agreed service levels to allow effective monitoring by the financial entity of ICT services and enable appropriate corrective actions to be taken, without undue delay, when agreed service levels are not met;

+ (b) notice periods and reporting obligations of the ICT third-party service provider to the financial entity, including notification of any development that might have a material impact on the ICT third-party service provider's ability to effectively provide the ICT services supporting critical or important functions in line with agreed service levels;

+ (c) requirements for the ICT third-party service provider to implement and test business contingency plans and to have in place ICT security measures, tools and policies that provide an appropriate level of security for the provision of services by the financial entity in line with its regulatory framework;

+ (d) the obligation of the ICT third-party service provider to participate and fully cooperate in the financial entity's TLPT as referred to in Articles 26 and 27;

+ (e) the right to monitor, on an ongoing basis, the ICT third-party service provider's performance, which entails the following:

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/53

+ (i) unrestricted rights of access, inspection and audit by the financial entity, or an appointed third party, and by the competent authority, and the right to take copies of relevant documentation on-site if they are critical to the operations of the ICT third-party service provider, the effective exercise of which is not impeded or limited by other contractual arrangements or implementation policies;

+ (ii) the right to agree on alternative assurance levels if other clients' rights are affected;

+ (iii) the obligation of the ICT third-party service provider to fully cooperate during the onsite inspections and audits performed by the competent authorities, the Lead Overseer, financial entity or an appointed third party; and

+ (iv) the obligation to provide details on the scope, procedures to be followed and frequency of such inspections and audits;

+ (f) exit strategies, in particular the establishment of a mandatory adequate transition period:

+ (i) during which the ICT third-party service provider will continue providing the respective functions, or ICT services, with a view to reducing the risk of disruption at the financial entity or to ensure its effective resolution and restructuring;

+ (ii) allowing the financial entity to migrate to another ICT third-party service provider or change to in-house solutions consistent with the complexity of the service provided.

+ By way of derogation from point (e), the ICT third-party service provider and the financial entity that is a microenterprise may agree that the financial entity's rights of access, inspection and audit can be delegated to an independent third party, appointed by the ICT third-party service provider, and that the financial entity is able to request information and assurance on the ICT third-party service provider's performance from the third party at any time.

+ 4. When negotiating contractual arrangements, financial entities and ICT third-party service providers shall consider the use of standard contractual clauses developed by public authorities for specific services.

+ 5. The ESAs shall, through the Joint Committee, develop draft regulatory technical standards to specify further the elements referred to in paragraph 2, point (a), which a financial entity needs to determine and assess when subcontracting ICT services supporting critical or important functions.

+ When developing those draft regulatory technical standards, the ESAs shall take into consideration the size and overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations.

+ The ESAs shall submit those draft regulatory technical standards to the Commission by 17 July 2024.

+ Section II Oversight Framework of critical ICT third-party service providers

+ Article 31

+ Designation of critical ICT third-party service providers 1. The ESAs, through the Joint Committee and upon recommendation from the Oversight Forum established pursuant to Article 32(1), shall: (a) designate the ICT third-party service providers that are critical for financial entities, following an assessment that takes

+ into account the criteria specified in paragraph 2;

+ L 333/54

+ EN

+ Official Journal of the European Union

+ 27.12.2022

+ (b) appoint as Lead Overseer for each critical ICT third-party service provider the ESA that is responsible, in accordance with Regulations (EU) No 1093/2010, (EU) No 1094/2010 or (EU) No 1095/2010, for the financial entities having together the largest share of total assets out of the value of total assets of all financial entities using the services of the relevant critical ICT third-party service provider, as evidenced by the sum of the individual balance sheets of those financial entities.

+ 2. The designation referred to in paragraph 1, point (a), shall be based on all of the following criteria in relation to ICT services provided by the ICT third-party service provider:

+ (a) the systemic impact on the stability, continuity or quality of the provision of financial services in the event that the relevant ICT third-party service provider would face a large scale operational failure to provide its services, taking into account the number of financial entities and the total value of assets of financial entities to which the relevant ICT third-party service provider provides services;

+ (b) the systemic character or importance of the financial entities that rely on the relevant ICT third-party service provider, assessed in accordance with the following parameters:

+ (i) the number of global systemically important institutions (G-SIIs) or other systemically important institutions (O-SIIs) that rely on the respective ICT third-party service provider;

+ (ii) the interdependence between the G-SIIs or O-SIIs referred to in point (i) and other financial entities, including situations where the G-SIIs or O-SIIs provide financial infrastructure services to other financial entities;

+ (c) the reliance of financial entities on the services provided by the relevant ICT third-party service provider in relation to critical or important functions of financial entities that ultimately involve the same ICT third-party service provider, irrespective of whether financial entities rely on those services directly or indirectly, through subcontracting arrangements;

+ (d) the degree of substitutability of the ICT third-party service provider, taking into account the following parameters:

+ (i) the lack of real alternatives, even partial, due to the limited number of ICT third-party service providers active on a specific market, or the market share of the relevant ICT third-party service provider, or the technical complexity or sophistication involved, including in relation to any proprietary technology, or the specific features of the ICT third-party service provider's organisation or activity;

+ (ii) difficulties in relation to partially or fully migrating the relevant data and workloads from the relevant ICT thirdparty service provider to another ICT third-party service provider, due either to significant financial costs, time or other resources that the migration process may entail, or to increased ICT risk or other operational risks to which the financial entity may be exposed through such migration.

+ 3. Where the ICT third-party service provider belongs to a group, the criteria referred to in paragraph 2 shall be considered in relation to the ICT services provided by the group as a whole.

+ 4. Critical ICT third-party service providers which are part of a group shall designate one legal person as a coordination point to ensure adequate representation and communication with the Lead Overseer.

+ 5. The Lead Overseer shall notify the ICT third-party service provider of the outcome of the assessment leading to the designation referred in paragraph 1, point (a). Within 6 weeks from the date of the notification, the ICT third-party service provider may submit to the Lead Overseer a reasoned statement with any relevant information for the purposes of the assessment. The Lead Overseer shall consider the reasoned statement and may request additional information to be submitted within 30 calendar days of the receipt of such statement.

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/55

+ After designating an ICT third-party service provider as critical, the ESAs, through the Joint Committee, shall notify the ICT third-party service provider of such designation and the starting date as from which they will effectively be subject to oversight activities. That starting date shall be no later than one month after the notification. The ICT third-party service provider shall notify the financial entities to which they provide services of their designation as critical.

+ 6. The Commission is empowered to adopt a delegated act in accordance with Article 57 to supplement this Regulation by specifying further the criteria referred to in paragraph 2 of this Article, by 17 July 2024.

+ 7. The designation referred to in paragraph 1, point (a), shall not be used until the Commission has adopted a delegated act in accordance with paragraph 6.

+ 8. The designation referred to in paragraph 1, point (a), shall not apply to the following:

+ (i) financial entities providing ICT services to other financial entities;

+ (ii) ICT third-party service providers that are subject to oversight frameworks established for the purposes of supporting the tasks referred to in Article 127(2) of the Treaty on the Functioning of the European Union;

+ (iii) ICT intra-group service providers;

+ (iv) ICT third-party service providers providing ICT services solely in one Member State to financial entities that are only active in that Member State.

+ 9. The ESAs, through the Joint Committee, shall establish, publish and update yearly the list of critical ICT third-party service providers at Union level.

+ 10. For the purposes of paragraph 1, point (a), competent authorities shall, on a yearly and aggregated basis, transmit the reports referred to in Article 28(3), third subparagraph, to the Oversight Forum established pursuant to Article 32. The Oversight Forum shall assess the ICT third-party dependencies of financial entities based on the information received from the competent authorities.

+ 11. The ICT third-party service providers that are not included in the list referred to in paragraph 9 may request to be designated as critical in accordance with paragraph 1, point (a).

+ For the purpose of the first subparagraph, the ICT third-party service provider shall submit a reasoned application to EBA, ESMA or EIOPA, which, through the Joint Committee, shall decide whether to designate that ICT third-party service provider as critical in accordance with paragraph 1, point (a).

+ The decision referred to in the second subparagraph shall be adopted and notified to the ICT third-party service provider within 6 months of receipt of the application.

+ 12. Financial entities shall only make use of the services of an ICT third-party service provider established in a third country and which has been designated as critical in accordance with paragraph 1, point (a), if the latter has established a subsidiary in the Union within the 12 months following the designation.

+ 13. The critical ICT third-party service provider referred to in paragraph 12 shall notify the Lead Overseer of any changes to the structure of the management of the subsidiary established in the Union.

+ Article 32

+ Structure of the Oversight Framework

+ 1. The Joint Committee, in accordance with Article 57(1) of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, shall establish the Oversight Forum as a sub-committee for the purposes of supporting the work of the Joint Committee and of the Lead Overseer referred to in Article 31(1), point (b), in the area of ICT third-party risk across financial sectors. The Oversight Forum shall prepare the draft joint positions and the draft common acts of the Joint Committee in that area.

+ L 333/56

+ EN

+ Official Journal of the European Union

+ 27.12.2022

+ The Oversight Forum shall regularly discuss relevant developments on ICT risk and vulnerabilities and promote a consistent approach in the monitoring of ICT third-party risk at Union level.

+ 2. The Oversight Forum shall, on a yearly basis, undertake a collective assessment of the results and findings of the oversight activities conducted for all critical ICT third-party service providers and promote coordination measures to increase the digital operational resilience of financial entities, foster best practices on addressing ICT concentration risk and explore mitigants for cross-sector risk transfers.

+ 3. The Oversight Forum shall submit comprehensive benchmarks for critical ICT third-party service providers to be adopted by the Joint Committee as joint positions of the ESAs in accordance with Article 56(1) of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

+ 4. The Oversight Forum shall be composed of:

+ (a) the Chairpersons of the ESAs;

+ (b) one high-level representative from the current staff of the relevant competent authority referred to in Article 46 from each Member State;

+ (c) the Executive Directors of each ESA and one representative from the Commission, from the ESRB, from ECB and from ENISA as observers;

+ (d) where appropriate, one additional representative of a competent authority referred to in Article 46 from each Member State as observer;

+ (e) where applicable, one representative of the competent authorities designated or established in accordance with Directive (EU) 2022/2555 responsible for the supervision of an essential or important entity subject to that Directive, which has been designated as a critical ICT third-party service provider, as observer.

+ The Oversight Forum may, where appropriate, seek the advice of independent experts appointed in accordance with paragraph 6.

+ 5. Each Member State shall designate the relevant competent authority whose staff member shall be the high-level representative referred in paragraph 4, first subparagraph, point (b), and shall inform the Lead Overseer thereof.

+ The ESAs shall publish on their website the list of high-level representatives from the current staff of the relevant competent authority designated by Member States.

+ 6. The independent experts referred to in paragraph 4, second subparagraph, shall be appointed by the Oversight Forum from a pool of experts selected following a public and transparent application process.

+ The independent experts shall be appointed on the basis of their expertise in financial stability, digital operational resilience and ICT security matters. They shall act independently and objectively in the sole interest of the Union as a whole and shall neither seek nor take instructions from Union institutions or bodies, from any government of a Member State or from any other public or private body.

+ 7. In accordance with Article 16 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, the ESAs shall by 17 July 2024 issue, for the purposes of this Section, guidelines on the cooperation between the ESAs and the competent authorities covering the detailed procedures and conditions for the allocation and execution of tasks between competent authorities and the ESAs and the details on the exchanges of information which are necessary for competent authorities to ensure the follow-up of recommendations pursuant to Article 35(1), point (d), addressed to critical ICT third-party service providers.

+ 8. The requirements set out in this Section shall be without prejudice to the application of Directive (EU) 2022/2555 and of other Union rules on oversight applicable to providers of cloud computing services.

+ 9. The ESAs, through the Joint Committee and based on preparatory work conducted by the Oversight Forum, shall, on yearly basis, submit a report on the application of this Section to the European Parliament, the Council and the Commission.

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/57

+ Article 33

+ Tasks of the Lead Overseer

+ 1. The Lead Overseer, appointed in accordance with Article 31(1), point (b), shall conduct the oversight of the assigned critical ICT third-party service providers and shall be, for the purposes of all matters related to the oversight, the primary point of contact for those critical ICT third-party service providers.

+ 2. For the purposes of paragraph 1, the Lead Overseer shall assess whether each critical ICT third-party service provider has in place comprehensive, sound and effective rules, procedures, mechanisms and arrangements to manage the ICT risk which it may pose to financial entities.

+ The assessment referred to in the first subparagraph shall focus mainly on ICT services provided by the critical ICT thirdparty service provider supporting the critical or important functions of financial entities. Where necessary to address all relevant risks, that assessment shall extend to ICT services supporting functions other than those that are critical or important.

+ 3. The assessment referred to in paragraph 2 shall cover:

+ (a) ICT requirements to ensure, in particular, the security, availability, continuity, scalability and quality of services which the critical ICT third-party service provider provides to financial entities, as well as the ability to maintain at all times high standards of availability, authenticity, integrity or confidentiality of data;

+ (b) the physical security contributing to ensuring the ICT security, including the security of premises, facilities, data centres;

+ (c) the risk management processes, including ICT risk management policies, ICT business continuity policy and ICT response and recovery plans;

+ (d) the governance arrangements, including an organisational structure with clear, transparent and consistent lines of responsibility and accountability rules enabling effective ICT risk management;

+ (e) the identification, monitoring and prompt reporting of material ICT-related incidents to financial entities, the management and resolution of those incidents, in particular cyber-attacks;

+ (f) the mechanisms for data portability, application portability and interoperability, which ensure an effective exercise of termination rights by the financial entities;

+ (g) the testing of ICT systems, infrastructure and controls;

+ (h) the ICT audits;

+ (i) the use of relevant national and international standards applicable to the provision of its ICT services to the financial entities.

+ 4. Based on the assessment referred to in paragraph 2, and in coordination with the Joint Oversight Network (JON) referred to in Article 34(1), the Lead Overseer shall adopt a clear, detailed and reasoned individual oversight plan describing the annual oversight objectives and the main oversight actions planned for each critical ICT third-party service provider. That plan shall be communicated yearly to the critical ICT third-party service provider.

+ Prior to the adoption of the oversight plan, the Lead Overseer shall communicate the draft oversight plan to the critical ICT third-party service provider.

+ Upon receipt of the draft oversight plan, the critical ICT third-party service provider may submit a reasoned statement within 15 calendar days evidencing the expected impact on customers which are entities falling outside of the scope of this Regulation and where appropriate, formulating solutions to mitigate risks.

+ 5. Once the annual oversight plans referred to in paragraph 4 have been adopted and notified to the critical ICT thirdparty service providers, competent authorities may take measures concerning such critical ICT third-party service providers only in agreement with the Lead Overseer.

+ L 333/58

+ EN

+ Official Journal of the European Union

+ 27.12.2022

+ Article 34

+ Operational coordination between Lead Overseers

+ 1. To ensure a consistent approach to oversight activities and with a view to enabling coordinated general oversight strategies and cohesive operational approaches and work methodologies, the three Lead Overseers appointed in accordance with Article 31(1), point (b), shall set up a JON to coordinate among themselves in the preparatory stages and to coordinate the conduct of oversight activities over their respective overseen critical ICT third-party service providers, as well as in the course of any action that may be needed pursuant to Article 42.

+ 2. For the purposes of paragraph 1, the Lead Overseers shall draw up a common oversight protocol specifying the detailed procedures to be followed for carrying out the day-to-day coordination and for ensuring swift exchanges and reactions. The protocol shall be periodically revised to reflect operational needs, in particular the evolution of practical oversight arrangements.

+ 3. The Lead Overseers may, on an ad-hoc basis, call on the ECB and ENISA to provide technical advice, share hands-on experience or join specific coordination meetings of the JON.

+ Article 35

+ Powers of the Lead Overseer

+ 1. For the purposes of carrying out the duties laid down in this Section, the Lead Overseer shall have the following powers in respect of the critical ICT third-party service providers:

+ (a) to request all relevant information and documentation in accordance with Article 37;

+ (b) to conduct general investigations and inspections in accordance with Articles 38 and 39, respectively;

+ (c) to request, after the completion of the oversight activities, reports specifying the actions that have been taken or the remedies that have been implemented by the critical ICT third-party service providers in relation to the recommendations referred to in point (d) of this paragraph;

+ (d) to issue recommendations on the areas referred to in Article 33(3), in particular concerning the following:

+ (i) the use of specific ICT security and quality requirements or processes, in particular in relation to the roll-out of patches, updates, encryption and other security measures which the Lead Overseer deems relevant for ensuring the ICT security of services provided to financial entities;

+ (ii) the use of conditions and terms, including their technical implementation, under which the critical ICT third-party service providers provide ICT services to financial entities, which the Lead Overseer deems relevant for preventing the generation of single points of failure, the amplification thereof, or for minimising the possible systemic impact across the Union's financial sector in the event of ICT concentration risk;

+ (iii) any planned subcontracting, where the Lead Overseer deems that further subcontracting, including subcontracting arrangements which the critical ICT third-party service providers plan to enter into with ICT third-party service providers or with ICT subcontractors established in a third country, may trigger risks for the provision of services by the financial entity, or risks to the financial stability, based on the examination of the information gathered in accordance with Articles 37 and 38;

+ (iv) refraining from entering into a further subcontracting arrangement, where the following cumulative conditions are met:

+ -- the envisaged subcontractor is an ICT third-party service provider or an ICT subcontractor established in a third country;

+ -- the subcontracting concerns critical or important functions of the financial entity; and

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/59

+ -- the Lead Overseer deems that the use of such subcontracting poses a clear and serious risk to the financial stability of the Union or to financial entities, including to the ability of financial entities to comply with supervisory requirements.

+ For the purpose of point (iv) of this point, ICT third-party service providers shall, using the template referred to in Article 41(1), point (b), transmit the information regarding subcontracting to the Lead Overseer.

+ 2. When exercising the powers referred to in this Article, the Lead Overseer shall:

+ (a) ensure regular coordination within the JON, and in particular shall seek consistent approaches, as appropriate, with regard to the oversight of critical ICT third-party service providers;

+ (b) take due account of the framework established by Directive (EU) 2022/2555 and, where necessary, consult the relevant competent authorities designated or established in accordance with that Directive, in order to avoid duplication of technical and organisational measures that might apply to critical ICT third-party service providers pursuant to that Directive;

+ (c) seek to minimise, to the extent possible, the risk of disruption to services provided by critical ICT third-party service providers to customers that are entities falling outside the scope of this Regulation.

+ 3. The Lead Overseer shall consult the Oversight Forum before exercising the powers referred to in paragraph 1.

+ Before issuing recommendations in accordance with paragraph 1, point (d), the Lead Overseer shall give the opportunity to the ICT third-party service provider to provide, within 30 calendar days, relevant information evidencing the expected impact on customers that are entities falling outside the scope of this Regulation and, where appropriate, formulating solutions to mitigate risks.

+ 4. The Lead Overseer shall inform the JON of the outcome of the exercise of the powers referred to in paragraph 1, points (a) and (b). The Lead Overseer shall, without undue delay, transmit the reports referred to in paragraph 1, point (c), to the JON and to the competent authorities of the financial entities using the ICT services of that critical ICT third-party service provider.

+ 5. Critical ICT third-party service providers shall cooperate in good faith with the Lead Overseer, and assist it in the fulfilment of its tasks.

+ 6. In the event of whole or partial non-compliance with the measures required to be taken pursuant to the exercise of the powers under paragraph 1, points (a), (b) and (c), and after the expiry of a period of at least 30 calendar days from the date on which the critical ICT third-party service provider received notification of the respective measures, the Lead Overseer shall adopt a decision imposing a periodic penalty payment to compel the critical ICT third-party service provider to comply with those measures.

+ 7. The periodic penalty payment referred to in paragraph 6 shall be imposed on a daily basis until compliance is achieved and for no more than a period of six months following the notification of the decision to impose a periodic penalty payment to the critical ICT third-party service provider.

+ 8. The amount of the periodic penalty payment, calculated from the date stipulated in the decision imposing the periodic penalty payment, shall be up to 1 % of the average daily worldwide turnover of the critical ICT third-party service provider in the preceding business year. When determining the amount of the penalty payment, the Lead Overseer shall take into account the following criteria regarding non-compliance with the measures referred to in paragraph 6:

+ (a) the gravity and the duration of non-compliance;

+ (b) whether non-compliance has been committed intentionally or negligently;

+ (c) the level of cooperation of the ICT third-party service provider with the Lead Overseer.

+ L 333/60

+ EN

+ Official Journal of the European Union

+ 27.12.2022

+ For the purposes of the first subparagraph, in order to ensure a consistent approach, the Lead Overseer shall engage in consultation within the JON.

+ 9. Penalty payments shall be of an administrative nature and shall be enforceable. Enforcement shall be governed by the rules of civil procedure in force in the Member State on the territory of which inspections and access shall be carried out. Courts of the Member State concerned shall have jurisdiction over complaints related to irregular conduct of enforcement. The amounts of the penalty payments shall be allocated to the general budget of the European Union.

+ 10. The Lead Overseer shall disclose to the public every periodic penalty payment that has been imposed, unless such disclosure would seriously jeopardise the financial markets or cause disproportionate damage to the parties involved.

+ 11. Before imposing a periodic penalty payment under paragraph 6, the Lead Overseer shall give the representatives of the critical ICT third-party service provider subject to the proceedings the opportunity to be heard on the findings and shall base its decisions only on findings on which the critical ICT third-party service provider subject to the proceedings has had an opportunity to comment.

+ The rights of the defence of the persons subject to the proceedings shall be fully respected in the proceedings. The critical ICT third-party service provider subject to the proceedings shall be entitled to have access to the file, subject to the legitimate interest of other persons in the protection of their business secrets. The right of access to the file shall not extend to confidential information or to the Lead Overseer's internal preparatory documents.

+ Article 36

+ Exercise of the powers of the Lead Overseer outside the Union

+ 1. When oversight objectives cannot be attained by means of interacting with the subsidiary set up for the purpose of Article 31(12), or by exercising oversight activities on premises located in the Union, the Lead Overseer may exercise the powers, referred to in the following provisions, on any premises located in a third-country which is owned, or used in any way, for the purposes of providing services to Union financial entities, by a critical ICT third-party service provider, in connection with its business operations, functions or services, including any administrative, business or operational offices, premises, lands, buildings or other properties:

+ (a) in Article 35(1), point (a); and

+ (b) in Article 35(1), point (b), in accordance with Article 38(2), points (a), (b) and (d), and in Article 39(1) and (2), point (a).

+ The powers referred to in the first subparagraph may be exercised subject to all of the following conditions:

+ (i) the conduct of an inspection in a third-country is deemed necessary by the Lead Overseer to allow it to fully and effectively perform its duties under this Regulation;

+ (ii) the inspection in a third-country is directly related to the provision of ICT services to financial entities in the Union;

+ (iii) the critical ICT third-party service provider concerned consents to the conduct of an inspection in a third-country; and

+ (iv) the relevant authority of the third-country concerned has been officially notified by the Lead Overseer and raised no objection thereto.

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/61

+ 2. Without prejudice to the respective competences of the Union institutions and of Member States, for the purposes of paragraph 1, EBA, ESMA or EIOPA shall conclude administrative cooperation arrangements with the relevant authority of the third country in order to enable the smooth conduct of inspections in the third country concerned by the Lead Overseer and its designated team for its mission in that third country. Those cooperation arrangements shall not create legal obligations in respect of the Union and its Member States nor shall they prevent Member States and their competent authorities from concluding bilateral or multilateral arrangements with those third countries and their relevant authorities.

+ Those cooperation arrangements shall specify at least the following elements:

+ (a) the procedures for the coordination of oversight activities carried out under this Regulation and any analogous monitoring of ICT third-party risk in the financial sector exercised by the relevant authority of the third country concerned, including details for transmitting the agreement of the latter to allow the conduct, by the Lead Overseer and its designated team, of general investigations and on-site inspections as referred to in paragraph 1, first subparagraph, on the territory under its jurisdiction;

+ (b) the mechanism for the transmission of any relevant information between EBA, ESMA or EIOPA and the relevant authority of the third country concerned, in particular in connection with information that may be requested by the Lead Overseer pursuant to Article 37;

+ (c) the mechanisms for the prompt notification by the relevant authority of the third-country concerned to EBA, ESMA or EIOPA of cases where an ICT third-party service provider established in a third country and designated as critical in accordance with Article 31(1), point (a), is deemed to have infringed the requirements to which it is obliged to adhere pursuant to the applicable law of the third country concerned when providing services to financial institutions in that third country, as well as the remedies and penalties applied;

+ (d) the regular transmission of updates on regulatory or supervisory developments on the monitoring of ICT third-party risk of financial institutions in the third country concerned;

+ (e) the details for allowing, if needed, the participation of one representative of the relevant third-country authority in the inspections conducted by the Lead Overseer and the designated team.

+ 3. When the Lead Overseer is not able to conduct oversight activities outside the Union, referred to in paragraphs 1 and 2, the Lead Overseer shall:

+ (a) exercise its powers under Article 35 on the basis of all facts and documents available to it;

+ (b) document and explain any consequence of its inability to conduct the envisaged oversight activities as referred to in this Article.

+ The potential consequences referred to in point (b) of this paragraph shall be taken into consideration in the Lead Overseer's recommendations issued pursuant to Article 35(1), point (d).

+ Article 37

+ Request for information

+ 1. The Lead Overseer may, by simple request or by decision, require critical ICT third-party service providers to provide all information that is necessary for the Lead Overseer to carry out its duties under this Regulation, including all relevant business or operational documents, contracts, policies, documentation, ICT security audit reports, ICT-related incident reports, as well as any information relating to parties to whom the critical ICT third-party service provider has outsourced operational functions or activities.

+ 2. When sending a simple request for information under paragraph 1, the Lead Overseer shall: (a) refer to this Article as the legal basis of the request; (b) state the purpose of the request; (c) specify what information is required; (d) set a time limit within which the information is to be provided;

+ L 333/62

+ EN

+ Official Journal of the European Union

+ 27.12.2022

+ (e) inform the representative of the critical ICT third-party service provider from whom the information is requested that he or she is not obliged to provide the information, but in the event of a voluntary reply to the request the information provided must not be incorrect or misleading.

+ 3. When requiring by decision to supply information under paragraph 1, the Lead Overseer shall:

+ (a) refer to this Article as the legal basis of the request;

+ (b) state the purpose of the request;

+ (c) specify what information is required;

+ (d) set a time limit within which the information is to be provided;

+ (e) indicate the periodic penalty payments provided for in Article 35(6) where the production of the required information is incomplete or when such information is not provided within the time limit referred to in point (d) of this paragraph;

+ (f) indicate the right to appeal the decision to ESA's Board of Appeal and to have the decision reviewed by the Court of Justice of the European Union (Court of Justice) in accordance with Articles 60 and 61 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

+ 4. The representatives of the critical ICT third-party service providers shall supply the information requested. Lawyers duly authorised to act may supply the information on behalf of their clients. The critical ICT third-party service provider shall remain fully responsible if the information supplied is incomplete, incorrect or misleading.

+ 5. The Lead Overseer shall, without delay, transmit a copy of the decision to supply information to the competent authorities of the financial entities using the services of the relevant critical ICT third-party service providers and to the JON.

+ Article 38

+ General investigations

+ 1. In order to carry out its duties under this Regulation, the Lead Overseer, assisted by the joint examination team referred to in Article 40(1), may, where necessary, conduct investigations of critical ICT third-party service providers.

+ 2. The Lead Overseer shall have the power to: (a) examine records, data, procedures and any other material relevant to the execution of its tasks, irrespective of the

+ medium on which they are stored; (b) take or obtain certified copies of, or extracts from, such records, data, documented procedures and any other material; (c) summon representatives of the critical ICT third-party service provider for oral or written explanations on facts or

+ documents relating to the subject matter and purpose of the investigation and to record the answers; (d) interview any other natural or legal person who consents to be interviewed for the purpose of collecting information

+ relating to the subject matter of an investigation; (e) request records of telephone and data traffic.

+ 3. The officials and other persons authorised by the Lead Overseer for the purposes of the investigation referred to in paragraph 1 shall exercise their powers upon production of a written authorisation specifying the subject matter and purpose of the investigation.

+ That authorisation shall also indicate the periodic penalty payments provided for in Article 35(6) where the production of the required records, data, documented procedures or any other material, or the answers to questions asked to representatives of the ICT third-party service provider are not provided or are incomplete.

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/63

+ 4. The representatives of the critical ICT third-party service providers are required to submit to the investigations on the basis of a decision of the Lead Overseer. The decision shall specify the subject matter and purpose of the investigation, the periodic penalty payments provided for in Article 35(6), the legal remedies available under Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, and the right to have the decision reviewed by the Court of Justice.

+ 5. In good time before the start of the investigation, the Lead Overseer shall inform competent authorities of the financial entities using the ICT services of that critical ICT third-party service provider of the envisaged investigation and of the identity of the authorised persons.

+ The Lead Overseer shall communicate to the JON all information transmitted pursuant to the first subparagraph.

+ Article 39

+ Inspections

+ 1. In order to carry out its duties under this Regulation, the Lead Overseer, assisted by the joint examination teams referred to in Article 40(1), may enter in, and conduct all necessary onsite inspections on, any business premises, land or property of the ICT third-party service providers, such as head offices, operation centres, secondary premises, as well as to conduct off-site inspections.

+ For the purposes of exercising the powers referred to in the first subparagraph, the Lead Overseer shall consult the JON.

+ 2. The officials and other persons authorised by the Lead Overseer to conduct an on-site inspection shall have the power to:

+ (a) enter any such business premises, land or property; and

+ (b) seal any such business premises, books or records, for the period of, and to the extent necessary for, the inspection.

+ The officials and other persons authorised by the Lead Overseer shall exercise their powers upon production of a written authorisation specifying the subject matter and the purpose of the inspection, and the periodic penalty payments provided for in Article 35(6) where the representatives of the critical ICT third-party service providers concerned do not submit to the inspection.

+ 3. In good time before the start of the inspection, the Lead Overseer shall inform the competent authorities of the financial entities using that ICT third-party service provider.

+ 4. Inspections shall cover the full range of relevant ICT systems, networks, devices, information and data either used for, or contributing to, the provision of ICT services to financial entities.

+ 5. Before any planned on-site inspection, the Lead Overseer shall give reasonable notice to the critical ICT third-party service providers, unless such notice is not possible due to an emergency or crisis situation, or if it would lead to a situation where the inspection or audit would no longer be effective.

+ 6. The critical ICT third-party service provider shall submit to on-site inspections ordered by decision of the Lead Overseer. The decision shall specify the subject matter and purpose of the inspection, fix the date on which the inspection shall begin and shall indicate the periodic penalty payments provided for in Article 35(6), the legal remedies available under Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, as well as the right to have the decision reviewed by the Court of Justice.

+ 7. Where the officials and other persons authorised by the Lead Overseer find that a critical ICT third-party service provider opposes an inspection ordered pursuant to this Article, the Lead Overseer shall inform the critical ICT third-party service provider of the consequences of such opposition, including the possibility for competent authorities of the relevant financial entities to require financial entities to terminate the contractual arrangements concluded with that critical ICT third-party service provider.

+ L 333/64

+ EN

+ Official Journal of the European Union

+ 27.12.2022

+ Article 40

+ Ongoing oversight

+ 1. When conducting oversight activities, in particular general investigations or inspections, the Lead Overseer shall be assisted by a joint examination team established for each critical ICT third-party service provider.

+ 2. The joint examination team referred to in paragraph 1 shall be composed of staff members from: (a) the ESAs; (b) the relevant competent authorities supervising the financial entities to which the critical ICT third-party service

+ provider provides ICT services; (c) the national competent authority referred to in Article 32(4), point (e), on a voluntary basis; (d) one national competent authority from the Member State where the critical ICT third-party service provider is

+ established, on a voluntary basis.

+ Members of the joint examination team shall have expertise in ICT matters and in operational risk. The joint examination team shall work under the coordination of a designated Lead Overseer staff member (the `Lead Overseer coordinator').

+ 3. Within 3 months of the completion of an investigation or inspection, the Lead Overseer, after consulting the Oversight Forum, shall adopt recommendations to be addressed to the critical ICT third-party service provider pursuant to the powers referred to in Article 35.

+ 4. The recommendations referred to in paragraph 3 shall be immediately communicated to the critical ICT third-party service provider and to the competent authorities of the financial entities to which it provides ICT services.

+ For the purposes of fulfilling the oversight activities, the Lead Overseer may take into consideration any relevant third-party certifications and ICT third-party internal or external audit reports made available by the critical ICT third-party service provider.

+ Article 41

+ Harmonisation of conditions enabling the conduct of the oversight activities

+ 1. The ESAs shall, through the Joint Committee, develop draft regulatory technical standards to specify:

+ (a) the information to be provided by an ICT third-party service provider in the application for a voluntary request to be designated as critical under Article 31(11);

+ (b) the content, structure and format of the information to be submitted, disclosed or reported by the ICT third-party service providers pursuant to Article 35(1), including the template for providing information on subcontracting arrangements;

+ (c) the criteria for determining the composition of the joint examination team ensuring a balanced participation of staff members from the ESAs and from the relevant competent authorities, their designation, tasks, and working arrangements.

+ (d) the details of the competent authorities' assessment of the measures taken by critical ICT third-party service providers based on the recommendations of the Lead Overseer pursuant to Article 42(3).

+ 2. The ESAs shall submit those draft regulatory technical standards to the Commission by 17 July 2024.

+ Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in paragraph 1 in accordance with the procedure laid down in Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/65

+ Article 42

+ Follow-up by competent authorities

+ 1. Within 60 calendar days of the receipt of the recommendations issued by the Lead Overseer pursuant to Article 35(1), point (d), critical ICT third-party service providers shall either notify the Lead Overseer of their intention to follow the recommendations or provide a reasoned explanation for not following such recommendations. The Lead Overseer shall immediately transmit this information to the competent authorities of the financial entities concerned.

+ 2. The Lead Overseer shall publicly disclose where a critical ICT third-party service provider fails to notify the Lead Overseer in accordance with paragraph 1 or where the explanation provided by the critical ICT third-party service provider is not deemed sufficient. The information published shall disclose the identity of the critical ICT third-party service provider as well as information on the type and nature of the non-compliance. Such information shall be limited to what is relevant and proportionate for the purpose of ensuring public awareness, unless such publication would cause disproportionate damage to the parties involved or could seriously jeopardise the orderly functioning and integrity of financial markets or the stability of the whole or part of the financial system of the Union.

+ The Lead Overseer shall notify the ICT third-party service provider of that public disclosure.

+ 3. Competent authorities shall inform the relevant financial entities of the risks identified in the recommendations addressed to critical ICT third-party service providers in accordance with Article 35(1), point (d).

+ When managing ICT third-party risk, financial entities shall take into account the risks referred to in the first subparagraph.

+ 4. Where a competent authority deems that a financial entity fails to take into account or to sufficiently address within its management of ICT third-party risk the specific risks identified in the recommendations, it shall notify the financial entity of the possibility of a decision being taken, within 60 calendar days of the receipt of such notification, pursuant to paragraph 6, in the absence of appropriate contractual arrangements aiming to address such risks.

+ 5. Upon receiving the reports referred to in Article 35(1), point (c), and prior to taking a decision as referred to in paragraph 6 of this Article, competent authorities may, on a voluntary basis, consult the competent authorities designated or established in accordance with Directive (EU) 2022/2555 responsible for the supervision of an essential or important entity subject to that Directive, which has been designated as a critical ICT third-party service provider.

+ 6. Competent authorities may, as a measure of last resort, following the notification and, if appropriate, the consultation as set out in paragraph 4 and 5 of this Article, in accordance with Article 50, take a decision requiring financial entities to temporarily suspend, either in part or completely, the use or deployment of a service provided by the critical ICT third-party service provider until the risks identified in the recommendations addressed to critical ICT third-party service providers have been addressed. Where necessary, they may require financial entities to terminate, in part or completely, the relevant contractual arrangements concluded with the critical ICT third-party service providers.

+ 7. Where a critical ICT third-party service provider refuses to endorse recommendations, based on a divergent approach from the one advised by the Lead Overseer, and such a divergent approach may adversely impact a large number of financial entities, or a significant part of the financial sector, and individual warnings issued by competent authorities have not resulted in consistent approaches mitigating the potential risk to financial stability, the Lead Overseer may, after consulting the Oversight Forum, issue non-binding and non-public opinions to competent authorities, in order to promote consistent and convergent supervisory follow-up measures, as appropriate.

+ 8. Upon receiving the reports referred to in Article 35(1), point (c), competent authorities, when taking a decision as referred to in paragraph 6 of this Article, shall take into account the type and magnitude of risk that is not addressed by the critical ICT third-party service provider, as well as the seriousness of the non-compliance, having regard to the following criteria:

+ L 333/66

+ EN

+ Official Journal of the European Union

+ 27.12.2022

+ (a) the gravity and the duration of the non-compliance;

+ (b) whether the non-compliance has revealed serious weaknesses in the critical ICT third-party service provider's procedures, management systems, risk management and internal controls;

+ (c) whether a financial crime was facilitated, occasioned or is otherwise attributable to the non-compliance;

+ (d) whether the non-compliance has been intentional or negligent;

+ (e) whether the suspension or termination of the contractual arrangements introduces a risk for continuity of the financial entity's business operations notwithstanding the financial entity's efforts to avoid disruption in the provision of its services;

+ (f) where applicable, the opinion of the competent authorities designated or established in accordance with Directive (EU) 2022/2555 responsible for the supervision of an essential or important entity subject to that Directive, which has been designated as a critical ICT third-party service provider, requested on a voluntary basis in accordance with paragraph 5 of this Article.

+ Competent authorities shall grant financial entities the necessary period of time to enable them to adjust the contractual arrangements with critical ICT third-party service providers in order to avoid detrimental effects on their digital operational resilience and to allow them to deploy exit strategies and transition plans as referred to in Article 28.

+ 9. The decision referred to in paragraph 6 of this Article shall be notified to the members of the Oversight Forum referred to in Article 32(4), points (a), (b) and (c), and to the JON.

+ The critical ICT third-party service providers affected by the decisions provided for in paragraph 6 shall fully cooperate with the financial entities impacted, in particular in the context of the process of suspension or termination of their contractual arrangements.

+ 10. Competent authorities shall regularly inform the Lead Overseer on the approaches and measures taken in their supervisory tasks in relation to financial entities as well as on the contractual arrangements concluded by financial entities where critical ICT third-party service providers have not endorsed in part or entirely recommendations addressed to them by the Lead Overseer.

+ 11. The Lead Overseer may, upon request, provide further clarifications on the recommendations issued to guide the competent authorities on the follow-up measures.

+ Article 43

+ Oversight fees

+ 1. The Lead Overseer shall, in accordance with the delegated act referred to in paragraph 2 of this Article, charge critical ICT third-party service providers fees that fully cover the Lead Overseer's necessary expenditure in relation to the conduct of oversight tasks pursuant to this Regulation, including the reimbursement of any costs which may be incurred as a result of work carried out by the joint examination team referred to in Article 40, as well as the costs of advice provided by the independent experts as referred to in Article 32(4), second subparagraph, in relation to matters falling under the remit of direct oversight activities.

+ The amount of a fee charged to a critical ICT third-party service provider shall cover all costs derived from the execution of the duties set out in this Section and shall be proportionate to its turnover.

+ 2. The Commission is empowered to adopt a delegated act in accordance with Article 57 to supplement this Regulation by determining the amount of the fees and the way in which they are to be paid by 17 July 2024.

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/67

+ Article 44

+ International cooperation

+ 1. Without prejudice to Article 36, EBA, ESMA and EIOPA may, in accordance with Article 33 of Regulations (EU) No 1093/2010, (EU) No 1095/2010 and (EU) No 1094/2010, respectively, conclude administrative arrangements with third-country regulatory and supervisory authorities to foster international cooperation on ICT third-party risk across different financial sectors, in particular by developing best practices for the review of ICT risk management practices and controls, mitigation measures and incident responses.

+ 2. The ESAs shall, through the Joint Committee, submit every five years a joint confidential report to the European Parliament, to the Council and to the Commission, summarising the findings of relevant discussions held with the third countries' authorities referred to in paragraph 1, focusing on the evolution of ICT third-party risk and the implications for financial stability, market integrity, investor protection and the functioning of the internal market.

+ CHAPTER VI

+ Information-sharing arrangements

+ Article 45

+ Information-sharing arrangements on cyber threat information and intelligence

+ 1. Financial entities may exchange amongst themselves cyber threat information and intelligence, including indicators of compromise, tactics, techniques, and procedures, cyber security alerts and configuration tools, to the extent that such information and intelligence sharing: (a) aims to enhance the digital operational resilience of financial entities, in particular through raising awareness in relation

+ to cyber threats, limiting or impeding the cyber threats' ability to spread, supporting defence capabilities, threat detection techniques, mitigation strategies or response and recovery stages; (b) takes places within trusted communities of financial entities; (c) is implemented through information-sharing arrangements that protect the potentially sensitive nature of the information shared, and that are governed by rules of conduct in full respect of business confidentiality, protection of personal data in accordance with Regulation (EU) 2016/679 and guidelines on competition policy.

+ 2. For the purpose of paragraph 1, point (c), the information-sharing arrangements shall define the conditions for participation and, where appropriate, shall set out the details on the involvement of public authorities and the capacity in which they may be associated to the information-sharing arrangements, on the involvement of ICT third-party service providers, and on operational elements, including the use of dedicated IT platforms.

+ 3. Financial entities shall notify competent authorities of their participation in the information-sharing arrangements referred to in paragraph 1, upon validation of their membership, or, as applicable, of the cessation of their membership, once it takes effect.

+ L 333/68

+ EN

+ Official Journal of the European Union

+ CHAPTER VII

+ Competent authorities

+ 27.12.2022

+ Article 46

+ Competent authorities

+ Without prejudice to the provisions on the Oversight Framework for critical ICT third-party service providers referred to in Chapter V, Section II, of this Regulation, compliance with this Regulation shall be ensured by the following competent authorities in accordance with the powers granted by the respective legal acts:

+ (a) for credit institutions and for institutions exempted pursuant to Directive 2013/36/EU, the competent authority designated in accordance with Article 4 of that Directive, and for credit institutions classified as significant in accordance with Article 6(4) of Regulation (EU) No 1024/2013, the ECB in accordance with the powers and tasks conferred by that Regulation;

+ (b) for payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366, electronic money institutions, including those exempted pursuant to Directive 2009/110/EC, and account information service providers as referred to in Article 33(1) of Directive (EU) 2015/2366, the competent authority designated in accordance with Article 22 of Directive (EU) 2015/2366;

+ (c) for investment firms, the competent authority designated in accordance with Article 4 of Directive (EU) 2019/2034 of the European Parliament and of the Council (38);

+ (d) for crypto-asset service providers as authorised under the Regulation on markets in crypto-assets and issuers of assetreferenced tokens, the competent authority designated in accordance with the relevant provision of that Regulation;

+ (e) for central securities depositories, the competent authority designated in accordance with Article 11 of Regulation (EU) No 909/2014;

+ (f) for central counterparties, the competent authority designated in accordance with Article 22 of Regulation (EU) No 648/2012;

+ (g) for trading venues and data reporting service providers, the competent authority designated in accordance with Article 67 of Directive 2014/65/EU, and the competent authority as defined in Article 2(1), point (18), of Regulation (EU) No 600/2014;

+ (h) for trade repositories, the competent authority designated in accordance with Article 22 of Regulation (EU) No 648/2012;

+ (i) for managers of alternative investment funds, the competent authority designated in accordance with Article 44 of Directive 2011/61/EU;

+ (j) for management companies, the competent authority designated in accordance with Article 97 of Directive 2009/65/EC;

+ (k) for insurance and reinsurance undertakings, the competent authority designated in accordance with Article 30 of Directive 2009/138/EC;

+ (l) for insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries, the competent authority designated in accordance with Article 12 of Directive (EU) 2016/97;

+ (m) for institutions for occupational retirement provision, the competent authority designated in accordance with Article 47 of Directive (EU) 2016/2341;

+ (n) for credit rating agencies, the competent authority designated in accordance with Article 21 of Regulation (EC) No 1060/2009;

+ (o) for administrators of critical benchmarks, the competent authority designated in accordance with Articles 40 and 41 of Regulation (EU) 2016/1011;

+ (38) Directive (EU) 2019/2034 of the European Parliament and of the Council of 27 November 2019 on the prudential supervision of investment firms and amending Directives 2002/87/EC, 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU (OJ L 314, 5.12.2019, p. 64).

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/69

+ (p) for crowdfunding service providers, the competent authority designated in accordance with Article 29 of Regulation (EU) 2020/1503;

+ (q) for securitisation repositories, the competent authority designated in accordance with Articles 10 and 14(1) of Regulation (EU) 2017/2402.

+ Article 47

+ Cooperation with structures and authorities established by Directive (EU) 2022/2555

+ 1. To foster cooperation and enable supervisory exchanges between the competent authorities designated under this Regulation and the Cooperation Group established by Article 14 of Directive (EU) 2022/2555, the ESAs and the competent authorities may participate in the activities of the Cooperation Group for matters that concern their supervisory activities in relation to financial entities. The ESAs and the competent authorities may request to be invited to participate in the activities of the Cooperation Group for matters in relation to essential or important entities subject to Directive (EU) 2022/2555 that have also been designated as critical ICT third-party service providers pursuant to Article 31 of this Regulation.

+ 2. Where appropriate, competent authorities may consult and share information with the single points of contact and the CSIRTs designated or established in accordance with Directive (EU) 2022/2555.

+ 3. Where appropriate, competent authorities may request any relevant technical advice and assistance from the competent authorities designated or established in accordance with Directive (EU) 2022/2555 and establish cooperation arrangements to allow effective and fast-response coordination mechanisms to be set up.

+ 4. The arrangements referred to in paragraph 3 of this Article may, inter alia, specify the procedures for the coordination of supervisory and oversight activities in relation to essential or important entities subject to Directive (EU) 2022/2555 that have been designated as critical ICT third-party service providers pursuant to Article 31 of this Regulation, including for the conduct, in accordance with national law, of investigations and on-site inspections, as well as for mechanisms for the exchange of information between the competent authorities under this Regulation and the competent authorities designated or established in accordance with that Directive which includes access to information requested by the latter authorities.

+ Article 48

+ Cooperation between authorities

+ 1. Competent authorities shall cooperate closely among themselves and, where applicable, with the Lead Overseer.

+ 2. Competent authorities and the Lead Overseer shall, in a timely manner, mutually exchange all relevant information concerning critical ICT third-party service providers which is necessary for them to carry out their respective duties under this Regulation, in particular in relation to identified risks, approaches and measures taken as part of the Lead Overseer's oversight tasks.

+ Article 49

+ Financial cross-sector exercises, communication and cooperation

+ 1. The ESAs, through the Joint Committee and in collaboration with competent authorities, resolution authorities as referred to in Article 3 of Directive 2014/59/EU, the ECB, the Single Resolution Board as regards information relating to entities falling under the scope of Regulation (EU) No 806/2014, the ESRB and ENISA, as appropriate, may establish mechanisms to enable the sharing of effective practices across financial sectors to enhance situational awareness and identify common cyber vulnerabilities and risks across sectors.

+ L 333/70

+ EN

+ Official Journal of the European Union

+ 27.12.2022

+ They may develop crisis management and contingency exercises involving cyber-attack scenarios with a view to developing communication channels and gradually enabling an effective coordinated response at Union level in the event of a major cross-border ICT-related incident or related threat having a systemic impact on the Union's financial sector as a whole.

+ Those exercises may, as appropriate, also test the financial sector's dependencies on other economic sectors.

+ 2. Competent authorities, ESAs and the ECB shall cooperate closely with each other and exchange information to carry out their duties pursuant to Articles 47 to 54. They shall closely coordinate their supervision in order to identify and remedy breaches of this Regulation, develop and promote best practices, facilitate collaboration, foster consistency of interpretation and provide cross-jurisdictional assessments in the event of any disagreements.

+ Article 50

+ Administrative penalties and remedial measures

+ 1. Competent authorities shall have all supervisory, investigatory and sanctioning powers necessary to fulfil their duties under this Regulation.

+ 2. The powers referred to in paragraph 1 shall include at least the following powers to:

+ (a) have access to any document or data held in any form that the competent authority considers relevant for the performance of its duties and receive or take a copy of it;

+ (b) carry out on-site inspections or investigations, which shall include but shall not be limited to;

+ (i) summoning representatives of the financial entities for oral or written explanations on facts or documents relating to the subject matter and purpose of the investigation and to record the answers;

+ (ii) interviewing any other natural or legal person who consents to be interviewed for the purpose of collecting information relating to the subject matter of an investigation;

+ (c) require corrective and remedial measures for breaches of the requirements of this Regulation.

+ 3. Without prejudice to the right of Member States to impose criminal penalties in accordance with Article 52, Member States shall lay down rules establishing appropriate administrative penalties and remedial measures for breaches of this Regulation and shall ensure their effective implementation.

+ Those penalties and measures shall be effective, proportionate and dissuasive.

+ 4. Member States shall confer on competent authorities the power to apply at least the following administrative penalties or remedial measures for breaches of this Regulation:

+ (a) issue an order requiring the natural or legal person to cease conduct that is in breach of this Regulation and to desist from a repetition of that conduct;

+ (b) require the temporary or permanent cessation of any practice or conduct that the competent authority considers to be contrary to the provisions of this Regulation and prevent repetition of that practice or conduct;

+ (c) adopt any type of measure, including of pecuniary nature, to ensure that financial entities continue to comply with legal requirements;

+ (d) require, insofar as permitted by national law, existing data traffic records held by a telecommunication operator, where there is a reasonable suspicion of a breach of this Regulation and where such records may be relevant to an investigation into breaches of this Regulation; and

+ (e) issue public notices, including public statements indicating the identity of the natural or legal person and the nature of the breach.

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/71

+ 5. Where paragraph 2, point (c), and paragraph 4 apply to legal persons, Member States shall confer on competent authorities the power to apply the administrative penalties and remedial measures, subject to the conditions provided for in national law, to members of the management body, and to other individuals who under national law are responsible for the breach.

+ 6. Member States shall ensure that any decision imposing administrative penalties or remedial measures set out in paragraph 2, point (c), is properly reasoned and is subject to a right of appeal.

+ Article 51

+ Exercise of the power to impose administrative penalties and remedial measures

+ 1. Competent authorities shall exercise the powers to impose administrative penalties and remedial measures referred to in Article 50 in accordance with their national legal frameworks, where appropriate, as follows: (a) directly; (b) in collaboration with other authorities; (c) under their responsibility by delegation to other authorities; or (d) by application to the competent judicial authorities.

+ 2. Competent authorities, when determining the type and level of an administrative penalty or remedial measure to be imposed under Article 50, shall take into account the extent to which the breach is intentional or results from negligence, and all other relevant circumstances, including the following, where appropriate: (a) the materiality, gravity and the duration of the breach; (b) the degree of responsibility of the natural or legal person responsible for the breach; (c) the financial strength of the responsible natural or legal person; (d) the importance of profits gained or losses avoided by the responsible natural or legal person, insofar as they can be

+ determined; (e) the losses for third parties caused by the breach, insofar as they can be determined; (f) the level of cooperation of the responsible natural or legal person with the competent authority, without prejudice to

+ the need to ensure disgorgement of profits gained or losses avoided by that natural or legal person; (g) previous breaches by the responsible natural or legal person.

+ Article 52

+ Criminal penalties

+ 1. Member States may decide not to lay down rules for administrative penalties or remedial measures for breaches that are subject to criminal penalties under their national law.

+ 2. Where Member States have chosen to lay down criminal penalties for breaches of this Regulation, they shall ensure that appropriate measures are in place so that competent authorities have all the necessary powers to liaise with judicial, prosecuting, or criminal justice authorities within their jurisdiction to receive specific information related to criminal investigations or proceedings commenced for breaches of this Regulation, and to provide the same information to other competent authorities, as well as EBA, ESMA or EIOPA to fulfil their obligations to cooperate for the purposes of this Regulation.

+ L 333/72

+ EN

+ Official Journal of the European Union

+ 27.12.2022

+ Article 53

+ Notification duties

+ Member States shall notify the laws, regulations and administrative provisions implementing this Chapter, including any relevant criminal law provisions, to the Commission, ESMA, the EBA and EIOPA by 17 January 2025. Member States shall notify the Commission, ESMA, the EBA and EIOPA without undue delay of any subsequent amendments thereto.

+ Article 54

+ Publication of administrative penalties

+ 1. Competent authorities shall publish on their official websites, without undue delay, any decision imposing an administrative penalty against which there is no appeal after the addressee of the penalty has been notified of that decision.

+ 2. The publication referred to in paragraph 1 shall include information on the type and nature of the breach, the identity of the persons responsible and the penalties imposed.

+ 3. Where the competent authority, following a case-by-case assessment, considers that the publication of the identity, in the case of legal persons, or of the identity and personal data, in the case of natural persons, would be disproportionate, including risks in relation to the protection of personal data, jeopardise the stability of financial markets or the pursuit of an ongoing criminal investigation, or cause, insofar as these can be determined, disproportionate damages to the person involved, it shall adopt one of the following solutions in respect of the decision imposing an administrative penalty:

+ (a) defer its publication until all reasons for non-publication cease to exist;

+ (b) publish it on an anonymous basis, in accordance with national law; or

+ (c) refrain from publishing it, where the options set out in points (a) and (b) are deemed either insufficient to guarantee a lack of any danger for the stability of financial markets, or where such a publication would not be proportionate to the leniency of the imposed penalty.

+ 4. In the case of a decision to publish an administrative penalty on an anonymous basis in accordance with paragraph 3, point (b), the publication of the relevant data may be postponed.

+ 5. Where a competent authority publishes a decision imposing an administrative penalty against which there is an appeal before the relevant judicial authorities, competent authorities shall immediately add on their official website that information and, at later stages, any subsequent related information on the outcome of such appeal. Any judicial decision annulling a decision imposing an administrative penalty shall also be published.

+ 6. Competent authorities shall ensure that any publication referred to in paragraphs 1 to 4 shall remain on their official website only for the period which is necessary to bring forth this Article. This period shall not exceed five years after its publication.

+ Article 55

+ Professional secrecy

+ 1. Any confidential information received, exchanged or transmitted pursuant to this Regulation shall be subject to the conditions of professional secrecy laid down in paragraph 2.

+ 2. The obligation of professional secrecy applies to all persons who work, or who have worked, for the competent authorities pursuant to this Regulation, or for any authority or market undertaking or natural or legal person to whom those competent authorities have delegated their powers, including auditors and experts contracted by them.

+ 27.12.2022

+ EN

+ Official Journal of the European Union

+ L 333/73

+ 3. Information covered by professional secrecy, including the exchange of information among competent authorities under this Regulation and competent authorities designated or established in accordance with Directive (EU) 2022/2555, shall not be disclosed to any other person or authority except by virtue of provisions laid down by Union or national law;

+ 4. All information exchanged between the competent authorities pursuant to this Regulation that concerns business or operational conditions and other economic or personal affairs shall be considered confidential and shall be subject to the requirements of professional secrecy, except where the competent authority states, at the time of communication, that such information may be disclosed or where such disclosure is necessary for legal proceedings.

+ Article 56

+ Data Protection

+ 1. The ESAs and the competent authorities shall be allowed to process personal data only where necessary for the purpose of carrying out their respective obligations and duties pursuant to this Regulation, in particular for investigation, inspection, request for information, communication, publication, evaluation, verification, assessment and drafting of oversight plans. The personal data shall be processed in accordance with Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, whichever is applicable.

+ 2. Except where otherwise provided in other sectoral acts, the personal data referred to in paragraph 1 shall be retained until the discharge of the applicable supervisory duties and in any case for a maximum period of 15 years, except in the event of pending court proceedings requiring further retention of such data.

+ CHAPTER VIII

+ Delegated acts

+ Article 57

+ Exercise of the delegation

+ 1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

+ 2. The power to adopt delegated acts referred to in Articles 31(6) and 43(2) shall be conferred on the Commission for a period of five years from 17 January 2024. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five-year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period.

+ 3. The delegation of power referred to in Articles 31(6) and 43(2) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

+ 4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making.

+ 5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

+ L 333/74

+ EN

+ Official Journal of the European Union

+ 27.12.2022

+ 6. A delegated act adopted pursuant to Articles 31(6) and 43(2) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of three months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by three months at the initiative of the European Parliament or of the Council.

+ CHAPTER IX

+ Transitional and final provisions

+ Article 58

+ Review clause

+ 1. By 17 January 2028, the Commission shall, after consulting the ESAs and the ESRB, as appropriate, carry out a review and submit a report to the European Parliament and the Council, accompanied, where appropriate, by a legislative proposal. The review shall include at least the following:

+ (a) the criteria for the designation of critical ICT third-party service providers in accordance with Article 31(2);

+ (b) the voluntary nature of the notification of significant cyber threats referred to in Article 19;

+ (c) the regime referred to in Article 31(12) and the powers of the Lead Overseer provided for in Article 35(1), point (d), point (iv), first indent, with a view to evaluating the effectiveness of those provisions with regard to ensuring effective oversight of critical ICT third-party service providers established in a third country, and the necessity to establish a subsidiary in the Union.

+ For the purposes of the first subparagraph of this point, the review shall include an analysis of the regime referred to in Article 31(12), including in terms of access for Union financial entities to services from third countries and availability of such services on the Union market and it shall take into account further developments in the markets for the services covered by this Regulation, the practical experience of financial entities and financial supervisors with regard to the application and, respectively, supervision of that regime, and any relevant regulatory and supervisory developments taking place at international level.

+ (d) the appropriateness of including in the scope of this Regulation financial entities referred to in Article 2(3), point (e), making use of automated sales systems, in light of future market developments on the use of such systems;

+ (e) the functioning and effectiveness of the JON in supporting the consistency of the oversight and the efficiency of the exchange of information within the Oversight Framework.

+ 2. In the context of the review of Directive (EU) 2015/2366, the Commission shall assess the need for increased cyber resilience of payment systems and payment-processing activities and the appropriateness of extending the scope of this Regulation to operators of payment systems and entities involved in payment-processing activities. In light of this assessment, the Commission shall submit, as part of the review of Directive (EU) 2015/2366, a report to the European Parliament and the Council no later than 17 July 2023.

+ Based on that review report, and after consulting ESAs, ECB and the ESRB, the Commission may submit, where appropriate and as part of the legislative proposal that it may adopt pursuant to Article 108, second paragraph, of Directive (EU) 2015/2366, a proposal to ensure that all operators of payment systems and entities involved in payment-processing activities are subject to an appropriate oversight, while taking into account existing oversight by the central bank.

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/75

+ 3. By 17 January 2026, the Commission shall, after consulting the ESAs and the Committee of European Auditing Oversight Bodies, carry out a review and submit a report to the European Parliament and the Council, accompanied, where appropriate, by a legislative proposal, on the appropriateness of strengthened requirements for statutory auditors and audit firms as regards digital operational resilience, by means of the inclusion of statutory auditors and audit firms into the scope of this Regulation or by means of amendments to Directive 2006/43/EC of the European Parliament and of the Council (39).

+ Article 59

+ Regulation (EC) No 1060/2009 is amended as follows: (1) in Annex I, Section A, point 4, the first subparagraph is replaced by the following:

+ `A credit rating agency shall have sound administrative and accounting procedures, internal control mechanisms, effective procedures for risk assessment, and effective control and safeguard arrangements for managing ICT systems in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*).

+ _____________ (*) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital

+ operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).';

+ (2) in Annex III, point 12 is replaced by the following: `12. The credit rating agency infringes Article 6(2), in conjunction with point 4 of Section A of Annex I, by not having sound administrative or accounting procedures, internal control mechanisms, effective procedures for risk assessment, or effective control or safeguard arrangements for managing ICT systems in accordance with Regulation (EU) 2022/2554; or by not implementing or maintaining decision-making procedures or organisational structures as required by that point.'.

+ Article 60

+ Amendments to Regulation (EU) No 648/2012

+ Regulation (EU) No 648/2012 is amended as follows: (1) Article 26 is amended as follows:

+ (a) paragraph 3 is replaced by the following: `3. A CCP shall maintain and operate an organisational structure that ensures continuity and orderly functioning in the performance of its services and activities. It shall employ appropriate and proportionate systems, resources and procedures, including ICT systems managed in accordance with Regulation (EU) 2022/ 2554 of the European Parliament and of the Council (*).

+ _____________ (*) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital

+ operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).';

+ (39) Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC (OJ L 157, 9.6.2006, p. 87).

+ L 333/76

+ Official Journal of the European Union

+ 27.12.2022

+ (2) Article 34 is amended as follows:

+ (a) paragraph 1 is replaced by the following:

+ `1. A CCP shall establish, implement and maintain an adequate business continuity policy and disaster recovery plan, which shall include ICT business continuity policy and ICT response and recovery plans put in place and implemented in accordance with Regulation (EU) 2022/2554, aiming to ensure the preservation of its functions, the timely recovery of operations and the fulfilment of the CCP's obligations.';

+ (b) in paragraph 3, the first subparagraph is replaced by the following:

+ `3. In order to ensure consistent application of this Article, ESMA shall, after consulting the members of the ESCB, develop draft regulatory technical standards specifying the minimum content and requirements of the business continuity policy and of the disaster recovery plan, excluding ICT business continuity policy and disaster recovery plans.';

+ (3) in Article 56(3), the first subparagraph is replaced by the following:

+ `3. In order to ensure consistent application of this Article, ESMA shall develop draft regulatory technical standards specifying the details, other than for requirements related to ICT risk management, of the application for registration referred to in paragraph 1.';

+ (4) in Article 79, paragraphs 1 and 2 are replaced by the following:

+ `1. A trade repository shall identify sources of operational risk and minimise them also through the development of appropriate systems, controls and procedures, including ICT systems managed in accordance with Regulation (EU) 2022/2554.

+ 2. A trade repository shall establish, implement and maintain an adequate business continuity policy and disaster recovery plan including ICT business continuity policy and ICT response and recovery plans established in accordance with Regulation (EU) 2022/2554, aiming to ensure the maintenance of its functions, the timely recovery of operations and the fulfilment of the trade repository's obligations.';

+ (5) in Article 80, paragraph 1 is deleted.

+ (6) in Annex I, Section II is amended as follows:

+ (a) points (a) and (b) are replaced by the following:

+ `(a) a trade repository infringes Article 79(1) by not identifying sources of operational risk or by not minimising those risks through the development of appropriate systems, controls and procedures including ICT systems managed in accordance with Regulation (EU) 2022/2554;

+ (b) a trade repository infringes Article 79(2) by not establishing, implementing or maintaining an adequate business continuity policy and disaster recovery plan established in accordance with Regulation (EU) 2022/ 2554, aiming to ensure the maintenance of its functions, the timely recovery of operations and the fulfilment of the trade repository's obligations;';

+ (7) Annex III is amended as follows:

+ (a) Section II is amended as follows:

+ (i) point (c) is replaced by the following:

+ `(c) a Tier 2 CCP infringes Article 26(3) by not maintaining or operating an organisational structure that ensures continuity and orderly functioning in the performance of its services and activities or by not employing appropriate and proportionate systems, resources or procedures including ICT systems managed in accordance with Regulation (EU) 2022/2554;';

+ (ii) point (f) is deleted.

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/77

+ (b) in Section III, point (a) is replaced by the following:

+ `(a) a Tier 2 CCP infringes Article 34(1) by not establishing, implementing or maintaining an adequate business continuity policy and response and recovery plan set up in accordance with Regulation (EU) 2022/2554, aiming to ensure the preservation of its functions, the timely recovery of operations and the fulfilment of the CCP's obligations, which at least allows for the recovery of all transactions at the time of disruption to allow the CCP to continue to operate with certainty and to complete settlement on the scheduled date;'.

+ Article 61

+ Amendments to Regulation (EU) No 909/2014

+ Article 45 of Regulation (EU) No 909/2014 is amended as follows:

+ (1) paragraph 1 is replaced by the following:

+ `1. A CSD shall identify sources of operational risk, both internal and external, and minimise their impact also through the deployment of appropriate ICT tools, processes and policies set up and managed in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*), as well as through any other relevant appropriate tools, controls and procedures for other types of operational risk, including for all the securities settlement systems it operates.

+ _____________ (*) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital

+ operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).';

+ (2) paragraph 2 is deleted;

+ (3) paragraphs 3 and 4 are replaced by the following:

+ `3. For services that it provides as well as for each securities settlement system that it operates, a CSD shall establish, implement and maintain an adequate business continuity policy and disaster recovery plan, including ICT business continuity policy and ICT response and recovery plans established in accordance with Regulation (EU) 2022/2554, to ensure the preservation of its services, the timely recovery of operations and the fulfilment of the CSD's obligations in the case of events that pose a significant risk to disrupting operations.

+ 4. The plan referred to in paragraph 3 shall provide for the recovery of all transactions and participants' positions at the time of disruption to allow the participants of a CSD to continue to operate with certainty and to complete settlement on the scheduled date, including by ensuring that critical IT systems can resume operations from the time of disruption as provided for in Article 12(5) and (7) of Regulation (EU) 2022/2554.';

+ (4) paragraph 6 is replaced by the following:

+ `6. A CSD shall identify, monitor and manage the risks that key participants in the securities settlement systems it operates, as well as service and utility providers, and other CSDs or other market infrastructures might pose to its operations. It shall, upon request, provide competent and relevant authorities with information on any such risk identified. It shall also inform the competent authority and relevant authorities without delay of any operational incidents, other than in relation to ICT risk, resulting from such risks.';

+ (5) in paragraph 7, the first subparagraph is replaced by the following:

+ `7. ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the operational risks referred to in paragraphs 1 and 6, other than ICT risk, and the methods to test, to address or to minimise those risks, including the business continuity policies and disaster recovery plans referred to in paragraphs 3 and 4 and the methods of assessment thereof.'.

+ L 333/78

+ Official Journal of the European Union

+ 27.12.2022

+ Article 62

+ Amendments to Regulation (EU) No 600/2014

+ Regulation (EU) No 600/2014 is amended as follows: (1) Article 27g is amended as follows:

+ (a) paragraph 4 is replaced by the following: `4. An APA shall comply with the requirements concerning the security of network and information systems set out in Regulation (EU) 2022/2554 of the European Parliament and of the Council (*). _____________ (*) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).';

+ (b) in paragraph 8, point (c) is replaced by the following: `(c) the concrete organisational requirements laid down in paragraphs 3 and 5.';

+ (2) Article 27h is amended as follows: (a) paragraph 5 is replaced by the following: `5. A CTP shall comply with the requirements concerning the security of network and information systems set out in Regulation (EU) 2022/2554.'. (b) in paragraph 8, point (e) is replaced by the following: `(e) the concrete organisational requirements laid down in paragraph 4.';

+ (3) Article 27i is amended as follows: (a) paragraph 3 is replaced by the following: `3. An ARM shall comply with the requirements concerning the security of network and information systems set out in Regulation (EU) 2022/2554.'; (b) in paragraph 5, point (b) is replaced by the following: `(b) the concrete organisational requirements laid down in paragraphs 2 and 4.'.

+ Article 63

+ In Article 6 of Regulation (EU) 2016/1011, the following paragraph is added:

+ `6. For critical benchmarks, an administrator shall have sound administrative and accounting procedures, internal control mechanisms, effective procedures for risk assessment, and effective control and safeguard arrangements for managing ICT systems in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*).

+ _____________ (*) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital

+ operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).'.

+ 27.12.2022

+ Official Journal of the European Union

+ L 333/79

+ Article 64

+ Entry into force and application This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 17 January 2025.

+ This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Strasbourg, 14 December 2022.

+ For the European Parliament The President R. METSOLA

+ For the Council The President

This is a computed comparison between saved source copies. It is not a statement by the source, a legal conclusion, or a determination of current status.