Recital 78

Exemptions from Oversight Framework


Similarly, financial entitiesas defined in Article 2, points (a) to (t) providing ICT servicesdigital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services to other financial entitiesas defined in Article 2, points (a) to (t), while belonging to the category of ICT third-party service providersan undertaking providing ICT services under this Regulation, should also be exempted from the Oversight Framework since they are already subject to supervisory mechanisms established by the relevant Union financial services law. Where applicable, competent authoritiesas defined in Article 46 should take into account, in the context of their supervisory activities, the ICT riskany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment posed to financial entitiesas defined in Article 2, points (a) to (t) by financial entitiesas defined in Article 2, points (a) to (t) providing ICT servicesdigital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services. Likewise, due to the existing risk monitoring mechanisms at groupa group as defined in Article 2, point (11), of Directive 2013/34/EU level, the same exemption should be introduced for ICT third-party service providersan undertaking providing ICT services delivering services predominantly to the entities of their own groupa group as defined in Article 2, point (11), of Directive 2013/34/EU. ICT third-party service providersan undertaking providing ICT services providing ICT servicesdigital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services solely in one Member State to financial entitiesas defined in Article 2, points (a) to (t) that are active only in that Member State should also be exempted from the designation mechanism because of their limited activities and lack of cross-border impact.