Harmonization of conduct activities

Preamble (Recitals 1 – 14)

Recitals

Chapter I (Articles 1 – 2)

Information to be provided by ICT third-party service providers in the application for a voluntary request to be designed as critical

Article 1

Information to be provided by ICT third-party service provider in the application for a voluntary request to be designated as critical

Article 2

Assessment of completeness of application

Chapter II (Articles 3 – 6)

Information from critical ICT third-party service providers to the lead overseer

Article 3

Content of information provided by critical ICT third-party service providers

Article 4

Information from critical ICT third-party providers after the issuance of recommendations

Article 5

Structure and format of information provided by critical ICT third-party service providers

Article 6

Information on subcontracting arrangements provided by critical ICT third-party service providers

Chapter III (Article 7)

Competent authorities’ assessment of the measures taken by critical ICT third-party service providers based on recommendations of the lead overseer

Article 7

Competent authorities’ assessment of the risks addressed in the recommendations of the Lead Overseer

Chapter IV (Article 8)

Final provisions

Article 8

Entry into force

Article 7Note: This article is based on the final draft from the ESAs and is not yet adopted. Competent authorities’ assessment of the risks addressed in the recommendations of the Lead Overseer

  1. As part of their supervision of financial entitiesas defined in Article 2, points (a) to (t), competent authoritiesas defined in Article 46 shall assess the impact on the financial entitiesas defined in Article 2, points (a) to (t) of the measures taken by critical ICT third-party service providersan ICT third-party service provider designated as critical in accordance with Article 31 based on the recommendations of the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation. This assessment shall reflect a risk-based approach and the principle of proportionality.

  2. When conducting the assessment referred to in paragraph 1, competent authoritiesas defined in Article 46 shall take into account all of the following:

    1. the adequacy and the coherence of the corrective and remedial measures implemented by the financial entitiesas defined in Article 2, points (a) to (t) under their remit to mitigate those risks, if any;

    2. the assessment made by the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation of the compliance with the measures and actions included in the remediation plan by the critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31 where it has impacts on the exposure of the financial entitiesas defined in Article 2, points (a) to (t) under their remit to the risks identified in the recommendations;

    3. the view of competent authoritiesas defined in Article 46 designated or established in accordance with Directive (EU) 2022/2555, where those competent authoritiesas defined in Article 46 have been consulted in accordance with Article 42(5) of Regulation (EU) 2022/2554;

    4. whether the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation has considered the actions and remedies implemented by the critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31 as adequate to mitigate the exposure of the financial entitiesas defined in Article 2, points (a) to (t) under their remit to the risks identified in the in recommendations.

  3. Upon request from the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation, the competent authorityas defined in Article 46 shall provide in reasonable time the results of the assessment set out in paragraph 1. When requesting the results of this assessment, the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation shall consider the principle of proportionality and the magnitude of risks associated with the recommendation, including the cross-border impacts of these risks when impacting financial entitiesas defined in Article 2, points (a) to (t) operating in more than one Member State.

  4. Where relevant, competent authoritiesas defined in Article 46 shall request to financial entitiesas defined in Article 2, points (a) to (t) any information necessary to carry out the assessment specified in paragraph 1.

Table of contents