Establishment of a joint examination team


  1. After the first designation of the ICT third-party service provideran undertaking providing ICT services as critical in accordance with Article 31(1) of Regulation (EU) 2022/2554, the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation, in agreement with the joint oversight network, shall establish the joint examination team responsible to carry out the oversight activities concerning the assigned critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31.

  2. When material changes regarding the critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31 occur, the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation may consider to update the composition of the joint examination team responsible to carry out the oversight activities concerning the assigned critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31.

    For the purpose of this paragraph, material changes regarding the critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31 relate to:

    1. the services provided by critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31;

    2. the activities performed by financial entitiesas defined in Article 2, points (a) to (t) supported by ICT servicesdigital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services of the critical ICT third-party service provideran ICT third-party service provider designated as critical in accordance with Article 31; or

    3. the list of critical ICT third-party service providersan ICT third-party service provider designated as critical in accordance with Article 31 at Union level referred in Article 31(9) or Regulation (EU) 2022/2554.

  3. The Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation shall identify the number of members of the joint examination team and its composition according to Article 3(1), and depending on the envisaged level of intensity of oversight activities to be performed in relation to all critical ICT third-party service providersan ICT third-party service provider designated as critical in accordance with Article 31.

  4. The authorities referred to in Article 40(2) of Regulation (EU) 2022/2554 shall nominate one or more individuals from their staff to be appointed as members of the joint examination team. An individual may be nominated and appointed as member of one or more joint examination teams.

  5. The Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation shall appoint the nominated individuals as members of the joint examination team either on a full-time or on a part-time basis depending on their availability, the specific needs of the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation, and the agreement between the nominating authority and the Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation.

  6. When nominating the members of the joint examination teams, the authorities shall assess their technical expertise, qualifications and skills in ICT and relevant areas, including communication and collaboration skills, as well as audit and supervision skills.

  7. The Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation may require the nominating authorities to modify their nominations only in justified circumstances and when the profiles of the nominated individuals do not match the profile of the resources needed.

  8. The Lead Overseerthe European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation and the authorities shall take all appropriate and possible measures to ensure the joint examination team is staffed adequately in accordance with the annual individual oversight plan.