EUR-Lex Access to European Union law
This document is an excerpt from the EUR-Lex website
Document 32022L2556
Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital operational resilience for the financial sector (Text with EEA relevance)
Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital operational resilience for the financial sector (Text with EEA relevance)
Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital operational resilience for the financial sector (Text with EEA relevance)
PE/42/2022/REV/1
OJ L 333, 27.12.2022, p. 153–163
(BG, ES, CS, DA, DE, ET, EL, EN, FR, GA, HR, IT, LV, LT, HU, MT, NL, PL, PT, RO, SK, SL, FI, SV)
In force
Relation | Act | Comment | Subdivision concerned | From | To |
---|---|---|---|---|---|
Modifies | 32009L0065 | Replacement | article 12 paragraph 1 unnumbered paragraph 2 point (a) | 16/01/2023 | |
Modifies | 32009L0065 | Replacement | article 12 paragraph 3 | 16/01/2023 | |
Modifies | 32009L0138 | Replacement | article 41 paragraph 4 | 16/01/2023 | |
Modifies | 32009L0138 | Replacement | article 50 paragraph 1 point (a) | 16/01/2023 | |
Modifies | 32009L0138 | Replacement | article 50 paragraph 1 point (b) | 16/01/2023 | |
Modifies | 32011L0061 | Replacement | article 18 | 16/01/2023 | |
Modifies | 32013L0036 | Addition | article 97 paragraph 1 point (d) | 16/01/2023 | |
Modifies | 32013L0036 | Replacement | article 65 paragraph 3 point (a) point (vi) | 16/01/2023 | |
Modifies | 32013L0036 | Replacement | article 74 paragraph 1 unnumbered paragraph 1 | 16/01/2023 | |
Modifies | 32013L0036 | Replacement | article 85 paragraph 2 | 16/01/2023 | |
Modifies | 32014L0059 | Addition | annex section B point 14a | 16/01/2023 | |
Modifies | 32014L0059 | Addition | annex section C point 4a | 16/01/2023 | |
Modifies | 32014L0059 | Addition | article 9 unnumbered paragraph | 16/01/2023 | |
Modifies | 32014L0059 | Replacement | annex section A point 16 | 16/01/2023 | |
Modifies | 32014L0059 | Replacement | annex section B point 14 | 16/01/2023 | |
Modifies | 32014L0059 | Replacement | annex section C point 4 | 16/01/2023 | |
Modifies | 32014L0059 | Replacement | article 10 paragraph 7 point (c) | 16/01/2023 | |
Modifies | 32014L0059 | Replacement | article 10 paragraph 7 point (q) | 16/01/2023 | |
Modifies | 32014L0065 | Deletion | article 47 paragraph 1 point (c) | 16/01/2023 | |
Modifies | 32014L0065 | Replacement | article 16 paragraph 4 | 16/01/2023 | |
Modifies | 32014L0065 | Replacement | article 16 paragraph 5 unnumbered paragraph 2 | 16/01/2023 | |
Modifies | 32014L0065 | Replacement | article 16 paragraph 5 unnumbered paragraph 3 | 16/01/2023 | |
Modifies | 32014L0065 | Replacement | article 17 paragraph 1 | 16/01/2023 | |
Modifies | 32014L0065 | Replacement | article 17 paragraph 7 point (a) | 16/01/2023 | |
Modifies | 32014L0065 | Replacement | article 47 paragraph 1 point (b) | 16/01/2023 | |
Modifies | 32014L0065 | Replacement | article 48 paragraph 1 | 16/01/2023 | |
Modifies | 32014L0065 | Replacement | article 48 paragraph 12 point (a) | 16/01/2023 | |
Modifies | 32014L0065 | Replacement | article 48 paragraph 12 point (g) | 16/01/2023 | |
Modifies | 32014L0065 | Replacement | article 48 paragraph 6 | 16/01/2023 | |
Modifies | 32015L2366 | Addition | article 95 paragraph 1 unnumbered paragraph | 16/01/2023 | |
Modifies | 32015L2366 | Addition | article 96 paragraph 7 | 16/01/2023 | |
Modifies | 32015L2366 | Replacement | article 19 paragraph 6 unnumbered paragraph 2 | 16/01/2023 | |
Modifies | 32015L2366 | Replacement | article 3 point (j) | 16/01/2023 | |
Modifies | 32015L2366 | Replacement | article 5 paragraph 1 unnumbered paragraph 1 point (e) | 16/01/2023 | |
Modifies | 32015L2366 | Replacement | article 5 paragraph 1 unnumbered paragraph 1 point (f) | 16/01/2023 | |
Modifies | 32015L2366 | Replacement | article 5 paragraph 1 unnumbered paragraph 1 point (h) | 16/01/2023 | |
Modifies | 32015L2366 | Replacement | article 5 paragraph 1 unnumbered paragraph 3 | 16/01/2023 | |
Modifies | 32015L2366 | Replacement | article 98 paragraph 5 | 16/01/2023 | |
Modifies | 32016L2341 | Replacement | article 21 paragraph 5 | 16/01/2023 |
27.12.2022 |
EN |
Official Journal of the European Union |
L 333/153 |
DIRECTIVE (EU) 2022/2556 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
of 14 December 2022
amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital operational resilience for the financial sector
(Text with EEA relevance)
THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 53(1) and 114 thereof,
Having regard to the proposal from the European Commission,
After transmission of the draft legislative act to the national parliaments,
Having regard to the opinion of the European Central Bank (1),
Having regard to the opinion of the European Economic and Social Committee (2),
Acting in accordance with the ordinary legislative procedure (3),
Whereas:
(1) |
The Union needs to adequately and comprehensively address digital risks to all financial entities stemming from an increased use of information and communication technology (ICT) in the provision and consumption of financial services, thereby contributing to the realisation of the potential of digital finance, in terms of boosting innovation and promoting competition in a secure digital environment. |
(2) |
Financial entities are heavily reliant on the use of digital technologies in their daily business. It is therefore of utmost importance to ensure the operational resilience of their digital operations against ICT risk. This need has become even more pressing due to the growth of breakthrough technologies in the market, in particular technologies enabling digital representations of value or of rights to be transferred and stored electronically, using distributed ledger or similar technology (crypto-assets), and of services related to those assets. |
(3) |
At Union level, the requirements related to the management of ICT risk in the financial sector are currently provided for in Directives 2009/65/EC (4), 2009/138/EC (5), 2011/61/EU (6), 2013/36/EU (7), 2014/59/EU (8), 2014/65/EU (9), (EU) 2015/2366 (10) and (EU) 2016/2341 (11) of the European Parliament and of the Council. Those requirements are diverse and occasionally incomplete. In some cases, ICT risk has been addressed only implicitly as part of operational risk, and in other cases it has not been addressed at all. Those issues are remedied by the adoption of Regulation (EU) 2022/2554 of the European Parliament and of the Council (12). Those Directives should therefore be amended to ensure consistency with that Regulation. This Directive enacts a set of amendments that are necessary to bring legal clarity and consistency in relation to the application, by financial entities authorised and supervised in accordance with those Directives, of various digital operational resilience requirements that are necessary in the pursuit of their activities and in the provision of services, thereby guaranteeing the smooth functioning of the internal market. It is necessary to ensure the adequacy of those requirements in relation to market developments, while encouraging proportionality in particular with regard to the size of financial entities and the specific regimes to which they are subject, with the aim of reducing compliance costs. |
(4) |
In the area of banking services, Directive 2013/36/EU currently sets out only general internal governance rules and operational risk provisions containing requirements for contingency and business continuity plans which implicitly serve as a basis for addressing ICT risk. However, in order to address ICT risk explicitly and clearly, the requirements for contingency and business continuity plans should be amended to also include business continuity plans and response and recovery plans concerning ICT risk, in accordance with the requirements laid down in Regulation (EU) 2022/2554. Furthermore, ICT risk is only implicitly included, as part of operational risk, in the supervisory review and evaluation process (SREP) performed by competent authorities and the criteria for its assessment are currently defined in the Guidelines on ICT Risk Assessment under the Supervisory Review and Evaluation process (SREP), issued by the European Supervisory Authority (European Banking Authority) (EBA), established by Regulation (EU) No 1093/2010 of the European Parliament and of the Council (13). In order to provide legal clarity and ensure that bank supervisors effectively identify ICT risk, and monitor its management by financial entities, in line with the new framework on digital operational resilience, the scope of the SREP should also be amended to explicitly refer to the requirements laid down in Regulation (EU) 2022/2554 and to cover in particular the risks revealed by major ICT-related incident reports and by the results of the digital operational resilience testing performed by financial entities in accordance with that Regulation. |
(5) |
Digital operational resilience is essential to preserve the critical functions and core business lines of a financial entity in the event of its resolution, and thereby to avoid disruption to the real economy and to the financial system. Major operational incidents can hamper the capacity of a financial entity to continue operating and can jeopardise resolution objectives. Certain contractual arrangements on the use of ICT services are essential to ensure operational continuity and to provide the necessary data in the event of resolution. In order to be aligned with the objectives of the Union framework for operational resilience, Directive 2014/59/EU should be amended accordingly, with a view to ensuring that information relating to operational resilience is taken into account in the context of resolution planning and the assessment of financial entities’ resolvability. |
(6) |
Directive 2014/65/EU sets out more stringent ICT risk rules for investment firms and trading venues that are engaging in algorithmic trading. Less detailed requirements apply to data reporting services and to trade repositories. Also, Directive 2014/65/EU contains only limited references to control and safeguard arrangements for information processing systems and to the use of appropriate systems, resources and procedures to ensure continuity and regularity of business services. Furthermore, that Directive should be aligned with Regulation (EU) 2022/2554 as regards continuity and regularity in the provision of investment services and in the performance of investment activities, operational resilience, the capacity of trading systems, and the effectiveness of business continuity arrangements and risk management. |
(7) |
Directive (EU) 2015/2366 sets out specific rules on ICT security controls and mitigation elements for the purposes of obtaining an authorisation to provide payment services. Those authorisation rules should be amended to align them with Regulation (EU) 2022/2554. Furthermore, in order to reduce the administrative burden and to avoid complexity and duplicative reporting requirements, the incident reporting rules in that Directive should cease to apply to payment service providers which are regulated under that Directive and also subject to Regulation (EU) 2022/2554, thus allowing those payment service providers to benefit from a single, fully harmonised incident reporting mechanism with regard to all operational or security payment-related incidents, irrespective of whether such incidents are ICT-related. |
(8) |
Directives 2009/138/EC and (EU) 2016/2341 partially capture ICT risk within their general provisions on governance and risk management, leaving certain requirements to be specified through delegated acts with or without specific references to ICT risk. Similarly, only very general rules apply to managers of alternative investment funds subject to Directive 2011/61/EU and management companies subject to Directive 2009/65/EC. Those Directives should therefore be aligned with the requirements laid down in Regulation (EU) 2022/2554 with regard to the management of ICT systems and tools. |
(9) |
In many cases, further ICT risk requirements have already been laid down in delegated and implementing acts, adopted on the basis of draft regulatory technical standards and draft implementing technical standards developed by the competent European Supervisory Authority. Since the provisions of Regulation (EU) 2022/2554 henceforth constitute the legal framework for ICT risk in the financial sector, certain empowerments to adopt delegated and implementing acts in Directives 2009/65/EC, 2009/138/EC, 2011/61/EU and 2014/65/EU should be amended to remove the ICT risk provisions from the scope of those empowerments. |
(10) |
To ensure a consistent implementation of the new framework on digital operational resilience for the financial sector, Member States should apply the provisions of national law transposing this Directive from the date of application of Regulation (EU) 2022/2554. |
(11) |
Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 have been adopted on the basis of Article 53(1) or Article 114 of the Treaty on the Functioning of the European Union (TFEU) or both. The amendments in this Directive have been included in a single legislative act due to the interconnectedness of the subject matter and objectives of the amendments. Consequently, this Directive should be adopted on the basis of both Article 53(1) and Article 114 TFEU. |
(12) |
Since the objectives of this Directive cannot be sufficiently achieved by the Member States as they entail the harmonisation of requirements already contained in Directives but can rather, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve those objectives. |
(13) |
In accordance with the Joint Political Declaration of 28 September 2011 of Member States and the Commission on explanatory documents (14), Member States have undertaken to accompany, in justified cases, the notification of their transposition measures with one or more documents explaining the relationship between the components of a directive and the corresponding parts of national transposition instruments. With regard to this Directive, the legislator considers the transmission of such documents to be justified, |
HAVE ADOPTED THIS DIRECTIVE:
Article 1
Amendments to Directive 2009/65/EC
Article 12 of Directive 2009/65/EC is amended as follows:
(1) |
in the second subparagraph of paragraph 1, point (a) is replaced by the following:
(*1) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L333, 27.12.2022, p.1).’;" |
(2) |
paragraph 3 is replaced by the following: ‘3. Without prejudice to Article 116, the Commission shall adopt, by means of delegated acts in accordance with Article 112a, measures specifying:
|
Article 2
Amendments to Directive 2009/138/EC
Directive 2009/138/EC is amended as follows:
(1) |
in Article 41, paragraph 4 is replaced by the following: ‘4. Insurance and reinsurance undertakings shall take reasonable steps to ensure continuity and regularity in the performance of their activities, including the development of contingency plans. To that end, the undertakings shall employ appropriate and proportionate systems, resources and procedures, and shall, in particular, set up and manage network and information systems in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*2). (*2) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L333, 27.12.2022, p.1).’;" |
(2) |
in Article 50(1), points (a) and (b) are replaced by the following:
|
Article 3
Amendment to Directive 2011/61/EU
Article 18 of Directive 2011/61/EU is replaced by the following:
‘Article 18
General principles
1. Member States shall require that AIFMs use, at all times, adequate and appropriate human and technical resources that are necessary for the proper management of AIFs.
In particular, the competent authorities of the home Member State of the AIFM, having regard also to the nature of the AIFs managed by the AIFM, shall require that the AIFM has sound administrative and accounting procedures, control and safeguard arrangements for electronic data processing, including with regard to network and information systems that are set up and managed in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*3), as well as adequate internal control mechanisms, including, in particular, rules for personal transactions by its employees or for the holding or management of investments in order to invest on its own account and ensuring, at least, that each transaction involving the AIFs may be reconstructed according to its origin, the parties to it, its nature, and the time and place at which it was effected and that the assets of the AIFs managed by the AIFM are invested in accordance with the AIF rules or instruments of incorporation and the legal provisions in force.
2. The Commission shall, by means of delegated acts in accordance with Article 56 and subject to the conditions of Articles 57 and 58, adopt measures specifying the procedures and arrangements referred to in paragraph 1 of this Article, other than the procedures and arrangements concerning network and information systems.
Article 4
Amendments to Directive 2013/36/EU
Directive 2013/36/EU is amended as follows:
(1) |
in Article 65(3), point (a)(vi) is replaced by the following:
(*4) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L333, 27.12.2022, p.1).’;" |
(2) |
in Article 74(1), the first subparagraph is replaced by the following: ‘Institutions shall have robust governance arrangements, which include a clear organisational structure with well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks they are or might be exposed to, adequate internal control mechanisms, including sound administration and accounting procedures, network and information systems that are set up and managed in accordance with Regulation (EU) 2022/2554, and remuneration policies and practices that are consistent with and promote sound and effective risk management.’; |
(3) |
in Article 85, paragraph 2 is replaced by the following: ‘2. Competent authorities shall ensure that institutions have adequate contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans for the technology they use for the communication of information, and that those plans are established, managed and tested in accordance with Article 11 of Regulation (EU) 2022/2554, in order to allow institutions to keep operating in the event of severe business disruption and limit losses incurred as a consequence of such disruption.’; |
(4) |
in Article 97(1), the following point is added:
|
Article 5
Amendments to Directive 2014/59/EU
Directive 2014/59/EU is amended as follows:
(1) |
Article 10 is amended as follows:
|
(2) |
the Annex is amended as follows:
|
Article 6
Amendments to Directive 2014/65/EU
Directive 2014/65/EU is amended as follows:
(1) |
Article 16 is amended as follows:
|
(2) |
Article 17 is amended as follows:
|
(3) |
in Article 47, paragraph 1 is amended as follows:
|
(4) |
Article 48 is amended as follows:
|
Article 7
Amendments to Directive (EU) 2015/2366
Directive (EU) 2015/2366 is amended as follows:
(1) |
in Article 3, point (j) is replaced by the following:
|
(2) |
Article 5(1) is amended as follows:
|
(3) |
in Article 19(6), the second subparagraph is replaced by the following: ‘Outsourcing of important operational functions, including ICT systems, shall not be undertaken in such way as to impair materially the quality of the payment institution’s internal control and the ability of the competent authorities to monitor and retrace the payment institution’s compliance with all of the obligations laid down in this Directive.’; |
(4) |
in Article 95(1), the following subparagraph is added: ‘The first subparagraph is without prejudice to the application of Chapter II of Regulation (EU) 2022/2554 to:
|
(5) |
in Article 96, the following paragraph is added: ‘7. Members States shall ensure that paragraphs 1 to 5 of this Article do not apply to:
|
(6) |
in Article 98, paragraph 5 is replaced by the following: ‘5. In accordance with Article 10 of Regulation (EU) No 1093/2010, EBA shall review and, if appropriate, update the regulatory technical standards on a regular basis in order, inter alia, to take account of innovation and technological developments, and of the provisions of Chapter II of Regulation (EU) 2022/2554.’. |
Article 8
Amendment to Directive (EU) 2016/2341
Article 21(5) of Directive (EU) 2016/2341 is replaced by the following:
‘5. Member States shall ensure that IORPs take reasonable steps to ensure continuity and regularity in the performance of their activities, including the development of contingency plans. To that end, IORPs shall employ appropriate and proportionate systems, resources and procedures, and shall, in particular, set up and manage network and information systems in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*8), where applicable.
Article 9
Transposition
1. By 17 January 2025, Member States shall adopt and publish the measures necessary to comply with this Directive. They shall immediately inform the Commission thereof.
They shall apply those measures from 17 January 2025.
When Member States adopt those measures, they shall contain a reference to this Directive or shall be accompanied by such reference on the occasion of their official publication. The methods of making such reference shall be laid down by Member States.
2. Member States shall communicate to the Commission the text of the main measures of national law which they adopt in the field covered by this Directive.
Article 10
Entry into force
This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
Article 11
Addressees
This Directive is addressed to the Member States.
Done at Strasbourg, 14 December 2022.
For the European Parliament
The President
R. METSOLA
For the Council
The President
M. BEK
(1) OJ C 343, 26.8.2021, p. 1.
(2) OJ C 155, 30.4.2021, p. 38.
(3) Position of the European Parliament of 10 November 2022 (not yet published in the Official Journal) and decision of the Council of 28 November 2022.
(4) Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS) (OJ L 302, 17.11.2009, p. 32).
(5) Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (OJ L 335, 17.12.2009, p. 1).
(6) Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010 (OJ L 174, 1.7.2011, p. 1).
(7) Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).
(8) Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190).
(9) Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).
(10) Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35).
(11) Directive (EU) 2016/2341 of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (OJ L 354, 23.12.2016, p. 37).
(12) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (See page1 of this Official Journal).
(13) Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).