Digital operational resilience for the financial sector

KEY POINTS

Scope

The regulation covers:

• credit, payment, electronic money and occupational pension institutions;
• service providers for account information, crypto assets, data reporting, crowdfunding and ICT third parties;
• investment firms, alternative investment funds, management companies, credit rating agencies and administrators of critical benchmarks;
• trade and securitisation repositories, central securities depositories, central counterparties and trading venues;
• insurance, insurance intermediaries and reinsurance businesses.

ICT risk management

Financial entities, other than microenterprises, must:

• have in place internal governance and control measures that ensure effective and prudent management of ICT risk;
• ensure that their management body defines, approves, oversees and is responsible for all the relevant arrangements;
• have in place a sound, comprehensive and well-documented ICT risk management framework with the necessary strategies, policies, procedures, protocols and tools to respond quickly and efficiently;
• use and maintain updated ICT systems, protocols and tools that are appropriate, reliable and technologically resilient, and that have sufficient capacity;
• identify, classify and adequately document all ICT-supported business functions, roles and responsibilities, and review risk scenarios;
• continuously monitor the security and operation of ICT systems and tools to minimise the impact of any ICT risk;
• promptly detect anomalies and identify potential failure points;
• put in place a comprehensive ICT business continuity policy with appropriate plans, procedures and mechanisms;
• develop and document backup policies and restoration and recovery procedures;
• deploy resources and staff to assess vulnerabilities, cyber threats and ICT-related incidents, especially cyberattacks, and analyse their potential impact on the entity’s digital operational resilience;
• devise crisis communication plans to disclose at least major ICT-related incidents or vulnerabilities to clients, counterparts and the public.

ICT-related management, classification and reporting

Financial entities must:

• define, establish and implement measures to detect, manage, record and notify ICT-related incidents;
• classify incidents and determine their impact using criteria such as number of clients and counterparts affected, duration, geographical spread and data losses;
• report major ICT-related incidents to their designated competent authority, which forwards it to a higher body such as the European Central Bank or the European Banking Authority.

Digital operational resilience testing

Financial entities, other than microenterprises, must:

• establish, maintain and review a sound and comprehensive digital operational testing programme equipped with the necessary assessments, tests, methodologies, practices and tools;
• carry out, at least every three years, threat-level penetration testing based on their risk profile and taking account of operational circumstances, and only use testers that are certified, possess the necessary expertise and suitability and have professional indemnity insurance.

Managing ICT third-party risk

Financial entities must:

• manage third-party risk as an integral component of their overall ICT risk;
• have in place contractual arrangements for ICT services to run their business operations in full compliance with the relevant legislation;
• take account of the nature, scale, complexity and importance of ICT-related dependencies and any potential risks;
• weigh the benefits and costs of alternative solutions when identifying and assessing any risks involved;
• include in the contract each party’s rights and obligations and the service agreement.

Oversight framework of critical ICT third-party service providers

The framework:

• entrusts the European Supervisory Authorities (ESAs) to:
• • designate, on the basis of clear criteria, the ICT third-party service providers considered to be critical for financial entities,
  • appoint, as lead overseer for each critical third-party service provider, the ESA responsible for the financial entity concerned;
• establishes an Oversight Forum to:
• • discuss relevant developments on ICT risk and vulnerabilities and promote a consistent EU monitoring approach,
  • assess oversight activities annually, promote moves to increase digital operational resilience and foster best practices,
  • submit comprehensive benchmarks for critical ICT third-party service providers;
• mandates the lead overseer to:
• • be the primary contact point for critical ICT third-party service providers,
  • assess whether each critical provider has comprehensive, sound and effective rules, procedures, mechanisms and arrangements in place,
  • request all relevant information and documentation, conduct investigations and inspections (including in non-EU countries), specify remedial action and issue recommendations;
• enables the European Banking Authority, the European Insurance and Occupational Pensions Authority and the European Securities and Markets Authority to work with non-EU regulatory and supervisory authorities on ICT third-party risk;
• requires ESAs to submit a confidential report every five years to the European Parliament, the Council of the European Union and the European Commission on their dealings with non-EU authorities.

Criteria for designating critical providers

Under Delegated Regulation (EU) 2024/1502, ICT third-party service providers may be designated as critical and brought under the direct oversight of the ESAs following a two-step assessment.

• Step 1 – quantitative criteria

The provider must meet measurable thresholds, such as:

• the number of financial entities, or the share of their total assets, that depend on the provider’s services;
• whether it serves systemic institutions (global systemically important institutions (G-SIIs) or other systemically important institutions (O-SIIs));
• whether its services can be replaced, or whether switching to another provider would be difficult or costly.

• Step 2 – qualitative criteria

Providers that satisfy step 1 are then assessed against broader considerations, including:

• the potential systemic impact if their services were disrupted;
• the degree of interdependence among financial entities using the same provider;
• the criticality of the functions supported;
• reliance on common subcontractors.

A provider is designated as critical only when it fulfils the criteria under both steps.

Information-sharing arrangements

Financial entities may exchange among themselves cyber-threat information and intelligence, provided that this:

• aims to strengthen their digital operational resilience;
• occurs within their trusted communities;
• protects business confidentiality and personal data, and respects competition policy rules.

Penalties and remedial measures

Competent authorities:

• have all the supervisory, investigatory and sanctioning powers needed to carry out their duties;
• impose, and publish on their websites, the administrative penalties and remedial measures determined by national law.

ESAs draft regulatory technical standards for ICT risk management tools, classification and reporting of ICT-related incidents and conduct of oversight activities.

The Commission:

• has the power to adopt delegated acts;
• will submit, by 17 January 2028, a review of the regulation, after consulting the ESAs and the European Systemic Risk Board, to the Parliament and the Council.

The regulation amends Regulation (EC) No 1060/2009, Regulations (EU) Nos 648/2012, 909/2014 and 600/2014 and Regulation (EU) 2016/1011.