Article 2 Systemic impact of ICT third-party service providers on the stability, continuity or quality of the provision of financial services

This article operationalises the first of four criteria the ESAs must consider when assessing whether an ICT third-party service provider should be designated as critical, building directly on the two-step framework established in Article 1.

It sets out two quantitative step 1 sub-criteria — market share by number of financial entities served and by total asset value of those entities — along with precise calculation formulas for each.

A clear numerical threshold of 10% must be met for both measures across at least one category of financial entities before a provider clears the step 1 hurdle.

Only then do the ESAs proceed to the qualitative step 2 assessment, which looks at the severity of potential disruption and the provider's dependence on shared subcontractors.

Important points:

• The ESAs are required to apply a 10% threshold to both the number of financial entities served and the total asset value of those entities, and both must be met for at least one category of financial entities to pass step 1.
• The ESAs then assess two further qualitative sub-criteria at step 2: the impact intensity of a service discontinuation on financial entities, and the provider's reliance on common subcontractors for critical or important functions.
• All calculations and assessments are broken down by categories of financial entities as defined in Article 2(1) of Regulation (EU) 2022/2554, meaning a provider could be captured under one category but not another.