Article 44 International cooperation

This article deals with international cooperation on ICT third-party risk, sitting alongside the oversight framework for critical ICT third-party service providers established in Article 36.

It authorises EBA, ESMA, and EIOPA to enter into administrative arrangements with regulatory and supervisory authorities in third countries, with the goal of developing shared best practices around ICT risk management, controls, mitigation, and incident response.

The article also establishes a reporting obligation, requiring the ESAs to periodically consolidate and report back to the EU institutions on what those international discussions have revealed.

Important points:

• EBA, ESMA, and EIOPA may conclude administrative arrangements with third-country authorities to foster international cooperation on ICT third-party risk.
• The ESAs are required to submit a joint confidential report every five years to the European Parliament, the Council, and the Commission on the findings from those international discussions.
• The reporting must focus on the evolution of ICT third-party risk and its implications for financial stability, market integrity, investor protection, and the functioning of the internal market.