Source: OJ L, 2025/532, 2.7.2025Current language: EN
- Digital operational resilience in the financial sector
ICT third-party service providers
- RTS on subcontracting ICT services
Article 1 Overall risk profile and complexity
Summary What does Article 1 of the RTS on subcontracting ICT services say?
This opening article establishes the foundational principle that financial entities must take their own size, risk profile, and operational complexity into account when applying the rules of this regulation.
It then sets out an extensive list of factors to be considered, all centred on the subcontracting arrangements of ICT third-party service providers.
The factors span the nature of the subcontracted services, geographic location of subcontractors, the depth of the subcontracting chain, data sharing, supervisory status of subcontractors, concentration risks, and the potential impact of disruptions.
This article effectively sets the parameters for how financial entities should calibrate their approach to ICT subcontracting risk throughout the rest of the regulation.
Important points:
- Take into account your own size, risk profile, and operational complexity when assessing ICT subcontracting arrangements supporting critical or important functions.
- The factors to consider extend deep into the supply chain, covering the location, regulatory status, and concentration of subcontractors, including those in third countries.
- Assess whether subcontracting arrangements could affect the transferability of ICT services or the continuity of critical or important functions in the event of a disruption.
Springlex's summary of the article, a reading aid, not a substitute for the legal text.
Financial entities shall take into account their size and their overall risk profile and the nature, scale, and elements of increased or reduced complexity of their services, activities and operations, including elements relating to:
the type of ICT services that support critical or important functions covered by the contractual arrangement between the financial entity and the ICT third-party service provider;
the type of ICT services covered by the contractual arrangement between the ICT-third party service provider and its subcontractors;
the location of the ICT subcontractor providing ICT services that support critical or important functions or a material part thereof, or of its parent company;
the length and complexity of the chain of subcontractors providing ICT services that support critical or important functions or material parts thereof used by the ICT third-party service provider;
the nature of the data shared with the ICT subcontractors providing ICT services that support critical or important functions or material parts thereof;
whether the ICT services that support critical or important functions or material parts thereof are provided by subcontractors, located within a Member State or in a third country, including the location where the ICT services are actually provided from and the location where the data are actually processed and stored;
whether the ICT subcontractors providing ICT services that support critical or important functions or material parts thereof are part of the same group as the financial entity to which those services are provided;
whether the ICT subcontractors providing ICT services that support critical or important functions or material parts thereof are authorised, registered or subject to supervision or oversight by a competent authority in a Member State, or are subject to the oversight framework under Chapter V, Section II, of Regulation (EU) 2022/2554;
whether the ICT third-party service providers that support critical or important functions or material parts thereof are authorised, registered or subject to supervision or oversight by a supervisory authority from a third country;
whether the provision of ICT services supporting critical or important functions or material parts thereof is concentrated to a single subcontractor of an ICT third-party service provider or a small number of such subcontractors;
whether the subcontracting of ICT services that support critical or important functions or material parts would impact the transferability of those ICT services to another ICT third-party service provider;
the potential impact of disruptions on the continuity and availability of the ICT services that support critical or important functions or material parts thereof provided by the ICT third-party service provider when using a subcontractor providing ICT services that support critical or important functions or material parts thereof.
Relevant recitals
Recital 1 Importance of indentifying the overall chain of subcontractors
The provision of ICT services to financial entities often depends on a complex chain of ICT subcontractors, whereby ICT third-party service providers may enter into one or more subcontracting arrangements with other ICT third-party service providers. Indirect reliance on ICT subcontractors may have an impact on a financial entity’ ability to identify, assess, and manage its risks, including risks that are related to gaps in the information provided by ICT third-party service providers, and to the limited ability of a financial entity to obtain information from those ICT subcontractors that provide ICT services that support critical or important functions or material parts thereof. In that regard, where the provision of ICT services to financial entities depends on a potentially long or complex chain of ICT subcontractors, it is essential that financial entities identify the overall chain of subcontractors providing ICT services supporting critical or important functions.
Recital 2 Focus on subcontractors that effectively underpin ICT services
Among those subcontractors that provide ICT services that support critical or important functions, financial entities should focus in particular and continuously on those subcontractors that effectively underpin the ICT service that supports critical or important functions, including all the subcontractors that provide ICT services the disruption of which would impair the security or continuity of the service as laid down in the register of information referred to in Article 28(3) of Regulation (EU) 2022/2554.
Recital 3 Principle of proportionality
Financial entities vary widely in size, structure, internal organisation, and in the nature and complexity of their activities. To ensure proportionality, that diversity should be taken into account when specifying which elements a financial entity should determine and assess when subcontracting ICT services that support critical or important functions.
Recital 4 Clear and holistic view of risks associated with subcontracting
When permitted by the financial entities in accordance with Article 30(2) of Regulation (EU) 2022/2554, the use of subcontracted ICT services supporting critical or important functions by ICT third-party services providers cannot reduce the ultimate responsibility for the management bodies of the financial entities to manage their risks and to comply with their legislative and regulatory obligations. Where subcontracting ICT services supporting critical or important functions is permitted, it is important that financial entities have a clear and holistic view of the risks associated with subcontracting services that support critical or important functions so that they are able to monitor, manage and mitigate those risks. They should therefore assess those risks before subcontracting those services.
Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.
Definition
ICT third-party service provider
Definition
management body
Definition
group
Definition
ICT services
Definition
critical or important function