Source: OJ L, 2024/1502, 30.5.2024
EN- Digital operational resilience in the financial sector
Oversight framework
- Criteria for designating critical service providers
Article 3 Systemic character and importance of the ICT services provided to financial entities
When considering the criterion set out in Article 31(2), point (b), of Regulation (EU) 2022/2554, the ESAsEuropean Supervisory Authority shall assess whether the ICT third-party service provider means an undertaking providing ICT services; fulfils the following ‘step 1’ sub-criteria:
sub-criterion 2.1: number of global systemically important institutions (G-SIIs) and other systemically important institutions (O-SIIs) that are credit institutions means a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council (^32^); Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1). to which ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; are provided by the same ICT third-party service provider means an undertaking providing ICT services; where the ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; support critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;;
sub-criterion 2.2: number of financial entitiesas defined in Article 2, points (a) to (t), other than credit institutions means a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council (^32^); Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1). and G-SIIs and O-SIIs referred to in point (a) above, identified as systemic by competent authoritiesas defined in Article 46 referred to under Article 46 of Regulation (EU) 2022/2554 to which ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; are provided by the same ICT third-party service provider means an undertaking providing ICT services; where the ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; support critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;.
An ICT third-party service provider means an undertaking providing ICT services; shall be considered as having fulfilled the sub-criterion set out in paragraph 1, point (a), if the ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; it provides are used at least by either of the following:
one G-SII;
at least three O-SIIs;
at least one O-SII with an O-SII score above 3000 calculated in accordance with Article 131(3) of Directive 2013/36/EU of the European Parliament and of the Council (2)Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338, ELI: http://data.europa.eu/eli/dir/2013/36/oj)..
An ICT third-party service provider means an undertaking providing ICT services; shall be considered as having fulfilled the sub-criterion set out in paragraph 1, point (b), if the ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; that it provides are used at least by either of the following:
one financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; that is a financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; as referred to in Article 2(1), points (g), (h), (i) or (j) of Regulation (EU) 2022/2554 and which is identified as ‘systemic’ by competent authoritiesas defined in Article 46;
at least three financial entitiesas defined in Article 2, points (a) to (t), other than credit institutions means a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council (^32^); Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1). and than financial entitiesas defined in Article 2, points (a) to (t) referred to in Article 2(1), points (g), (h), (i) or (j) of Regulation (EU) 2022/2554 and which are identified as ‘systemic’ by competent authoritiesas defined in Article 46.
When considering the criterion set out in Article 31(2), point (b), of Regulation (EU) 2022/2554 and where the ICT third-party service provider means an undertaking providing ICT services; fulfils the ‘step 1’ sub-criteria referred to in paragraph 1 of this Article, the ESAsEuropean Supervisory Authority shall carry out their assessment in the light of the following ‘step 2’ sub-criterion:
sub-criterion 2.3: G-SIIs or O-SIIs and other financial entitiesas defined in Article 2, points (a) to (t) included in the assessment in the ‘step 1’ sub criteria referred to in paragraph 1 of this Article, including where those G-SIIs or O-SIIs provide financial infrastructure services to other financial entitiesas defined in Article 2, points (a) to (t), relying on an ICT service means an ICT service as defined in Article 2, point (13), of Regulation (EU) 2019/881; provided by the same ICT third-party service provider means an undertaking providing ICT services;, are interdependent.
Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.