Art. 4 Amendments to Directive 2013/36/EU | DORA directive |

Directive 2013/36/EU is amended as follows:

in Article 65(3), point (a)(vi) is replaced by the following:
third parties to whom the entities means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; referred to in points (i) to (iv) have outsourced functions or activities, including ICT third-party service providers means an undertaking providing ICT services; referred to in Chapter V of Regulation (EU) 2022/2554 of the European Parliament and of the Council (¹⁸)Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L333, 27.12.2022, p.1).’;;
in Article 74(1), the first subparagraph is replaced by the following:
‘Institutions shall have robust governance arrangements, which include a clear organisational structure with well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; they are or might be exposed to, adequate internal control mechanisms, including sound administration and accounting procedures, network and information systems means: any device or group of interconnected or related devices, one or more of which, pursuant to a programme, carry out automatic processing of digital data; or digital data stored, processed, retrieved or transmitted by elements covered under points (a) and (b) for the purposes of their operation, use, protection and maintenance; an electronic communications network as defined in Article 2, point (1), of Directive (EU) 2018/1972; that are set up and managed in accordance with Regulation (EU) 2022/2554, and remuneration policies and practices that are consistent with and promote sound and effective risk means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; management.’;
in Article 85, paragraph 2 is replaced by the following:
Competent authoritiesas defined in Article 46 shall ensure that institutions have adequate contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans for the technology they use for the communication of information, and that those plans are established, managed and tested in accordance with Article 11 of Regulation (EU) 2022/2554, in order to allow institutions to keep operating in the event of severe business disruption and limit losses incurred as a consequence of such disruption.’;
in Article 97(1), the following point is added:
risks means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; revealed by digital operational resilience testingas defined in Article 24 in accordance with Chapter IV of Regulation (EU) 2022/2554.’.