Chapter VManaging of ICT third-party risk

Section I – Key principles for a sound management of ICT third-party risk

• Article 28General principles

  1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and…

• Article 29Preliminary assessment of ICT concentration risk at entity level

  1. When performing the identification and assessment of risks referred to in Article 28(4), point (c), financial entities shall also take into account whether the envisaged conclusion of…

• Article 30Key contractual provisions

  1. The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full contract…

Section II – Oversight Framework of critical ICT third-party service providers

• Article 31Designation of critical ICT third-party service providers

  1. The ESAs, through the Joint Committee and upon recommendation from the Oversight Forum established pursuant to Article 32(1), shall: (a) designate the ICT third-party service providers that…

• Article 32Structure of the Oversight Framework

  1. The Joint Committee, in accordance with Article 57(1) of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, shall establish the Oversight Forum as a…

• Article 33Tasks of the Lead Overseer

  1. The Lead Overseer, appointed in accordance with Article 31(1), point (b), shall conduct the oversight of the assigned critical ICT third-party service providers and shall be, for…

• Article 34Operational coordination between Lead Overseers

  1. To ensure a consistent approach to oversight activities and with a view to enabling coordinated general oversight strategies and cohesive operational approaches and work methodologies, the three…

• Article 35Powers of the Lead Overseer

  1. For the purposes of carrying out the duties laid down in this Section, the Lead Overseer shall have the following powers in respect of the critical ICT…

• Article 36Exercise of the powers of the Lead Overseer outside the Union

  1. When oversight objectives cannot be attained by means of interacting with the subsidiary set up for the purpose of Article 31(12), or by exercising oversight activities on…

• Article 37Request for information

  1. The Lead Overseer may, by simple request or by decision, require critical ICT third-party service providers to provide all information that is necessary for the Lead Overseer…

• Article 38General investigations

  1. In order to carry out its duties under this Regulation, the Lead Overseer, assisted by the joint examination team referred to in Article 40(1), may, where necessary,…

• Article 39Inspections

  1. In order to carry out its duties under this Regulation, the Lead Overseer, assisted by the joint examination teams referred to in Article 40(1), may enter in,…

• Article 40Ongoing oversight

  1. When conducting oversight activities, in particular general investigations or inspections, the Lead Overseer shall be assisted by a joint examination team established for each critical ICT third-party…

• Article 41Harmonisation of conditions enabling the conduct of the oversight activities

  1. The ESAs shall, through the Joint Committee, develop draft regulatory technical standards to specify: (a) the information to be provided by an ICT third-party service provider in…

• Article 42Follow-up by competent authorities

  1. Within 60 calendar days of the receipt of the recommendations issued by the Lead Overseer pursuant to Article 35(1), point (d), critical ICT third-party service providers shall…

• Article 43Oversight fees

  1. The Lead Overseer shall, in accordance with the delegated act referred to in paragraph 2 of this Article, charge critical ICT third-party service providers fees that fully…

• Article 44International cooperation

  1. Without prejudice to Article 36, EBA, ESMA and EIOPA may, in accordance with Article 33 of Regulations (EU) No 1093/2010, (EU) No 1095/2010 and (EU) No 1094/2010,…