3 Sound management of third-party risk

As part of the overall internal control framework including internal control mechanisms, financial entities should have a holistic risk management framework extending across all business lines and internal units. Under that framework, financial entities should establish whether an arrangement with a TPSP falls under the definition of third-party arrangement provided in these Guidelines. Under this assessment, consideration should be given to:

• a. determine whether the services they rely or plan to rely on are non-ICT services;
• b. whether the TPSP is providing non-ICT services supporting a function at least on a recurrent or ongoing basis; and
• c. whether the function under b) is critical or important.

Where an arrangement with a TPSP covers multiple functions, financial entities should consider all aspects of the arrangement within their assessment, e.g. if the third-party service provided includes the provision of operational task of risk management and prudential reporting both aspects should be considered together. In case where for the provision of a non-ICT service, the arrangement with a third-party service provider also implies the use of ICT services as defined under Article 3(21) of DORA, it belongs to the financial entity to determine whether the use of an ICT service is material for the provision of the services under the third-party arrangement and thus triggers the application of DORA framework (⁴⁰ ).

⁴⁰ See also ESAs Q&A30.

As a general principle, the following services are excluded from the scope of application of these Guidelines (⁴¹ ):

• a. a service that is legally required to be performed by a TPSP (e.g. statutory audit);
• b. a regulated financial service that is legally required to be performed by another financial entity regulated under Union law including by financial entities not in the scope of these guidelines but regulated under financial services Union law (e.g. custody and safekeeping services, trading venues including regulated market, multilateral trading facilities… );
• c. market information services;
• d. financial services transactions between financial institutions as counterparties (e.g. inter-bank lending); financial transaction with central banks (e.g. deposit and lending facilities);
• e. Payment network infrastructures (e.g. Visa, MasterCard, European payment initiatives, WERO, GIE CB);
• f. clearing and settlement arrangements between clearing houses, central counterparties and settlement institutions and their members;
• a. global financial messaging infrastructures that are subject to oversight by relevant authorities (e.g. SWIFT);
• b. correspondent banking services;
• c. the acquisition of services that do not have material impact on the financ ial entities’ risks exposures or on their operational resilience (e.g. advice from an architect, printing services, providing legal opinion including on tax , and representation in front of the court and administrative bodies, public relation consulting, cleaning, gardening and maintenance of the institution ’s or payment institution ’ s premises, medical services, servicing of company cars, catering, canteen, cafeteria, vending machine services, clerical services, travel services, post-room services, receptionists, secretaries and switchboard operators); the acquisition of goods (e.g. plastic cards, card readers, office supplies, personal computers, furniture … ) or the acquisition of utilities (e.g. electricity, gas, water, telephone services).

⁴¹ These exclusions are not intended to imply that financial entities should not take appropriate steps to manage risk of these arrangements.