+4. Guidelines on the sound management of third-party risks
---+Title I – Proportionality: group application and institutional protection schemes
------+1 Proportionality
---------+23. Financial entities and competent authorities should, when complying or supervising compliance …
---------+24. When applying the provisions set out in these Guidelines, financial entities should take into …
---------+25. When applying the principle of proportionality, financial entities ( ) and competent …
------+2 Management of third-party risks by financial entities within groups and institutions that are members of an institutional protection scheme
---------+26. In accordance with Article 109(2) of Directive 2013/36/EU, these Guidelines should also apply …
---------+27. Where applicable, financial entities, in accordance with paragraph 26, and institutions that …
---------+28. In addition to paragraph 27, financial entities within a group for which no waivers have been …
---------+29. Where waivers have been granted pursuant to Article 21 of Directive 2013/36/EU or Article …
---------+30. Financial entities that are subsidiaries of an EU parent undertaking or of a parent undertaking …
---+Title II – Assessment of third-party arrangements
------+3 Sound management of third-party risk
---------+31. As part of the overall internal control framework including internal control mechanisms …
---------+32. Where an arrangement with a TPSP covers multiple functions, financial entities should consider …
---------+33. As a general principle, the following services are excluded from the scope of application of …
------+4 Critical or important functions
---------+34. Financial entities should always consider a function as critical or important in the following …
---------+35. When relying on a TPSP for operational tasks of internal control functions, financial entities …
---------+36. When financial entities intend to use TPSPs for the provision of functions of banking …
---------+37. In the case of financial entities that are subject to Directive 2014/59/EU ( ), particular …
---+Title III – Governance framework
------+5 Sound governance arrangements and third-party risk
---------+38. The management body of financial entities should define, approve and regularly review a …
---------+39. The overall internal control framework, including the risk management framework, should enable …
---------+40. Taking into account the application of the principle of proportionality as referred to in Title …
---------+41. The use of TPSPs for the provision of services to support functions cannot result in the …
---------+42. The management body is at all times fully responsible and accountable for at least: a. ensuring …
---------+43. The use of TPSPs should not lower the suitability requirements applied to the members of the …
---------+44. Financial entities should: a. clearly assign the responsibilities for the documentation …
---------+45. Financial entities should maintain at all times sufficient substance and not become ‘ empty …
---------+46. When using a TPSP, financial entities should at least ensure that: a. they can take and …
------+6 Policy on the contractual arrangement regarding the use of non-ICT services supporting critical or important functions provided by TPSP
---------+47. The management body of a financial entity that has third-party arrangements in place or plans …
---------+48. The policy should include the main phases of the life cycle for the adoption and use of …
---------+49. The policy may be merged with the policy foreseen under Article 28(10) of DORA ( ). However, it …
---------+50. Financial entities should ensure that the policy covers the identification of potential impact …
------+7 Conflicts of interests
---------+51. Financial entities ( ) should identify, assess, and manage conflicts of interests with regard …
---------+52. Where third-party arrangements create material conflicts of interest, including between …
---------+53. When services supporting critical or important functions are provided by a TPSP that is part of …
------+8 Business continuity plans
---------+54. Financial entities ( ) should have in place, maintain, and periodically test appropriate …
---------+55. Business continuity plans should take into account the possible event of a failure or …
------+9 Internal audit function
---------+56. The activities of the internal audit function ( ), where established, or the internal audit …
---------+57. Financial entities should establish a formal follow-up process regarding internal audit …
------+10 Documentation requirements
---------+58. As part of their risk management framework, financial entities should maintain an updated …
---------+59. Financial entities should also maintain the documentation of ended third-party arrangements …
---------+60. Taking into account the application of proportionality as referred to in Title I of the …
---------+61. Taking into account the application of proportionality under Title I of the Guidelines, the …
---------+62. For third-party arrangements supporting critical or important functions, the register should …
---------+63. Financial entities should, upon request, make available to the competent authority either the …
---------+64. Financial entities should, upon request, make available to the competent authority all …
---------+65. Financial entities, including payment institutions for the purpose of complying with Article …
---------+66. Financial entities should inform competent authorities in a timely manner of material changes …
---------+67. Financial entities should appropriately document the assessments made under Title IV and the …
------+Title IV – Third-party arrangement process
------+11 Pre-contractual analysis
---------+68. Before entering into any third-party arrangement, financial entities should: a. assess whether …
------+11.1 Supervisory conditions for contracting with third-party service providers
---------+69. Financial entities should ensure that the use of TPSPs to provide functions of banking …
---------+70. Without prejudice of the requirements established under Article 32 of the Commission Delegated …
------+11.2 Risk assessment of third-party arrangements
---------+71. Financial entities should consider, on a risk-based approach, the potential impact of …
---------+72. Financial entities should consider: a. the potential impact of a third-party arrangement on …
---------+73. The risk assessment should include, where appropriate or relevant, scenarios of possible risk …
---------+74. Within the risk assessment, financial entities should also consider the expected benefits and …
---------+75. Where a third-party arrangement supporting critical or important functions includes the …
---------+76. When carrying out the risk assessment prior to the conclusion of the third-party arrangement …
------+11.3 Due diligence
---------+77. Before entering into third-party arrangements and considering all the relevant risks related to …
---------+78. Factors to be considered when conducting due diligence on a potential TPSP include, but are not …
---------+79. With regard to critical and important functions ( ), financial entities should ensure that the …
---------+80. The planned usage of subcontractors to perform services supporting critical or important …
---------+81. Where the use of a TPSP involves the processing of personal or confidential data, financial …
---------+82. Financial entities should take appropriate steps to ensure that TPSPs act in a manner …
------+12 Contractual phase
---------+83. The rights and obligations of the financial entity and the TPSP should be clearly allocated and …
---------+84. The contractual arrangement should include at least the following elements: a. a clear and …
---------+85. In addition to the elements referred to in paragraph 84, the third-party arrangement supporting …
---------+86. Without prejudice to the requirements set out under Regulation (EU) 2016/679, financial …
------+12.1 Subcontracting of critical or important functions
---------+87. The third-party arrangements on the use of services supporting critical or important function …
---------+88. If the subcontracting of services supporting critical or important functions or material parts …
---------+89. If the use of subcontractors supporting critical or important functions or material parts …
---------+90. The written agreement between the financial entities and the TPSPs should specify that the TPSP …
---------+91. The written agreement should include a reasonable notice period by which the financial entity …
---------+92. The TPSP should only enter into new subcontracting arrangements or implement material changes …
---------+93. Where the financial entity is of the opinion that the new subcontracting arrangement or the …
---------+94. Financial entities should ensure that the TPSP appropriately identifies all subcontractors and …
---------+95. The financial entity should ensure in the written agreement with the TPSP that the agreement …
------+12.2 Access, information and audit rights
---------+96. Financial entities should ensure through the written contractual arrangement that the internal …
---------+97. Regardless of the criticality or importance of the function performed by TPSPs, the written …
---------+98. With regard to contractual arrangements supporting critical or important functions, financial …
---------+99. For services not supporting critical or important functions provided by TPSPs, financial …
---------+100. Financial entities should ensure that the contractual arrangement does not impede or limit the …
---------+101. Financial entities should exercise their access and audit rights, determine the audit …
---------+102. Without prejudice to their final responsibility regarding third-party arrangements, financial …
---------+103. For services supporting critical or important functions provided by TPSPs financial entities …
---------+104. Financial entities should make use of the method referred to in paragraph 102(b) only if they …
---------+105. Before a planned onsite visit, financial entities, competent authorities, and auditors or …
---------+106. When performing audits in multi-client environments, care should be taken to ensure that risks …
---------+107. Where the third-party arrangement carries a high level of complexity, the financial entity …
------+12.3 Termination rights
---------+108. The financial entity should be able to terminate the third-party arrangements, in accordance …
---------+109. The third-party arrangement should facilitate the transfer of the services supporting a …
------+13 Monitoring
---------+110. Following a risk-based approach, financial entities should monitor the performance of the …
---------+111. Financial entities should monitor and manage their internal concentration risks caused by …
---------+112. Financial entities should ensure, on an ongoing basis, that third-party arrangements …
---------+113. Financial entities should take appropriate measures if they identify actual or potential …
------+14 Exit strategies regarding third-party arrangement supporting critical or important functions
---------+114. Financial entities should have a documented exit strategy when services supporting critical or …
---------+115. Financial entities should ensure that they are able to exit third-party arrangements …
---------+116. When developing exit strategies for third-party arrangements supporting critical or important …
------+Title V – Guidelines on third-party arrangements risks addressed to competent authorities
---------+117. When establishing appropriate methods to monitor financial entities ’ compliance with the …
---------+118. Competent authorities should be satisfied that they can effectively supervise financial …
---------+119. The analysis of financial entities’ third-party risk should be performed at least within the …
---------+120. Further to the information recorded within the register, as referred to in Section 10 …
---------+121. In addition to the information required under Section 10, competent authorities may require …
---------+122. Competent authorities should assess the following on a risk-based approach: a. whether …
---------+123. Competent authorities should ensure that EU/EEA financial entities are not operating as an …
---------+124. Within their assessment, competent authorities should take into account all risks, in …
---------+125. Where concentration risks are identified, competent authorities should monitor the development …
---------+126. Where concerns are identified that lead to the conclusion that a financial entity no longer …
---------+127. Competent authorities should be satisfied that they are able to perform effective supervision …
---------+128. Competent authorities should closely cooperate among themselves and should, in a timely …

4. Guidelines on the sound management of third-party risks

4. Guidelines on the sound management of third-party risks

1. Übersicht

,
Title I – Proportionality: group application and institutional protection schemes

Title I – Proportionality: group application and institutional protection schemes
Title II – Assessment of third-party arrangements

Title II – Assessment of third-party arrangements
Title III – Governance framework

Title III – Governance framework

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Standards

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Standards

Standards
  • EBA - Published by the European Banking Authority at https://www.eba.europa.eu/