+Title III – Governance framework
---+5 Sound governance arrangements and third-party risk
------+38. The management body of financial entities should define, approve and regularly review a …
------+39. The overall internal control framework, including the risk management framework, should enable …
------+40. Taking into account the application of the principle of proportionality as referred to in Title …
------+41. The use of TPSPs for the provision of services to support functions cannot result in the …
------+42. The management body is at all times fully responsible and accountable for at least: a. ensuring …
------+43. The use of TPSPs should not lower the suitability requirements applied to the members of the …
------+44. Financial entities should: a. clearly assign the responsibilities for the documentation …
------+45. Financial entities should maintain at all times sufficient substance and not become ‘ empty …
------+46. When using a TPSP, financial entities should at least ensure that: a. they can take and …
---+6 Policy on the contractual arrangement regarding the use of non-ICT services supporting critical or important functions provided by TPSP
------+47. The management body of a financial entity that has third-party arrangements in place or plans …
------+48. The policy should include the main phases of the life cycle for the adoption and use of …
------+49. The policy may be merged with the policy foreseen under Article 28(10) of DORA ( ). However, it …
------+50. Financial entities should ensure that the policy covers the identification of potential impact …
---+7 Conflicts of interests
------+51. Financial entities ( ) should identify, assess, and manage conflicts of interests with regard …
------+52. Where third-party arrangements create material conflicts of interest, including between …
------+53. When services supporting critical or important functions are provided by a TPSP that is part of …
---+8 Business continuity plans
------+54. Financial entities ( ) should have in place, maintain, and periodically test appropriate …
------+55. Business continuity plans should take into account the possible event of a failure or …
---+9 Internal audit function
------+56. The activities of the internal audit function ( ), where established, or the internal audit …
------+57. Financial entities should establish a formal follow-up process regarding internal audit …
---+10 Documentation requirements
------+58. As part of their risk management framework, financial entities should maintain an updated …
------+59. Financial entities should also maintain the documentation of ended third-party arrangements …
------+60. Taking into account the application of proportionality as referred to in Title I of the …
------+61. Taking into account the application of proportionality under Title I of the Guidelines, the …
------+62. For third-party arrangements supporting critical or important functions, the register should …
------+63. Financial entities should, upon request, make available to the competent authority either the …
------+64. Financial entities should, upon request, make available to the competent authority all …
------+65. Financial entities, including payment institutions for the purpose of complying with Article …
------+66. Financial entities should inform competent authorities in a timely manner of material changes …
------+67. Financial entities should appropriately document the assessments made under Title IV and the …
---+Title IV – Third-party arrangement process
---+11 Pre-contractual analysis
------+68. Before entering into any third-party arrangement, financial entities should: a. assess whether …
---+11.1 Supervisory conditions for contracting with third-party service providers
------+69. Financial entities should ensure that the use of TPSPs to provide functions of banking …
------+70. Without prejudice of the requirements established under Article 32 of the Commission Delegated …
---+11.2 Risk assessment of third-party arrangements
------+71. Financial entities should consider, on a risk-based approach, the potential impact of …
------+72. Financial entities should consider: a. the potential impact of a third-party arrangement on …
------+73. The risk assessment should include, where appropriate or relevant, scenarios of possible risk …
------+74. Within the risk assessment, financial entities should also consider the expected benefits and …
------+75. Where a third-party arrangement supporting critical or important functions includes the …
------+76. When carrying out the risk assessment prior to the conclusion of the third-party arrangement …
---+11.3 Due diligence
------+77. Before entering into third-party arrangements and considering all the relevant risks related to …
------+78. Factors to be considered when conducting due diligence on a potential TPSP include, but are not …
------+79. With regard to critical and important functions ( ), financial entities should ensure that the …
------+80. The planned usage of subcontractors to perform services supporting critical or important …
------+81. Where the use of a TPSP involves the processing of personal or confidential data, financial …
------+82. Financial entities should take appropriate steps to ensure that TPSPs act in a manner …
---+12 Contractual phase
------+83. The rights and obligations of the financial entity and the TPSP should be clearly allocated and …
------+84. The contractual arrangement should include at least the following elements: a. a clear and …
------+85. In addition to the elements referred to in paragraph 84, the third-party arrangement supporting …
------+86. Without prejudice to the requirements set out under Regulation (EU) 2016/679, financial …
---+12.1 Subcontracting of critical or important functions
------+87. The third-party arrangements on the use of services supporting critical or important function …
------+88. If the subcontracting of services supporting critical or important functions or material parts …
------+89. If the use of subcontractors supporting critical or important functions or material parts …
------+90. The written agreement between the financial entities and the TPSPs should specify that the TPSP …
------+91. The written agreement should include a reasonable notice period by which the financial entity …
------+92. The TPSP should only enter into new subcontracting arrangements or implement material changes …
------+93. Where the financial entity is of the opinion that the new subcontracting arrangement or the …
------+94. Financial entities should ensure that the TPSP appropriately identifies all subcontractors and …
------+95. The financial entity should ensure in the written agreement with the TPSP that the agreement …
---+12.2 Access, information and audit rights
------+96. Financial entities should ensure through the written contractual arrangement that the internal …
------+97. Regardless of the criticality or importance of the function performed by TPSPs, the written …
------+98. With regard to contractual arrangements supporting critical or important functions, financial …
------+99. For services not supporting critical or important functions provided by TPSPs, financial …
------+100. Financial entities should ensure that the contractual arrangement does not impede or limit the …
------+101. Financial entities should exercise their access and audit rights, determine the audit …
------+102. Without prejudice to their final responsibility regarding third-party arrangements, financial …
------+103. For services supporting critical or important functions provided by TPSPs financial entities …
------+104. Financial entities should make use of the method referred to in paragraph 102(b) only if they …
------+105. Before a planned onsite visit, financial entities, competent authorities, and auditors or …
------+106. When performing audits in multi-client environments, care should be taken to ensure that risks …
------+107. Where the third-party arrangement carries a high level of complexity, the financial entity …
---+12.3 Termination rights
------+108. The financial entity should be able to terminate the third-party arrangements, in accordance …
------+109. The third-party arrangement should facilitate the transfer of the services supporting a …
---+13 Monitoring
------+110. Following a risk-based approach, financial entities should monitor the performance of the …
------+111. Financial entities should monitor and manage their internal concentration risks caused by …
------+112. Financial entities should ensure, on an ongoing basis, that third-party arrangements …
------+113. Financial entities should take appropriate measures if they identify actual or potential …
---+14 Exit strategies regarding third-party arrangement supporting critical or important functions
------+114. Financial entities should have a documented exit strategy when services supporting critical or …
------+115. Financial entities should ensure that they are able to exit third-party arrangements …
------+116. When developing exit strategies for third-party arrangements supporting critical or important …
---+Title V – Guidelines on third-party arrangements risks addressed to competent authorities
------+117. When establishing appropriate methods to monitor financial entities ’ compliance with the …
------+118. Competent authorities should be satisfied that they can effectively supervise financial …
------+119. The analysis of financial entities’ third-party risk should be performed at least within the …
------+120. Further to the information recorded within the register, as referred to in Section 10 …
------+121. In addition to the information required under Section 10, competent authorities may require …
------+122. Competent authorities should assess the following on a risk-based approach: a. whether …
------+123. Competent authorities should ensure that EU/EEA financial entities are not operating as an …
------+124. Within their assessment, competent authorities should take into account all risks, in …
------+125. Where concentration risks are identified, competent authorities should monitor the development …
------+126. Where concerns are identified that lead to the conclusion that a financial entity no longer …
------+127. Competent authorities should be satisfied that they are able to perform effective supervision …
------+128. Competent authorities should closely cooperate among themselves and should, in a timely …
|
Title III – Governance framework
Title III – Governance framework
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Standards
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Standards
Standards
| Quelle |
Anforderung |
- EBA - Published by the European Banking Authority at https://www.eba.europa.eu/
|