1 Proportionality

Financial entities and competent authorities should, when complying or supervising compliance with these Guidelines, have regard to the principle of proportionality. The proportionality principle aims to ensure that governance arrangements, including those related to third-party risk management, are consistent with the individual risk profile, the nature and business model of the financial entity, and the scale and complexity of their activities so that the objectives of the regulatory requirements are effectively achieved.

When applying the provisions set out in these Guidelines, financial entities should take into account the complexity of the functions supported by TPSPs, the risks arising from the third-party arrangement, the criticality or importance of the function supported by TPSPs and the potential impact of such arrangement on the continuity of their activities.

When applying the principle of proportionality, financial entities (³⁷ ) and competent authorities should take into account the criteria specified in Title I of the EBA Guidelines on internal governance under Directive 2013/36/EU, in Title I of the EBA Guidelines on internal governance under Directive (EU) 2019/2034, and Title I of the EBA Guidelines on the minimum content of the governance arrangements for issuers of asset-referenced tokens under Regulation (EU) 2023/1114.

³⁷ Payment institutions should also refer to the EBA Guidelines under PSD 2 on the information to be provided for the authorisation of payment institutions and electronic money institutions and the registration of account information service providers, which are available on the EBA’s website under the following link: https://www.eba.europa.eu/regulation-and-policy/payment-services-and-electronic-money/guidelines-on-security-measures-for-operational-and-security-risks-under-the-psd2.