43. When assessing the potential impact of ICT risks on the critical ICT systems and services of an …

When assessing the potential impact of ICT risks on the critical ICT systems and services of an institution, competent authorities should consider:

a. The financial impact, including (but not limited to) loss of funds or assets, potential customer compensation, legal and remediation costs, contractual damages, lost revenue;
b. The potential for business disruption, considering (but not limited to) the criticality of the financial services affected; the number of customers and/or branches and employees potentially affected;
c. The potential reputational impact on the institution based on the criticality of the banking service or operational activity affected (e.g. theft of customer data); the external profile/visibility of the ICT systems and services affected (e.g. mobile or on-line banking systems, point of sale, ATMs or payment systems);
d. The regulatory impact, including the potential for public censure by the regulator, fines or even variation of permissions.
e. The strategic impact on the institution, for example if strategic product or business plans are compromised or stolen.

1. Overview

Summary	Regulation

Requirements
Source	Requirement

Standards
Source	Requirement

EBA -
EN: Guidelines and other publications of the European Banking Authority (EBA), https://www.eba.europa.eu/. © European Banking Authority. Reproduction is authorised provided the source is acknowledged (EBA legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by the EBA are authoritative.

DE: Leitlinien und weitere Veröffentlichungen der Europäischen Bankenaufsichtsbehörde (EBA), https://www.eba.europa.eu/. © European Banking Authority. Wiedergabe mit Quellenangabe gestattet (Rechtlicher Hinweis der EBA). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die von der EBA veröffentlichten Fassungen.