+Guidelines on ICT and security risk management (EBA/GL/2019/04)
---+Compliance and reporting obligations
------+Status of these guidelines
---------+1. This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/2010 …
---------+2. Guidelines set out the EBA ’s view of appropriate supervisory practices within the European …
------+Reporting requirements
---------+ A1
------------+3. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify …
------------+4. Notifications will be published on the EBA website, in line with Article 16(3).
---+Subject matter, scope and definitions
------+Subject matter
---------+ A1
------------+5. These guidelines are based on the mandate to issue guidelines under Article 95(3) of Directive …
------------+6. These guidelines complement the risk management measures under Digital Operational Resilience …
------+Scope of application
---------+ A1
------------+7. These Guidelines specify requirements for the establishment, implementation and monitoring of …
------+Addressees
---------+ A1
------------+8. These guidelines are addressed to competent authorities as defined in Article 4 point (2) point …
------+Definitions
---+Implementation
------+Date of application
---------+ A1
------------+9. These guidelines apply from the latest by 20.05.2025.
------+Repeal
---------+ A1
---+Guidelines on ICT and security risk management
------+3.1. Proportionality
---------+ A1
---------+[deleted]
------+3.2. Governance and strategy
---------+ A1
---------+[deleted]
------+3.3. ICT and security risk management framework
---------+ A1
---------+[deleted]
------+3.4. Information security
---------+ A1
---------+[deleted]
------+3.5. ICT operations management
---------+ A1
---------+[deleted]
------+3.6. ICT project and change management
---------+ A1
---------+[deleted]
------+3.7. Business continuity management
---------+ A1
------+3.8. Payment service user relationship management
---------+92. Payment service providers should establish and implement processes to enhance payment service …
---------+93. The assistance and guidance offered to payment service users should be updated in the light of …
---------+94. Where product functionality permits, payment service providers should allow payment service …
---------+95. Where, in accordance with Article 68(1) of Directive (EU) 2015/2366, a payment service provider …
---------+96. Payment service providers should provide payment service users with the option to receive …
---------+97. Payment service providers should keep payment service users informed about updates in security …
---------+98. Payment service providers should provide payment service users with assistance on all …
 English - European Union - Financial Industry -

Guidelines on ICT and security risk management (EBA/GL/2019/04)

Guidelines on ICT and security risk management (EBA/GL/2019/04)

Consolidated version.

https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-ict-and-security-risk-management – PDF

1. Overview

,
Compliance and reporting obligations

Compliance and reporting obligations
Subject matter, scope and definitions

Subject matter, scope and definitions
Implementation

Implementation
Guidelines on ICT and security risk management

Guidelines on ICT and security risk management

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

Requirements

3. Related Standards

Standards

Linked Issues

Issuelinks
is related to Imported: Guidelines on ICT and security risk management (2025-05-20-26c0b4197b-3dad)
is related to Assignments added: Guidelines on ICT and security risk management (2025-05-20-26c0b4197b-3dad) – 5 links
is related to Assignments added: Guidelines on ICT and security risk management (2025-05-20-26c0b4197b-3dad) – 1 links
  • EBA - Published by the European Banking Authority at https://www.eba.europa.eu/