|
+REGULATION (EU) 2022/2554 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL ---+DORA Ch. I General provisions ------+DORA Ch. I Art. 1 Subject matter ---------+DORA Ch. I Art. 1 1. ---------+DORA Ch. I Art. 1 2. ---------+DORA Ch. I Art. 1 3. ------+DORA Ch. I Art. 2 Scope ---------+DORA Ch. I Art. 2 1. ---------+DORA Ch. I Art. 2 2. ---------+DORA Ch. I Art. 2 3. ---------+DORA Ch. I Art. 2 4. ------+DORA Ch. I Art. 3 Definitions ---------+DORA Ch. I Art. 3 1. digital operational resilience ---------+DORA Ch. I Art. 3 2. ---------+DORA Ch. I Art. 3 3. ---------+DORA Ch. I Art. 3 4. ---------+DORA Ch. I Art. 3 5. ---------+DORA Ch. I Art. 3 6. ---------+DORA Ch. I Art. 3 7. ---------+DORA Ch. I Art. 3 8. ---------+DORA Ch. I Art. 3 9. operational or security payment-related incident ---------+DORA Ch. I Art. 3 10. major ICT-related incident ---------+DORA Ch. I Art. 3 11. major operational or security payment-related incident ---------+DORA Ch. I Art. 3 12. ---------+DORA Ch. I Art. 3 13. ---------+DORA Ch. I Art. 3 14. cyber-attack ---------+DORA Ch. I Art. 3 15. threat intelligence ---------+DORA Ch. I Art. 3 16. ---------+DORA Ch. I Art. 3 17. threat-led penetration testing (TLPT) ---------+DORA Ch. I Art. 3 18. ICT third-party risk ---------+DORA Ch. I Art. 3 19. ---------+DORA Ch. I Art. 3 20. ---------+DORA Ch. I Art. 3 21. ---------+DORA Ch. I Art. 3 22. critical or important function ---------+DORA Ch. I Art. 3 23. critical ICT third-party service provider ---------+DORA Ch. I Art. 3 24. ICT third-party service provider established in a third country ---------+DORA Ch. I Art. 3 25. ---------+DORA Ch. I Art. 3 26. ---------+DORA Ch. I Art. 3 27. ---------+DORA Ch. I Art. 3 28. ICT subcontractor established in a third country ---------+DORA Ch. I Art. 3 29. ---------+DORA Ch. I Art. 3 30. ---------+DORA Ch. I Art. 3 31. ---------+DORA Ch. I Art. 3 32. ---------+DORA Ch. I Art. 3 33. ---------+DORA Ch. I Art. 3 34. ---------+DORA Ch. I Art. 3 35. ---------+DORA Ch. I Art. 3 36. ---------+DORA Ch. I Art. 3 37. ---------+DORA Ch. I Art. 3 38. ---------+DORA Ch. I Art. 3 39. ---------+DORA Ch. I Art. 3 40. ---------+DORA Ch. I Art. 3 41. ---------+DORA Ch. I Art. 3 42. ---------+DORA Ch. I Art. 3 43. ---------+DORA Ch. I Art. 3 44. ---------+DORA Ch. I Art. 3 45. ---------+DORA Ch. I Art. 3 46. ---------+DORA Ch. I Art. 3 47. ---------+DORA Ch. I Art. 3 48. ---------+DORA Ch. I Art. 3 49. ---------+DORA Ch. I Art. 3 50. ---------+DORA Ch. I Art. 3 51. ---------+DORA Ch. I Art. 3 52. ---------+DORA Ch. I Art. 3 53. ---------+DORA Ch. I Art. 3 54. ---------+DORA Ch. I Art. 3 55. crypto-asset service provider ---------+DORA Ch. I Art. 3 56. issuer of asset-referenced tokens ---------+DORA Ch. I Art. 3 57. ---------+DORA Ch. I Art. 3 58. ---------+DORA Ch. I Art. 3 59. ---------+DORA Ch. I Art. 3 60. ---------+DORA Ch. I Art. 3 61. ---------+DORA Ch. I Art. 3 62. ---------+DORA Ch. I Art. 3 63. ---------+DORA Ch. I Art. 3 64. ---------+DORA Ch. I Art. 3 65. ------+DORA Ch. I Art. 4 Proportionality principle ---------+DORA Ch. I Art. 4 1. ---------+DORA Ch. I Art. 4 2. ---------+DORA Ch. I Art. 4 3. ------+DORA Ch. II ICT risk management ---------+DORA Ch. II Sec. I Art. 5 Governance and organisation ------------+DORA Ch. II Sec. I Art. 5 1. ------------+DORA Ch. II Sec. I Art. 5 2. ------------+DORA Ch. II Sec. I Art. 5 3. ------------+DORA Ch. II Sec. I Art. 5 4. ---------+DORA Ch. II Sec. II Art. 6 ICT risk management framework ------------+DORA Ch. II Sec. II Art. 6 1. ------------+DORA Ch. II Sec. II Art. 6 2. ------------+DORA Ch. II Sec. II Art. 6 3. ------------+DORA Ch. II Sec. II Art. 6 4. ------------+DORA Ch. II Sec. II Art. 6 5. ------------+DORA Ch. II Sec. II Art. 6 6. ------------+DORA Ch. II Sec. II Art. 6 7. ------------+DORA Ch. II Sec. II Art. 6 8. ------------+DORA Ch. II Sec. II Art. 6 9. ------------+DORA Ch. II Sec. II Art. 6 10. ---------+DORA Ch. II Sec. II Art. 7 ICT systems, protocols and tools ---------+DORA Ch. II Sec. II Art. 8 Identification ------------+DORA Ch. II Sec. II Art. 8 1. ------------+DORA Ch. II Sec. II Art. 8 2. ------------+DORA Ch. II Sec. II Art. 8 3. ------------+DORA Ch. II Sec. II Art. 8 4. ------------+DORA Ch. II Sec. II Art. 8 5. ------------+DORA Ch. II Sec. II Art. 8 6. ------------+DORA Ch. II Sec. II Art. 8 7. ---------+DORA Ch. II Sec. II Art. 9 Protection and prevention ------------+DORA Ch. II Sec. II Art. 9 1. ------------+DORA Ch. II Sec. II Art. 9 2. ------------+DORA Ch. II Sec. II Art. 9 3. ------------+DORA Ch. II Sec. II Art. 9 4. ---------+DORA Ch. II Sec. II Art. 10 Detection ------------+DORA Ch. II Sec. II Art. 10 1. ------------+DORA Ch. II Sec. II Art. 10 2. ------------+DORA Ch. II Sec. II Art. 10 3. ------------+DORA Ch. II Sec. II Art. 10 4. ---------+DORA Ch. II Sec. II Art. 11 Response and recovery ------------+DORA Ch. II Sec. II Art. 11 1. ------------+DORA Ch. II Sec. II Art. 11 2. ------------+DORA Ch. II Sec. II Art. 11 3. ------------+DORA Ch. II Sec. II Art. 11 4. ------------+DORA Ch. II Sec. II Art. 11 5. ------------+DORA Ch. II Sec. II Art. 11 6. ------------+DORA Ch. II Sec. II Art. 11 7. ------------+DORA Ch. II Sec. II Art. 11 8. ------------+DORA Ch. II Sec. II Art. 11 9. ------------+DORA Ch. II Sec. II Art. 11 10. ------------+DORA Ch. II Sec. II Art. 11 11. ---------+DORA Ch. II Sec. II Art. 12 Backup policies and procedures, restoration and recovery procedures and methods ------------+DORA Ch. II Sec. II Art. 12 1. ------------+DORA Ch. II Sec. II Art. 12 2. ------------+DORA Ch. II Sec. II Art. 12 3. ------------+DORA Ch. II Sec. II Art. 12 4. ------------+DORA Ch. II Sec. II Art. 12 5. ------------+DORA Ch. II Sec. II Art. 12 6. ------------+DORA Ch. II Sec. II Art. 12 7. ---------+DORA Ch. II Sec. II Art. 13 Learning and evolving ------------+DORA Ch. II Sec. II Art. 13 1. ------------+DORA Ch. II Sec. II Art. 13 2. ------------+DORA Ch. II Sec. II Art. 13 3. ------------+DORA Ch. II Sec. II Art. 13 4. ------------+DORA Ch. II Sec. II Art. 13 5. ------------+DORA Ch. II Sec. II Art. 13 6. ------------+DORA Ch. II Sec. II Art. 13 7. ---------+DORA Ch. II Sec. II Art. 14 Communication ------------+DORA Ch. II Sec. II Art. 14 1. ------------+DORA Ch. II Sec. II Art. 14 2. ------------+DORA Ch. II Sec. II Art. 14 3. ---------+DORA Ch. II Sec. II Art. 15 Further harmonisation of ICT risk management tools, methods, processes and policies ---------+DORA Ch. II Sec. II Art. 16 Simplified ICT risk management framework ------------+DORA Ch. II Sec. II Art. 16 1. ------------+DORA Ch. II Sec. II Art. 16 2. ------------+DORA Ch. II Sec. II Art. 16 3. ---------+DORA Ch. III ICT-related incident management, classification and reporting ------------+DORA Ch. III Art. 17 ICT-related incident management process ---------------+DORA Ch. III Art. 17 1. ---------------+DORA Ch. III Art. 17 2. ---------------+DORA Ch. III Art. 17 3. ------------+DORA Ch. III Art. 18 Classification of ICT-related incidents and cyber threats ---------------+DORA Ch. III Art. 18 1. ---------------+DORA Ch. III Art. 18 2. ---------------+DORA Ch. III Art. 18 3. ---------------+DORA Ch. III Art. 18 4. ------------+DORA Ch. III Art. 19 Reporting of major ICT-related incidents and voluntary notification of significant cyber threats ---------------+DORA Ch. III Art. 19 1. ---------------+DORA Ch. III Art. 19 2. ---------------+DORA Ch. III Art. 19 3. ---------------+DORA Ch. III Art. 19 4. ---------------+DORA Ch. III Art. 19 5. ---------------+DORA Ch. III Art. 19 6. ---------------+DORA Ch. III Art. 19 7. ---------------+DORA Ch. III Art. 19 8. ------------+DORA Ch. III Art. 20 Harmonisation of reporting content and templates ------------+DORA Ch. III Art. 21 Centralisation of reporting of major ICT-related incidents ---------------+DORA Ch. III Art. 21 1. ---------------+DORA Ch. III Art. 21 2. ---------------+DORA Ch. III Art. 21 3. ------------+DORA Ch. III Art. 22 Supervisory feedback ---------------+DORA Ch. III Art. 22 1. ---------------+DORA Ch. III Art. 22 2. ------------+DORA Ch. III Art. 23 Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions ---+DORA Ch. IV Digital operational resilience testing ------+DORA Ch. IV Art. 24 General requirements for the performance of digital operational resilience testing ---------+DORA Ch. IV Art. 24 1. ---------+DORA Ch. IV Art. 24 2. ---------+DORA Ch. IV Art. 24 3. ---------+DORA Ch. IV Art. 24 4. ---------+DORA Ch. IV Art. 24 5. ---------+DORA Ch. IV Art. 24 6. ------+DORA Ch. IV Art. 25 Testing of ICT tools and systems ---------+DORA Ch. IV Art. 25 1. ---------+DORA Ch. IV Art. 25 2. ---------+DORA Ch. IV Art. 25 3. ------+DORA Ch. IV Art. 26 Advanced testing of ICT tools, systems and processes based on TLPT ---------+DORA Ch. IV Art. 26 1. ---------+DORA Ch. IV Art. 26 2. ---------+DORA Ch. IV Art. 26 3. ---------+DORA Ch. IV Art. 26 4. ---------+DORA Ch. IV Art. 26 5. ---------+DORA Ch. IV Art. 26 6. ---------+DORA Ch. IV Art. 26 7. ---------+DORA Ch. IV Art. 26 8. ---------+DORA Ch. IV Art. 26 9. ---------+DORA Ch. IV Art. 26 10. ---------+DORA Ch. IV Art. 26 11. ------+DORA Ch. IV Art. 27 Requirements for testers for the carrying out of TLPT ---------+DORA Ch. IV Art. 27 1. ---------+DORA Ch. IV Art. 27 2. ---------+DORA Ch. IV Art. 27 3. ---+DORA Ch. V Managing of ICT third-party risk ------+DORA Ch. V Sec. I ---------+DORA Ch. V Sec. I Art. 28 General principles ------------+DORA Ch. V Sec. I Art. 28 1. ------------+DORA Ch. V Sec. I Art. 28 2. ------------+DORA Ch. V Sec. I Art. 28 3. ------------+DORA Ch. V Sec. I Art. 28 4. ------------+DORA Ch. V Sec. I Art. 28 5. ------------+DORA Ch. V Sec. I Art. 28 6. ------------+DORA Ch. V Sec. I Art. 28 7. ------------+DORA Ch. V Sec. I Art. 28 8. ------------+DORA Ch. V Sec. I Art. 28 9. ------------+DORA Ch. V Sec. I Art. 28 10. ---------+DORA Ch. V Sec. I Art. 29 Preliminary assessment of ICT concentration risk at entity level ------------+DORA Ch. V Sec. I Art. 29 1. ------------+DORA Ch. V Sec. I Art. 29 2. ---------+DORA Ch. V Sec. I Art. 30 Key contractual provisions ------------+DORA Ch. V Sec. I Art. 30 1. ------------+DORA Ch. V Sec. I Art. 30 2. ------------+DORA Ch. V Sec. I Art. 30 3. ------------+DORA Ch. V Sec. I Art. 30 4. ------------+DORA Ch. V Sec. I Art. 30 5. ---------+DORA Ch. V Sec. II Oversight Framework of critical ICT third-party service providers ------------+DORA Ch. V Sec. II Art. 31 Designation of critical ICT third-party service providers ---------------+DORA Ch. V Sec. II Art. 31 1. ---------------+DORA Ch. V Sec. II Art. 31 2. ---------------+DORA Ch. V Sec. II Art. 31 3. ---------------+DORA Ch. V Sec. II Art. 31 4. ---------------+DORA Ch. V Sec. II Art. 31 5. ---------------+DORA Ch. V Sec. II Art. 31 6. ---------------+DORA Ch. V Sec. II Art. 31 7. ---------------+DORA Ch. V Sec. II Art. 31 8. ---------------+DORA Ch. V Sec. II Art. 31 9. ---------------+DORA Ch. V Sec. II Art. 31 10. ---------------+DORA Ch. V Sec. II Art. 31 11. ---------------+DORA Ch. V Sec. II Art. 31 12. ---------------+DORA Ch. V Sec. II Art. 31 13. ------------+DORA Ch. V Sec. II Art. 32 Structure of the Oversight Framework ---------------+DORA Ch. V Sec. II Art. 32 1. ---------------+DORA Ch. V Sec. II Art. 32 2. ---------------+DORA Ch. V Sec. II Art. 32 3. ---------------+DORA Ch. V Sec. II Art. 32 4. ---------------+DORA Ch. V Sec. II Art. 32 5. ---------------+DORA Ch. V Sec. II Art. 32 6. ---------------+DORA Ch. V Sec. II Art. 32 7. ---------------+DORA Ch. V Sec. II Art. 32 8. ---------------+DORA Ch. V Sec. II Art. 32 9. ------------+DORA Ch. V Sec. II Art. 33 Tasks of the Lead Overseer ---------------+DORA Ch. V Sec. II Art. 33 1. ---------------+DORA Ch. V Sec. II Art. 33 2. ---------------+DORA Ch. V Sec. II Art. 33 3. ---------------+DORA Ch. V Sec. II Art. 33 4. ---------------+DORA Ch. V Sec. II Art. 33 5. ------------+DORA Ch. V Sec. II Art. 34 Operational coordination between Lead Overseers ---------------+DORA Ch. V Sec. II Art. 34 1. ---------------+DORA Ch. V Sec. II Art. 34 2. ---------------+DORA Ch. V Sec. II Art. 34 3. ------------+DORA Ch. V Sec. II Art. 35 Powers of the Lead Overseer ---------------+DORA Ch. V Sec. II Art. 35 1. ---------------+DORA Ch. V Sec. II Art. 35 2. ---------------+DORA Ch. V Sec. II Art. 35 3. ---------------+DORA Ch. V Sec. II Art. 35 4. ---------------+DORA Ch. V Sec. II Art. 35 5. ---------------+DORA Ch. V Sec. II Art. 35 6. ---------------+DORA Ch. V Sec. II Art. 35 7. ---------------+DORA Ch. V Sec. II Art. 35 8. ---------------+DORA Ch. V Sec. II Art. 35 9. ---------------+DORA Ch. V Sec. II Art. 35 10. ---------------+DORA Ch. V Sec. II Art. 35 11. ------------+DORA Ch. V Sec. II Art. 36 Exercise of the powers of the Lead Overseer outside the Union ---------------+DORA Ch. V Sec. II Art. 36 1. ---------------+DORA Ch. V Sec. II Art. 36 2. ---------------+DORA Ch. V Sec. II Art. 36 3. ------------+DORA Ch. V Sec. II Art. 37 Request for information ---------------+DORA Ch. V Sec. II Art. 37 1. ---------------+DORA Ch. V Sec. II Art. 37 2. ---------------+DORA Ch. V Sec. II Art. 37 3. ---------------+DORA Ch. V Sec. II Art. 37 4. ---------------+DORA Ch. V Sec. II Art. 37 5. ------------+DORA Ch. V Sec. II Art. 38 General investigations ---------------+DORA Ch. V Sec. II Art. 38 1. ---------------+DORA Ch. V Sec. II Art. 38 2. ---------------+DORA Ch. V Sec. II Art. 38 3. ---------------+DORA Ch. V Sec. II Art. 38 4. ---------------+DORA Ch. V Sec. II Art. 38 5. ------------+DORA Ch. V Sec. II Art. 39 Inspections ---------------+DORA Ch. V Sec. II Art. 39 1. ---------------+DORA Ch. V Sec. II Art. 39 2. ---------------+DORA Ch. V Sec. II Art. 39 3. ---------------+DORA Ch. V Sec. II Art. 39 4. ---------------+DORA Ch. V Sec. II Art. 39 5. ---------------+DORA Ch. V Sec. II Art. 39 6. ---------------+DORA Ch. V Sec. II Art. 39 7. ------------+DORA Ch. V Sec. II Art. 40 Ongoing oversight ---------------+DORA Ch. V Sec. II Art. 40 1. ---------------+DORA Ch. V Sec. II Art. 40 2. ---------------+DORA Ch. V Sec. II Art. 40 3. ---------------+DORA Ch. V Sec. II Art. 40 4. ------------+DORA Ch. V Sec. II Art. 41 Harmonisation of conditions enabling the conduct of the oversight activities ---------------+DORA Ch. V Sec. II Art. 41 1. ---------------+DORA Ch. V Sec. II Art. 41 2. ------------+DORA Ch. V Sec. II Art. 42 Follow-up by competent authorities ---------------+DORA Ch. V Sec. II Art. 42 1. ---------------+DORA Ch. V Sec. II Art. 42 2. ---------------+DORA Ch. V Sec. II Art. 42 3. ---------------+DORA Ch. V Sec. II Art. 42 4. ---------------+DORA Ch. V Sec. II Art. 42 5. ---------------+DORA Ch. V Sec. II Art. 42 6. ---------------+DORA Ch. V Sec. II Art. 42 7. ---------------+DORA Ch. V Sec. II Art. 42 8. ---------------+DORA Ch. V Sec. II Art. 42 9. ---------------+DORA Ch. V Sec. II Art. 42 10. ---------------+DORA Ch. V Sec. II Art. 42 11. ------------+DORA Ch. V Sec. II Art. 43 Oversight fees ---------------+DORA Ch. V Sec. II Art. 43 1. ---------------+DORA Ch. V Sec. II Art. 43 2. ------------+DORA Ch. V Sec. II Art. 44 International cooperation ---------------+DORA Ch. V Sec. II Art. 44 1. ---------------+DORA Ch. V Sec. II Art. 44 2. ---+DORA Ch. VI Information-sharing arrangements ------+DORA Ch. VI Art. 45 Information-sharing arrangements on cyber threat information and intelligence ---------+DORA Ch. VI Art. 45 1. ---------+DORA Ch. VI Art. 45 2. ---------+DORA Ch. VI Art. 45 3. ---+DORA Ch. VII Competent authorities ------+DORA Ch. VII Art. 46 Competent authorities ------+DORA Ch. VII Art. 47 Cooperation with structures and authorities established by Directive (EU) 2022/2555 ---------+DORA Ch. VII Art. 47 1. ---------+DORA Ch. VII Art. 47 2. ---------+DORA Ch. VII Art. 47 3. ---------+DORA Ch. VII Art. 47 4. ------+DORA Ch. VII Art. 48 Cooperation between authorities ---------+DORA Ch. VII Art. 48 1. ---------+DORA Ch. VII Art. 48 2. ------+DORA Ch. VII Art. 49 Financial cross-sector exercises, communication and cooperation ---------+DORA Ch. VII Art. 49 1. ---------+DORA Ch. VII Art. 49 2. ------+DORA Ch. VII Art. 50 Administrative penalties and remedial measures ---------+DORA Ch. VII Art. 50 1. ---------+DORA Ch. VII Art. 50 2. ---------+DORA Ch. VII Art. 50 3. ---------+DORA Ch. VII Art. 50 4. ---------+DORA Ch. VII Art. 50 5. ---------+DORA Ch. VII Art. 50 6. ------+DORA Ch. VII Art. 51 Exercise of the power to impose administrative penalties and remedial measures ---------+DORA Ch. VII Art. 51 1. ---------+DORA Ch. VII Art. 51 2. ------+DORA Ch. VII Art. 52 Criminal penalties ---------+DORA Ch. VII Art. 52 1. ---------+DORA Ch. VII Art. 52 2. ------+DORA Ch. VII Art. 53 Notification duties ------+DORA Ch. VII Art. 54 Publication of administrative penalties ---------+DORA Ch. VII Art. 54 1. ---------+DORA Ch. VII Art. 54 2. ---------+DORA Ch. VII Art. 54 3. ---------+DORA Ch. VII Art. 54 4. ---------+DORA Ch. VII Art. 54 5. ---------+DORA Ch. VII Art. 54 6. ------+DORA Ch. VII Art. 55 Professional secrecy ---------+DORA Ch. VII Art. 55 1. ---------+DORA Ch. VII Art. 55 2. ---------+DORA Ch. VII Art. 55 3. ---------+DORA Ch. VII Art. 55 4. ------+DORA Ch. VII Art. 56 Data Protection ---------+DORA Ch. VII Art. 56 1. ---------+DORA Ch. VII Art. 56 2. ---+DORA Ch. VIII Delegated acts ------+DORA Ch. VIII Art. 57 Exercise of the delegation ---------+DORA Ch. VIII Art. 57 1. ---------+DORA Ch. VIII Art. 57 2. ---------+DORA Ch. VIII Art. 57 3. ---------+DORA Ch. VIII Art. 57 4. ---------+DORA Ch. VIII Art. 57 5. ---------+DORA Ch. VIII Art. 57 6. ---+DORA Ch. IX Transitional and final provisions ------+DORA Ch. IX Sec. I Art. 58 Review clause ---------+DORA Ch. IX Sec. I Art. 58 1. ---------+DORA Ch. IX Sec. I Art. 58 2. ---------+DORA Ch. IX Sec. I Art. 58 3. ------+DORA Ch. IX Sec. II Amendments ---------+DORA Ch. IX Sec. II Art. 59 Amendments to Regulation (EC) No 1060/2009 ---------+DORA Ch. IX Sec. II Art. 60 ---------+DORA Ch. IX Sec. II Art. 61 ---------+DORA Ch. IX Sec. II Art. 62 ---------+DORA Ch. IX Sec. II Art. 63 ---------+DORA Ch. IX Sec. II Art. 64 |
1. OverviewREGULATION (EU) 2022/2554 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCILREGULATION (EU) 2022/2554 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (Text with EEA relevance) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof, Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national parliaments, Having regard to the opinion of the European Central Bank (1), Having regard to the opinion of the European Economic and Social Committee (2), Acting in accordance with the ordinary legislative procedure (3), Whereas: (1) In the digital age, information and communication technology (ICT) supports complex systems used for everyday activities. It keeps our economies running in key sectors, including the financial sector, and enhances the functioning of the internal market. Increased digitalisation and interconnectedness also amplify ICT risk, making society as a whole, and the financial system in particular, more vulnerable to cyber threats or ICT disruptions. While the ubiquitous use of ICT systems and high digitalisation and connectivity are today core features of the activities of Union financial entities, their digital resilience has yet to be better addressed and integrated into their broader operational frameworks. (2) The use of ICT has in the past decades gained a pivotal role in the provision of financial services, to the point where it has now acquired a critical importance in the operation of typical daily functions of all financial entities. Digitalisation now covers, for instance, payments, which have increasingly moved from cash and paper-based methods to the use of digital solutions, as well as securities clearing and settlement, electronic and algorithmic trading, lending and funding operations, peer-to-peer finance, credit rating, claim management and back-office operations. The insurance sector has also been transformed by the use of ICT, from the emergence of insurance intermediaries offering their services online operating with InsurTech, to digital insurance underwriting. Finance has not only become largely digital throughout the whole sector, but digitalisation has also deepened interconnections and dependencies within the financial sector and with third-party infrastructure and service providers. (3) The European Systemic Risk Board (ESRB) reaffirmed in a 2020 report addressing systemic cyber risk how the existing high level of interconnectedness across financial entities, financial markets and financial market infrastructures, and particularly the interdependencies of their ICT systems, could constitute a systemic vulnerability because localised cyber incidents could quickly spread from any of the approximately 22 000 Union financial entities to the entire financial system, unhindered by geographical boundaries. Serious ICT breaches that occur in the financial sector do not merely affect financial entities taken in isolation. They also smooth the way for the propagation of localised vulnerabilities across the financial transmission channels and potentially trigger adverse consequences for the stability of the Union’s financial system, such as generating liquidity runs and an overall loss of confidence and trust in financial markets. (4) In recent years, ICT risk has attracted the attention of international, Union and national policy makers, regulators and standard-setting bodies in an attempt to enhance digital resilience, set standards and coordinate regulatory or supervisory work. At international level, the Basel Committee on Banking Supervision, the Committee on Payments and Market Infrastructures, the Financial Stability Board, the Financial Stability Institute, as well as the G7 and G20 aim to provide competent authorities and market operators across various jurisdictions with tools to bolster the resilience of their financial systems. That work has also been driven by the need to duly consider ICT risk in the context of a highly interconnected global financial system and to seek more consistency of relevant best practices. (5) Despite Union and national targeted policy and legislative initiatives, ICT risk continues to pose a challenge to the operational resilience, performance and stability of the Union financial system. The reforms that followed the 2008 financial crisis primarily strengthened the financial resilience of the Union financial sector and aimed to safeguard the competitiveness and stability of the Union from economic, prudential and market conduct perspectives. Although ICT security and digital resilience are part of operational risk, they have been less in the focus of the post-financial crisis regulatory agenda and have developed in only some areas of the Union’s financial services policy and regulatory landscape, or in only a few Member States. (6) In its Communication of 8 March 2018 entitled ‘FinTech Action plan: For a more competitive and innovative European financial sector’, the Commission highlighted the paramount importance of making the Union financial sector more resilient, including from an operational perspective to ensure its technological safety and good functioning, its quick recovery from ICT breaches and incidents, ultimately enabling the effective and smooth provision of financial services across the whole Union, including under situations of stress, while also preserving consumer and market trust and confidence. (7) In April 2019, the European Supervisory Authority (European Banking Authority), (EBA) established by Regulation (EU) No 1093/2010 of the European Parliament and of the Council (4), the European Supervisory Authority (European Insurance and Occupational Pensions Authority), (‘EIOPA’) established by Regulation (EU) No 1094/2010 of the European Parliament and of the Council (5) and the European Supervisory Authority (European Securities and Markets Authority), (‘ESMA’) established by Regulation (EU) No 1095/2010 of the European Parliament and of the Council (6) (known collectively as ‘European Supervisory Authorities’ or ‘ESAs’) jointly issued technical advice calling for a coherent approach to ICT risk in finance and recommending to strengthen, in a proportionate way, the digital operational resilience of the financial services industry through a sector-specific initiative of the Union. (8) The Union financial sector is regulated by a Single Rulebook and governed by a European system of financial supervision. Nonetheless, provisions tackling digital operational resilience and ICT security are not yet fully or consistently harmonised, despite digital operational resilience being vital for ensuring financial stability and market integrity in the digital age, and no less important than, for example, common prudential or market conduct standards. The Single Rulebook and system of supervision should therefore be developed to also cover digital operational resilience, by strengthening the mandates of competent authorities to enable them to supervise the management of ICT risk in the financial sector in order to protect the integrity and efficiency of the internal market, and to facilitate its orderly functioning. (9) Legislative disparities and uneven national regulatory or supervisory approaches with regard to ICT risk trigger obstacles to the functioning of the internal market in financial services, impeding the smooth exercise of the freedom of establishment and the provision of services for financial entities operating on a cross-border basis. Competition between the same type of financial entities operating in different Member States could also be distorted. This is the case, in particular, for areas where Union harmonisation has been very limited, such as digital operational resilience testing, or absent, such as the monitoring of ICT third-party risk. Disparities stemming from developments envisaged at national level could generate further obstacles to the functioning of the internal market to the detriment of market participants and financial stability. (10) To date, due to the ICT risk related provisions being only partially addressed at Union level, there are gaps or overlaps in important areas, such as ICT-related incident reporting and digital operational resilience testing, and inconsistencies as a result of emerging divergent national rules or cost-ineffective application of overlapping rules. This is particularly detrimental for an ICT-intensive user such as the financial sector since technology risks have no borders and the financial sector deploys its services on a wide cross-border basis within and outside the Union. Individual financial entities operating on a cross-border basis or holding several authorisations (e.g. one financial entity can have a banking, an investment firm, and a payment institution licence, each issued by a different competent authority in one or several Member States) face operational challenges in addressing ICT risk and mitigating adverse impacts of ICT incidents on their own and in a coherent cost-effective way. (11) As the Single Rulebook has not been accompanied by a comprehensive ICT or operational risk framework, further harmonisation of key digital operational resilience requirements for all financial entities is required. The development of ICT capabilities and overall resilience by financial entities, based on those key requirements, with a view to withstanding operational outages, would help preserve the stability and integrity of the Union financial markets and thus contribute to ensuring a high level of protection of investors and consumers in the Union. Since this Regulation aims to contribute to the smooth functioning of the internal market, it should be based on the provisions of Article 114 of the Treaty on the Functioning of the European Union (TFEU) as interpreted in accordance with the consistent case law of the Court of Justice of the European Union (Court of Justice). (12) This Regulation aims to consolidate and upgrade ICT risk requirements as part of the operational risk requirements that have, up to this point, been addressed separately in various Union legal acts. While those acts covered the main categories of financial risk (e.g. credit risk, market risk, counterparty credit risk and liquidity risk, market conduct risk), they did not comprehensively tackle, at the time of their adoption, all components of operational resilience. The operational risk rules, when further developed in those Union legal acts, often favoured a traditional quantitative approach to addressing risk (namely setting a capital requirement to cover ICT risk) rather than targeted qualitative rules for the protection, detection, containment, recovery and repair capabilities against ICT-related incidents, or for reporting and digital testing capabilities. Those acts were primarily meant to cover and update essential rules on prudential supervision, market integrity or conduct. By consolidating and upgrading the different rules on ICT risk, all provisions addressing digital risk in the financial sector should for the first time be brought together in a consistent manner in one single legislative act. Therefore, this Regulation fills in the gaps or remedies inconsistencies in some of the prior legal acts, including in relation to the terminology used therein, and explicitly refers to ICT risk via targeted rules on ICT risk-management capabilities, incident reporting, operational resilience testing and ICT third-party risk monitoring. This Regulation should thus also raise awareness of ICT risk and acknowledge that ICT incidents and a lack of operational resilience have the possibility to jeopardise the soundness of financial entities. (13) Financial entities should follow the same approach and the same principle-based rules when addressing ICT risk taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations. Consistency contributes to enhancing confidence in the financial system and preserving its stability especially in times of high reliance on ICT systems, platforms and infrastructures, which entails increased digital risk. Observing basic cyber hygiene should also avoid imposing heavy costs on the economy by minimising the impact and costs of ICT disruptions. (14) A Regulation helps reduce regulatory complexity, fosters supervisory convergence and increases legal certainty, and also contributes to limiting compliance costs, especially for financial entities operating across borders, and to reducing competitive distortions. Therefore, the choice of a Regulation for the establishment of a common framework for the digital operational resilience of financial entities is the most appropriate way to guarantee a homogenous and coherent application of all components of ICT risk management by the Union financial sector. (15) Directive (EU) 2016/1148 of the European Parliament and of the Council (7) was the first horizontal cybersecurity framework enacted at Union level, applying also to three types of financial entities, namely credit institutions, trading venues and central counterparties. However, since Directive (EU) 2016/1148 set out a mechanism of identification at national level of operators of essential services, only certain credit institutions, trading venues and central counterparties that were identified by the Member States, have been brought into its scope in practice, and hence required to comply with the ICT security and incident notification requirements laid down in it. Directive (EU) 2022/2555 of the European Parliament and of the Council (8) sets a uniform criterion to determine the entities falling within its scope of application (size-cap rule) while also keeping the three types of financial entities in its scope. (16) However, as this Regulation increases the level of harmonisation of the various digital resilience components, by introducing requirements on ICT risk management and ICT-related incident reporting that are more stringent in comparison to those laid down in the current Union financial services law, this higher level constitutes an increased harmonisation also in comparison with the requirements laid down in Directive (EU) 2022/2555. Consequently, this Regulation constitutes lex specialis with regard to Directive (EU) 2022/2555. At the same time, it is crucial to maintain a strong relationship between the financial sector and the Union horizontal cybersecurity framework as currently laid out in Directive (EU) 2022/2555 to ensure consistency with the cyber security strategies adopted by Member States and to allow financial supervisors to be made aware of cyber incidents affecting other sectors covered by that Directive. (17) In accordance with Article 4(2) of the Treaty on European Union and without prejudice to the judicial review by the Court of Justice, this Regulation should not affect the responsibility of Member States with regard to essential State functions concerning public security, defence and the safeguarding of national security, for example concerning the supply of information which would be contrary to the safeguarding of national security. (18) To enable cross-sector learning and to effectively draw on experiences of other sectors in dealing with cyber threats, the financial entities referred to in Directive (EU) 2022/2555 should remain part of the ‘ecosystem’ of that Directive (for example, Cooperation Group and computer security incident response teams (CSIRTs)).The ESAs and national competent authorities should be able to participate in the strategic policy discussions and the technical workings of the Cooperation Group under that Directive, and to exchange information and further cooperate with the single points of contact designated or established in accordance with that Directive. The competent authorities under this Regulation should also consult and cooperate with the CSIRTs. The competent authorities should also be able to request technical advice from the competent authorities designated or established in accordance with Directive (EU) 2022/2555 and establish cooperation arrangements that aim to ensure effective and fast-response coordination mechanisms. (19) Given the strong interlinkages between the digital resilience and the physical resilience of financial entities, a coherent approach with regard to the resilience of critical entities is necessary in this Regulation and Directive (EU) 2022/2557 of the European Parliament and the Council (9). Given that the physical resilience of financial entities is addressed in a comprehensive manner by the ICT risk management and reporting obligations covered by this Regulation, the obligations laid down in Chapters III and IV of Directive (EU) 2022/2557 should not apply to financial entities falling within the scope of that Directive. (20) Cloud computing service providers are one category of digital infrastructure covered by Directive (EU) 2022/2555. The Union Oversight Framework (‘Oversight Framework’) established by this Regulation applies to all critical ICT third-party service providers, including cloud computing service providers providing ICT services to financial entities, and should be considered complementary to the supervision carried out pursuant to Directive (EU) 2022/2555. Moreover, the Oversight Framework established by this Regulation should cover cloud computing service providers in the absence of a Union horizontal framework establishing a digital oversight authority. (21) In order to maintain full control over ICT risk, financial entities need to have comprehensive capabilities to enable a strong and effective ICT risk management, as well as specific mechanisms and policies for handling all ICT-related incidents and for reporting major ICT-related incidents. Likewise, financial entities should have policies in place for the testing of ICT systems, controls and processes, as well as for managing ICT third-party risk. The digital operational resilience baseline for financial entities should be increased while also allowing for a proportionate application of requirements for certain financial entities, particularly microenterprises, as well as financial entities subject to a simplified ICT risk management framework. To facilitate an efficient supervision of institutions for occupational retirement provision that is proportionate and addresses the need to reduce administrative burdens on the competent authorities, the relevant national supervisory arrangements in respect of such financial entities should take into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations even when the relevant thresholds established in Article 5 of Directive (EU) 2016/2341 of the European Parliament and of the Council (10) are exceeded. In particular, supervisory activities should focus primarily on the need to address serious risks associated with the ICT risk management of a particular entity. Competent authorities should also maintain a vigilant but proportionate approach in relation to the supervision of institutions for occupational retirement provision which, in accordance with Article 31 of Directive (EU) 2016/2341, outsource a significant part of their core business, such as asset management, actuarial calculations, accounting and data management, to service providers. (22) ICT-related incident reporting thresholds and taxonomies vary significantly at national level. While common ground may be achieved through the relevant work undertaken by the European Union Agency for Cybersecurity (ENISA) established by Regulation (EU) 2019/881 of the European Parliament and of the Council (11) and the Cooperation Group under Directive (EU) 2022/2555, divergent approaches on setting the thresholds and use of taxonomies still exist, or can emerge, for the remainder of financial entities. Due to those divergences, there are multiple requirements that financial entities must comply with, especially when operating across several Member States and when part of a financial group. Moreover, such divergences have the potential to hinder the creation of further uniform or centralised Union mechanisms that speed up the reporting process and support a quick and smooth exchange of information between competent authorities, which is crucial for addressing ICT risk in the event of large-scale attacks with potentially systemic consequences. (23) To reduce the administrative burden and potentially duplicative reporting obligations for certain financial entities, the requirement for the incident reporting pursuant to Directive (EU) 2015/2366 of the European Parliament and of the Council (12) should cease to apply to payment service providers that fall within the scope of this Regulation. Consequently, credit institutions, e-money institutions, payment institutions and account information service providers, as referred to in Article 33(1) of that Directive, should, from the date of application of this Regulation, report pursuant to this Regulation, all operational or security payment-related incidents which have been previously reported pursuant to that Directive, irrespective of whether such incidents are ICT-related. (24) To enable competent authorities to fulfil supervisory roles by acquiring a complete overview of the nature, frequency, significance and impact of ICT-related incidents and to enhance the exchange of information between relevant public authorities, including law enforcement authorities and resolution authorities, this Regulation should lay down a robust ICT-related incident reporting regime whereby the relevant requirements address current gaps in financial services law, and remove existing overlaps and duplications to alleviate costs. It is essential to harmonise the ICT-related incident reporting regime by requiring all financial entities to report to their competent authorities through a single streamlined framework as set out in this Regulation. In addition, the ESAs should be empowered to further specify relevant elements for the ICT-related incident reporting framework, such as taxonomy, timeframes, data sets, templates and applicable thresholds. To ensure full consistency with Directive (EU) 2022/2555, financial entities should be allowed, on a voluntary basis, to notify significant cyber threats to the relevant competent authority, when they consider that the cyber threat is of relevance to the financial system, service users or clients. (25) Digital operational resilience testing requirements have been developed in certain financial subsectors setting out frameworks that are not always fully aligned. This leads to a potential duplication of costs for cross-border financial entities and makes the mutual recognition of the results of digital operational resilience testing complex which, in turn, can fragment the internal market. (26) In addition, where no ICT testing is required, vulnerabilities remain undetected and result in exposing a financial entity to ICT risk and ultimately create a higher risk to the stability and integrity of the financial sector. Without Union intervention, digital operational resilience testing would continue to be inconsistent and would lack a system of mutual recognition of ICT testing results across different jurisdictions. In addition, as it is unlikely that other financial subsectors would adopt testing schemes on a meaningful scale, they would miss out on the potential benefits of a testing framework, in terms of revealing ICT vulnerabilities and risks, and testing defence capabilities and business continuity, which contributes to increasing the trust of customers, suppliers and business partners. To remedy those overlaps, divergences and gaps, it is necessary to lay down rules for a coordinated testing regime and thereby facilitate the mutual recognition of advanced testing for financial entities meeting the criteria set out in this Regulation. (27) Financial entities’ reliance on the use of ICT services is partly driven by their need to adapt to an emerging competitive digital global economy, to boost their business efficiency and to meet consumer demand. The nature and extent of such reliance has been continuously evolving in recent years, driving cost reduction in financial intermediation, enabling business expansion and scalability in the deployment of financial activities while offering a wide range of ICT tools to manage complex internal processes. (28) The extensive use of ICT services is evidenced by complex contractual arrangements, whereby financial entities often encounter difficulties in negotiating contractual terms that are tailored to the prudential standards or other regulatory requirements to which they are subject, or otherwise in enforcing specific rights, such as access or audit rights, even when the latter are enshrined in their contractual arrangements. Moreover, many of those contractual arrangements do not provide for sufficient safeguards allowing for the fully-fledged monitoring of subcontracting processes, thus depriving the financial entity of its ability to assess the associated risks. In addition, as ICT third-party service providers often provide standardised services to different types of clients, such contractual arrangements do not always cater adequately for the individual or specific needs of financial industry actors. (29) Even though Union financial services law contains certain general rules on outsourcing, monitoring of the contractual dimension is not fully anchored into Union law. In the absence of clear and bespoke Union standards applying to the contractual arrangements concluded with ICT third-party service providers, the external source of ICT risk is not comprehensively addressed. Consequently, it is necessary to set out certain key principles to guide financial entities’ management of ICT third-party risk, which are of particular importance when financial entities resort to ICT third-party service providers to support their critical or important functions. Those principles should be accompanied by a set of core contractual rights in relation to several elements in the performance and termination of contractual arrangements with a view to providing certain minimum safeguards in order to strengthen financial entities’ ability to effectively monitor all ICT risk emerging at the level of third-party service providers. Those principles are complementary to the sectoral law applicable to outsourcing. (30) A certain lack of homogeneity and convergence regarding the monitoring of ICT third-party risk and ICT third-party dependencies is evident today. Despite efforts to address outsourcing, such as EBA Guidelines on outsourcing of 2019 and ESMA Guidelines on outsourcing to cloud service providers of 2021 the broader issue of counteracting systemic risk which may be triggered by the financial sector’s exposure to a limited number of critical ICT third-party service providers is not sufficiently addressed by Union law. The lack of rules at Union level is compounded by the absence of national rules on mandates and tools that allow financial supervisors to acquire a good understanding of ICT third-party dependencies and to monitor adequately risks arising from the concentration of ICT third-party dependencies. (31) Taking into account the potential systemic risk entailed by increased outsourcing practices and by the ICT third-party concentration, and mindful of the insufficiency of national mechanisms in providing financial supervisors with adequate tools to quantify, qualify and redress the consequences of ICT risk occurring at critical ICT third-party service providers, it is necessary to establish an appropriate Oversight Framework allowing for a continuous monitoring of the activities of ICT third-party service providers that are critical ICT third-party service providers to financial entities, while ensuring that the confidentiality and security of customers other than financial entities is preserved. While intra-group provision of ICT services entails specific risks and benefits, it should not be automatically considered less risky than the provision of ICT services by providers outside of a financial group and should therefore be subject to the same regulatory framework. However, when ICT services are provided from within the same financial group, financial entities might have a higher level of control over intra-group providers, which ought to be taken into account in the overall risk assessment. (32) With ICT risk becoming more and more complex and sophisticated, good measures for the detection and prevention of ICT risk depend to a great extent on the regular sharing between financial entities of threat and vulnerability intelligence. Information sharing contributes to creating increased awareness of cyber threats. In turn, this enhances the capacity of financial entities to prevent cyber threats from becoming real ICT-related incidents and enables financial entities to more effectively contain the impact of ICT-related incidents and to recover faster. In the absence of guidance at Union level, several factors seem to have inhibited such intelligence sharing, in particular uncertainty about its compatibility with data protection, anti-trust and liability rules. (33) In addition, doubts about the type of information that can be shared with other market participants, or with non-supervisory authorities (such as ENISA, for analytical input, or Europol, for law enforcement purposes) lead to useful information being withheld. Therefore, the extent and quality of information sharing currently remains limited and fragmented, with relevant exchanges mostly being local (by way of national initiatives) and with no consistent Union-wide information-sharing arrangements tailored to the needs of an integrated financial system. It is therefore important to strengthen those communication channels. (34) Financial entities should be encouraged to exchange among themselves cyber threat information and intelligence, and to collectively leverage their individual knowledge and practical experience at strategic, tactical and operational levels with a view to enhancing their capabilities to adequately assess, monitor, defend against, and respond to cyber threats, by participating in information sharing arrangements. It is therefore necessary to enable the emergence at Union level of mechanisms for voluntary information-sharing arrangements which, when conducted in trusted environments, would help the community of the financial industry to prevent and collectively respond to cyber threats by quickly limiting the spread of ICT risk and impeding potential contagion throughout the financial channels. Those mechanisms should comply with the applicable competition law rules of the Union set out in the Communication from the Commission of 14 January 2011 entitled ‘Guidelines on the applicability of Article 101 of the Treaty on the Functioning of the European Union to horizontal cooperation agreements’, as well as with Union data protection rules, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (13). They should operate based on the use of one or more of the legal bases that are laid down in Article 6 of that Regulation, such as in the context of the processing of personal data that is necessary for the purposes of the legitimate interest pursued by the controller or by a third party, as referred to in Article 6(1), point (f), of that Regulation, as well as in the context of the processing of personal data necessary for compliance with a legal obligation to which the controller is subject, necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, as referred to in Article 6(1), points (c) and (e), respectively, of that Regulation. (35) In order to maintain a high level of digital operational resilience for the whole financial sector, and at the same time to keep pace with technological developments, this Regulation should address risk stemming from all types of ICT services. To that end, the definition of ICT services in the context of this Regulation should be understood in a broad manner, encompassing digital and data services provided through IC
1.1 References1.2 Identified Requirements1.3 Related Standards2. Identified Requirements
3. Related Standards
|