Article 3 8

(a)

do not relieve the financial entity and its management body of its regulatory obligations and its responsibilities to its clients;

(b)

are not to prevent effective supervision of a financial entity and are not to contravene any supervisory restrictions on services and activities;

(c)

are to require that the ICT third party service providers cooperate with the competent authorities;

(d)

are to require that the financial entity, its auditors, and competent authorities have effective access to data and premises relating to the use of ICT services supporting critical or important functions.