1. TLPT authorities shall assess whether any financial entity is required to perform TLPT, taking into account the impact of those financial entities, their systemic character and their ICT risk profile, on the basis of all of the following criteria:
|
(a)
|
impact-related and systemic character related factors:
|
(i)
|
the size of the financial entity, determined on the basis of whether the financial entity provides financial services in one or more Member States and by comparing the activities of the financial entity to those of other financial entities providing similar services;
|
|
(ii)
|
the extent and nature of the interconnectedness of the financial entity with other financial entities in the financial sector in one or more Member States;
|
|
(iii)
|
the criticality or importance of the services that the financial entity provides to the financial sector;
|
|
(iv)
|
the substitutability of the services that the financial entity provides;
|
|
(v)
|
the complexity of the business model of the financial entity and the related services and processes;
|
|
(vi)
|
whether the financial entity is part of a group of systemic character at Union or national level in the financial sector and sharing ICT systems;
|
|
|
(b)
|
ICT risk-related factors:
|
(i)
|
the risk profile of the financial entity;
|
|
(ii)
|
the threat landscape of the financial entity;
|
|
(iii)
|
the degree of dependence of critical or important functions or their supporting functions of the financial entity on ICT systems and processes;
|
|
(iv)
|
the complexity of the ICT architecture of the financial entity;
|
|
(v)
|
the ICT services and functions supported by ICT third-party service providers, and the quantity and type of contractual arrangements with ICT third-party service providers or ICT intra-group service providers;
|
|
(vi)
|
the outcomes of any supervisory reviews relevant for the assessment of the ICT maturity of the financial entity;
|
|
(vii)
|
the maturity of ICT business continuity plans and ICT response and recovery plans;
|
|
(viii)
|
the maturity of the operational ICT security detection and mitigation measures, including the ability to:
|
(1)
|
monitor the financial entity’s ICT infrastructure on a permanent basis;
|
|
(2)
|
detect ICT-related events in real time;
|
|
(3)
|
analyse the events referred to in point (2);
|
|
(4)
|
respond to the events referred to in point (2) in a timely and effective manner;
|
|
|
(ix)
|
whether the financial entity is part of a group active in the financial sector at Union or national level that shares ICT systems.
|
|
For the purposes of point (a)(i), the TLPT authority shall, where possible, consider:
|
(a)
|
the market share position of the financial entity at Union and national level;
|
|
(b)
|
the range of activities offered by the financial entity;
|
|
(c)
|
the market share of the services provided by the financial entity or of the activities undertaken at Union and national level.
|
For the purposes of point (a)(v), the TLPT authority shall, where possible, consider:
|
(a)
|
whether the financial entity operates more than one business model;
|
|
(b)
|
the interconnectedness of different business processes and the related services.
|