6 Policy on the contractual arrangement regarding the use of non-ICT services supporting critical or important functions provided by TPSP

The management body of a financial entity⁴⁸ that has third-party arrangements in place or plans on entering into such arrangements should approve a written policy on the use of non-ICT related services supporting critical or important functions provided by TPSP. The management body should review it at least once a year and, update it where relevant. Changes made to the policy should be implemented in a timely manner and as soon as it is possible within the relevant contractual arrangements. The management body should also ensure the policy’s implementation, as applicable, on an individual, sub-consolidated, and consolidated basis.

⁴⁸ See also the EBA Guidelines on the security measures for operational and security risks of payment services under PSD2, available under: https://www.eba.europa.eu/regulation-and-policy/payment-services-and-electronic-money/guidelines-on-security-measures-for-operational-and-security-risks-under-the-psd2.

The policy should include the main phases of the life cycle for the adoption and use of contractual arrangements with TPSP. It should cover, for each main phase of the life cycle of the contractual arrangement, at least:

• a. the responsibilities of the management body in line with paragraphs 38 and 42, including its involvement, as appropriate, in the decision-making on the use of services supporting critical or important functions provided by TPSP;
• b. the involvement of business lines, internal control functions, and other individuals in respect of contractual arrangements supporting critical or important functions;
• c. the identification of the role or member of senior management responsible for monitoring the relevant contractual arrangements, specifying how that role or member of senior management shall cooperate with the internal control functions, unless it is part of it, and setting out the reporting lines to the management body, including the nature of the information to report and the documents to provide, and the frequency of such reporting;
• d. the planning of contractual arrangements, including:
• i. establishing whether an arrangement with a TPSP could potentially fall under the definition of third-party arrangement provided in these Guidelines;
• ii. the definition of business requirements regarding third-party arrangements;
• iii. the criteria, including those referred to in Section 4, and processes for identifying critical or important functions;
• iv. risk identification, assessment, and management in accordance with Section 1211.2;
• v. due diligence checks on prospective TPSPs, including the measures required under Section 1211.3;
• vi. procedures for the identification, assessment, management, and mitigation of potential conflicts of interest, in accordance with Section 7;
• vii. business continuity planning in accordance with Section 8;
• viii. the approval process of new third-party arrangements;
• e. the implementation, monitoring, and management of third-party arrangements supporting critical or important functions, including:
• i. the monitoring of the TPSP’s performance in line with Section 13;
• ii. the procedures for being notified and responding to changes to a third-party arrangement or TPSP (e.g. to its financial position, organisational or ownership structures, subcontracting);
• iii. the independent review and audit of compliance with legal and regulatory requirements and policies;
• iv. their renewal processes, where applicable;
• f. the documentation and record-keeping, taking into account the guidelines in Section 10;
• g. the exit strategies and termination processes, including a requirement for a documented exit plan for non-ICT services supporting critical or important function to be provided by TPSPs, in accordance with Section 14.

The policy may be merged with the policy foreseen under Article 28(10) of DORA (⁴⁹ ). However, it should differentiate between the following:

• a. ICT services for which DORA requirements apply and non-ICT services;
• b. non-ICT services supporting critical or important functions provided by TPSPs that are authorised by a competent authority and those that are not;
• c. intragroup third-party arrangements, including third-party arrangements within the same institutional protection scheme (including entities fully owned individually or collectively by institutions within the institutional protection scheme), and third-party arrangements with TPSPs outside the group; and
• d. the use of TPSPs located within a Member State and TPSPs located in third countries.

⁴⁹ Commission Delegated Regulation (EU) 2024/1773 of 13 March 2024 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards specifying the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers (OJ L, 2024/1773, 25.6.2024, ELI: http://data.europa.eu/eli/reg_del/2024/1773/oj).

Financial entities should ensure that the policy covers the identification of potential impact on the following areas resulting from critical or important functions provided by TPSPs and that these are taken into account in the decision-making process:

• a. the financial entity ’ s risk profile;
• b. the ability to oversee the TPSP and manage the risks;
• c. the business continuity measures; and
• d. the performance of their business activities.