76. When carrying out the risk assessment prior to the conclusion of the third-party arrangement …

When carrying out the risk assessment prior to the conclusion of the third-party arrangement and during ongoing monitoring of the TPSP’s performance, financial entities should, at least:

• a. conduct a thorough risk-based analysis of the functions that are being considered for an arrangement with a TPSP or have been provided by a TPSP,
• b. whether the functions are critical or important and address the potential risks, in particular the operational and reputational risks, and the oversight limitations related to the countries where the functions are or may be provided;
• c. consider the consequences of where the TPSP is located (within or outside the EU);
• d. consider the political stability and security situation of the jurisdictions in question, including:
• i. the laws in force, including laws on data protection, compliant with the EU General Data Protection Regulation (GDPR);
• ii. the law enforcement provisions in place; and
• iii. the insolvency law provisions that would apply in the event of a TPSP ’ s failure and any constraints that would arise in respect of the urgent recovery of the financial entity ’ s function in particular;
• e. consider whether the TPSP is a subsidiary or parent undertaking of the financial entity, is included in the scope of accounting consolidation or is a member of or owned by financial entities that are members of an institutional protection scheme and, if so, the extent to which the financial entity controls it or has the ability to influence its actions in line with Section 2.

1. Yleiskatsaus

1.1 Viittaukset

1.2 Tunnistetut vaatimukset

1.3 Liittyvät standardit

2. Tunnistetut vaatimukset

3. Liittyvät standardit

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/