72. Financial entities should consider: a. the potential impact of a third-party arrangement on …

Financial entities should consider:

• a. the potential impact of a third-party arrangement on their ability to:
• i. identify, monitor and manage relevant risks;
• ii. comply with all legal and regulatory requirements;
• iii. conduct appropriate audits regarding the function provided by TPSPs;
• b. the potential impact on the services provided to their clients;
• c. the size and complexity of any business area affected;
• d. the possibility that a proposed third-party arrangement might be scaled up without replacing or revising an underlying agreement;
• e. the ability to transfer a proposed third-party arrangement to another TPSP, if necessary or desirable, both contractually and in practice, including the estimated risks, impediments to business continuity, costs and time frame for doing so (‘substitutability’);
• f. the ability to reintegrate the function provided by TPSPs into the financial entity, if feasible, necessary, or desirable;
• g. the protection of data and the potential impact of a confidentiality breach or failure to ensure data availability and integrity on the financial entity and its clients, including but not limited to compliance with Regulation (EU) 2016/679 (⁵⁵ ).

⁵⁵ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, pp. 1 – 88, ELI: http://data.europa.eu/eli/reg/2016/679/oj).

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Normes associées

2. Exigences identifiées

3. Normes associées

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/