1. A third-party service provider to whom reporting obligations have been outsourced as referred to in Article 19(5) of Regulation (EU) 2022/2554 may use the template set out in Annex I to this Regulation to provide aggregated information about a major ICT-related incident impacting multiple financial entities in one single notification or report, and submit that notification or report to the competent authority on behalf of all impacted financial entities, provided that all of the following conditions are met:
|
(a)
|
the major ICT-related incident to be reported originates from or is being caused by a third-party ICT service provider;
|
|
(b)
|
that third-party service provider provides the relevant ICT service to more than one financial entity, or to a group;
|
|
(c)
|
the ICT-related incident is classified as major by each financial entity covered in the aggregated notification or report;
|
|
(d)
|
the major ICT-related incident affects financial entities within a single Member State and the aggregated report relates to financial entities which are supervised by the same competent authority;
|
|
(e)
|
competent authorities have explicitly permitted this type of financial entities to aggregate their reporting.
|