Subject matter and scope of application

These Guidelines, drawn up pursuant to Article 107(3) of Directive 2013/36/EU⁵ aim to ensure the convergence of supervisory practices in the assessment of the information and communication technology (ICT) risk under the supervisory review and evaluation process (SREP) referred to in Article 97 of Directive 2013/36/EU and further specified in the EBA Guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP)⁶ . In particular these Guidelines specify the assessment criteria that competent authorities should apply in the supervisory assessment of institutions’ governance and strategy on ICT and the supervisory assessment of institutions’ ICT risk exposures and controls. These Guidelines form an integral part of the EBA SREP Guidelines.

Competent authorities should apply these Guidelines in line with the level of application of SREP specified in the EBA SREP Guidelines and in accordance with the minimum engagement model and proportionality requirements established therein.