47. The management body of a financial entity that has third-party arrangements in place or plans …

The management body of a financial entity⁴⁸ that has third-party arrangements in place or plans on entering into such arrangements should approve a written policy on the use of non-ICT related services supporting critical or important functions provided by TPSP. The management body should review it at least once a year and, update it where relevant. Changes made to the policy should be implemented in a timely manner and as soon as it is possible within the relevant contractual arrangements. The management body should also ensure the policy’s implementation, as applicable, on an individual, sub-consolidated, and consolidated basis.

⁴⁸ See also the EBA Guidelines on the security measures for operational and security risks of payment services under PSD2, available under: https://www.eba.europa.eu/regulation-and-policy/payment-services-and-electronic-money/guidelines-on-security-measures-for-operational-and-security-risks-under-the-psd2.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Standard correlati

2. Requisiti identificati

3. Standard correlati

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/