11.3 Due diligence

Before entering into third-party arrangements and considering all the relevant risks related to the non-ICT services that will be performed by a TPSP, financial entities should ensure in their selection and assessment process that the prospective TPSP is suitable and that the level of details regarding the due diligence is proportionate to the criticality or importance of the relevant function.

Factors to be considered when conducting due diligence on a potential TPSP include, but are not limited to:

• a. its business model, nature, scale, complexity, financial soundness, ownership and group as well as organisational structure;
• b. operational and technical capability and track record, including, where possible, drawing on prior engagements or potential long relationships between the financial entity and the TPSP;
• c. whether the TPSP is a parent undertaking or subsidiary of the financial entity, is part of the accounting scope of consolidation of the institution, or is a member, or is owned by institutions that are members of the same institutional protection scheme to which the institution belongs;
• d. whether or not the TPSP is supervised by competent authorities.

With regard to critical and important functions (⁵⁶ ), financial entities should ensure that the TPSP has:

• a. the business reputation, appropriate and sufficient abilities, the expertise, the capacity, the resources to deliver the relevant service;
• b. appropriate internal controls and risk management processes and procedures, including its ability to manage operational risks, especially supply chain risks, when applicable;
• c. geographic dependencies and manage the related risks. These risks may relate to the economic, financial, political, legal, and regulatory environment in the jurisdiction(s) where the relevant service will be provided;
• d. business continuity plans, contingency plans, disaster recovery plans, and other relevant plans;
• e. if applicable, the required regulatory authorisation(s) or registration(s) to perform the critical or important function in a reliable and professional manner to meet its obligations over the duration of the contract;
• f. proper arrangements that ensure that it is effectively possible to conduct audits, including onsite, by the financial entity itself, appointed third parties, and competent authorities at the TPSP.

⁵⁶ Without prejudice of the conditions listed in Article 31(2) of Commission Delegated Regulation (EU) 2017/565.

The planned usage of subcontractors to perform services supporting critical or important functions or material parts thereof, is also to be considered.

Where the use of a TPSP involves the processing of personal or confidential data, financial entities should be satisfied that the TPSP implements appropriate technical and organisational measures to protect the data.

Financial entities should take appropriate steps to ensure that TPSPs act in a manner consistent with their values and code of conduct. With regard to TPSPs located in third countries and, if applicable, their subcontractors, financial entities should be satisfied that such TPSPs act in an ethical and socially responsible manner, including by taking into account environmental, social, and governance (ESG) risks, and adheres to international standards on human rights including the prohibition of child labour and, environmental protection