Guideline 11: Information exchanges between the Lead Overseer and competent authorities to ensure the follow-up of recommendations

11.1 The Lead Overseer should make available to the competent authorities of the financial entities using the ICT services provided by a critical ICT third-party service provider, the following information:

• a. Within 10 working days following the receipt by the Lead Overseer:
• - the notification of the critical ICT third-party service provider to follow the recommendations issued by the Lead Overseer and the remediation plan prepared by the critical ICT third-party service provider;
• - the reasoned explanation of the critical ICT third-party service provider for not following the recommendations;
• - the reports specifying the actions that have been taken or the remedies that have been implemented by the critical ICT third-party service provider according to Article 35(1)(c) of the DORA.
• b. Within 10 working days after the expiration of the 60 calendar days according to Article 42(1) of the DORA:

13

• - the fact that the critical ICT third-party service provider failed to send the notification within 60 calendar days after the issuance of recommendations to the critical ICT third-party service provider according to Article 35(1)(d) of the DORA.
• c. Within 10 working days after the adoption by the Lead Overseer:
• - the assessment as to whether the critical ICT third-party service provider ’ s explanation for not following the Lead Overseer’s recommendations is deemed sufficient and, if it is deemed sufficient, the Lead Overseer’s decision concerning amendment of recommendations¹¹ ;
• - the assessment of the reports specifying the actions that have been taken or the remedies that have been implemented by the critical ICT third-party service provider according to Articles 35(1)(c) of the DORA. In case the critical ICT third-party service provider has not adequately implemented the recommendations, the assessment should at least cover the criteria a) to d) of Article 42(8) of the DORA;
• - the decision imposing a periodic penalty payment on the critical ICT third-party service provider according to Article 35(6) of the DORA. If the Lead Overseer opted not to disclose the periodic penalty payment to the public as per Article 35(10) of the DORA, the competent authorities receiving the information should not disclose it to the public;
• - assessment as to whether the refusal of a critical ICT-third-party service provider to endorse recommendations, based on a divergent approach from the one advised by the Lead Overseer, could adversely impact a large number of financial entities, or a significant part of the financial sector.

11.2 In accordance with Article 42(10) of the DORA, the competent authorities should make available to the Lead Overseer the following information where critical ICT third party service providers have not endorsed in part or entirely recommendations addressed to them by the Lead Overseer:

• a. Within 10 working days following the adoption by the competent authority:
• - notification to the financial entity of the possibility of a decision being taken where a competent authority deems that a financial entity fails to take into account or to sufficiently address within its management of ICT third-party risk the specific risks identified in the recommendations issued by the Lead Overseer according to Article 42(4) of the DORA;
• - individual warnings issued by competent authorities according to Article 42(7) of the DORA and relevant information which allows the Lead Overseer to assess whether such

11 The Lead Overseer and the Joint Examination Team assess the critical ICT third party service provide r’s reasoned explanation for not following the recommendations. If the Lead Overseer decides that the explanation is deemed sufficient, the Lead Overseer may amend the respective recommendations. 14 warnings have resulted in consistent approaches mitigating the potential risk to financial stability.

• b. Within 10 working days following the consultation:
• - outcome of the consultation with NIS2 authorities prior to taking a decision, as referred to in Article 42(5) of the DORA , where possible.
• c. Within 10 working days following the receipt of the information from financial entities:
• - the material changes to existing contractual arrangements of financial entities with critical ICT third-party service providers which were made to address the risks identified in the recommendations issued by the Lead Overseer;
• - the start of executing exit strategies and transition plans of the financial entities as referred to in Article 28(8) of the DORA.

11.3 The ESAs, in consultation with competent authorities, should develop a template to facilitate the transmission of the information as defined in point 11.3.

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde standaarden

2. Geïdentificeerde eisen

3. Gerelateerde standaarden

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/