Article 42 8

(a)

the gravity and the duration of the non-compliance;

(b)

whether the non-compliance has revealed serious weaknesses in the critical ICT third-party service provider’s procedures, management systems, risk management and internal controls;

(c)

whether a financial crime was facilitated, occasioned or is otherwise attributable to the non-compliance;

(d)

whether the non-compliance has been intentional or negligent;

(e)

whether the suspension or termination of the contractual arrangements introduces a risk for continuity of the financial entity’s business operations notwithstanding the financial entity’s efforts to avoid disruption in the provision of its services;

(f)

where applicable, the opinion of the competent authorities designated or established in accordance with Directive (EU) 2022/2555 responsible for the supervision of an essential or important entity subject to that Directive, which has been designated as a critical ICT third-party service provider, requested on a voluntary basis in accordance with paragraph 5 of this Article.