235. Competent authorities should consider both internal and external factors or events that might …

Competent authorities should consider both internal and external factors or events that might give rise to reputational concerns, excluding events that result in legal proceedings. For Category 1 and Category 2 institutions, competent authorities should consider all the following indicators in their assessment:

• a. negative media/social media coverage and consumer-association initiatives that could deteriorate the public perception and reputation of the institution;
• b. the number of and changes in customer complaints or sudden loss of customers or investors;
• c. negative events relating to the institution’s peers that the public could associate with the whole financial sector or a group of institutions;
• d. the reputation of individuals involved in the management of the institution or with qualifying shareholdings;
• e. involvement or operation in sectors or jurisdictions highly exposed to ML/TF or with individuals associated with high risk from an ML/TF perspective;
• f. involvement or operation in sectors or jurisdictions and/or with counterparties highly exposed to material issues or public controversies related to ESG factors, including but not necessarily limited to environmental factors;
• g. the reputational impact of ICT-related incidents as recorded by the institution in accordance to the Commission Delegated Regulation (EU) 2024/1772⁴⁷ ;
• h. other ‘market’ indicators, if available (e.g. rating downgrades or changes in the share price throughout the year).

⁴⁷ Commission Delegated Regulation (EU) 2024/1772 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents, C/2024/1519 (OJL, 2024/1772, 25.6.2024, ELI: http://data.europa.eu/eli/reg_del/2024/1772/oj).

1. Visão geral

1.1 Referências

1.2 Requisitos identificados

1.3 Normas relacionadas

2. Requisitos identificados

3. Normas relacionadas

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/