11.1 Supervisory conditions for contracting with third-party service providers

Financial entities should ensure that the use of TPSPs to provide functions of banking activities or payment services, the issuance of ARTs as defined in Article 3(1), point (6) of Regulation (EU) 2023/1114, or investment services as defined in Article 4, point (2) of Directive 2014/65/EU, to an extent that the performance of that function requires authorisation or registration by a competent authority in the Member State where they are authorised, to a TPSP located in the same or different Member State or a third country takes place only if one of the following conditions is met:

• a. the TPSP is authorised or registered by a competent authority to perform such activities or services; or
• b. the TPSP is otherwise allowed to carry out those activities or services in accordance with the relevant national legal framework.

Without prejudice of the requirements established under Article 32 of the Commission Delegated Regulation (EU) 2017/565, financial entities should ensure that the use of TPSPs in a third country for the provision of functions of banking activities or payment services or the issuance of ARTs as defined in Article 3(1), point (6) of Regulation (EU) 2023/1114, to an extent that the performance of that function would require authorisation or registration by a competent authority in the Member State where the financial entity is authorised, takes place only if the following conditions are met:

• a. the TPSP is authorised or registered to provide that activity or service in the third country and is supervised by a relevant competent authority in that third country (referred to as a ‘ supervisory authority ’ );
• b. there is an appropriate cooperation agreement, e.g. in the form of a memorandum of understanding or college agreement, between the competent authorities responsible for the supervision of the financial entity and the supervisory authorities responsible for the supervision of the TPSP; and
• c. the cooperation agreement referred to in point (b) ensures that the competent authorities are able, at least, to:
• i. obtain, upon request, the information necessary to carry out their supervisory tasks pursuant to Directive 2013/36/EU, Directive (EU) 2015/2366, Directive 2009/110/EC, Directive 2014/65/EU, Directive (EU) 2019/2034, and Regulation (EU) 2023/1114;
• ii. obtain appropriate access to any data, documents, premises, or personnel in the third country that are relevant for the performance of their supervisory powers;
• iii. receive, as soon as possible, information from the supervisory authority in the third country for investigating apparent breaches of the requirements of Directive 2013/36/EU, Regulation (EU) No 575/2013, Directive (EU) 2015/2366, Directive 2009/110/EC, Directive 2014/65/EU, Directive (EU) 2019/2034, and Regulation (EU) 2023/1114; and
• iv. cooperate with the relevant supervisory authorities in the third country on enforcement in the case of a breach of the applicable regulatory requirements and national law in the Member State. Cooperation should include, but not necessarily be limited to, receiving information on potential breaches of the applicable regulatory requirements from the supervisory authorities in the third country as soon as is practicable.