Subject matter

These Guidelines specify the internal governance arrangements, including sound risk management that institutions, investment firms that do not meet all the conditions to qualify as small and non-interconnected under Article 12(1) of Regulation (EU) 2019/2033 (IFR) (¹⁸ ), payment institutions, electronic money institutions, issuers of asset-referenced tokens (ARTs) and creditors as defined in point (2) of Article 4 of Directive 2014/17/EU (Mortgage Credit Directive – MCD) (¹⁹ ) which are financial institutions should implement when they rely on third-party service providers (TPSPs) to provide non-ICT services supporting (²⁰ ) functions with a particular focus on critical or important functions. These Guidelines apply to non-ICT services (hereafter ‘ services ’ ) provided by TPSPs, other than those within the scope of Chapter V of Regulation (EU) 2022/2554 (DORA).

¹⁸ Regulation (EU) 2019/2033 of the European Parliament and of the Council of 27 November 2019 on the prudential requirements of investment firms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No 806/2014 (OJ L 314, 5.12.2019, pp. 1 – 63, ELI: http://data.europa.eu/eli/reg/2019/2033/oj).

¹⁹ Directive 2014/17/EU of the European Parliament and of the Council of 4 February 2014 on credit agreements for consumers relating to residential immovable property and amending Directives 2008/48/EC and 2013/36/EU and Regulation (EU) No 1093/2010 (OJ L 60, 28.2.2014, pp. 34 – 85, ELI: http://data.europa.eu/eli/dir/2014/17/oj).

²⁰ The wording ‘ support ’ by TPSPs may include the provision of the full function within the meaning of these guidelines.

The Guidelines specify how the arrangements referred to in the previous paragraph should be reviewed and monitored by competent authorities, in the context of Article 97 of Directive 2013/36/EU (CRD) on supervisory review and evaluation process (SREP), Article 36 of Directive 2019/2034/EU (IFD) (²¹ ), Article 9(3) of Directive (EU) 2015/2366 (PSD 2), Article 5(5) of Directive 2009/110/EC (EMD) (²² ) and Article 35(3) of Regulation (EU) 2023/1114 (MiCAR) (²³ ), thereby fulfilling the competent authorities’ duty to monitor the addressed entities' continuous compliance with the conditions of their authorization .

²¹ Directive (EU) 2019/2034 of the European Parliament and of the Council of 27 November 2019 on the prudential supervision of investment firms and amending Directives 2002/87/EC, 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU (OJ L 314, 5.12.2019, pp. 64 – 114, ELI: http://data.europa.eu/eli/dir/2019/2034/oj).

²² Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC (OJ L 267, 10.10.2009, pp. 7 – 17, ELI: http://data.europa.eu/eli/dir/2009/110/oj).

²³ Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (OJ L 150, 9.6.2023, pp. 40 – 205, ELI: http://data.europa.eu/eli/reg/2023/1114/oj).

The management of information and communication technology (ICT) risk and the use of TPSPs to provide ICT services as defined in Article 3(21) of Regulation (EU) 2022/2554 (DORA) (²⁴ ) are excluded from the scope of application of these Guidelines, as they fall within the scope of DORA. I n this regard, these Guidelines only cover the use of TPSPs that do not provide ICT services supporting critical or important functions under DORA. Consistency has been ensured with DORA and its relevant mandates; while DORA sets out the framework on the management of third-party risks with regard to ICT services, these Guidelines apply to the management of third-party risks with regard to non-ICT services. However financial entities should have a holistic approach covering the management of third-party risk with regard to both ICT and non-ICT services provided by third party service providers.

²⁴ Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, pp. 1-79, ELI: http://data.europa.eu/eli/reg/2022/2554/oj).