Article 59 Amendments to Regulation (EC) No 1060/2009
TL;DR
The EU Digital Operations Resilience Act regulates the operations of credit rating agencies. It mandates that credit rating agencies must have in place sound administrative and accounting procedures, internal control mechanisms, effective procedures for risk assessment and effective control and safeguard arrangements for managing ICT systems as per Regulation (EU) 2022/2554. It sets out that any failure to implement or maintain decision-making procedures or organisational structures as required by Regulation (EU) 2022/2554 are considered to be an infringement of Article 6(2).Regulation (EC) No 1060/2009 is amended as follows:
-
in Annex I, Section A, point 4, the first subparagraph is replaced by the following:
‘A credit rating agencymeans a credit rating agency as defined in Article 3(1), point (b), of Regulation (EC) No 1060/2009; shall have sound administrative and accounting procedures, internal control mechanisms, effective procedures for risk assessment, and effective control and safeguard arrangements for managing ICT systems in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*)
_____________
* Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resiliencemeans the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of the network and information systems which a financial entity uses, and which support the continued provision of financial services and their quality, including throughout disruptions; for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).’; -
in Annex III, point 12 is replaced by the following:
‘12. The credit rating agencymeans a credit rating agency as defined in Article 3(1), point (b), of Regulation (EC) No 1060/2009; infringes Article 6(2), in conjunction with point 4 of Section A of Annex I, by not having sound administrative or accounting procedures, internal control mechanisms, effective procedures for risk assessment, or effective control or safeguard arrangements for managing ICT systems in accordance with Regulation (EU) 2022/2554; or by not implementing or maintaining decision-making procedures or organisational structures as required by that point.’.