Joint examination teams

Preamble (Recitals 1 – 10)

Recitals

Article 1

Tasks of the members of a joint examination team

Article 2

Establishment of a joint examination team

Article 3

Members of the joint examination team

Article 4

Renewal of the membership in the joint examination team

Article 5

Working arrangements of the members of the joint examination team

Article 6

Entry into force

Article 2Note: This article is based on the final draft from the ESAs and is not yet adopted. Establishment of a joint examination team

  1. After the first designation of the ICT third-party service providermeans an undertaking providing ICT services; as critical in accordance with Article 31(1) of Regulation (EU) 2022/2554, the Lead Overseermeans the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation;, in agreement with the joint oversight network, shall establish the joint examination team responsible to carry out the oversight activities concerning the assigned critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31;.

  2. When material changes regarding the critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31; occur, the Lead Overseermeans the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation; may consider to update the composition of the joint examination team responsible to carry out the oversight activities concerning the assigned critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31;.

    For the purpose of this paragraph, material changes regarding the critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31; relate to:

    1. the services provided by critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31;;

    2. the activities performed by financial entitiesas defined in Article 2, points (a) to (t) supported by ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; of the critical ICT third-party service providermeans an ICT third-party service provider designated as critical in accordance with Article 31;; or

    3. the list of critical ICT third-party service providersmeans an ICT third-party service provider designated as critical in accordance with Article 31; at Union level referred in Article 31(9) or Regulation (EU) 2022/2554.

  3. The Lead Overseermeans the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation; shall identify the number of members of the joint examination team and its composition according to Article 3(1), and depending on the envisaged level of intensity of oversight activities to be performed in relation to all critical ICT third-party service providersmeans an ICT third-party service provider designated as critical in accordance with Article 31;.

  4. The authorities referred to in Article 40(2) of Regulation (EU) 2022/2554 shall nominate one or more individuals from their staff to be appointed as members of the joint examination team. An individual may be nominated and appointed as member of one or more joint examination teams.

  5. The Lead Overseermeans the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation; shall appoint the nominated individuals as members of the joint examination team either on a full-time or on a part-time basis depending on their availability, the specific needs of the Lead Overseermeans the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation;, and the agreement between the nominating authority and the Lead Overseermeans the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation;.

  6. When nominating the members of the joint examination teams, the authorities shall assess their technical expertise, qualifications and skills in ICT and relevant areas, including communication and collaboration skills, as well as audit and supervision skills.

  7. The Lead Overseermeans the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation; may require the nominating authorities to modify their nominations only in justified circumstances and when the profiles of the nominated individuals do not match the profile of the resources needed.

  8. The Lead Overseermeans the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation; and the authorities shall take all appropriate and possible measures to ensure the joint examination team is staffed adequately in accordance with the annual individual oversight plan.

Table of contents