Subcontracting ICT services

Preamble (Recitals 1 – 19)

Recitals

Article 1

Overall risk profile and complexity

Article 2

Group application

Article 3

Due diligence and risk assessment regarding the use of subcontractors supporting critical or important functions

Article 4

Description and conditions under which ICT services supporting a critical or important function may be subcontracted

Article 5

Conditions for subcontracting relating to the chain of ICT subcontractors providing a service supporting a critical or important function by the financial entity

Article 6

Material changes to subcontracting arrangements of ICT service supporting critical or important functions

Article 7

Termination of the contractual arrangement

Article 8

Entry into force

Article 7Note: This article is based on the final draft from the ESAs and is not yet adopted. Termination of the contractual arrangement

Without prejudice to Article 28 paragraph (7) of Regulation (EU) 2022/2554, the financial entity has a right to terminate the agreement with the ICT third-party service providermeans an undertaking providing ICT services; in each of the following cases:

  1. when the ICT third-party service providermeans an undertaking providing ICT services; implements material changes to subcontracting arrangements regarding the provision of ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; supporting critical or imporant functions despite the objection and request for modifications to the changes by the financial entity referred to in Article 6;

  2. when the ICT third-party service providermeans an undertaking providing ICT services; implements material changes to subcontracting arrangements supporting critical or important functionsmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; before the end of the notice period without explicit approval by the financial entity, as referred to in Article 6;

  3. when the ICT third-party service providermeans an undertaking providing ICT services; subcontracts an ICT service supporting a critical or important functionmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; not explicitly permitted to be subcontracted by the contractual agreement.

Table of contents