Third-party ICT service policy

Preamble (Recitals 1 – 13)

Recitals

Article 1

Overall risk profile and complexity

Article 2

Group application

Article 3

Governance arrangements

Article 4

Main phases of the life cycle for the adoption and use of contractual arrangements

Article 5

Ex-ante risk assessment

Article 6

Due diligence

Article 7

Conflicts of interest

Article 8

Contractual clauses

Article 9

Monitoring of the contractual arrangements

Article 10

Exit from and termination of the contractual arrangements

Article 11

Entry into force

Article 4 Main phases of the life cycle for the adoption and use of contractual arrangements

The policy shall specify the requirements, including the rules, the responsibilities and the processes, for each main phase of the lifecycle of the contractual arrangement, covering at least the following:

  1. the responsibilities of the management bodya management body as defined in Article 4(1), point (36), of Directive 2014/65/EU, Article 3(1), point (7), of Directive 2013/36/EU, Article 2(1), point (s), of Directive 2009/65/EC of the European Parliament and of the Council, Article 2(1), point (45), of Regulation (EU) No 909/2014, Article 3(1), point (20), of Regulation (EU) 2016/1011, and in the relevant provision of the Regulation on markets in crypto-assets, or the equivalent persons who effectively run the entity or have key functions in accordance with relevant Union or national law, including its involvement, as appropriate, in the decision-making process on the use of ICT servicesdigital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services supporting critical or important functionsa function the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law provided by ICT third-party service providersan undertaking providing ICT services;

  2. the planning of contractual arrangements, including the risk assessment, the due diligence as set out in Articles 5 and 6 and the approval process regarding new or material changes to contractual arrangements as set out in Article 8(4);

  3. the involvement of business units, internal controls and other relevant units in respect of contractual arrangements;

  4. the implementation, monitoring and management of contractual arrangements as referred to in Articles 7, 8 and 9, including at consolidated and sub-consolidated level, where applicable;

  5. the documentation and record-keeping, taking into account the requirements with regard to the register of information laid down in Article 28(3) of Regulation (EU) 2022/2554;

  6. the exit strategies and termination processes as set out in Article 10.

Table of contents