Third-party ICT service policy

Preamble (Recitals 1 – 13)

Recitals

Article 1

Overall risk profile and complexity

Article 2

Group application

Article 3

Governance arrangements

Article 4

Main phases of the life cycle for the adoption and use of contractual arrangements

Article 5

Ex-ante risk assessment

Article 6

Due diligence

Article 7

Conflicts of interest

Article 8

Contractual clauses

Article 9

Monitoring of the contractual arrangements

Article 10

Exit from and termination of the contractual arrangements

Article 11

Entry into force

Article 5 Ex-ante risk assessment

  1. The policy shall require that the business needs of the financial entity are defined before a contractual arrangement is concluded.

  2. The policy shall require that a risk assessment is conducted at financial entity level and, where applicable, at consolidated and sub-consolidated level before a contractual arrangement is concluded.

    The risk assessment shall take into account all the relevant requirements laid down in Regulation (EU) 2022/2554 and applicable sectoral Union legislation. It shall consider, in particular, the impact of the provision of ICT servicesdigital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services supporting critical or important functionsa function the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law by ICT third-party service providersan undertaking providing ICT services on the financial entity and all the risks posed by the provision of those ICT servicesdigital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services supporting critical or important functionsa function the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law by ICT third-party service providersan undertaking providing ICT services, including the following:

    1. operational risks;

    2. legal risks;

    3. ICT risksany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment;

    4. reputational risks;

    5. risks linked to the protection of confidential or personal data;

    6. risks linked to the availability of data;

    7. risks linked to the location where the data is processed and stored;

    8. risks linked to the location of the ICT third-party service provideran undertaking providing ICT services;

    9. ICT concentration risksan exposure to individual or multiple related critical ICT third-party service providers creating a degree of dependency on such providers so that the unavailability, failure or other type of shortfall of such provider may potentially endanger the ability of a financial entity to deliver critical or important functions, or cause it to suffer other types of adverse effects, including large losses, or endanger the financial stability of the Union as a whole at entity level.

Table of contents