Criteria for designating critical service providers

To determine the systemic impact of the ICT third-party service provider means an undertaking providing ICT services; on the stability, continuity or quality of the provision of financial services it is of paramount importance to develop a clear view on the extent and nature of systemic impact which a large-scale operational failure of an ICT third-party service provider means an undertaking providing ICT services; would have on financial entitiesas defined in Article 2, points (a) to (t), which rely on services provided by an ICT third-party service provider means an undertaking providing ICT services;, and on the financial system. Therefore, it is appropriate to consider the number of financial entitiesas defined in Article 2, points (a) to (t) of a specific category of financial entitiesas defined in Article 2, points (a) to (t) using the same ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services;, as well as the value of their assets to assess whether it is relevant to consider the ICT third-party service provider means an undertaking providing ICT services; offering those ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; as critical. Furthermore, a qualitative assessment of the systemic importance and interconnectedness of ICT third-party service providers means an undertaking providing ICT services;, as well as the importance of the services provided by an ICT third-party provider on financial entitiesas defined in Article 2, points (a) to (t)’ provision of financial services taking into account the stability and the continuity of the services should be carried out to determine the systemic impact of the ICT third-party service provider means an undertaking providing ICT services; on the activities of financial entitiesas defined in Article 2, points (a) to (t).

To determine the systemic character and importance of the financial entitiesas defined in Article 2, points (a) to (t) relying on the ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services;, it is necessary to take into account the nature of those financial entitiesas defined in Article 2, points (a) to (t). Where financial entitiesas defined in Article 2, points (a) to (t) that are classified as G-SIIs and O-SIIs or that are identified as ‘systemic’ rely on the same ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; to support their critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;, it is appropriate to assess whether the ICT third-party service provider means an undertaking providing ICT services; providing those services should be considered as critical for the Union financial sector. The interconnectedness between financial entitiesas defined in Article 2, points (a) to (t) within the Union financial sector that rely on ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; provided by the same ICT third-party service provider means an undertaking providing ICT services; should also be assessed to determine the reliance of financial entitiesas defined in Article 2, points (a) to (t) on that ICT third-party service provider means an undertaking providing ICT services;.

The ICT services means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; supporting critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; of the financial entitiesas defined in Article 2, points (a) to (t) should be assessed in respect of their type and critical nature that are necessary for the financial entitiesas defined in Article 2, points (a) to (t) to run their activities without any disruptions.

To determine the degree of substitutability of the ICT third party service provider, it is necessary to take into account the number of ICT third-party service providers means an undertaking providing ICT services; active on a given market, the existence of alternative solutions for the same ICT service means an ICT service as defined in Article 2, point (13), of Regulation (EU) 2019/881;, as well as at the costs of migrating data and ICT workloads to other ICT third-party service providers means an undertaking providing ICT services; as part of the assessment to be carried out by the ESAsEuropean Supervisory Authority.

In order to ensure the soundness of the assessment process, it is important that the ESAsEuropean Supervisory Authority rely on the data from the registers of information referred to in Article 28(3) of Regulation (EU) 2022/2554, and any other readily available information, when assessing whether the ICT third-party service providers means an undertaking providing ICT services; should be designated as critical,