Commission Delegated Regulation (EU) 2025/532 of 24 March 2025 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards sp...

Official Journal of the European Union 2025/532 2.7.2025 COMMISSION DELEGATED REGULATION (EU) 2025/532 of 24 March 2025 EN L series supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions (Text with EEA relevance) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (1), and in particular Article 30(5), fourth subparagraph, thereof, Whereas: (1) The provision of ICT services to financial entities often depends on a complex chain of ICT subcontractors, whereby ICT third-party service providers may enter into one or more subcontracting arrangements with other ICT thirdparty service providers. Indirect reliance on ICT subcontractors may have an impact on a financial entity’ ability to identify, assess, and manage its risks, including risks that are related to gaps in the information provided by ICT third-party service providers, and to the limited ability of a financial entity to obtain information from those...