COMMISSION DELEGATED REGULATION (EU) …/... supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the detaile...

EUROPEAN COMMISSION Brussels, 13.3.2024 C(2024) 1531 final COMMISSION DELEGATED REGULATION (EU) …/... of 13.3.2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers (Text with EEA relevance) EXPLANATORY MEMORANDUM 1. CONTEXT OF THE DELEGATED ACT Article 28(2) of Regulation 2022/2554 on digital operational resilience for the financial sector (“DORA”) requires from financial entities that: “as part of their ICT risk management framework, financial entities [...] shall adopt, and regularly review, a strategy on ICT thirdparty risk […].The strategy on ICT third-party risk shall include a policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers and shall apply on an individual basis and, where relevant, on a sub-consolidated and consolidated basis…”. In accordance with Article 28 (10) of DORA, “the ESAs shall, through the Joint Committee, develop draft regulatory technical standards to further specify the detailed content of the policy … in relation to the contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers”. This...