Commission Delegated Regulation (EU) 2024/1502 of 22 February 2024 supplementing Regulation (EU) 2022/2554
as it stood on 2024-02-22, permalink: /eu-eurlex/32024r1502/2024-02-22--3f343e985a47b9a25a518f5cbf5a3b33a85bfdf32e078e73bfabe630895c036c
Official publisher wording state selected for 2024-02-22.
This is the consolidated version dated 2024-02-22. Its interval on Lex's
publisher-version axis is publisher version 2024-02-22 → latest held; that is not a claim about
entry into force or application.
Text included, per-article reading view.
Deterministic extraction of the verbatim retrieved document; each displayed provision carries its own hash and anchor.
© European Union, 1998-2026. Reuse permitted with attribution under Commission Decision 2011/833/EU. Consolidated texts have no legal effect; only acts published in the Official Journal are authentic.
art_1
#art_1
Article 1
- When considering the criteria set out in Article 31(2) of Regulation (EU) 2022/2554 to designate an ICT third-party service provider that is critical for financial entities, the ESAs shall apply the following approach:
| (a) | as a first step, the ESAs shall assess whether the ICT third-party service provider fulfils all of the ‘step 1’ sub-criteria set out in Articles 2(1), 3(1), and 5(1); |
|---|
| (b) | as a second step, for those ICT third-party service providers that fulfil all of the ‘step 1’ sub-criteria referred to in point (a), the ESAs shall carry out their assessment in the light of the ‘step 2’ sub-criteria referred to in Articles 2(5), 3(4), 4(1), and 5(5). |
|---|
By way of derogation from the first sub paragraph, for the assessment of the criterion (c) of Article 31(2) of Regulation (EU) 2022/2554, the first step shall be covered by the assessment to be carried out for the criteria (a), (b) and (d) of Article 31(2) of Regulation (EU) 2022/2554.
- After the end of the time period for the submission of a reasoned statement referred to in Article 31(5), first subparagraph, of Regulation (EU) 2022/2554, the ESAs, through the Joint Committee and upon recommendation from the Oversight Forum, shall designate an ICT third-party service provider as critical for financial entities if it fulfils all the ‘step 1’ sub-criteria referred to in paragraph 1, point (a), and following a positive outcome of the assessment carried out in relation to the ‘step 2’ sub-criteria referred to in paragraph 1, point (b).
art_2
#art_2
Article 2
- When considering the criterion set out in Article 31(2), point (a), of Regulation (EU) 2022/2554, the ESAs shall assess whether the ICT third-party service provider fulfils the following ‘step 1’ sub-criteria:
| (a) | sub-criterion 1.1: share of the number of financial entities, broken down by categories of financial entities as listed in Article 2(1) of Regulation (EU) 2022/2554, to which ICT services are provided by the same ICT third-party service provider where the ICT services support critical or important functions; |
|---|
| (b) | sub-criterion 1.2: share of the total value of assets of financial entities, broken down by categories of financial entities as listed in Article 2(1) of Regulation (EU) 2022/2554, to which ICT services are provided by the same ICT third-party provider where the ICT services support critical or important functions of financial entities. |
|---|
- The sub-criterion 1.1 set out in paragraph 1, point (a), shall be calculated as follows:
| number of financial entities of a category of financial entitiesas set out in Article 2(1) of Regulation (EU) 2022/2554,to which ICT services are provided by the same ICT third party services providerwhere the ICT services support critical or important functions of financial entities |
|---|
| total number of financial entities of a category of financial entitiesas set out in Article 2(1) of Regulation (EU) 2022/2554 |
- The sub-criterion 1.2 set out in paragraph 1, point (b), shall be calculated as follows:
| total value of assets of financial entities of a category of financial entitiesas listed in Article 2(1) of Regulation (EU) 2022/2554,to which ICT services are provided by the same ICT third party providerwhere the ICT services support critical or important functions of financial entities |
|---|
| total value of assets of all EU financial entities of the same categoryas set out in Article 2(1) of Regulation (EU) 2022/2554 |
An ICT third-party service provider shall be considered as having fulfilled the ‘step 1’ sub-criteria referred to in paragraph 1 where both of the shares as calculated in accordance with paragraphs 2 and 3 are of at least 10 % of the total number for at least one category of financial entities as set out in Article 2(1) of Regulation (EU) 2022/2554.
When considering the criterion set out in Article 31(2), point (a), of Regulation (EU) 2022/2554 and where the ICT third-party service provider fulfils the ‘step 1’ sub-criteria referred to in paragraph 1 of this Article, the ESAs shall carry out their assessment in the light of the following ‘step 2’ sub-criteria:
| (a) | sub-criterion 1.3: the intensity of the impact of discontinuing the ICT services provided by the ICT third-party service provider on the activities and operations of financial entities identified in the ‘step 1’ sub-criteria referred to in paragraph 1 of this Article and the number of those financial entities affected; |
|---|
| (b) | sub-criterion 1.4: the dependence of the critical ICT third-party service provider on the same subcontractors providing ICT services supporting critical or important functions of financial entities. |
|---|
art_3
#art_3
Article 3
- When considering the criterion set out in Article 31(2), point (b), of Regulation (EU) 2022/2554, the ESAs shall assess whether the ICT third-party service provider fulfils the following ‘step 1’ sub-criteria:
| (a) | sub-criterion 2.1: number of global systemically important institutions (G-SIIs) and other systemically important institutions (O-SIIs) that are credit institutions to which ICT services are provided by the same ICT third-party service provider where the ICT services support critical or important functions; |
|---|
| (b) | sub-criterion 2.2: number of financial entities, other than credit institutions and G-SIIs and O-SIIs referred to in point (a) above, identified as systemic by competent authorities referred to under Article 46 of Regulation (EU) 2022/2554 to which ICT services are provided by the same ICT third-party service provider where the ICT services support critical or important functions. |
|---|
- An ICT third-party service provider shall be considered as having fulfilled the sub-criterion set out in paragraph 1, point (a), if the ICT services it provides are used at least by either of the following:
| (a) | one G-SII; |
|---|
| (b) | at least three O-SIIs; |
|---|
| (c) | at least one O-SII with an O-SII score above 3 000 calculated in accordance with Article 131(3) of Directive 2013/36/EU of the European Parliament and of the Council (2). |
|---|
- An ICT third-party service provider shall be considered as having fulfilled the sub-criterion set out in paragraph 1, point (b), if the ICT services that it provides are used at least by either of the following:
| (a) | one financial entity that is a financial entity as referred to in Article 2(1), points (g), (h), (i) or (j) of Regulation (EU) 2022/2554 and which is identified as ‘systemic’ by competent authorities; |
|---|
| (b) | at least three financial entities, other than credit institutions and than financial entities referred to in Article 2(1), points (g), (h), (i) or (j) of Regulation (EU) 2022/2554 and which are identified as ‘systemic’ by competent authorities. |
|---|
- When considering the criterion set out in Article 31(2), point (b), of Regulation (EU) 2022/2554 and where the ICT third-party service provider fulfils the ‘step 1’ sub-criteria referred to in paragraph 1 of this Article, the ESAs shall carry out their assessment in the light of the following ‘step 2’ sub-criterion:
| — | sub-criterion 2.3: G-SIIs or O-SIIs and other financial entities included in the assessment in the ‘step 1’ sub criteria referred to in paragraph 1 of this Article, including where those G-SIIs or O-SIIs provide financial infrastructure services to other financial entities, relying on an ICT service provided by the same ICT third-party service provider, are interdependent. |
|---|
art_4
#art_4
Article 4
When considering the criterion set out in Article 31(2), point (c), of Regulation (EU) 2022/2554, the ESAs shall carry out their assessment in the light of the following ‘step 2’ sub-criterion:
| — | sub-criterion 3.1: the ICT service provided ultimately by the same ICT third-party service provider supporting critical or important functions of financial entities is of a critical nature for the activities of the financial entities. |
|---|
art_5
#art_5
Article 5
- When considering the criterion set out in Article 31(2), point (d), of Regulation (EU) 2022/2554, the ESAs shall assess whether the ICT third-party service provider fulfils the following ‘step 1’ sub-criteria:
| (a) | sub-criterion 4.1: the share of the total number of financial entities, broken down by categories of financial entities as set out in Article 2(1) of Regulation (EU) 2022/2554, for which no alternative ICT third-party service provider is available which has the required capacity to provide the same ICT services that support critical or important functions of financial entities as the one provided by the relevant ICT third-party service provider; |
|---|
| (b) | sub-criterion 4.2: the share of the total number of financial entities, broken down by categories of financial entities as set out in Article 2(1) of Regulation (EU) 2022/2554, for which it is highly difficult to migrate an ICT service provided by the relevant ICT third-party service provider that supports critical or important functions of financial entities to another ICT third-party service provider. |
|---|
- The sub-criterion 4.1 set out in paragraph 1, point (a), shall be calculated as follows:
| number of financial entities of a category of financial entities as set out inArticle 2(1) of Regulation (EU) 2022/2554,for which no alternative ICT third party service provider is availablewhich has the required capacity to provide the same ICT servicesthat support critical or important functions of financial entitiesas the one provided by the relevant ICT third party service provider |
|---|
| total number of financial entities of that category of financial entitiesas set out in Article 2(1)of Regulation 2022/2554 |
- The sub-criterion set out in paragraph 1, point (b), shall be calculated as follows:
| number of financial entities of a category of financial entities as set out inArticle 2(1) of Regulation (EU) 2022/2554,for which it is highly difficult to migrate or reintegrate an ICT service providedby the ICT third party provider that supportcritical or important functions to another ICT third party provider |
|---|
| total number of EU financial entities of that category of financial entitiesas set out in Article 2(1) of Regulation (EU) 2022/2554 |
- An ICT third-party service provider shall be considered as having fulfilled both sub-criteria 4.1 and 4.2 where either of the following is met:
| (a) | the share of the total number of financial entities referred to in paragraph 1, point (a), is of at least 10 % of the total number of financial entities for a category of financial entities as set out in Article 2(1) of Regulation (EU) 2022/2554; |
|---|
| (b) | the share of the total number of financial entities referred to in paragraph 1, point (b), is of at least 10 % of the total number of financial entities or a category of financial entities as set out in Article 2(1) of Regulation (EU) 2022/2554. |
|---|
- When considering the criterion set out in Article 31(2), point (d), of Regulation (EU) 2022/2554 and where the ICT third-party service provider fulfils the ‘step 1’ sub-criteria referred to in paragraph 1 of this Article, the ESAs shall carry out their assessment in the light of the step two sub-criterion specified in Article 31(2), point (d)(i) of Regulation (EU) 2022/2554.
art_6
#art_6
Article 6
The ESAs shall use the data provided by the registers of information referred to in Article 28(3) of Regulation (EU) 2022/2554, for the assessment of the sub-criteria listed in Articles 2 to 5. The ESAs may also use additional available data they have at their disposal from all sources of information to perform the criticality assessment.
The ESAs shall take into account the most recent data available to them during the assessment year, or where applicable, the data that has been made available to them at the latest by 31 December of the year preceding the criticality assessment.
art_7
#art_7
Article 7
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
However, the Lead Overseer shall apply the sub-criterion 1.4 referred to in Article 2, paragraph 5, point (b) as of 16 January 2025.
Provenance and validity dates, identifier, hash
| as of | 2024-02-22 → this publisher state was selected |
| publisher state | publisher version 2024-02-22 → latest held publisher-asserted |
| type | REG_DEL Commission Delegated Regulation (EU) 2024/1502 of 22 February 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council by specifying the criteria for the designation of ICT third-party service providers as critical for financial entities |
| language | en |
| published | 2024-02-22 |
| lex_id | eu-eurlex:32024r1502:2024-02-22--3f343e985a47b9a25a518f5cbf5a3b33a85bfdf32e078e73bfabe630895c036c |
| record sha256 | 00355bd62fd8adc08d712fe30f9eed757fec168ed955b6dd0cdd6efa23c50b93 |
New here? What am I looking at?
This is an official consolidated text: the original act with later amendments merged by EUR-Lex for the date shown above.
The consolidation date is not an entry-into-force or application date. It identifies a publisher wording state. The authentic legal acts remain those published in the Official Journal; Lex preserves the consolidated wording, source and hashes as a reading and comparison aid.
Each displayed provision carries its own hash so you can verify that Lex served the indexed text unchanged, here is how.
| tier | A, publisher-supplied consolidated wording-state dates |
| history begins | publisher |
| index built | 2026-08-15T09:01:06Z · corpus e9c4df0981c855855a1a28218cf086ddeb5bb691 |
| stamp signature | valid (ECDSA-P256) |