{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2024/1773 — RTS — ICT Third-Party Risk Policy [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-2/rts/2024-1773-ict-third-party-risk-policy/articles/5","url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1773-ict-third-party-risk-policy/articles/5","title":"Article 5 — Ex-ante risk assessment","family":"l2_unit_view","work_id":"spaces/dora/level-2/rts/2024-1773-ict-third-party-risk-policy","view_of":"/dora/level-2/rts/2024-1773-ict-third-party-risk-policy","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Commission Delegated Regulation (EU) 2024/1773, OJ L, 2024/1773, 25.6.2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj/eng","valid_from":"2024-07-15","valid_until":null,"content_id":"bbc1494054971b97","versions":["2024-07-15"],"version_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1773-ict-third-party-risk-policy/articles/5/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1773-ict-third-party-risk-policy/articles/5/versions/2026-10-26/rev/bbc1494054971b97","versions_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1773-ict-third-party-risk-policy/articles/5/versions","relations_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1773-ict-third-party-risk-policy/articles/5/relations","act_url":"https://www.headlesslaw.com/dora/level-2/rts/2024-1773-ict-third-party-risk-policy#art-5","source_line":"Commission Delegated Regulation (EU) 2024/1773 · binding · OJ L, 2024/1773, 25.6.2024 · dated 13 Mar 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-03-13","published_on":"2024-06-25","entry_into_force":"2024-07-15","locators":{"document_date":"CELLAR 32024R1773 work_date_document","published_on":"CELLAR 32024R1773 official-journal-act_date_publication","entry_into_force":"CELLAR 32024R1773 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dora/level-2/rts/2024-1773-ict-third-party-risk-policy","path":"/dora/level-2/rts/2024-1773-ict-third-party-risk-policy","name":"Commission Delegated Regulation (EU) 2024/1773","number":"2024/1773","celex":"32024R1773","title_official":"COMMISSION DELEGATED REGULATION (EU) 2024/1773 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers (Text with EEA relevance)","document_date":"2024-03-13"},"position":{"kind":"article","key":"5","index":5,"articles":11,"annexes":0},"prev":{"path":"/dora/level-2/rts/2024-1773-ict-third-party-risk-policy/articles/4","key":"4","title":"Article 4 — Main phases of the life cycle for the adoption and use of contractual arrangements"},"next":{"path":"/dora/level-2/rts/2024-1773-ict-third-party-risk-policy/articles/6","key":"6","title":"Article 6 — Due diligence"},"act_anchor":"#art-5"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg_del/2024/1773/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/dora/level-2/rts/2024-1773-ict-third-party-risk-policy.md","unit_text_sha256":"479f7271d2a67ca933764c895c1bfc03b72d985fe6e3073f7c1a7d736c3cb3d1","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/dora/level-2/rts/2024-1773-ict-third-party-risk-policy/art-5","kind":"article","key":"5","heading":"Article 5 — Ex-ante risk assessment","text":"## <a id=\"art-5\"></a>Article 5 — Ex-ante risk assessment\n\n1. <a id=\"art-5-p-1\"></a>The policy shall require that the business needs of the financial entity are defined before a contractual arrangement is concluded.\n2. <a id=\"art-5-p-2\"></a>The policy shall require that a risk assessment is conducted at financial entity level and, where applicable, at consolidated and sub-consolidated level before a contractual arrangement is concluded.\n\n    The risk assessment shall take into account all the relevant requirements laid down in Regulation (EU) 2022/2554 and applicable sectoral Union legislation. It shall consider, in particular, the impact of the provision of ICT services supporting critical or important functions by ICT third-party service providers on the financial entity and all the risks posed by the provision of those ICT services supporting critical or important functions by ICT third-party service providers, including the following:\\\n   <a id=\"art-5-p-2-a\"></a>a) operational risks;\\\n   <a id=\"art-5-p-2-b\"></a>b) legal risks;\\\n   <a id=\"art-5-p-2-c\"></a>c) ICT risks;\\\n   <a id=\"art-5-p-2-d\"></a>d) reputational risks;\\\n   <a id=\"art-5-p-2-e\"></a>e) risks linked to the protection of confidential or personal data;\\\n   <a id=\"art-5-p-2-f\"></a>f) risks linked to the availability of data;\\\n   <a id=\"art-5-p-2-g\"></a>g) risks linked to the location where the data is processed and stored;\\\n   <a id=\"art-5-p-2-h\"></a>h) risks linked to the location of the ICT third-party service provider;\\\n   <a id=\"art-5-p-2-i\"></a>i) ICT concentration risks at entity level.\\\n\n","marks":[],"text_hash":"479f7271d2a67ca933764c895c1bfc03b72d985fe6e3073f7c1a7d736c3cb3d1","revision":1}}