Skip to the text
In this act Article 25 of 32

Article 25 — Information on digital operational resilience (Article 27da(2), points (a), (b) and (l), of Regulation (EU) No 600/2014)

Financial servicesLevel 2RTSMiFIRIn forceOfficial source

25(1)

1.An applicant seeking authorisation to operate a CT pursuant to Article 27db of Regulation (EU) No 600/2014 shall include in its application for authorisation evidence of compliance with the requirements on ICT risk management organisation and capabilities, operational resilience strategy and testing, incident management and ICT third-party risk monitoring under Regulation (EU) 2022/2554.

Copy link
25(2)

2.The information set out in paragraph 1 shall include documents regarding the applicant’s arrangements, in accordance with Regulation (EU) 2022/2554, on:

Copy link
25(2)(a)
(a)ICT risk management;
Copy link
25(2)(b)
(b)ICT-related incident management;
Copy link
25(2)(c)
(c)digital operational resilience testing;
Copy link
25(2)(d)
(d)ICT third-party risk monitoring.
Copy link
25(3)

3.The information set out in paragraph 1 shall take into account the size and overall risk profile, and the nature, scale and complexity of the applicant’s services, activities and operations.

Copy link