Skip to the text
In this act Article 7 of 32

Article 7 — Information on digital operational resilience (Article 27d(1) of Regulation (EU) No 600/2014)

Financial servicesLevel 2RTSMiFIRIn forceOfficial source

7(1)

1.An applicant seeking authorisation to operate an APA or an ARM pursuant to Article 27d of Regulation (EU) No 600/2014 shall include in its application for authorisation evidence of compliance with the requirements on ICT risk management organisation and capabilities, operational resilience strategy and testing, incident management and ICT third-party risk management under Regulation (EU) 2022/2554.

Copy link
7(2)

2.The information set out in paragraph 1 shall include documents regarding the applicant’s arrangements, in accordance with Regulation (EU) 2022/2554, on:

Copy link
7(2)(a)
(a)ICT risk-management;
Copy link
7(2)(b)
(b)ICT-related incident management;
Copy link
7(2)(c)
(c)digital operational resilience testing;
Copy link
7(2)(d)
(d)ICT third-party risk monitoring.
Copy link
7(3)

3.The information set out in paragraph 1 shall take into account the size and overall risk profile, and the nature, scale and complexity of the applicant’s services, activities and operations.

Copy link

SECTION II — Organisational requirements for APAs and ARMs — (Article 27g(1), (3) and (5), Article 27i(2) and (4) of Regulation (EU) No 600/2014)