Article 5 — Applications for authorisation — compare
Showing 4 of 4Release 10 Nov 2026Details
- Coverage
- Not covered: national guidance, court decisions.
- Freshness
- Release 2d86bd12 published 10 Nov 2026, 17:06 CET. Verified against EUR-Lex on 9 Nov 2026.
- Shown
- Showing 4 of 4
- Failures
- None.
- Incomplete
- No.
- From
- 8 April 2024 · Consolidated version of 8 April 2024 · Verified 9 Nov 2026 · Official source
- To
- 11 November 2026 · Consolidated version of 17 January 2025 · Verified 9 Nov 2026 · Official source
5(1)(e)
(e)a description of the applicant’s governance arrangements and internal control mechanisms, including administrative, risk management and accounting procedures as well as arrangements for the use of ICT services in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council, which demonstrates that those governance arrangements, control mechanisms and procedures and internal control mechanisms are proportionate, appropriate, sound and adequate;
5(1)(f)
(f)a description of the procedure in place to monitor, handle and follow up a security incident and security related customer complaints, including an incidentsincident reporting mechanism which takes account of the notification obligations of the payment institution laid down in Article 96Chapter III of Regulation (EU) 2022/2554;
5(1)(h)
(h)a description of business continuity arrangements including a clear identification of the critical operations, effective contingency ICT business continuity policy and plans and ICT response and recovery plans and a procedure to regularly test and review the adequacy and efficiency of such plans in accordance with Regulation (EU) 2022/2554;
The security control and mitigation measures referred to in point (j) of the first subparagraph shall indicate how they ensure a high level of digital operational resilience in accordance with Chapter II of Regulation (EU) 2022/2554, in particular in relation to technical security and data protection, including for the software and ITICT systems used by the applicant or the undertakings to which it outsources the whole or part of its operations. Those measures shall also include the security measures laid down in Article 95(1) of this Directive. Those measures shall take into account EBA’s guidelines on security measures as referred to in Article 95(3) of this Directive, when in place.