Info
🔗 Back to Summary. 🇫🇷 French Version: 2025R1190_FR.2. Back to Summary of LVL1. Direct link to EUR-LEX.
Article 1 – Definitions ⬅️ | ➡️ Article 3 – TCT and TLPT Test Managers
Article 2 - Identification of financial entities required to perform TLPT
1.
TLPT authorities shall assess whether any financial entity is required to perform TLPT, taking into account the impact of those financial entities, their systemic character and their ICT risk profile, on the basis of all of the following criteria:
(a)
impact-related and systemic character related factors:
(i)
the size of the financial entity, determined on the basis of whether the financial entity provides financial services in one or more Member States and by comparing the activities of the financial entity to those of other financial entities providing similar services;
(ii)
the extent and nature of the interconnectedness of the financial entity with other financial entities in the financial sector in one or more Member States;
(iii)
the criticality or importance of the services that the financial entity provides to the financial sector;
(iv)
the substitutability of the services that the financial entity provides;
(v)
the complexity of the business model of the financial entity and the related services and processes;
(vi)
whether the financial entity is part of a group of systemic character at Union or national level in the financial sector and sharing ICT systems;
(b)
ICT risk-related factors:
(i)
the risk profile of the financial entity;
(ii)
the threat landscape of the financial entity;
(iii)
the degree of dependence of critical or important functions or their supporting functions of the financial entity on ICT systems and processes;
(iv)
the complexity of the ICT architecture of the financial entity;
(v)
the ICT services and functions supported by ICT third-party service providers, and the quantity and type of contractual arrangements with ICT third-party service providers or ICT intra-group service providers;
(vi)
the outcomes of any supervisory reviews relevant for the assessment of the ICT maturity of the financial entity;
(vii)
the maturity of ICT business continuity plans and ICT response and recovery plans;
(viii)
the maturity of the operational ICT security detection and mitigation measures, including the ability to:
(1)
monitor the financial entity’s ICT infrastructure on a permanent basis;
(2)
detect ICT-related events in real time;
(3)
analyse the events referred to in point (2);
(4)
respond to the events referred to in point (2) in a timely and effective manner;
(ix)
whether the financial entity is part of a group active in the financial sector at Union or national level that shares ICT systems.
For the purposes of point (a)(i), the TLPT authority shall, where possible, consider:
(a)
the market share position of the financial entity at Union and national level;
(b)
the range of activities offered by the financial entity;
(c)
the market share of the services provided by the financial entity or of the activities undertaken at Union and national level.
For the purposes of point (a)(v), the TLPT authority shall, where possible, consider:
(a)
whether the financial entity operates more than one business model;
(b)
the interconnectedness of different business processes and the related services.
2.
TLPT authorities shall require all of the following financial entities to perform TLPT, unless the assessment referred to in paragraph 1 in respect of a financial entity indicates that its impact, the financial stability concerns relating to that financial entity, or its ICT risk profile, does not justify the performance of a TLPT:
(a)
credit institutions that meet any of the following conditions:
(i)
they have been identified as global systemically important institutions (G-SIIs) in accordance with EU of the European Parliament and of the Council
;
(ii)
they have been identified as other systemically important institutions (O-SIIs) in accordance with EU;
(iii)
they are part of a G-SIIs or O-SIIs;
(b)
payment institutions that exceeded in each of the 2 calendar years preceding the assessment by the TLPT authority EUR 150 billion of total value of payment transactions as defined in 2366 of the European Parliament and of the Council
;
(c)
electronic money institutions that exceeded in each of the 2 calendar years preceding the assessment by the TLPT authority either EUR 150 billion of total value of payment transactions as defined in 2366 or EUR 40 billion of total value of the amount of outstanding electronic money;
(d)
central securities depositories;
(e)
central counterparties;
(f)
trading venues with an electronic trading system that meet any of the following criteria:
(i)
the trading venue has the highest market share in terms of turnover at national level in each of the 2 calendar years preceding the assessment by the TLPT authority in any of the following:
(1)
transferable securities as defined in Article 4(1), point (44)(a), of Directive 2014/65/EU of the European Parliament and of the Council
;
(2)
transferable securities as defined in Article 4(1), point (44)(b), of Directive 2014/65/EU;
(3)
derivatives as defined in 2014 of the European Parliament and of the Council
;
(4)
structured finance products as defined in 2014;
(5)
emission allowances as referred to in Section C, point (11), of Annex I to EU;
(ii)
the trading venue has a market share in terms of turnover at Union level that exceeds 5 % in each of the 2 calendar years preceding the assessment by the TLPT authority in any of the following:
(1)
shares in companies and other securities equivalent to shares in companies, partnerships or other entities, and depositary receipts in respect of shares;
(2)
bonds or other forms of securitised debt, including depositary receipts in respect of such securities;
(3)
derivatives as defined in 2014,
(4)
structured finance products as defined in 2014;
(5)
emission allowances as referred to in Section C, point (11), of Annex I to EU;
(g)
insurance and reinsurance undertakings that meet all the following criteria:
(i)
they have a gross written premium (GWP) that exceeds EUR 1 500 000 000;
(ii)
they have technical provisions that exceed EUR 10 000 000 000;
(iii)
insurance undertakings that pursue only life activities or that pursue both life and non-life activities and that have total assets that exceed 3,5 % of the sum of the total assets valuated in accordance with EC of the European Parliament and of the Council
of the insurance and reinsurance undertakings established in the Member State.
For the purposes of (f)(ii), where the trading venue is part of a group sharing ICT systems or the same ICT intra-group service provider, the turnover of the securities and derivatives contracts on all trading venues pertaining to the same group and established in the Union shall be considered.
For the purposes of point (g), TLPT authorities shall identify a subset of all insurance and reinsurance undertakings by applying the criteria laid down in points (g)(i), (ii), and (iii). Insurance and reinsurance undertakings included in that subset shall be required to perform TLPT where they also meet any of the following criteria:
(a)
gross written premium (GWP) that exceeds EUR 3 000 000 000;
(b)
technical provisions that exceed EUR 30 000 000 000;
(c)
total assets that exceed 10 % of the sum of the total assets valuated in accordance with EC of the insurance and reinsurance undertakings established in the Member State.
3.
Where more than one financial entity belonging to the same group and sharing ICT systems, or where more than one financial entity using the same ICT intra-group service provider, meet the criteria set out in paragraph 2, the TLPT authorities of those financial entities shall, in accordance with Article 16(2), decide whether the requirement to perform TLPT on an individual basis is relevant for those financial entities. Where the TLPT authority of the parent undertaking of a group of financial entities referred to in the first subparagraph is different from the TLPT authorities of the financial entities of the group, that authority shall be consulted by the TLPT authorities of the financial entities belonging to that group on whether it is appropriate to perform TLPT on an individual basis.