LegalizeCommission Implementing Regulation (EU) 2024/2956 of 29 November 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to standard templates for the register of information
| Column Code | Column Name | Type | Fill-in Instruction | Fill-in Option |
|---|---|---|---|---|
| B_07.01.0010 | Contractual arrangement reference number | Alphanumerical | As reported in B_02.01.0010 | Mandatory |
| B_07.01.0020 | Identification code of the ICT third-party service provider | Alphanumerical | As reported in B_05.01.0010 | Mandatory |
| B_07.01.0030 | Type of code to identify the ICT third-party service provider | Pattern | As reported in B_05.01.0020 | Mandatory |
| B_07.01.0040 | Type of ICT services | Closed set of options | One of the types of ICT services referred to in Annex III | Mandatory |
| B_07.01.0050 | Substitutability of the ICT third-party service provider | Closed set of options | Use this column to provide the results of the financial entity’s assessment in relation to the degree of substitutability of the ICT third-party service provider to perform the specific ICT services supporting a critical or important function. One of the options in the following closed list shall be used: 1. Not substitutable; 2. Highly complex substitutability; 3. Medium complexity in terms of substitutability; 4. Easily substitutable. | Mandatory |
| B_07.01.0060 | Reason where the ICT third-party service provider is considered not substitutable or difficult to be substitutable | Closed set of options | One of the options in the following closed list shall be used: 1. The lack of real alternatives, even partial, due to the limited number of ICT third-party service providers active on a specific market, or the market share of the relevant ICT third-party service provider, or the technical complexity or sophistication involved, including in relation to any proprietary technology, or the specific features of the ICT third-party service provider’s organisation or activity; 2. Difficulties in relation to a partial or full migration of the relevant data and workloads from the relevant ICT third- party service provider to another ICT third-party service provider or by reintegrating them in the financial entity’s operations, due either to significant financial costs, time or other resources that the migration process may entail, or to an increased ICT risk or other operational risks to which the financial entity might be exposed; 3. Both reasons referred to in points 1 and 2. | Mandatory in case “not substitutable” or “highly complex substitutability” is selected in B_07.01.0041 |
| B_07.01.0070 | Date of the last audit on the ICT third-party service provider | Date | Use this column to provide the date of the last audit on the specific ICT services provided by the ICT third-party service provider. This column relates to audits conducted by any of the following: (a) the internal audit department or any other additional qualified personnel of the financial entity; (b) a joint team together with other clients of the same ICT third-party service provider (‘pooled audit’); (c) a third party appointed by the supervised entity to audit the service provider. This column does not relate to the reception or reference date of third-party certifications or internal audit reports of the ICT third-party service provider, the annual monitoring date of the arrangement by the financial entity or the date of review of the risk assessment performed by the financial entity. This column shall be used to report all types of audits performed by any of the subjects referred to in points (a), (b) and (c) concerning fully or partially the ICT services provided by the ICT third-party service provider. To report the date, the ISO 8601 (yyyy–mm–dd) code shall be used. Where no audit has been performed, it shall be filled in with ‘9999-12-31’. | Mandatory |
| B_07.01.0080 | Existence of an exit plan | [Yes/No] | Use this column to report the existence of an exit plan from the ICT third-party service provider in relation to the specific ICT service provided. One of the options in the following closed list shall be used: 1. Yes; 2. No. | Mandatory |
| B_07.01.0090 | Possibility of reintegration of the contracted ICT service | Closed set of options | One of the options in the following closed list shall be used: 1. Easy; 2. Difficult; 3. Highly complex. Use this column where the ICT service is provided by an ICT third-party service provider that is not an ICT intra-group service provider | Mandatory |
| B_07.01.0100 | Impact of discontinuing the ICT services | Closed set of options | Use this column to provide the impact for the financial entity of discontinuing the ICT services provided by the ICT third-party service provider according to the financial entity’s assessment. One of the options in the following closed list shall be used: 1. Low 2. Medium; 3. High; 4. Assessment not performed. | Mandatory |
| B_07.01.0110 | Are there alternative ICT third-party service providers identified? | Closed set of options | One of the options in the following closed list shall be used: 1. Yes; 2. No; 3. Assessment not performed. For each ICT third-party service provider supporting a critical or important function, the assessment to identify an alternative service provider shall be performed. | Mandatory |
| B_07.01.0120 | Identification of alternative ICT TPP | Alphanumerical | If ‘Yes’ is reported in B_07.01.0110, additional information may be provided in this column | Optional |
Instructions to complete template B_99.01 — Terminology used by financial entities using the ICT services
Financial entities shall provide entity-internal explanations, meanings, and definitions of the closed set of indicators and options used by them in the register of information.
| B_99.01.C0010 | B_99.01.C0020 | B_99.01.C0030 | B_99.01.C0040 | |
|---|---|---|---|---|
| Column Code | Column Name | Option | Description/Internal definition of the option | |
| B_99.01.R0010 | B_02.01.0020 | Type of contractual arrangement | 1. Standalone arrangement | |
| B_99.01.R0020 | B_02.01.0020 | Type of contractual arrangement | 2. Overarching arrangement | |
| B_99.01.R0030 | B_02.01.0020 | Type of contractual arrangement | 3. Subsequent or associated arrangement | |
| B_99.01.R0040 | B_02.02.0170 | Sensitiveness of the data stored by the ICT third-party service provider | 1. Low | |
| B_99.01.R0050 | B_02.02.0170 | Sensitiveness of the data stored by the ICT third-party service provider | 2. Medium | |
| B_99.01.R0060 | B_02.02.0170 | Sensitiveness of the data stored by the ICT third-party service provider | 3. High | |
| B_99.01.R0070 | B_06.01.0110 | Impact of discontinuing the function | 1. Low | |
| B_99.01.R0080 | B_06.01.0110 | Impact of discontinuing the function | 2. Medium | |
| B_99.01.R0090 | B_06.01.0110 | Impact of discontinuing the function | 3. High | |
| B_99.01.R0100 | B_07.01.0050 | Substitutability of the ICT third-party service provider | 1. Not substitutable | |
| B_99.01.R0110 | B_07.01.0050 | Substitutability of the ICT third-party service provider | 2. Highly complex substitutability | |
| B_99.01.R0120 | B_07.01.0050 | Substitutability of the ICT third-party service provider | 3. Medium complexity in terms of substitutability | |
| B_99.01.R0130 | B_07.01.0050 | Substitutability of the ICT third-party service provider | 4. Easily substitutable | |
| B_99.01.R0140 | B_07.01.0090 | Possibility of reintegration of the contracted ICT service | 1. Easy | |
| B_99.01.R0150 | B_07.01.0090 | Possibility of reintegration of the contracted ICT service | 2. Difficult | |
| B_99.01.R0160 | B_07.01.0090 | Possibility of reintegration of the contracted ICT service | 3. Highly complex | |
| B_99.01.R0170 | B_07.01.0100 | Impact of discontinuing the ICT services | 1. Low | |
| B_99.01.R0180 | B_07.01.0100 | Impact of discontinuing the ICT services | 2. Medium | |
| B_99.01.R0190 | B_07.01.0100 | Impact of discontinuing the ICT services | 3. High |
ANNEX II
List of activities by type of entity
| Type of entity | List of activities and services |
|---|---|
| (a) credit institutions | Activities listed in Annex I to Directive 2013/36/EU and activities listed in Section A and B of Annex I to Directive 2014/65/EU |
| (b) payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366 | Activities listed in Annex I to Directive (EU) 2015/2366 |
| (c) account information service providers | Account information services as referred to in point (8) of Annex I to Directive (EU) 2015/2366 |
| (d) electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC | Issuing electronic money in accordance with Directive 2009/110/EC and the activities listed in Annex I to Directive (EU) 2015/2366 |
| (e) investment firms | Investment services and activities listed in Section A and B of Annex I to Directive 2014/65/EU |
| (f) crypto-asset service providers authorised under Regulation (EU) 2023/1114 | Services and activities listed in Article 3, point (16), of Regulation (EU) 2023/1114 |
| (g) issuers of asset-referenced tokens authorised under Regulation (EU) 2023/1114 | Activities referred to in Article 16(1) of Regulation (EU) 2023/1114 |
| (h) central securities depositories | Activities listed in Annex to Regulation (EU) No 909/2014 of the European Parliament and of the Council [^E0004] |
| (i) central counterparties | Activity of central counterparties as defined in Article 2, point (1), of Regulation (EU) No 648/2012 |
| (j) trading venues | Activity of trading venues as defined in Article 4(21-24), of Directive 2014/65/EU |
| (k) trade repositories | Activities of trade repositories as defined in Article 2, point (2), of Regulation (EU) No 648/2012 and in Article 3, point (1), of Regulation (EU) No 2015/2365 of the European Parliament and of the Council [^E0005] |
| (l) managers of alternative investment funds | Activities listed in Article 6(4) and in Annex I to Directive 2011/61/EU of the European Parliament and of the Council [^E0006] |
| (m) management companies | Activities listed in Article 6(3) and in Annex II to Directive 2009/65/EC of the European Parliament and of the Council [^E0007] |
| (n) data reporting service providers | Services referred to in Article 2(1), points (34), (35) and (36), of Regulation (EU) No 600/2014 of the European Parliament and of the Council [^E0008] |
| (o) insurance and reinsurance undertakings | Activities authorised for (i) the classes of non-life insurance as referred to in Section B of Annex I to Directive 2009/138/EC of the European Parliament and of the Council [^E0009]: (ii) classes of life insurance as referred to in Annex II to that Directive: (iii) non-life reinsurance activities and (iv) life reinsurance activities as referred to in article 15(5) of that Directive. |
| (p) insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries | Activities of insurance and reinsurance distribution as defined in Article 2(1), points (1) and (2), of Directive (EU) 2016/97 of the European Parliament and of the Council [^E0010] |
| (q) institutions for occupational retirement provision | Activities of institutions for occupational retirement provision as referred to in Article 7 of Directive (EU) 2016/2341 of the European Parliament and of the Council [^E0011] |
| (r) credit rating agencies | Activities of credit rating agencies as referred to in Article 3(1), points (a) and (b), of Regulation (EC) No 1060/2009 of the European Parliament and of the Council [^E0012] |
| (s) administrators of critical benchmarks | Provision of benchmarks by administrators as defined in Article 3(1)(5) and 3(1)(6) of Regulation (EU) 2016/1011 of the European Parliament and of the Council, referring to critical benchmarks defined in Article 3(1), point (25), of that Regulation. |
| (t) crowdfunding service providers | Provision of crowdfunding services in accordance with Article 3 of Regulation (EU) 2020/1503 of the European Parliament and of the Council [^E0013] |
| (u) securitisation repositories | Activity of securitisation repositories as defined in Article 2, point (23), of Regulation (EU) 2017/2402 of the European Parliament and of the Council [^E0014] and Article 1(4-5) of Commission Delegated Regulation (EU) 2020/1230 [^E0015] |
| Non-financial entity: ICT intra-group service provider | Not applicable |
| Non-financial entity: Other intra-group entity | Not applicable |
| Non-financial entity: ICT third-party service provider | Not applicable |
Regulation (EU) No 909/2014 of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives 98/26/EC and 2014/65/EU and Regulation (EU) No 236/2012 (OJ L 257, 28.8.2014, p. 1, ELI: http://data.europa.eu/eli/reg/2014/909/oj).
Regulation (EU) 2015/2365 of the European Parliament and of the Council of 25 November 2015 on transparency of securities financing transactions and of reuse and amending Regulation (EU) No 648/2012 (OJ L 337, 23.12.2015, p. 1, ELI: http://data.europa.eu/eli/reg/2015/2365/oj).
Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010 (OJ L 174, 1.7.2011, p. 1, ELI: http://data.europa.eu/eli/dir/2011/61/oj).
Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS) (OJ L 302, 17.11.2009, p. 32, ELI: http://data.europa.eu/eli/dir/2009/65/oj).
Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Regulation (EU) No 648/2012 (OJ L 173, 12.6.2014, p. 84, ELI: http://data.europa.eu/eli/reg/2014/600/oj).
Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (OJ L 335, 17.12.2009, p. 1, ELI: http://data.europa.eu/eli/dir/2009/138/oj).
Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution (OJ L 26, 2.2.2016, p. 19, ELI: http://data.europa.eu/eli/dir/2016/97/oj).
Directive (EU) 2016/2341 of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (OJ L 354, 23.12.2016, p. 37, ELI: http://data.europa.eu/eli/dir/2016/2341/oj).
Regulation (EC) No 1060/2009 of the European Parliament and of the Council of 16 September 2009 on credit rating agencies (OJ L 302, 17.11.2009, p. 1, ELI: http://data.europa.eu/eli/reg/2009/1060/oj).
Regulation (EU) 2020/1503 of the European Parliament and of the Council of 7 October 2020 on European crowdfunding service providers for business, and amending Regulation (EU) 2017/1129 and Directive (EU) 2019/1937 (OJ L 347, 20.10.2020, p. 1, ELI: http://data.europa.eu/eli/reg/2020/1503/oj).
Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation and creating a specific framework for simple, transparent and standardised securitisation, and amending Directives 2009/65/EC, 2009/138/EC and 2011/61/EU and Regulations (EC) No 1060/2009 and (EU) No 648/2012 (OJ L 347, 28.12.2017, p. 35, ELI: http://data.europa.eu/eli/reg/2017/2402/oj).
Commission Delegated Regulation (EU) 202/1230 of 29 November 2019 supplementing Regulation (EU) 2017/2402 of the European Parliament and of the Council with regard to regulatory technical standards specifying the details of the application for registration of a securitisation repository and the details of the simplified application for an extension of registration of a trade repository (OJ L 289, 03.09.2020 p. 345) ELI: http://data.europa.eu/eli/reg/2020/1230/oj).
ANNEX III
Type of ICT services
When referring to a type of ICT services in the templates of the register of information, only the identifier (from S01 to S19) of the relevant type of ICT services shall be reported.
| Identifier | Type of ICT services | Description |
|---|---|---|
| S01 | 1. ICT project management | Provision of services related to Project Management Officer (PMO). |
| S02 | 2. ICT Development | Provision of services related to: business analysis, software design and development, testing. |
| S03 | 3. ICT help desk and first level support | Provision of services related to: helpdesk support and first level support on ICT incident |
| S04 | 4. ICT security management services | Provision of services related to: ICT security (protection, detection, response and recovering), including security incident handling and forensics. |
| S05 | 5. Provision of data | Subscription to the services of data providers. (digital data service) |
| S06 | 6. Data analysis | Provision of services related to the support for data analysis. (digital data service) |
| S07 | 7. ICT, facilities and hosting services (excluding Cloud services) | Provision of ICT infrastructure, facilities and hosting services, including the provision of utilities (energy, heat management etc.), telecom access and physical security (excluding cloud services), payment-processing activities, or operating payment infrastructures |
| S08 | 8. Computation | Provision of digital processing capabilities (including data computation), excluding the computation services performed in the context of a cloud environment. |
| S09 | 9. Non-Cloud Data storage | Provision of data storage platform (excluding cloud services). |
| S10 | 10. Telecom carrier | Operations for telecommunication systems and flow management. Traditional analogue telephone services are explicitly excluded pursuant to Article 3, point (21), of Regulation (EU) 2022/2554 |
| S11 | 11. Network infrastructure | Provision of network infrastructure |
| S12 | 12. Hardware and physical devices | Provision of workstations, phones, servers, data storage devices, appliances, etc. in a form of a service |
| S13 | 13. Software licencing (excluding SaaS) | Provision of software run on premises. |
| S14 | 14. ICT operation management (including maintenance) | Provision of services related to: infrastructure (systems and hardware except network) configuration, maintenance, installing, capacity management, business continuity management, etc. Including Managed Service Providers (MSP) |
| S15 | 15. ICT Consulting | Provision of intellectual / ICT expertise services. |
| S16 | 16. ICT Risk management | Verification of compliance with ICT risk management requirements in accordance with Article 6(10) of Regulation (EU) 2022/2554 |
| S17 | 17. Cloud services: IaaS | Infrastructure-as-a-Service |
| S18 | 18. Cloud services: PaaS | Platform-as-a-Service |
| S19 | 19. Cloud services: SaaS | Software-as-a-Service |
ANNEX IV
Instruction to report the “value of total assets”
| Type of entity | Instruction to report value of total assets in column B_01.02.0110 |
|---|---|
| (a) credit institutions | Information as specified in Template C40.00, Row 0410, Column 0010 of Annex X to Commission Implementing Regulation (EU) 2021/451 [^E0016] |
| (b) payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366 | Value of the total assets in the statutory accounts |
| (c) account information service providers | Value of the total assets in the statutory accounts |
| (d) electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC | Value of the total assets in the statutory accounts |
| (e) investment firms | Information as specified in template Z01.00, column 0090 of Annex I to Commission Implementing Regulation (EU) 2018/1624 [^E0017] |
| (f) crypto-asset service providers authorised under Regulation (EU) 2023/1114 | Value of the total assets in the statutory accounts |
| (g) issuers of asset-referenced tokens authorised under Regulation (EU) 2023/1114 | Value of the total assets in the statutory accounts |
| (h) central securities depositories | Value of the total assets in the audited financial statements reported to competent authorities pursuant to Article 41, point (a), of Commission Delegated Regulation (EU) 2017/392 [^E0018] |
| (i) central counterparties | Information as reported in "Public quantitative disclosure standards for central counterparties" of BIS/IOSCO, field 15.2 |
| (j) trading venues | Value of the total assets in the statutory accounts |
| (k) trade repositories | Value of the total assets in the statutory accounts |
| (l) managers of alternative investment funds | Value of the total assets in the statutory accounts |
| (m) management companies | Value of the total assets in the statutory accounts |
| (n) data reporting service providers | Value of the total assets in the statutory accounts |
| (o) insurance and reinsurance undertakings | Information as specified in Annex II and Template S02.01, Row 0500, Column 0010, of Annex III to Commission Implementing Regulation (EU) 2023/894 [^E0019] |
| (p) insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries | Value of the total assets in the statutory accounts |
| (q) institutions for occupational retirement provision | Total assets must equal the sum of all items separately identified on the assets side of the balance sheet and must also equal total liabilities |
| (r) credit rating agencies | Value of the total assets in the statutory accounts |
| (s) administrators of critical benchmarks | Value of the total assets in the statutory accounts |
| (t) crowdfunding service providers | Value of the total assets in the statutory accounts |
| (u) securitisation repositories | Value of the total assets in the statutory accounts |
| Non-financial entity: ICT intra-group service provider | Not applicable |
| Non-financial entity: Other intra-group entity | Not applicable |
| Non-financial entity: ICT third-party service provider | Not applicable |
Commission Implementing Regulation (EU) 2021/451 of 17 December 2020 laying down implementing technical standards for the application of Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to supervisory reporting of institutions and repealing Implementing Regulation (EU) No 680/2014 (OJ L 97, 19.3.2021, p. 1, ELI: http://data.europa.eu/eli/reg_impl/2021/451/oj).
Commission Implementing Regulation (EU) 2018/1624 of 23 October 2018 laying down implementing technical standards with regard to procedures and standard forms and templates for the provision of information for the purposes of resolution plans for credit institutions and investment firms pursuant to Directive 2014/59/EU of the European Parliament and of the Council, and repealing Commission Implementing Regulation (EU) 2016/1066 (OJ L 277, 7.11.2018, p. 1, ELI: http://data.europa.eu/eli/reg_impl/2018/1624/oj).
Commission Delegated Regulation (EU) 2017/392 of 11 November 2016 supplementing Regulation (EU) No 909/2014 of the European Parliament and of the Council with regard to regulatory technical standards on authorisation, supervisory and operational requirements for central securities depositories (OJ L 65, 10.3.2017, p. 48, ELI: http://data.europa.eu/eli/reg_del/2017/392/oj).
Commission Implementing Regulation (EU) 2023/894 of 4 April 2023 laying down implementing technical standards for the application of Directive 2009/138/EC of the European Parliament and the Council with regard to the templates for the submission by insurance and reinsurance undertakings to their supervisory authorities of information necessary for their supervision and repealing Implementing Regulation (EU) 2015/2450 (OJ L 120, 5.5.2023, p. 1, ELI: http://data.europa.eu/eli/reg_impl/2023/894/oj).
Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.
This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence.
EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.