Response to consultation on draft Guidelines on the sound management of third-party risk

Go back

Question n. 1 for Public Consultation: Are subject matter, scope of application, definitions and transitional arrangements appropriate and sufficiently clear? 

NA

Question n. 2 for Public Consultation: Is Title II appropriate and sufficiently clear?

NA

Question n. 3 for Public Consultation: Are Sections 5 to 10 (Title III) of the Guidelines sufficiently clear and appropriate?

 With reference to paragraph 61 of section 10 Documentation requirements, we would like to ask whether the five-year period during which financial entities must retain documentation relating to ended third-party agreements within the Register and the supporting documentation, should be understood as applying retroactively or only from the date of entry into force of the EBA Guidelines. 

We believe that this requirement should apply only from the date of entry into force of the EBA Guidelines, in line with what had previously been established for the Register of Information under the DORA Regulation (EU) 2022/2554, as set out in Article 3, paragraph 3 of the first version of ITS 85 dated 10 January 2024: 

“Financial entities shall maintain the information in the register of information in relation to contractual arrangements that are terminated for at least 5 years after the termination of the provision of the ICT services. This requirement shall apply to the contractual arrangements in force from the date of application of Regulation (EU) 2022/2554.”  

This provision, before being removed, required financial entities to retain in the RoI information relating to terminated ICT agreements for at least five years, and explicitly clarified that the requirement applied only to contractual arrangements in force from the date of application of DORA Regulation. 

Question n. 4 for Public Consultation: Is Title IV of the Guidelines appropriate and sufficiently clear?

NA

Question n. 5 for Public Consultation: Is Annex I, provided as a list of non-exhaustive examples, appropriate and sufficiently clear?

NA

Name of the organization

Deloitte Advisory S.r.l. S.B.