Criteria for designating critical service providers

To determine the systemic impact of the ICT third-party service provider on the stability, continuity or quality of the provision of financial services it is of paramount importance to develop a clear view on the extent and nature of systemic impact which a large-scale operational failure of an ICT third-party service provider would have on financial entities, which rely on services provided by an ICT third-party service provider, and on the financial system. Therefore, it is appropriate to consider the number of financial entities of a specific category of financial entities using the same ICT services, as well as the value of their assets to assess whether it is relevant to consider the ICT third-party service provider offering those ICT services as critical. Furthermore, a qualitative assessment of the systemic importance and interconnectedness of ICT third-party service providers, as well as the importance of the services provided by an ICT third-party provider on financial entities’ provision of financial services taking into account the stability and the continuity of the services should be carried out to determine the systemic impact of the ICT third-party service provider on the activities of financial entities.

To determine the systemic character and importance of the financial entities relying on the ICT services, it is necessary to take into account the nature of those financial entities. Where financial entities that are classified as G-SIIs and O-SIIs or that are identified as ‘systemic’ rely on the same ICT services to support their critical or important functions, it is appropriate to assess whether the ICT third-party service provider providing those services should be considered as critical for the Union financial sector. The interconnectedness between financial entities within the Union financial sector that rely on ICT services provided by the same ICT third-party service provider should also be assessed to determine the reliance of financial entities on that ICT third-party service provider.

The ICT services supporting critical or important functions of the financial entities should be assessed in respect of their type and critical nature that are necessary for the financial entities to run their activities without any disruptions.

To determine the degree of substitutability of the ICT third party service provider, it is necessary to take into account the number of ICT third-party service providers active on a given market, the existence of alternative solutions for the same ICT service, as well as at the costs of migrating data and ICT workloads to other ICT third-party service providers as part of the assessment to be carried out by the ESAs.

In order to ensure the soundness of the assessment process, it is important that the ESAs rely on the data from the registers of information referred to in Article 28(3) of Regulation (EU) 2022/2554, and any other readily available information, when assessing whether the ICT third-party service providers should be designated as critical,