EBA Streamlines ICT Risk Management Requirements Under DORA: What You Need to Know
The European Banking Authority (EBA) has made significant updates to its Guidelines on ICT and security risk management, aligning them with the Digital Operational Resilience Act (DORA), which will come into effect on January 17, 2025. These revisions aim to streamline the ICT risk management framework while providing legal clarity to the financial sector.
Revisions to EBA Guidelines for ICT Risk Management
The EBA has narrowed the scope of its Guidelines, focusing specifically on the entities affected by DORA. This includes:
- Credit institutions
- Payment institutions
- Account information service providers
By doing so, the EBA aims to eliminate potential overlaps with existing regulations and ensure consistent ICT risk management practices across the board.
Key Changes in the Guidelines
One of the most notable changes in the revised Guidelines is the limited scope concerning the types of entities covered. The new focus includes:
- Credit institutions
- Payment institutions
- Exempted payment institutions
- Exempted e-money institutions
This revision excludes other types of payment service providers (PSPs) that do not fall under DORA. PSPs operating under the Payment Services Directive (PSD2) will continue to adhere to operational and security risk management requirements established since the directive’s implementation in 2018.
Focus on Relationship Management
Another significant adjustment in the Guidelines pertains to relationship management for payment service users. The EBA has streamlined the requirements to concentrate solely on the provision of payment services, thereby avoiding duplication of existing regulatory requirements.
Background of the Guidelines
The original Guidelines were published in November 2019 and were based on the provisions of:
- Article 74 of Directive 2013/36/EU (CRD)
- Article 95(3) of Directive (EU) 2015/2366 (PSD2)
These earlier guidelines outlined the ICT and security risk management requirements for various financial entities. The recent updates reflect the evolving regulatory landscape as the industry prepares for DORA’s implementation in January 2025.
For more information on EBA guidelines and the upcoming Digital Operational Resilience Act, visit the respective websites.
Stay informed about these critical changes in financial regulations to ensure compliance and effective risk management strategies in your organization.
