Company: BCDRF
Filing Date: 2025-03-03
Form Type: 6-K
Source: 0000891478-25-000057
Chunk: 19

Company: Banco Santander, S.A.
Filing Date: 2025-03-03
Form: 6-K
Chunk 19
---
 providers that provide services to financial institutions and also imposes common cybersecurity requirements. This regulation comprises five key pillars: Information and Communication Technologies (ICT) risk management; classification and reporting of incidents relating to ICT; digital

operational resilience tests; third-party risk management and information exchange between financial institutions.

The RTS and ITS (regulatory and implementation technical standards), which develop the DORA Regulation, have been finalized in 2024 and published in two batches. The first batch of the RTS covers the ICT risk management framework, the criteria for ICT incident classification, specification of the policy on ICT services which support essential functions(*) and the draft ITS on the register of information. The second batch covers the criteria for specifying threat-led penetration testing (TLPT)(*), the templates, content, format, deadlines and procedures for major ICT incident reports, criteria for determining the composition of the joint examination team (JET), harmonisation of the conditions for performing supervision activities, and guidelines on both cooperation on supervision and estimation of the costs generated by major ICT incidents. All these rules implementing the DORA Regulation have been published as Delegated Acts of the European Commission except for the two marked with (*), which are expected to be published in early 2025.

#### Payments
The regulatory framework, that reinforces payment services, has continued to make progress with the introduction of additional requirements for payment institutions in 2024, to strengthen the legal framework already established by the PSD2 and to adapt to users' requirements in recent years, with a growing trend for electronic payments.

The legislative package contains two proposals: an update to the Payment Services Directive (PSD3) and a Payment Services Regulation (PSR), which introduce changes in the foundational framework of the European payments market. The proposed directive (PSD3) addresses rules on authorisation, licensing and supervision of payment institutions (including those for electronic money), while the proposed regulation (PSR) focuses on rules on the provision of payment services by payment service providers (PSPs). Their approval is expected in the first half of 2025.

The Instant Payments Regulation came into force on 8 April 2024. It establishes measures to facilitate and universalise instant transfers in euro within the EU. The target of this regulation is for instant payments to be more accessible, secure and affordable for consumers and companies, allowing funds to be transferred within less than 10 seconds at any time of day between Member States. This regulation establishes a precise calendar for compliance with obligations. Specifically, payment service providers that are located in a Member State with