EUROPEAN COMMISSION Brussels, 24.9.2020 SWD(2020) 198 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT REPORT

Accompanying the document Proposal for a Regulation of the European Parliament and of the Council on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014 and (EU) No 909/2014 {COM(2020) 595 final} - {SEC(2020) 307 final} - {SWD(2020) 199 final}



TABLE OF CONTENTS 1.Introduction 1.1.Political context 1.2.Market context 2.Problem definition and subsidiarity 2.1.Problem definition 2.1.1.Fragmentation in managing ICT risks 2.1.2.Ineffective reporting of and limited awareness about threats and incidents 2.1.3.Limited and uncoordinated testing 2.1.4.ICT third-party risks Problem tree 2.2.The EU's need to act and justification 2.2.1.Legal basis 2.2.2.Subsidiarity: Need for EU action 2.2.3.Subsidiarity: Added value of EU action 3.Objectives Table 2 – Intervention logic diagram 4.Options and assessment of policy options

4.1.Do nothing: No change in the EU financial services regulatory framework 4.1.1.Overall assessment of the current state of play and expected impact 4.2.Option 1: Strengthening financial institutions’ ability to absorb losses stemming from lack of digital operational resilience 4.2.1.Assessment of the impact 4.2.2.Overall assessment of the option 4.3.Option 2: A digital operational resilience act for the financial sector 4.3.1.Assessment of the impact 4.3.2.Overall assessment of the option 4.4.Option 3: A financial services digital operational resilience act together with centralised supervision of activities of critical ICT TPPs 4.4.1.Assessment of the impact 4.4.2.Overall assessment of the option 4.5.Comparison of options 4.6.Retained option 5.Other specific impacts of the retained policy option 5.1.Impacts on SMEs 5.2.Social impacts 5.3.Environmental impacts 6.Monitoring and evaluation Annex 1 – Procedural information 1.Lead DG, Decide planning / CWP references

2.Organisation and timing 3.Consultation of the Regulatory Scrutiny Board (RSB) 4.Evidence, sources and quality Annex 2 – Overview of the regulatory framework concerning digital operational resilience 1.ICT risk management 2.Incident notification 3.Testing 4.Third party risk Annex 3 – Synopis report on stakeholder consultations 1.Introduction67 2.Overview of respondents and responses 3.Summary of respondents’ feedback 3.1.ICT risk management requirements 3.2.ICT incident reporting requirements 3.3.Digital operational resilience testing 3.4.Addressing third party risk: oversight of TPPs (including outsourcing) 3.5.Other areas where EU action may be needed 3.6.Interaction with the NIS Directive 3.7.Potential impacts Annex 4 – Detailed provisions under the retained option

Annex 5 – Who is affected by the initiative and how? 1.Practical implications of the initiative 2.Summary of cost and benefits Annex 6 – Glossary



1.Introduction 1.1. Political context As stated by President von der Leyen in her Political Guidelines, and set out in the Communication ‘Shaping Europe’s digital future’, it is crucial that Europe can reap all the benefits of the digital age and strengthens its industry and innovation capacity, within safe and ethical boundaries. The European strategy for data sets out four pillars – data protection, fundamental rights, safety and cyber-security – as essential pre-requisites for a society empowered by data. New technologies are transforming the EU financial system and the way it provides services to Europe’s businesses and citizens. The socioeconomic consequences of the Covid-19 pandemic have also highlighted the importance of digital finance and the imperative of allowing business to be conducted remotely and through innovative digital technologies, wherever possible. Digitalisation and operational resilience in the financial sector are two sides of the same coin, as digital opportunities can also give rise to risks that need to be well understood and managed. It is of paramount importance for financial institutions to assure business continuity, confidence and the provision of services to consumers and the economy, both under normal operating conditions, and in particular under situations of stress (see Box 1 for further explanation on the concept of operational resilience). This is amply demonstrated by the operational challenges resulting from Covid-19 response measures. The Financial Stability Board (FSB) has also warned that the financial industry is at particular risk of cyber-attack during the Covid-19 outbreak given the increase in remote working, where continuity in delivering some products and services is ensured by employees working from home. Industry reports also highlight several other implications for financial institutions in this context, such as the large-scale shift to remote working and digital channels in a very short period of time, which led to higher demands on institutions’ digital infrastructure to replace manual operations, increased use of third party service providers (e.g. cloud service providers), employees working with sensitive data in less secure home-based environments, increased demand for quick and tailored crisis communication channels with all stakeholders (e.g. employees, customers, regulators), etc. In recent years, and because ICT risks know no borders, ICT risks have come onto the radar of national, European and international policy makers, regulators and standard-setting bodies in an attempt to enhance resilience, set standards and coordinate regulatory or supervisory work. This work has been carried out both across industries and in a sector specific manner for a number of sectors, including financial services. In the financial sector, the European Systemic Risk Board (ESRB) identified cyber risk as a source of systemic risk to the EU financial system, with the potential to have serious negative consequences for the real economy. The FSB has also stressed that risks to financial stability could arise from “interconnected IT systems between multiple financial institutions or between financial institutions and third-party service providers”. At international level, the Basel Committee on Banking Supervision (BCBS), Committee on Payments and Markets Infrastructures (CPMI), Financial Stability Board (FSB), Financial Stability Institute (FSI), G7 and G20 all aim to provide authorities and market operators across jurisdictions with tools to bolster the resilience of their financial systems. Despite the significant progress made through national and European targeted policy and legislative initiatives, ICT risks continue to pose a challenge to the operational resilience, performance and the stability of the EU financial system. The reform that followed the 2008 financial crisis primarily strengthened the financial resilience of the EU financial sector and aimed at safeguarding EU competitiveness and stability from economic, prudential and market conduct perspectives. ICT security and overall digital operational resilience are part of operational risk, but have been less in the focus of the post-crisis regulatory agenda, and have developed only in some areas of EU financial markets policy and regulation, or only in a few Member States. The Commission’s 2018 Fintech action plan highlighted that making the EU financial sector more resilient also from an operational perspective is of paramount importance to ensure that it is well protected, that it can recover from breaches and incidents, that it is functioning well and that financial services are delivered effectively and smoothly across the EU, including under situations of stress, and that consumer and market trust and confidence are preserved. As the EU financial sector is highly integrated and interconnected, so is EU level regulation and supervision. To maintain a level playing field among financial institutions and to ensure that they are all subject to a high level of prudential, market integrity and market conduct rules, an EU system of financial supervision and a Single Rulebook for financial services has been gradually created, including the creation of EU supervisory authorities (ESAs) for banking (EBA), securities markets (ESMA), insurance and occupational pensions (EIOPA), the Single Supervisory Mechanism (SSM) at the ECB and the Single Resolution Board (SRB). This level of regulatory and supervisory integration at EU level is unique and unmatched in other sectors. Nonetheless, the European Single Rulebook for financial services and the European system of financial supervision does not comprehensively harmonise provisions tackling digital operational resilience and ICT security. Digital operational resilience and security are essential for financial markets, especially in the digital age, and no less important than for example common prudential or market conduct standard; the financial services Single Rulebook and system of supervision should therefore be developed to cover this field too. In April 2019, the ESAs therefore jointly issued two pieces of technical advice emphasising the need for a coherent approach to ICT risk in finance, recommending to strengthen, in a proportionate way, the digital operational resilience of the financial services industry through an EU sector-specific initiative. The purpose of this document is to assess the case for action, the objectives, and the impact of different policy options for a legislative initiative on digital operational resilience in the Financial Sector, as envisaged by the 2020 Commission work programme. 1.2. Market context The past decades have witnessed significant advances and increased complexity in the use of ICT in finance. The financial sector has become as much about data and technology as it is about money and capital. In terms of expenditure, the financial sector is by quite some distance the largest ICT sector of the economy, accounting for about 20% of global ICT expenditure. Digitalization is a vital driving force in the transformation of nearly all financial sectors. It this not only covers payments, which increasingly have moved from cash and paper-based methods to digital solutions, but also back-office operations, electronic and algorithmic trading, lending and funding including credit rating, insurance underwriting, claim management and peer-to-peer finance. According to a report by the Bank for International settlements, which reflects numbers from 2016, around 90% of all futures trading was done electronically, and 80% of all foreign currency exchange and equity trading. Other industry reports show that around 70% of Europeans use online banking on a regular basis, with this percentage going above 90% in some Member States. ICT risk therefore puts a continuous stress on the financial sector due the sector’s overwhelming dependency on software, data and digital processes for performing key financial services operations and functions. Figure 1 illustrates the depth and breadth of digitalisation in one financial sector (banking).

Figure 1. Bank in an open ecosystem context Source: Capgemini, World Payments Report, 2019 Finance has not only become largely digital throughout the whole sector, but digitalisation has also deepened interconnections and dependencies within the financial sector and with infrastructure and service providers (see figure 2). According to ECB, almost 100 bn payment transactions took place in 2018 and about 500 million securities transactions take place every year. Figure 2. Stylised interconnectedness in the financial sector Source: IMF, Cybersecurity Risk Supervision, 2019 Box 1 – basic concepts ICT risks are generally understood to mean risks arising with the use of network and information systems or communication technology. That includes malfunctions, hardware and software failures, disruptions caused by human error, spam, viruses etc., misuses or other types of adverse malicious and non-malicious events that can compromise the security and resilience of such network information systems or communications technologies, the operation and running of processes or the provision of services. For example, major losses are incurred when data or ICT systems lose integrity or become unavailable, confidential data is breached or physical ICT infrastructure is damaged. ICT risk management is used to describe the application of risk management processes and mechanisms to information and communication technologies in order to manage operational risk of a digital nature. Every firm, in the financial sector and outside, should identify risks to its ICT systems and data in order to reduce or manage those risks and develop a response plan in the event of a crisis. Digital operational resilience refers to the qualitative processes that a financial institution undergoes to build, maintain and review, on a continuous basis, the full operational integrity of its ICT systems, for a safe and compliant running of its operations and deployment of services. Digital operational resilience complements the approach embedded in existing financial services regulation to address financial institutions’ operational risk, which has so far relied mainly on identifying, monitoring and addressing risks through quantitative approaches (in particular an effective capital planning and provisioning to cover for possible losses stemming from those risks). Digital operational resilience requires the activation of a set of comprehensive functions, policies, processes of ICT risk management that allow the financial institution to be prepared to protect its ICT systems and prevent disruptions, to adapt to changing ICT patterns and to recover from those disruptions (within certain limits of tolerance either acceptable or known in advance). Digital operational resilience requirements thus address both the institution’s internal organisation processes and its inherent technological dependencies to third parties for the deployment of ICT supporting business functions – in particular in relation to the monitoring of the digital risks posed by third parties through outsourcing arrangements. For a financial institution to be able to achieve full operational integrity on an ongoing basis, its digital operational resilience must be the consequent result of a synergy of distinct components: corporate governance requirements, a defined detailed ICT risk management framework (including incident reporting and testing), a comprehensive monitoring of digital risk coming from third party dependencies (in particular from outsourcing), as well as mechanisms for coordination between financial institutions and with financial supervisors. While being a broader concept, the digital operational resilience fully integrates and relies on the concept of “security of network and information systems” which is vital to ensure a safe and compliant use of any of the financial institution’s technology or data dependent components, tools and processes to support its business. The horizontal framework on cybersecurity, Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (NIS) defines the “security of network and information systems” in Article 4(2) as the ability of network and information systems to resist, at a given level of confidence, any action that compromises the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the related services offered by, or accessible via, those network and information system. Firms operating in the financial services industry are 300 times as likely as other companies to be the target of cyber-attacks. This was also acknowledged in a European Parliament report. Despite significant investment in ICT security technology, the average cost to financial institutions resulting from operational incidents keeps on increasing. From 2013 to 2018, the total annual cost of all types of cyberattacks increased by 72%. An 2018 IMF modelling exercise put the base-case average aggregated annual loss due to cyber-attacks at 9% of banks’ net income globally, or around $100 billion. In a severe scenario — in which the frequency of cyber-attacks is twice as high as in the past due to greater contagion — losses could be 2½–3½ times as high as this, or $270 billion to $350 billion. ICT security breaches affecting a market participant in the financial sector are prone to spread within the financial system, as its participants have numerous and very close interconnections. According to the ESRB, the high level of interconnectedness across financial institutions, financial markets and financial market infrastructures, and particularly the interdependencies of their IT systems, constitute a potential vulnerability as a localised cyber incident could quickly spread across markets and jurisdictions. For example, ICT systems underpinning payment operations link together thousands of credit institutions both to each other and with payment services providers. Securities trading and settlement chains bring together credit institutions, investment firms, trading venues, central securities depositories and central counterparties. ICT security breaches in the financial sector therefore affect not just a single financial entity or sector and its customers, but adversely impact the stability of the whole financial system. As a result, a localised ICT threat or incident could more likely propagate at a faster pace from any of the ca. 21 000 single financial institutions in Europe towards the entire financial system, unhindered by any geographical boundaries. Therefore, idiosyncratic ICT risks at one entry point can become systemic, especially because they can trigger liquidity runs and an overall loss of confidence and trust in financial markets. Figure 4. How cyber incidents could affect financial stability Source: Office of Financial Research, 2017 Financial Stability Report. U.S. Department of the Treasury Source: IMF, Cyber Risk Surveillance: A Case Study of Singapore, 2020 A global consensus among authorities has formed that ICT risks are a source of systemic risk in the financial sector. Recent studies and papers published in Europe and in the U.S. demonstrate that ICT risk can threaten the stability of the entire financial system and that this type of risk can itself trigger a liquidity crisis and be a source of systemic risk (for more details on hypothetical scenarios see Annex 6). According to the IMF, cyber events can propagate risks through the entire financial system and cause systemic risks via three broad transmission channels: risk concentration, risk contagion, and erosion of confidence. Although these channels are similar to the mechanisms of traditional financial shocks, a key difference lies in the speed by which risks materialise. Especially when driven by malicious intent (cyber-attacks), ICT risks can spread more quickly and at a larger scale, across sectors and beyond geographical borders, triggering liquidity runs and an overall loss of confidence and trust in financial markets. Critical functions that the financial sector provides to support the real economy (in particular deposit-taking and savings, lending, capital markets and investments, payments, clearing) may be impaired and may reverberate across other sectors of economy, in particular where the financial system itself faces difficulties in absorbing losses emerging from cyber-attacks and other large scale operational disruptions. 2.Problem definition and subsidiarity 2.1.Problem definition To be able to achieve digital operational resilience and adapt rapidly to changing business conditions, financial institutions should strengthen their ICT risk management (by developing a set of strategies and capabilities around governance, identifying and protecting against threats, responding and recovering from ICT-related disruptions, adopting an ICT change management policy, implementing an adaptive approach to incorporate into the framework lessons learned from past events, etc.), periodically test the effectiveness of their preventive and responsive capabilities integrated in the ICT risk management framework, share information with other financial institutions on actionable threat intelligence at strategical, tactical and operational level, report any major incident to financial supervisors, and manage risks stemming from their dependency on ICT third parties. All these measures to address ICT risk are already implemented to a greater or smaller extent, and on a mandatory or voluntary basis. For instance, financial institutions are currently investing in ICT systems to strengthen their cyber security. However, these investments are unevenly distributed, and estimates show that about 10% of financial institutions make only very limited investments. Furthermore, these investments currently take place in an environment where rules on digital operational resilience are not harmonised, and where accordingly supervisory expectations and requirements differ. This makes it more difficult for a firm to roll out effective, consistent and coherent responses aimed at addressing ICT risk across the group as a whole. 2.1.1.Fragmentation in managing ICT risks

Financial institutions in the EU operate within a set of legal requirements governing ICT risk alongside soft law measures, notably guidance and supervisory expectations enshrined at EU and/or national levels. Drivers: The legal framework covering ICT risk and operational resilience across the financial sector is fragmented and not fully consistent. The regulatory provisions were developed at different moments in time, and seek to address the main risks identified at the time, hence they vary significantly across financial services sectors (see Annex 2). Some sectors (such as the Payment Services Directive – PSD2 or the Central Securities Depositories Regulation – CSDR) have specific and granular provisions for digital operational resilience. However, in other sectors (such as the Capital Requirements Directive – CRD IV, Solvency II for Insurance and Reinsurance, Credit Rating Agencies Regulation, Institutions for Occupational Retirement Directive – IORPS), the rules on ICT risk are scarce or limited only to high-level generic provisions. National requirements and supervisory guidance may fill some of these gaps, but not all and not necessarily in a consistent manner. ICT risk is addressed through operational risk requirements in EU financial services legislation, which are often and traditionally mainly quantitative (i.e. setting a capital requirement to cover the risk) rather than providing qualitative requirements aimed at protection, detection, containment, recovery and repair capabilities from operational incidents and failure. In addition to the financial services legislation, a general framework covering a number of sectors and service providers governs the security of network and information systems under the NIS Directive. This is a cross-sectoral directive covering a number of economic activities deemed critical (see Annex 2), and that are rather diverse in their nature and market/cross-border integration. NIS being a minimum harmonisation directive, it has led to diversity in national transposition Its design revolves around the identification at national level of operators of essential services (OESs) and setting rules on “state of the art” security and incident notification. For financial services, the NIS Directive covers OES in three areas of the financial sector, namely credit institutions, trading venues and central counterparties (CCPs). Under a lex specialis clause, EU sector-specific rules take precedence over NIS requirements when they are at least equivalent in effect to the NIS requirements. However, difficulties have arisen in this interplay, as well as divergences in implementing the NIS Directive to the financial sector. In its 2017 Communication, the Commission specified that PSD2 is lex specialis for both security requirements and incident notification and that the Markets in financial instruments directive (MiFID) and the European Market Infrastructure Regulation (EMIR) are lex specialis for security requirements, which means they take precedence over the requirements of the NIS Directive. At the same time, Member States could add and some have added in their transposition additional sectors and national requirements at their own discretion. It needs to be clarified that Directive 2008/114/EC on the protection of critical infrastructures (CIP), according to which Member States need to identify and designate European critical infrastructures and ensure risk assessments and reporting of incidents, does not cover the financial sector. Problem: Both the lack of specific ICT risk requirements in some subsectors and differences between such ICT risk requirements across financial subsectors and Member States leads to inconsistencies in protection, detection, containment, response and recovery capabilities for ICT related incidents between sectors and Member States. This leaves parts of the financial sector exposed to ICT related incident risks, without frameworks in place to address and manage these risks and makes the playing field uneven across the single market, with operators in some Member States being subject to specific requirements, whereas their competitors in other Member States are not subject to the same requirements. Further fragmentation and thus difficulties in compliance emerge for those financial institutions that operate on different financial sub-markets and have thus obtained several authorisations. Consequences: The current disparity in rules puts at risk the financial sector’s stability and integrity, as despite the interconnectedness of all parts of the financial sector, risks are addressed and managed inconsistently across subsectors. As pointed out by the ESRB, due to the highly interconnected nature of the financial system, the uneven level of ICT risk management can quickly cause problems in other segments of the financial sector. Furthermore, the current disparity of rules segments the single market for financial services, subjecting competitors to different requirements both in terms of scope and intensity. The responses to the public consultation have shown extensive support to strengthen the ICT risk management framework for all financial institutions. Most respondents insisted that common standards should be principle and risk based and allow for proportionate application. They should ensure coherence in areas where currently, given the lack of more EU harmonisation, many financial institutions have voluntarily established and implemented security measures to manage and mitigate ICT risks, following national rules, EU soft rules (e.g. EBA guidelines) or global standards (e.g. International Organization for Standardization ISO). 2.1.2.Ineffective reporting of and limited awareness about threats and incidents Under regulatory and/or supervisory requirements, financial institutions are subject to a number of ICT and operational incident reporting requirements to different authorities (see type 1 in table 1 below). What use authorities can make of the incident notification information they receive, and whether and how they will share it with other authorities or market participants, depends on the regulatory and supervisory requirements under which the information is notified and the mandates of the respective authorities. Given the cross-border dimension of ICT risks and incidents, co-operation among competent authorities, including law enforcement where applicable, and exchanging relevant information (see type 2 in table 1 below) in the incident reports they receive is necessary to effectively manage incidents or their consequences. Lastly, information sharing among financial institutions (see type 3 in table 1 below) on threats and vulnerabilities contributes to increase awareness of ICT security and operational threats and to enhance the capacity to prevent threats from materialising into breaches or incidents, contain their effects or recover from them more efficiently. The table below summarises the three main types of communication presented above: Table 1 - Main types of communication on ICT-related incidents and threats Incident reporting (type 1) financial institution → competent authority Exchange of information and cooperation (type 2) competent authority → competent authority (also cross-border) Information sharing (type 3) financial institution → financial institution (possible collaboration with competent authorities) Lack of incident reporting requirements in some financial subsectors Few pieces of financial services legislation contain specific provisions on ICT incident reporting to authorities at either national or European level; most are silent on this. In the area of payments, PSD2 offers the most complete framework mandating the immediate reporting of an incident to the competent authority. It also enables - through EBA guidelines - a classification and evaluation of reports, which creates a taxonomy that is useful in making incidents comparable. Investment firms engaged in algorithmic trading report material breaches in their electronic security measures, and trading venues report incidents of misuse or unauthorised access. Data reporting service providers also report to competent authorities and notify clients affected by the breach. However, the financial services legislation covering most other areas (for example governing credit institutions, insurance undertakings or central securities depositories) does not establish reporting requirements. At the same time, the NIS Directive requires some of these institutions (certain credit institutions, CCPs and trading venues identified as OES, but not insurance undertakings, central securities depositories or asset managers) to notify incidents to the national NIS authority. Whether there is a single national NIS authority or whether sectoral authorities such as financial supervisors act as NIS authority in a Member State depends on national transposition and application of the NIS Directive. Incidents amounting to breaches of the General Data Protection Regulation (GDPR) must be notified to data protection authorities. Drivers: Since most pieces of EU financial services legislation remain silent or contain general wording on reporting of ICT-related incidents, some areas completely lack reporting to financial supervisors or NIS authorities. To fill these gaps, in some areas some financial supervisors have set up their own reporting schemes. For example, the SSM implemented its own set of requirements for its supervised banks, which comes on top of national financial services requirements, requirements under PSD2, application of the NIS Directive or the GDPR. Problems: The lack of consistent information on the nature and consequences of ICT-related incidents impedes the proper calibration and implementation of prudential requirements and the development of suitable policy responses. At the same time, it means supervisors have an incomplete overview of the nature, frequency, significance and impact of incidents. Moreover, with no incident reporting in place, cybercriminal incidents remain unreported, information cannot be exchanged from financial supervisors to law enforcement authorities, and that ultimately impedes the investigation and prosecution of perpetrators and overall diminishes the deterrence of cybercrime. Consequences: Notwithstanding ad hoc supervisory initiatives, the lack of consistent information on significant ICT related incidents in the financial system as a whole reduces public authorities’ capability to assess and monitor risks that may affect the stability of the financial system, and to impose on financial institutions the necessary measures to prevent ICT-related incidents or limit their impact. There have been cases where financial supervisors were not made aware in time of cyber risks affecting other sectors. This undermines effective supervision and, ultimately, the objective of maintaining financial stability and market integrity.

Overlapping incident reporting Drivers: Divergent transposition and implementation occurs mostly when dealing with minimum harmonisation directives, which are gold-plated by additional –more stringent- national rules. In addition, different frameworks give rise to multiple reporting obligations for the same ICT-related incident by a single financial institution. This may be necessary due to different angles under which the impact of an ICT breach can be analysed (e.g. an incident may impact personal data and, as such, it is brought to the attention of the data protection authorities for purposes other than the financial risk angle of financial supervision). This translates into financial institutions in fact having to report the same or different information on the same incident, under different legislation and to different authorities. For instance, as also revealed in the public consultation, a bank may have to report the same incident under the NIS Directive (if it has been identified as an OES and if the incident has a significant impact on the continuity of the bank’s services), the SSM incident reporting framework (if it is a significant bank), under PSD2 (if the incident involves the payments side), under GDPR (if it affected the personal data of its customers) and under any other applicable national legislation. Problem: Some financial institutions face complex, overlapping and potentially inconsistent reporting requirements for the same incident. The problem is amplified by differences in the taxonomy of ICT/operational incidents, reporting timeframes, data sets, templates or applicable thresholds (triggering the reporting of an incident), as well as in the general approaches to consumer notification. Finally, the fragmentation becomes even more challenging for cross-border financial institutions that operate outside the EU and have to comply with additional requirements stemming from regulations from third country jurisdictions. Responding companies to the public consultation are currently subject to multiple ICT and security incident reporting requirements that either stem from regulation (e.g. GDPR, eIDAS, national rules transposing PSD2, NIS, or other national laws), supervisory expectations (e.g. SSM, TARGET2) or industry best practices. A concrete example would be the case of a big bank that has been identified under the NIS transposition as operator of essential services in one Member State and is also licenced as payment service provider under PSD2. In this case, incident reporting obligations deriving from the legislation overlap if the lex specialis clause is not upheld in that Member State; to this overlap, one has to add the incident notification under the SSM framework for significant banks. The bank should not report major incidents to the NIS authority in that Member State because it also operates under PSD2 (and the lex specialis is supposed to do away with the overlap). However, because the NIS transposition has been quite fragmented, it must report the same incident to the financial supervisor, to the NIS authority and to the SSM, under different criteria and patterns. A big subsidiary of this bank in another Member State, for example, even if providing services deemed essential under the national transposition of the NIS Directive, would not have to report to the NIS authority because the transposition of the NIS Directive took the lex specialis into account. Consequences: Having to report the same incident to multiple authorities leads to excessive administrative burden and compliance costs at times when financial institutions must also focus resources on managing and containing the incident and recovering from it. Respondents to the public consultations stressed that the myriad of different requirements creates a significant compliance burden for them without a corresponding improvement in security. In addition, all these different criteria lead to fragmentation in the overall incident reporting requirements, possibly amplified by any different interpretations across legislations, with authorities having only partial insights into how ICT and operational incidents affect the financial sector. Absence at EU level of trusted mechanisms enabling cyber threat intelligence sharing between financial institutions Drivers: With cyber, ICT and operational threat landscapes becoming complex and sophisticated, good detection and prevention measures depend to a great extent on regular threat and vulnerability intelligence sharing between financial institutions. However, a number of factors inhibit intelligence and information sharing in relation to threats, in particular a lack of trust and of suitable mechanisms and arrangements. Financial institutions also express doubts or concerns about whether information sharing is legally possible and commercially feasible between peers. In particular, respondents to the public consultation cited concerns over compatibility with data protection and anti-trust requirements, or even liability (for more details see point 3.2 of Annex 3). Hesitations about what can be shared –other than incidents- with other market participants, with competent authorities, e.g. financial supervisors in their oversight function, the European Union Agency for Cybersecurity (ENISA) for analytical input or Europol for law enforcement purposes, leads to information being withheld. Problem: As the ICT risk dimension has only gradually and partially been addressed across the EU financial services legislation, the extent of information sharing among financial institutions in relation to threats, as well as the quality of such information (when shared) is limited, fragmented and mostly local (national initiatives), with no consistent EU-wide information sharing arrangements tailored for the real needs of the financial sector and authorities. Since financial institutions cannot leverage in a collective manner their individual knowledge and practical experience, their understanding of the cyber threats also remains fragmented and isolated. This prevents threat-informed decisions to help build up defensive capabilities, threat detection techniques and mitigation strategies. The lack of correlation between different types of cyber information and intelligence from multiple sources, for instance indicators of compromise such as system artefacts or observables associated with an attack, motives of threat perpetrators, and security alerts, which weakens financial institutions’ efforts to successfully withstand malicious attacks. Consequences: Insufficient information sharing and cooperation on cyber threat intelligence at strategical, tactical and operational level (on, for example, indicators of compromise or techniques used by cyber criminals) ultimately prevent individual financial institutions from adequately assessing, monitoring, defending against and responding to cyber threats. Moreover, the lack of information sharing in trusted environments undermines the ability of the financial community to prevent and respond collectively by quickly limiting the spread of cyber risks and operational threats and impeding potential contagion throughout financial channels. 2.1.3.Limited and uncoordinated testing To achieve robust digital operational resilience, in line with international standards (e.g. the G7 Fundamental Elements for Threat-Led Penetration Testing (TLPT)), institutions should regularly test their ICT systems and governance as to the effectiveness of their preventive, detection, response and recovery capabilities, to uncover and address potential vulnerabilities. Responding to differences across and within financial sectors regarding the maturity level of financial institutions’ cybersecurity preparedness, testing should include a wide variety of tools and actions, ranging from simple assessment of basic requirements (e.g. gap analyses, compliance reviews, vulnerability scans) to more advanced testing (e.g. TLPT for significant financial institutions capable of carrying out such tests). The majority of respondents to the public consultation agree that financial entities should be required to perform a baseline testing/assessment of their ICT systems and tools. Drivers: Regarding the current testing exercises carried out in the EU, the problem is twofold: (1) in some financial subsectors, there are multiple and uncoordinated penetration and resilience testing frameworks and requirements that address the same issues in a different way, with the subsequent duplication of costs for the tested financial institutions and no cross-border recognition of results and (2) other subsectors lack penetration and resilience testing frameworks. To map the resilience testing practices in the EU, the EBA conducted a survey on supervisory practices on cybersecurity, which identified many differences in testing requirements, the process of testing, cross border cooperation on such testing and sharing of the testing results. The survey revealed that only a few authorities organised penetration testing or gave guidance on such testing. Most respondents indicated not having pen-tested financial institutions’ vulnerability and resilience to cyber risks. In 2018, the ECB published a framework for threat intelligence-based ethical red teaming (TIBER–EU). This is a common framework that delivers a controlled, bespoke, intelligence-led red team test of financial institutions’ critical live production systems. TIBER-EU is designed to be adopted by competent authorities in any jurisdiction, on a voluntary basis and for a variety of prospective uses, in particular as a supervisory or oversight tool, for financial stability purposes, or as a catalyst in collaboration with market participants. Although a number of Member States and supervisors have developed and/or are in the process of implementing digital operational resilience testing frameworks, some inspired by TIBER-EU, the frameworks present certain similarities, but also differences in terms of scope, testing methods and the requirements or authorities involved. Problems: Without the establishment of at least a common set of rules in guiding these tests, the frameworks are not applied coherently. Moreover, there is no mutual acceptance of the testing results between Member States, and financial institutions active in multiple jurisdictions are subject to multiple testing frameworks and requirements on the same ICT infrastructure. Respondents to the public consultation face issues with overlapping or diverging testing obligations for ICT and security tests by different authorities, which tie up considerable resources. In many financial subsectors there is also no knowledge exchange at EU level between competent authorities, which means best practices are not shared between financial institutions or between them and competent authorities. In addition, where there is no testing, vulnerabilities remain undetected and can and will be exploited by threat perpetrators. Consequences: Uncoordinated testing can potentially segment the single market and undermine the single or coordinated supervisory approach. At the same time, the lack of cross-border acceptance of test results among supervisory authorities generates additional burden and costs for financial institutions. This makes the level playing field uneven, as evidenced by the responses to the public consultation (for more details see point 3.3 of Annex 3). When there is no testing and vulnerabilities hence remain undetected, the financial sector stability and integrity is at higher risk. 2.1.4.ICT third-party risks Financial institutions have increased the use of third-party providers (TPPs), in particularly for the provision of ICT products and services. Financial institutions enter into contractual relationships with ICT TPPs whereby they outsource the performance of some of their operational functions. In particular, the use of cloud services has recently been the focus of much attention. According to the FSB, the deployment of cloud technologies in the financial service industry is still in an early phase, with around 70% of financial services companies reporting in a recent survey that they were only at the initial or trial and testing stage. However, the use of cloud services is patchy across different financial operators and financial subsectors, and there is high potential for growth. Markets and Markets predicts that the financial cloud market will grow at a rate of 24% to reach more than $29 billion by 2021. A recent Bloomberg survey of Europe’s top banks revealed that 22 of 22 respondents use Amazon, Microsoft, or Google. According to the Institute of International Finance (IIF), Amazon Web Services have almost 50% of market share, followed by Microsoft Azzure, Google, IBM or Alibaba. Figure 5. Market share of ICT vendors in financial service industry, 2018

Source: Apps Run The World The dependence on ICT third parties was also highlighted in the ESAs joint technical advice, which suggested an appropriate oversight framework be applicable to the activities of ICT TPPs that are critical service providers to financial institutions. The extent and nature of this reliance has amplified in recent years, driven by an effort from financial institutions to adapt to the digital economy, boost efficiency and remain competitive, as well as meet consumer demand. The main incentives to rely on third parties for the provision of ICT products or services are performance, reliance, elasticity of ICT resource provisioning and cost-effectiveness. The aim of financial institutions when accessing innovative technologies offered ‘as a service’, for instance cloud adoption, may be to source alternatives for outdated, on-site legacy ICT infrastructure, which can be very costly to maintain and upgrade, and less flexible in accommodating the institution’s ICT needs to embrace innovation and ensure security. The use of ICT TPPs by financial institutions is not limited to cloud service providers. Most financial institutions also use specialised ICT TPPs for products and services that they cannot develop in-house (e.g. specialised software, hardware, etc.), or where such in-house features would fall below the standards that TPPs are able to provide. The operations of ICT TPPs entail significant risks for financial institutions (for example in handling financial data). Almost 60% of surveyed companies experienced a data breach caused by a third party, according to the Ponemon Institute. Such risks are predominantly micro-prudential and, if at all addressed by the existing regulatory framework, addressed to varying degrees: governance risks, operational risks (security and privacy, integration, portability, and interoperability between systems), vendor lock-in, confidential data risks, fourth party and supply chain risks (given the increasing tendency of some TPPs to sub-contract parts of the services they provide to additional vendors), legal and compliance risk (e.g. when operational incidents or poor performance at a TPP prevent a financial institution from complying with its regulatory reporting obligations), reputational risks and lack of explainability. Moreover, the widespread use of a limited number of closely connected ICT TPPs by a large number of financial institutions can lead to macro-prudential risks, such as concentration and systemic risks. This can adversely impact financial stability in the event that one or more of the critical providers experience a major disruption in providing their services. That conclusion stands irrespective of the root cause (e.g. be it a malfunction or a major cyber-attack). Limitations and difficulties for financial institutions to ensure compliance with the regulatory framework on outsourcing and further sub-outsourcing arrangements Drivers: As financial institutions become more and more dependent on products and services provided by ICT TPPs, they also face higher levels of risk exposure, both of a micro and macro prudential nature, towards providers outside the financial sector, who are unregulated and thus unmonitored by financial supervisors. The burden for ensuring TPPs’ compliance with the regulatory framework remains on the financial institutions. Without prejudice to their contractual freedom, the regulatory framework requires financial institutions to remain fully responsible for their outsourcing arrangements; some must draw them in writing and notify financial supervisors of their outsourcing arrangements and sometimes get the supervisors’ approval (please see section 4 of Annex 2). That is because outsourcing entails critical or important operations or functions that financial institutions should in principle deploy in house and because such business arrangements impact financial institutions’ compliance with their prudential regulatory obligation to monitor and address operational risks. One of the most complicated problems that financial institutions and supervisors acknowledge today is their lack of ability or actual power to monitor risks in the sub-outsourcing value chain. In addition, financial institutions often have difficulties in negotiating written agreements tailored to their prudential legal and regulatory requirements or cannot fully enforce rights of access as stipulated in contracts with ICT TPPs. Their initial contract with the TPP often does not provide for sufficient safeguards on how the sub-outsourcing process should be monitored (i.e. no notification of the sub-outsourced services, lack of relevant information on the type of function further sub-outsourced or on the actual location or jurisdiction where the sub-outsourcing is performed). This may be the result of a high degree of asymmetry in negotiating positions between financial institutions and hyper-scale technology providers, which leads to contractual limitations or gaps (e.g. on rights to access, audit and obtain information from TPPs). The public consultation highlighted a large number of additional challenges during contractual negotiations between financial institutions and ICT TPPs, such as the geographical storage of data, sub-contractor approval and transparency, information rights, exit strategies, post-termination assistance, resolution requirements, business continuity clauses, etc. (see section 3.4 on page 10 of Annex 3). At the same time, supervisors are not getting the insights they need into the solutions and risks presented by ICT TPPs. According to the Ponemon Institute, companies are not able to (i) confirm whether third parties have had a data breach or cyber-attack involving their sensitive and confidential information, (ii) determine the number of third parties with access to their confidential information, and (iii) verify whether the third party can sufficiently respond to a data breach or cyber-attack. Problem: When the contractual relationship entails outsourcing and sub-outsourcing of core functions or operations of a financial institution, this lack of control may impair the continuity and security of the performance of the financial services that are outsourced. Currently, the indirect supervision performed by financial supervisors over the supervised financial institutions, who in turn ought to have robust contractual terms and conditions in their outsourcing arrangements guaranteeing the performance (or in its absence, the liability) of the outsourced activities or functions by TTPs does not address concentration and systemic risks posed by ICT TPPs to the financial system. Consequences: The inability to enshrine contractual rights tailored to the prudential requirements for outsourcing that financial institutions must abide to, the difficulty to enforce these rights, and the lack of supervisory insights into the activities of financial institutions which are provided by ICT TTPs (with all risks associated) expose financial institutions individually, and the financial system as a whole, to operational risks which, even though they originate at a third party (or further along the sub-outsourcing chain), have direct consequences on the actual performance of financial institutions, and hence on the stability and integrity of the financial service or system. These risks remain outside the purview and perimeter of proper, direct and consistent EU financial services regulation and supervision. Unmonitored ICT third-party providers Drivers: Currently, there is no EU-wide direct oversight framework to enable financial supervisors to effectively monitor the activities of critical ICT TPPs in relation to the services they provide to financial operators. Some steps were taken under the EBA guidelines on outsourcing to require banks, investment firms, payment and e-money institutions to maintain and update a register of all outsourcing arrangements with cloud service providers. Financial institutions and cloud service providers joined forces to develop a template for the register, but the register will be available only as of December 2021 and it has some limitations (e.g. it covers only outsourcing arrangements with a subset of ICT TPPs - cloud service providers, it has a limited coverage of the supply chain, no common templates for data reporting). Most importantly, the register applies only to the financial entities mentioned above and there is no comparable inventory or register applicable to other financial institutions. This could also result in asymmetries in the volume of information available to supervisory authorities. According to the results of the public consultation, a typical European financial institution accesses over 1,000 different cloud services, many unapproved and unlikely to be monitored. Employees and partner organisations may use ICT systems that are not monitored, managed or secured. These third parties could greatly increase operational risks and yet the competent authorities’ oversight over some ICT (cloud) TPPs is inadequate. Furthermore, some respondents complain that relevant ICT TPPs are not regulated within the EU. The above-mentioned increased reliance of financial institutions on ICT TPPs is only partially addressed in EU legislation via requirements imposed on financial institutions to notify their outsourcing arrangements to supervisors and the general principle that financial institutions retain full responsibility for their contractual relationships. Higher risk exposure and the concentration and systemic risks originated at the unregulated entity offering the outsourced service or platform are not explicitly captured by the current legal framework. This translates in practice into different supervisory approaches that are based on the supervisors’ general mandate to monitor operational risks: (1)some supervisory authorities are hesitant to allow financial institutions to enter into contractual arrangements with ICT TPPs, as supervisors either have insufficient insight into whether ICT third parties present risks or do not always possess all the tools they need to analyse and oversee the impact of these third-party dependencies; (2)other supervisory authorities, although they allow such contractual arrangements, still require financial institutions to obtain approval before outsourcing to ICT TPPs and impose diverging requirements on financial institutions. Problem: In the absence of EU or national rules tackling risk exposures to critical entities outside the financial sector, that have the potential to jeopardize overall financial stability, either risks remain unaddressed or diverging and unsatisfactory administrative practices emerge. Supervisors are not equipped with a sufficient mandate, nor the tools and expertise to monitor and manage concentration and systemic risks stemming from financial institutions’ outsourcing of important functions and subsequent third party dependencies. Consequences: In a highly interdependent financial system, which is interlinked across the EU, concentration and systemic risks are not effectively contained or unilaterally addressed due to uncoordinated supervisory approaches at national level. In the absence of an EU coherent oversight framework, the Single Rulebook does not offer fully appropriate mechanisms and tools that supervisors need to be able to quantify, qualify, address and redress operational, concentration and exposure risks vis-a-vis critical ICT TPPs. The ensuing reluctance of supervisors to allow financial institutions to make greater use of ICT TPPs also hampers the adoption of potentially more cyber-resilient ICT solutions provided by ICT TPPs. 1. Fragmentation in managing ICT risksIncomplete Single Rulebook on digital dimensionFinancial sector stability and integrity at riskExcessive administrative burden and limited supervisory effectivenessInsufficient/unequal protection of consumers and investorsInsufficient regulatory response to increased levels of ICT risksIncomplete view over the frequency and significance of incidentsComplex, inconsistent and overlapping reporting obligationsFragmentation due to multiple testing and no cross-border recognition of resultsInsufficient assessment of preventive and resilience capabilitiesChallenges for financial institutions to assure compliance with the regulatory frameworkDisparity of ICT risk requirements across financial sectorsLack of incident reporting requirements for some financial institutionsOverlapping testing for some financial institutionsLack of testing for some financial institutionsContractual limitations / gaps in written agreements with ICT TPPsMultiple incident reporting requirements for some financial institutionsLack of specific requirements on ICT risks Regulatory and supervisory divergent approaches and gapsHighly digitalised and interconnected financial sectorOut of scope: Data breach notifications under GDPRUnmonitored ICT TPPs risksInsufficient information sharing and cooperation on threat intelligenceInsufficient trust to share threat intelligence and uncertainty over legal compliance when sharingIncreased reliance on ICT TPPs1. Fragmentation in managing ICT risksIncomplete Single Rulebook on digital dimensionFinancial sector stability and integrity at riskExcessive administrative burden and limited supervisory effectivenessInsufficient/unequal protection of consumers and investorsInsufficient regulatory response to increased levels of ICT risksIncomplete view over the frequency and significance of incidentsComplex, inconsistent and overlapping reporting obligationsFragmentation due to multiple testing and no cross-border recognition of resultsInsufficient assessment of preventive and resilience capabilitiesChallenges for financial institutions to assure compliance with the regulatory frameworkDisparity of ICT risk requirements across financial sectorsLack of incident reporting requirements for some financial institutionsOverlapping testing for some financial institutionsLack of testing for some financial institutionsContractual limitations / gaps in written agreements with ICT TPPsMultiple incident reporting requirements for some financial institutionsLack of specific requirements on ICT risks Regulatory and supervisory divergent approaches and gapsHighly digitalised and interconnected financial sectorOut of scope: Data breach notifications under GDPRUnmonitored ICT TPPs risksInsufficient information sharing and cooperation on threat intelligenceInsufficient trust to share threat intelligence and uncertainty over legal compliance when sharingIncreased reliance on ICT TPPsProblem tree

Drivers Problems Consequences 3. Limited and uncoordinated testing 4. ICT third party risk 2. Ineffective reporting of and limited awareness about threats and incidents

2.2. The EU's need to act and justification 2.2.1.Legal basis The Treaty on the Functioning of the European Union confers to the European institutions the competence to lay down appropriate provisions for the approximation of laws of the Member States, that have as their objective the establishment and functioning of the internal market (Article 114 TFEU). This encompasses the power to enact legislation at EU level to approximate prudential, market conduct and other relevant requirements for financial institutions and for their supervisors. As financial services are currently overwhelmingly deployed through varied and complex ICT-based systems and processes, and likely to become even more so in future, there is a clear need that all financial operators understand and remain at all times in full control of the ICT risks deriving from their use of technological solutions, including their third party dependencies. This initiative aims to remove obstacles to and improve the establishment and functioning of the internal market for financial services by ensuring the applicable rules are fully harmonised. The current disparities in the area of ICT risk management, testing and third party risk, both at legislative and supervisory level, and both at EU and national level, act as obstacles to the single market in financial services: financial institutions with cross-border activities face different and at times overlapping regulatory requirements or expectations, that have the potential to impede their exercise of freedom of establishment and provision of services; competition between the same type of financial institutions in different Member States is also distorted. Moreover, in areas where EU harmonisation is absent or partial/limited (e.g. digital operational testing framework, oversight of activities of critical ICT TPPs), the divergent development of national rules or approaches, which have either been adopted or are in the process of adoption and implementation at national level, could also act as deterrents to the single market freedoms for financial services. 2.2.2.Subsidiarity: Need for EU action Digital operational resilience is an issue of common interest to the EU’s financial markets. It is essential for the proper functioning of the EU financial sector, especially in the digital age. The level of integration within the EU financial sector - governed by EU regulation and supervision - together with the cross-border activity of financial institutions, and the depth and breadth of digitalisation set the financial sector apart from other sectors. Without completing the European Single Rulebook with operational provisions and tools to address ICT risks and incidents that it currently lacks, all other types of risks would be tackled at European level, but digital operational resilience would remain either left out or subjected to fragmented and uncoordinated national-level initiatives. The potentially significant levels of investment required also highlight that diverging requirements have very real impacts on the level playing field in the internal market. All this currently segments financial markets and could further make the playing field uneven. The interdependencies so typical of the financial sector are such that individual financial institutions very often cannot fully handle the threats, manage the risks and the possible impacts of ICT incidents on their own. ICT threats and risks have a cross-border dimension that poses operational challenges. Those interdependencies across Member States make public intervention at EU level not only beneficial, but needed. The current disparities resulting from uneven frameworks applicable to different financial institutions and to different financial subsectors and also to the same financial institution operating cross-border and/or holding several authorisations (e.g. one financial institution can have a banking, an investment firm, and a payment institution licence, every single one issued by a different supervisor in one or several Member States) across the Member States can thus only be tackled at EU level. The initiative would harmonise an area of the economy that is so deeply connected, integrated, interdependent and that already benefits from a single set of rules and supervision. In terms of incident reporting, only harmonised EU-level action could reduce the reporting burden - and the implicit costs - of the same ICT-related incident being reported to different EU and/or national authorities. EU action is needed also to facilitate the mutual recognition/acceptance of the testing results of institutions operating cross-border that are subject to different testing frameworks in different Member States. Some Member States have put in place (or are considering) national testing frameworks, some based on TIBER-EU, and some diverging from it. Furthermore, although some risks are mitigated in the Members States that introduced specific testing obligations, in others those risks remain unaddressed and unmonitored and this distorts competition. Financial institutions also rely on service providers and infrastructures located across the EU; the lack of an appropriate and coherent oversight framework to monitor risks stemming from ICT TPPs, including concentration and contagion risks at EU level, also benefits from EU-wide action. Finally, it should be noted that GDPR notifications are out of scope in this initiative since they are imposed by the GDPR which pursues a distinct objective, and cover only a sub-sector of cases (e.g. those where personal data is concerned). 2.2.3.Subsidiarity: Added value of EU action In the current context and looking at future scenarios, it appears that, to increase collective digital operational resilience for the financial system as a whole, individual action by Member States and a fragmented approach is suboptimal and clearly insufficient. EU action is deemed necessary to address fragmentation in ICT risk management, the testing frameworks, overlapping incident notifications and the mechanisms and tools needed to contain ICT third party risk. Action at EU level would bring more advantages and greater value than action taken separately at national level. It would provide legal clarity on whether and how digital operational provisions apply, especially to cross-border financial institutions, and it would eliminate the need for Member States to individually improve rules, standards and expectations regarding operational resilience and cybersecurity as a response to the limited coverage of EU financial rules and the general nature of the NIS Directive. However, EU intervention would not impact on the NIS Directive, as it would build on it and address any possible overlaps via a lex specialis exemption. The interaction between financial services regulation and the NIS Directive would continue to be governed by a lex specialis clause, which would continue to exempt financial institutions from the substantive NIS requirements and avoid overlaps between the digital operational resilience act and the NIS review. In addition, the interaction with the European Critical Infrastructure (ECI) Directive would be in a similar way as it today co-exists with the NIS Directive. Not taking action at EU level would be a missed opportunity to reap the full benefits of the single market, as the proliferation of piecemeal and uncoordinated approaches at national level would continue. This is particularly the case, in light of the ongoing COVID-19 crisis, whereby different measures to support operational resilience were taken at national level. The benefits of digital finance in continuing to serve customers remotely during the crisis illustrate even more acutely the need to ensure heightened and coordinated operational resilience. Because the COVID-19 crisis is likely to provide even further impetus to the digitalization of financial services, that should come hand in hand with further emphasis on ensuring a coordinated digital operational resilience. An EU-wide framework would significantly increase the effectiveness of the policy while also reducing complexity, and easing the financial and administrative burden on all operators. By way of example, the decision to incorporate the Basel standards into EU legislation over ten years ago has proven to be a success story: as a result, European banks are now much better capitalised and follow a single set of rules applicable throughout the EU thanks to a decision to act at EU and not at national level. In accordance with the principle of proportionality, the proposed rules will not go beyond what is necessary in order to achieve the objectives set out in section 3 below. The initiative will cover only the aspects that Member States cannot achieve on their own and where the administrative burden and costs are commensurate with the specific and general objectives to be achieved. Proportionality will be carefully designed in terms of scope and intensity and using qualitative and quantitative assessment criteria to ensure that the new rules will cover all financial subsectors and institutions, but will be tailored to the specific risks they face and the needs they must address; as such, proportionality will be embedded to different degrees in the different rules on ICT risk management, basic and advanced testing, reporting of major incidents and oversight of critical ICT TPPs. None of the options analysed in this impact assessment goes beyond what is necessary to achieve the objectives set in the following section. EU action is therefore justified on both grounds of subsidiarity and of proportionality. 3.Objectives In light of the problems outlined in the previous chapter, the overall objective of the initiative is to strengthen the digital operational resilience of the EU financial sector entities by streamlining and upgrading existing rules and bringing in new requirements where there are gaps. This would also enhance the Single Rulebook on its digital dimension. Moreover, the initiative would seek to maximise the benefits associated with the horizontal framework (e.g. NIS Directive), and as such contribute to the overall resiliency of the EU economy. The initiative will duly take into account recommendations endorsed at international level, as well as existing EU and national frameworks on ICT risk management and operational resilience.

The overall objective can be structured in three general objectives: ·Reduce the risk of financial disruption and instability: an EU digital operational resilience framework for the EU financial services would enhance the security and resilience of the financial institutions and market infrastructures and reduce the risks to financial stability. This would translate into the following specific objectives: -Address ICT risks more comprehensively and strengthen the overall level of digital resilience of the financial sector; -Enable financial supervisors’ access to information on ICT-related incidents; -Ensure that financial institutions assess the effectiveness of their preventive and resilience measures and identify ICT vulnerabilities; -Strengthen the outsourcing rules governing the indirect oversight of ICT TPPs; -Enable a direct oversight of the activities of ICT TPPs; -Incentivise the exchange of threat intelligence in the financial sector. ·Reduce the administrative burden and increase supervisory effectiveness: the different overlapping incident reporting obligations should be streamlined and simplified to reduce the administrative burden for the financial institutions. In addition, a coherent EU digital operational resilience testing framework would contribute to reduce costs resulting from multiple testing, duplication of work and additional burden for financial institutions within the EU financial sector. This would translate into the following specific objectives: -Streamline ICT-related incident reporting and address overlapping requirements; -Reduce single market fragmentation and enable cross-border acceptance of testing results. ·Increase consumer and investor protection: the envisaged measures in the initiative would be addressed to financial institutions. However, strengthening the overall digital operational resilience of the EU financial sector would also (indirectly) contribute to increasing both consumer and investor protection. Table 2 – Intervention logic diagram Drivers of the problems Identified problems and

their consequences Objectives Consequence 1 of the identified problems Financial sector stability and integrity at risk General Objective 1 Reduce the risks to financial sector stability and integrity ·Lack of specific requirements on ICT risks ·Disparity of ICT risk requirements across financial sectors ·Problem 1: Non-specific and insufficient regulatory response to increased levels of ICT risks ·Specific objective 1: address ICT and security risks more comprehensively and strengthen the overall level of digital resilience of the financial sector ·Lack of incident reporting requirements for some financial institutions ·Problem 2: Incomplete view over the frequency and impact of ICT-related incidents ·Specific objective 2: enable financial supervisors’ access to information on ICT-related incidents ·Lack of testing for some financial institutions ·Problem 3: Insufficient assessment of preventive and resilience capabilities ·Specific objective 3: ensure that financial institutions assess the effectiveness of their preventive and resilience capabilities and identify ICT vulnerabilities ·Contractual limitations / gaps in written agreements with ICT TPPs ·Problem 4: Challenges for financial institutions to assure compliance with the regulatory framework when certain functions are outsourced or further sub-outsourced ·Specific objective 4: strengthen the outsourcing rules governing the indirect oversight of ICT TPPs ·No coherent oversight framework for ICT TPPs ·Problem 5: Unmonitored ICT TPPs risks that lead to financial stability concerns linked to concentration risk ·Specific objective 5: enable a direct oversight of the activities of ICT TPPs ·Insufficient trust to share threat intelligence and uncertainty over legal compliance when sharing ·Problem 6: Insufficient information sharing and cooperation on threat intelligence ·Specific objective 6: incentivise the exchange of threat intelligence in the financial sector Consequence 2 of the identified problems Excessive administrative burden and limited supervisory effectiveness General Objective 2 Reduce the administrative burden and increase supervisory effectiveness ·Multiple incident reporting requirements for some financial institutions ·Problem 1: Complex, inconsistent and overlapping reporting obligations ·Specific objective 1: streamline ICT-related incident reporting and address overlapping requirements ·Overlapping testing for some financial institutions ·Problem 2: Cost of compliance with multiple testing and lack of cross-border recognition of testing results ·Specific objective 2: reduce costs (and single market fragmentation) and enable cross-border acceptance of testing results Consequence 3 of the identified problems Insufficient/unequal protection of consumers and investors General Objective 3 Increase consumer and investor protection 4.Options and assessment of policy options This section will examine the policy options available and their estimated impacts in achieving the objectives presented in Table 2: ·“Do nothing” scenario: No change in the EU financial services regulatory framework; ·Option 1: Strengthening financial institutions’ ability to absorb losses stemming from lack of digital operational resilience; ·Option 2: A financial services digital operational resilience act; ·Option 3: A financial services digital operational resilience act together with centralised supervision of activities of critical ICT TPPs.

The below policy matrix summarises each of the options (in the rows) along with the related four policy areas to be addressed (in the columns) in light of the problems and objectives specified above. The four policy areas have been identified because they are the four key inter-related pillars included consensually in European and international guidance and best practices (e.g. ECB, G7, FSB, BCBS, etc.) aimed at enhancing the cyber and operational resilience of the financial sector. The four policy areas are therefore the “state of the art” which any EU initiative which aims at reducing the risks to financial sector stability and integrity from cyber and operational risk (general objective 1 and related sub-objectives) must address. These are also the areas that existing fragmented rules and supervisory activities at European and national level cover, and hence any initiative aimed at reducing the administrative burden and increase supervisory effectiveness (general objective 2 and related specific objectives) must cover them. The digital operational resilience act aims to strengthen the digital operational resilience of the EU financial sector by addressing the different issues reflected in the “state of the art” of international and European work. Achieving this objective can be pursued in different ways (e.g. quantitative vs. qualitative approach) and with different levels of integration (e.g. supervisory cooperation vs. new authority to oversee ICT TPPs). This is reflected in the different options assessed in this section. In the below matrix, each cell outlines the specific measures and level of ambition foreseen in each policy area. More specifically: ·The first column, ICT risk management, refers to the main elements of the risk management framework for building a proper digital operational resilience core requirements for the financial sector (e.g. requirements on governance, on ICT risks to strengthen the protection, detection, response and recovery capabilities against ICT-related incidents and failures, ICT change management, etc.). ·Reporting and threat intelligence refers to the rules that will govern the reporting of ICT-related incidents (e.g. in particular on the level of ambition for streamlining existing rules), and the exchange of threat intelligence among financial institutions. ·Testing refers to the different tools and measures that financial institutions should employ to assess the effectiveness of their preventive, detection, response and recovery capabilities to uncover and address potential vulnerabilities in their ICT systems and ICT services (e.g. via stress tests or digital operational resilience testing). ·ICT third party risk refers to the direct oversight or indirect supervision (e.g. through application of outsourcing rules) of ICT TPPs and the authority(s) that will perform this activity. ICT risk management Reporting and threat intelligence Testing ICT third party risk “Do nothing” scenario Status-quo for EU financial services rules + NIS Directive Status-quo for EU financial services rules + NIS Directive Voluntary threat intel Based on national rules Status-quo on outsourcing based on ESAs guidelines

( indirect supervision) Option 1 Capital buffer

+

NIS Directive Same as “do nothing” EU – wide resilience stress tests Capital buffer Option 2 Comprehensive EU rules in financial services legislation + NIS Directive Comprehensive EU rules in financial services legislation + NIS Directive Voluntary threat intel Comprehensive EU rules on digital operational resilience testing + mutual recognition of testing results EU oversight framework Option 3 Comprehensive EU rules in financial services legislation + out of NIS completely Comprehensive EU rules in financial services legislation + out of NIS completely Compulsory threat intel Comprehensive EU rules on digital operational resilience testing + cross-authority testing under ESAs coordination New EU Authority

(direct supervision) 4.1. Do nothing: No change in the EU financial services regulatory framework Under this scenario, the Commission will not propose any changes to the current EU regulatory framework governing digital operational resilience for the financial industry. Rules addressing operational resilience would continue to be set by current provisions in the EU financial services legislation, which as highlighted differ substantially across sectors, partly by the NIS Directive and its forthcoming review, as well as by national schemes that have emerged or could emerge in the future. In addition to the planned review of the NIS Directive, progressive harmonisation and alignment of ICT security and supervisory practices across the financial sector could take place on a voluntary basis through soft law measures (e.g. guidelines, recommendations) by the ESAs. Under this scenario, financial institutions would also continue to be encouraged to take into account international standards, principles and best practices issued by global standard setting bodies, which in due course may lead to changes to provisions in EU financial regulatory legislation. For each of the main policy areas, no changes to the regulatory framework would entail the following: a)ICT risk management: requirements on ICT risk would remain fragmented across sectoral and horizontal legislation. Such fragmentation is likely to remain also after a revision of the NIS Directive: Such a review can expand the personal and material scope of ICT risk requirements to further parts of the financial sector, but it cannot overcome fragmentation because of the continued interaction with fragmented sectoral legislation. b)Incident reporting and information sharing: in the absence of EU regulatory action, financial institutions will remain subject to multiple reporting obligations that entail different timelines, reporting templates, authorities, thresholds, etc. In the same vein, competent authorities will continue to experience difficulties in monitoring ICT incidents and their impact upon the financial sector. Similarly to point a), a revision of the NIS Directive could expand the personal and material scope of incident reporting and information sharing, but it will not overcome the fragmentation of requirements, as requirements established by sectoral legislation will remain fragmented. Currently, cyber threat intelligence sharing is voluntary and only a limited number of financial institutions are taking part in such initiatives. Legal and regulatory barriers are often quoted as reasons for not engaging in threat intelligence sharing. Without any regulatory action, information sharing arrangements would remain limited and fragmented in the EU, thus missing the opportunity to create synergies that leverage in a collective manner financial institutions’ individual knowledge and practical experience. Financial institutions’ efforts to build up their defensive capabilities, threat detection techniques and mitigation strategies may then be less effective. c)Digital operational resilience testing: no changes to the current EU regulatory framework implies that Member States will continue to develop and implement their own national testing frameworks. This will likely lead to increased multiplication and duplication of testing requirements on financial institutions with cross-border activities, and an increase of regulatory asymmetries due to the lack of mutual acceptance of testing results. The NIS Directive does not include specific requirements harmonising testing. d)ICT third-party risk: with no changes in the regulatory framework, the arrangements and supervisory practices in applying the rules for financial institutions on outsourcing to ICT third party service providers (the indirect oversight), where they exist, will remain scattered. The Commission’s ongoing work on standardising contractual clauses for outsourcing to cloud by financial institutions may improve the contractual position of financial institutions, however only in relation to one subset of ICT TPPs (cloud providers). Moreover, without binding regulatory principles, financial institutions will continue to face limitations and challenges to comply with and/or reinforce the regulatory framework on outsourcing (including the sub-outsourcing value chain). In addition, prudential supervisors will continue to lack the appropriate tools to analyse and oversee the impact of third party dependencies on the financial system. While the NIS Directive includes ex-post supervision of security requirements and incident reporting of cloud service providers, it is limited to only one subset of ICT TPPs, it does not deal with the oversight of all critical ICT TPPs when they provide their services to financial institutions, nor does it deal with outsourcing to such entities. 4.1.1.Overall assessment of the current state of play and how the problems would evolve A progressive harmonisation of ICT provisions and incident reporting requirements across financial subsectors will not take place. While some financial institutions may upgrade their ICT security, this would happen only unevenly, and due to the interconnectedness of the financial system, the remaining financial institutions will continue to pose risks for all operators in the financial system. Risks for financial sector stability and integrity (see section 4.3.1 below for an estimation) would therefore not be mitigated substantially. Similar considerations apply to the national rules and supervisory practices on the direct and indirect oversight of TPPs, which are expected to remain scattered across the different financial subsectors. Under this scenario, financial institutions and prudential supervisors would thus miss on the expected benefits (e.g. cost effectiveness, increased compliance with the regulatory framework, improved monitoring over the activities of ICT TPPs,) that a coherent EU oversight framework might entail.

Regulator sponsored cyber resilience testing is a relatively recent practice for the financial services industry, and financial institutions (mainly from the banking sector) are gradually implementing the different schemes on a voluntary basis. Without a coordinated EU approach in this area, cyber resilience testing would continue to be patchy and there would be no mutual recognition of testing results across different jurisdictions; also, it is unlikely that other financial subsectors beyond banking and market infrastructures would adopt such schemes on a meaningful scale, therefore missing out on the potential benefits, such as for example revealing vulnerabilities and risks, test defence capabilities and business continuity, increase trust of customers, suppliers and business partners, etc. The information sharing arrangements and initiatives would not be incentivised and are likely to remain underdeveloped and scattered across the EU. There are important economic and social benefits that could be missed, such as strengthening defence capabilities to prevent incidents from happening, increase access to knowledge and resources for less prepared entities in the sector, sharing of resources to jointly procure cybersecurity services from IT security companies, etc. The forthcoming review of the NIS Directive might bring changes, among others in terms of expanding the scope of the directive and providing greater harmonisation of requirements. However, the current NIS Directive is focused on cyber security and is not explicitly addressing broader digital operational resilience issues, such as testing, information sharing among peers, direct oversight of ICT TPPs (with the exception of the ex post supervision of cloud service providers mentioned under letter d)) and outsourcing rules to such entities. Moreover, digital operational resilience risks are inherently linked to the broader set of risks financial institutions face (e.g. market risk, credit risk, liquidity risk, etc.). All these risks are embedded, to a greater or lesser extent, in the EU financial services legislation, and are continuously supervised by financial supervisors as part of their mandate. The Single Rulebook for financial services is the foundation of the EU single market in financial services both in the Banking Union and in the Capital Markets Union. A mere review of the NIS Directive, without adjusting supervisors’ toolbox to protect financial stability and market integrity would not be sufficient to ensure fully coherent and harmonised rules for financial institutions, given the interlinks with the broader set of financial risks. Financial supervisors would not be empowered with an integrated European framework to perform their mandate, which is of particular relevance as a legal basis for supervisors established at EU level (e.g. banking under the SSM supervision). Under this scenario, it is unlikely that streamlining ICT-related incident reporting and addressing overlapping requirements would be achieved. Given that these provisions are present in several pieces of EU legislation or supervisory practices (e.g. NIS Directive, PSD2, ECB incident reporting scheme, etc.), reviews of individual legislations would bring limited to no benefits in this regards. Similarly, in order to reduce single market fragmentation and enable cross-border acceptance of testing results, limited to no benefits are expected through individual reviews or no action taken at EU level. Costs (direct, indirect, regulatory charges, administrative costs) For financial institutions: financial institutions’ digital operational resilience will continue to be governed by the different EU financial services legislation and partially by the NIS Directive, depending on how Member States have implemented that Directive. Institutions facing overlapping incident reporting on the same incident and multiple testing frameworks in several jurisdictions will incur high costs (for more details see section 4.3.1 below and section 3.7 of Annex 3). Under the “do nothing” scenario, financial institutions will continue to be bound by existing multiple incident reporting obligations. In this context, incidents will continue to be categorised differently due to diverse reporting requirements (e.g. different taxonomies, thresholds, etc.) and disparate methodologies that authorities use to collect data. Over time, such approach will generate increasing expenses in compliance costs and administrative burden. The current absence of mutual acceptance of testing results across the Member States is likely to remain at the same levels and this may lead to additional costs, more administrative burden and additional regulatory misalignments. In addition, even without any policy change, financial institutions are likely to face increasing costs in compliance and due diligence processes in the next years. Even today and in the absence of a uniform and comprehensive EU initiative, financial institutions voluntarily implement and update security measures or plan significant investment programmes in the next years. Some follow national or EU rules (e.g. EBA guidelines and Solvency II) or global standards (e.g. ISO, NIST, etc.). Based on global and regional regulatory requirements and best practices, respondents to the public consultation mentioned to have developed their own policies, standards, and guidelines covering information security and risk, and will increase their spending on this front. However, they found it difficult to anticipate any quantification of such development of expenses (for more details see point 3.1 of Annex 3). Threat intelligence sharing is considered a useful preventive practice in the cyber resilience toolbox of financial institutions, as it can help market participants to exploit the economies of scale generated by the network through an active sharing of information on possible threats. Under this scenario, financial institutions are subject to these costs (see section 4.3.1 below for a detailed estimation of these costs) only when they engage in such initiatives on a voluntary basis, and their engagement is proportional to the level of available resources. For supervisors: Over the last few years, several prudential supervisors have been increasing their resources dedicated to IT supervision. Under this scenario, the overall costs related to supervision, reporting and enforcement borne by national competent authorities as a result of monitoring ICT-related activities in each national jurisdiction are likely to remain and further increase as supervisors may upgrade their systems unevenly on a voluntary basis. On average, according to supervisory data and Commission’s calculations, it is estimated that currently around 5-10% of the total FTEs dedicated to supervising financial institutions are assigned to IT supervision. Overall, the ongoing COVID-19 crisis is likely to further accentuate many of the costs highlighted above. The crisis has so far illustrated the benefits of digital finance in ensuring access to financial services on a remote basis. It is therefore likely that financial services policy at various levels will in the near future focus on further digitalising finance. This will put further emphasis on strengthening digital operational resilience. Hence, in the absence of a coherent response at EU level, national/sectoral actions are likely to proliferate, thus accentuating the costs outlined above. 4.2. Option 1: Strengthening financial institutions’ ability to absorb losses stemming from lack of digital operational resilience EU financial services legislation is governed by a set of sectoral provisions on risks (e.g. market risk, operational risk, credit risk, liquidity risk, etc.). One of these risks is operational risk and it covers the risk of losses resulting from “inadequate or failed internal processes, people and systems or from external events”. For banks and insurance services, for example, these provisions translate into capital charges. This quantitative approach is in line with international regulatory measures to address risks through capital charges/buffers. For instance, the Basel Committee on Banking Supervision (BCBS) has recently revised the operational risk framework by addressing the risks with increased capital. Under this option, strengthening the digital operational resilience in financial services would be achieved by amending the different provisions on operational risk in the EU financial services legislation and partly by the review of the NIS Directive. In contrast to the other options, this option – in addition to the review of the NIS Directive – follows a purely quantitative approach targeted at increasing the capital charges and loss absorption capacity for operational risks. This reduces the financial risk (of default) from an operational risk event. Setting capital aside to cover a potential risk represents a cost for the financial institution. Capital charges should accordingly incentivise financial institutions to reduce their exposure to the underlying risk to the extent possible. Under this option: a)ICT risk management: first, the current operational risk framework would be amended by introducing a specific loss event type on ICT risk. Second, a new and specific capital buffer for ICT risk would be created and it will sit above the capital provisions for operational risk. The calibration of this capital buffer would be based on historical data on losses due to ICT-related incidents. b)Incident reporting and information sharing: Streamlining and improving incident reporting to financial supervisors would not be addressed under this option. Financial institutions would be required to report losses stemming from ICT-related incidents and provision the specific capital buffer based on past losses resulting from ICT-related incidents. The level of this specific capital buffer would very likely be higher as compared to the current rules on operational risk. The sharing of cyber threat intelligence will continue to be voluntary and limited to the financial institutions currently participating in such initiatives. c)Digital operational resilience testing: under this option, the digital operational resilience of financial institutions would be assessed through stress testing the specific capital buffer for ICT risk. For banks, the existing EU-wide stress tests coordinated every two years by EBA would be used. These tests assess how resilient banks are to economic shocks. The specific capital buffer for ICT risk would be included in the methodologies and scenarios of the EU-wide stress test. For other financial institutions, a similar stress testing exercise focused on ICT risks would be developed by the ESAs and run in collaboration with the national competent authorities. d)ICT third-party risk: under this option, a dedicated capital buffer for exposure to ICT TPPs would be set in the legislation. This capital buffer would aim to strengthen the financial resilience of financial institutions by increasing the loss absorption capacity from operational incidents stemming from ICT TPPs, and, similarly to capital charges more broadly, incentivise financial institutions to reduce those risks.

4.2.1.Assessment of the impact Benefits Reduce the risk of financial instability: only one (i.e. strengthen the overall level of digital resilience of the financial sector) out of the six specific objectives in Table 2 would be partially achieved. The overall resilience of the financial sector would be enhanced through increasing the loss absorption capacity of some financial institutions. Some benefits would be achieved compared to the “do nothing” scenario, as better capitalised financial institutions would have more financial resources to absorb the impact of ICT-related incidents. Furthermore, additional benefits could result over time from lower capital charges if financial institutions take actions to improve their resilience, as less incidents would translate into lower capital provisions. This may accordingly improve system resilience over time. However, this option would not be equally effective for all financial sectors, as evidenced by recent incidents at, for instance, Bank of Valetta and Equifax. In these cases, the impact on capital was significant and clearly exceeded any additional capital charges which could reasonably be put on financial institutions. For Bank of Valetta, the €13 million that were subject to the cyber incident represented approximately one third of its minimum capital requirements for operational risks (in accordance with Article 438 (c) to (f) of CRR). In the case of Equifax, the estimated losses of around $1.38 billion exceeded by far the minimum capital requirements for operational risks and accounted to approx. 40% of their total capital, and to around 20% of their total assets. In addition, for the first time ever, there was a change of rating outlook for Equifax due to a cyber breach, which can lead to additional costs such as increase in the costs of borrowing and access to capital markets. In terms of financial supervisors’ access to information on ICT-related incidents, this option would bring no improvement. Compared to the current rules, and as such, no benefits are expected compared to the “do nothing” scenario. From the perspective of financial institutions, the voluntary exchange of threat intelligence across the financial sector would likely remain at the same level as compared to the “do nothing” scenario. The benefits of incentivising the exchange of threat intelligence in the financial sector would not be achieved. Under this option, ICT TPPs would continue to be subject to an indirect supervision performed by supervisors over the supervised financial institutions through the different written agreements used in outsourcing arrangements. In this context, financial ins