Regulatory Alerts2025-03-24
Added · Updated
Commission Delegated Regulation (EU) 2025/532 on ICT subcontracting for financial entities
The European Commission adopted Delegated Regulation (EU) 2025/532 to supplement Regulation (EU) 2022/2554 by establishing regulatory technical standards for financial entities subcontracting ICT services supporting critical or important functions. Financial entities must assess the overall risk profile and complexity of subcontracting chains, conduct due diligence on ICT third-party service providers, and ensure contractual arrangements grant authorities and entities rights of access, inspection, and audit. The regulation mandates that entities monitor subcontractor performance, receive prior notification of material changes, and retain the right to terminate contracts if risks exceed their tolerance levels.
Topics
Share