Regulatory Alerts2025-06-23
Instruction No. 2025-I-09 on the Notification to the ACPR of the Outsourcing of the Obligation to Report Major ICT-Related Incidents
The Autorité de Contrôle Prudentiel et de Résolution (ACPR) issues Instruction No. 2025-I-09 to regulate the notification process for financial entities outsourcing their major ICT incident reporting obligations under EU Regulation 2022/2554. The instruction mandates that covered entities individually notify the ACPR of any outsourcing agreement using a specific model and prohibits the first report by the third-party provider until the day after the ACPR receives the notification. Furthermore, entities must promptly notify the ACPR of the termination of such agreements and resume direct reporting obligations immediately upon cessation.
Share