Decision on the Application of Guidelines on the Assessment of ICT-Related Risks under the SREP Process

Evidence Data Collection: Other General and Individual Acts Decision on the Application of Guidelines on the Assessment of ICT-Related Risks under the Supervisory Review and Evaluation Process (SREP) Official Gazette of the Republic of Slovenia, No. 66/17 ID: SKLE11279 SOP: 2017-01-3103 Adopted: 13. 11. 2017 Published: 23. 11. 2017 Effective from: 24. 11. 2017 Applicable from: 31. 12. 2017 Type of Act: Decision Responsible Authority: Bank of Slovenia Adopting Body: Bank of Slovenia Forms The electronic edition of the Official Gazette is the official edition from 1 January 2006. Prior to this date, official editions were published in paper form. Text

Pursuant to the third paragraph of Article 13 of the Banking Act (Official Gazette of the Republic of Slovenia, No. 25/15, 44/16 – ZRPPB, 77/16 – ZCKR and 41/17; hereinafter: ZBan-2) and the first paragraph of Article 31 of the Bank of Slovenia Act (Official Gazette of the Republic of Slovenia, No. 72/06 – consolidated text and 59/11), the Council of the Bank of Slovenia issues

DECISION

on the Application of Guidelines on the Assessment of ICT-Related Risks under the Supervisory Review and Evaluation Process (SREP)

Article 1

(Purpose and Scope of the Guidelines)

(1) The European Banking Authority, pursuant to the first paragraph of Article 16 of Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L No 331 of 15 December 2010, p. 12; hereinafter: Regulation (EU) No 1093/2010), published on 4 August 2017 the Guidelines on the Assessment of ICT-Related Risks (information and communication technologies) under the Supervisory Review and Evaluation Process (SREP) (hereinafter: Guidelines), which are published on its website.

(2) The Guidelines referred to in the first paragraph of this Article specify in detail the criteria that competent authorities should use in supervisory assessments of institutions' management of ICT and their ICT strategies, as well as in supervisory assessments of institutions' exposure to ICT-related risks and their ICT controls. These Guidelines are an integral part of the Guidelines on Common Procedures and Methodologies for the Supervisory Review and Evaluation Process (SREP), which the EBA published on 19 December 2014.

(3) The Guidelines apply to competent authorities as defined in Article 4(2)(i) of Regulation (EU) No 1093/2010.

Article 2

(Content of the Decision and Scope of Application of the Guidelines)

(1) By this Decision, the Bank of Slovenia determines the application of the Guidelines for the Bank of Slovenia, when, in accordance with ZBan-2, it exercises the powers and duties of supervision over banks in its capacity as a competent authority.

(2) In performing its supervisory duties and powers in accordance with ZBan-2 and Regulation (EU) No 575/2013, the Bank of Slovenia will fully take into account the provisions of the Guidelines.

Article 3

(Entry into Force of the Decision)

This Decision shall enter into force on the day following its publication in the Official Gazette of the Republic of Slovenia, and shall apply from 1 January 2018.

Ljubljana, 14 November 2017

dr. Primož Dolenc l.r.

Deputy Chairman

of the Council of the Bank of Slovenia