Instruction No. 2025-I-11 on Information to Notify to the ACPR Regarding Participation in Cyber Threat Intelligence Sharing Arrangements

AUTORITÉ DE CONTRÔLE PRUDENTIEL ET DE RÉSOLUTION ----- Instruction No. 2025-I-11 on the information to be notified to the Prudential Supervision and Resolution Authority in the context of participation in an information and intelligence sharing arrangement on cyber threats

The Prudential Supervision and Resolution Authority,

Having regard to Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011;

Having regard in particular to Article 45 of Regulation (EU) 2022/2554 relating to information and intelligence sharing arrangements on cyber threats and in particular the provisions of point (3) of Article 45 of said Regulation (EU) 2022/2554 relating to the notification to competent authorities of participation in information sharing arrangements upon validation of membership or cessation thereof, when it takes effect;

Having regard to the Monetary and Financial Code, in particular Articles L. 612-2 and L. 612-24;

Having regard to the Insurance Code, in particular Articles L. 310-3-1, L. 355-1, L. 356-21, L. 381-1, L. 385-6, D. 344-5, R. 355-6 and R. 385-17;

Having regard to the Mutual Insurance Code, in particular Articles L. 212-1, L. 211-10, L. 214-1, L. 214-12, D. 114-11 and R. 214-5;

Having regard to the Social Security Code, in particular Articles L. 931-6, L. 931-9, L. 942-1, L. 942-11, D. 931-37 and R. 942-5;

Having regard to the opinion of the Prudential Affairs Consultative Commission of 5 June 2025,

DECIDES

Article 1

The entities referred to in Article 2 of Regulation (EU) 2022/2554, subject to the exclusions provided for in that article, hereinafter referred to as "subject entities", are subject to this Instruction:

A. In the banking, payment services and investment services sector:
1) credit institutions that are not classified as important, in accordance with Article 6(4) of Regulation (EU) No 1024/2013;
2) payment institutions;
3) account information service providers;
4) electronic money institutions;
5) investment firms as defined in Article L. 531-4 of the Monetary and Financial Code;
6) token issuers referring to one or more approved assets under Regulation (EU) 2023/1114;
7) central counterparties;
8) trading venues;

B. In the insurance sector:
9) insurance and reinsurance undertakings subject to the so-called "Solvency II" regime mentioned in Articles L. 310-3-1 of the Insurance Code, L. 211-10 of the Mutual Insurance Code and L. 931-6 of the Social Security Code;
10) insurance holding companies and mutual insurance holding companies mentioned in Articles L. 322-1-2 and L. 322-1-3 of the Insurance Code; group mutual unions mentioned in Article L. 111-4-2 of the Mutual Insurance Code;
11) social protection insurance holding companies mentioned in Article L. 931-2-2 of the Social Security Code;
12) mixed financial holding companies mentioned in Article L. 517-4 of the Monetary and Financial Code, included in group supervision within the meaning of Article L. 356-2 of the Insurance Code;
13) supplementary occupational retirement provision bodies, namely supplementary occupational retirement provision funds (FRPS) mentioned in Article L. 381-1 of the Insurance Code, supplementary occupational retirement provision mutuals or unions (MRPS or URPS) mentioned in Article L. 214-1 of the Mutual Insurance Code and supplementary occupational retirement provision institutions (IRPS) mentioned in Article L. 942-1 of the Social Security Code, in accordance with the provisions set out in Regulation (EU) 2022/2554 in Article 2, paragraph 3, point c);
14) insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries that are not microenterprises or small and medium-sized enterprises in accordance with point (e) of Article 2(3) of Regulation (EU) 2022/2554.

Article 2

Any subject entity that participates in or ceases to participate in an information sharing arrangement that meets the criteria set out in Article 45(1) of Regulation (EU) 2022/2554 shall notify the ACPR under the conditions provided for in Article 3.

Article 3

Subject entities shall carry out the notification provided for by completing the form provided in the annex to this Instruction and submitting it according to the technical and methodological modalities relating to this submission.

Article 4

This Instruction shall enter into force as of 1 July 2025.

Subject entities shall notify the ACPR by 30 September 2025 the information sharing arrangements meeting the criteria set out in Article 45(1) of Regulation (EU) 2022/2554 established before 30 June 2025, under the conditions of Article 3 of this Instruction, by completing the form annexed to this Instruction by adding as many tabs as necessary.

Paris, 23 June 2025

The President,
François VILLEROY de GALHAU