Instruction No. 2025-I-12 on the Submission to the ACPR of Registers of Information on Agreements Concerning the Use of ICT Services

INSTRUCTION NO. 2025-I-12 ON THE SUBMISSION TO THE ACPR OF REGISTERS OF INFORMATION ON AGREEMENTS CONCERNING THE USE OF ICT SERVICES

The Prudential Control and Resolution Authority, Having regard to Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011; Having regard in particular to Article 28(3), fourth subparagraph, of Regulation (EU) 2022/2554 relating to the making available to the competent authority, if it so requests, the complete register of information or, where applicable, specific sections thereof; Having regard to Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council as regards standard templates for the register of information; Having regard to Commission Delegated Regulation (EU) No 2015/35 of 10 October 2014 supplementing Directive 2009/138/EC of the European Parliament and of the Council on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II); Having regard to Commission Implementing Regulation (EU) 2015/2450 of 2 December 2015 laying down implementing technical standards with regard to communication templates for the submission of information to supervisory authorities under Directive 2009/138/EC of the European Parliament and of the Council; Having regard to Decision ESA 2024/22 of 8 November 2024 on the submission by competent authorities to the European Supervisory Authorities of information necessary for the designation of critical third-party ICT service providers; Having regard to the Monetary and Financial Code, in particular Articles L. 612-2 and L. 612-24; Having regard to the Insurance Code, in particular Articles L. 310-3-1, L. 355-1, L. 356-21, L. 381-1, L. 385-6, D. 344-5, R. 355-6 and R. 385-17; Having regard to the Mutual Code, in particular Articles L. 212-1, L. 211-10, L. 214-1, L. 214-12, D. 114-11 and R. 214-5; Having regard to the Social Security Code, in particular Articles L. 931-6, L. 931-9, L. 942-1, L. 942-11, D. 931-37 and R. 942-5; Having regard to Decree No. 2020-94 of 5 February 2020 relating to the internal and external control of the Caisse des dépôts et consignations; Having regard to the opinion of the Prudential Affairs Consultative Commission of 3 April 2025, DECIDES

Article 1 With a view to the submission by the Prudential Control and Resolution Authority to the European Supervisory Authorities of the registers of information in accordance with Decision ESA 2024/22 of 8 November 2024, subject to the exclusions mentioned in the third paragraph of Article 2 of Regulation (EU) 2022/2554, the following financial entities are concerned by this instruction – hereinafter referred to as "subject entities":

A. In the banking, payment services and investment services sector:

1. credit institutions that are not classified as important, in accordance with Article 6(4) of Regulation (EU) No 1024/2013;
2. payment institutions;
3. account information service providers;
4. electronic money institutions;
5. investment firms as defined in Article L. 531-4 of the Monetary and Financial Code;
6. issuers of tokens referring to one or more approved assets under Regulation (EU) 2023/1114;
7. central counterparties;

B. In the insurance sector: 8) insurance and reinsurance undertakings subject to the "Solvency II" regime mentioned in Articles L. 310-3-1 of the Insurance Code, L. 211-10 of the Mutual Code and L. 931-6 of the Social Security Code; 9) insurance holding companies and mutual insurance holding companies mentioned in Articles L. 322-1-2 and L. 322-1-3 of the Insurance Code; mutual unions mentioned in Article L. 111-4-2 of the Mutual Code; 10) social protection insurance holding companies mentioned in Article L. 931-2-2 of the Social Security Code; 11) mixed financial holding companies mentioned in Article L. 517-4 of the Monetary and Financial Code, included in group supervision within the meaning of Article L. 356-2 of the Insurance Code; 12) supplementary occupational retirement benefit institutions, namely supplementary occupational retirement funds (FRPS) mentioned in Article L. 381-1 of the Insurance Code, supplementary occupational retirement mutuals or unions (MRPS or URPS) mentioned in Article L. 214-1 of the Mutual Code and supplementary occupational retirement institutions (IRPS) mentioned in Article L. 942-1 of the Social Security Code, in accordance with the provisions of Regulation (EU) 2022/2554 in its Article 2(3)(c); 13) insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries that are not microenterprises or small and medium-sized enterprises in accordance with point (e) of Article 2(3) of Regulation (EU) 2022/2554.

Article 2 Under the conditions set out in Article 3 of this instruction, subject entities submit to the Prudential Control and Resolution Authority their register of information on contractual agreements concerning the use of ICT services provided by third-party ICT service providers – hereinafter referred to as "registers of information" – in accordance with the provisions of Article 28(3) of Regulation (EU) 2022/2554 and the details specified in Annex I of Implementing Regulation (EU) 2024/2956.

Article 3 When a subject entity is in one of the following cases, it submits its register of information on an individual basis: i) It is not part of a group of financial entities; ii) It is part of a group of financial entities whose parent company in the European Union or the European Economic Area is established in France but does not carry out activity in one of the sectors mentioned in Article 1; iii) It is part of a group of financial entities whose parent company is not established in the European Union or the European Economic Area.

In the case of a group of financial entities whose parent company established in France is also the parent company in the Union, the submission is made by the latter on a consolidated basis. It must include information relating to all financial entities subject to Regulation (EU) 2022/2554 on an individual basis that it consolidates, according to the following modalities: i) When the parent company is an entity in the banking, payment services and investment services sector within the meaning of Article L. 612-2 of the Monetary and Financial Code, all information relating to entities established within the European Union or the European Economic Area of this same sector is included in the register, as well as all entities established in France in the insurance sector; ii) When the parent company is an entity in the insurance sector within the meaning of Article L. 612-2 of the Monetary and Financial Code, all information relating to entities established within the European Union or the European Economic Area of this same sector is included in the register, as well as all entities established in France in the banking, payment services and investment services sector.

When a subject entity is not in any of the cases envisaged in the first and second paragraphs, it does not make any submission to the Prudential Control and Resolution Authority.

Article 4 Registers of information are submitted on an annual basis. They cover data with a reference date of 31 December of year N-1 relative to the year of submission. Registers of information are submitted no later than 31 March.

Article 5 The technical and methodological modalities for the submission are defined by the ACPR instructions in force.

Article 6 This instruction enters into force on 1 January 2026. Paris, 23 June 2025 The President, François VILLEROY de GALHAU