Joint Regulatory Technical Standards on the criteria for determining the composition of the joint examination team

Final Report
Draft regulatory technical standard on the harmonisation of conditions enabling the conduct of the oversight activities under
Article 41(1)(c) of Regulation (EU) 2022/2554
JC 2024 54
17 July 2024

Contents

1. Executive Summary 3

2. Background and rationale 5

3. Draft Regulatory Technical Standards 7

4. Cost-benefit analysis / impact assessment 14

5. Feedback statement 18

6. Executive Summary
   Introduction and scope

7. Regulation (EU) 2022/2554 1
   (“DORA”) introduces a pan-European oversight framework of ICT third-party service providers designated as critical (CTPPs). As part of this oversight framework, the ESAs and competent authorities (CAs) have received new roles and responsibilities.

8. In this context, the ESAs have been mandated under Article 41(1) to develop draft regulatory
   technical standards (RTS) to harmonise the conditions enabling the conduct of oversight activities.

9. According to the mandate, the draft RTS shall specify:
   a) the information to be provided by an ICT third–party service provider in the application for a voluntary request to be designated as critical; b) the information to be submitted by the ICT third–party service providers that is necessary for the LO to carry out its duties; c) the criteria for determining the composition of the joint examination team, their designation, tasks, and working arrangements; d) the details of the competent authorities’ assessment of the measures taken by CTPPs based on the recommendations of the LO.

10. The draft RTS covered by this final report aims at specifying the criteria for determining the
    composition of the joint examination team ensuring a balanced participation of staff members from the ESAs and from the relevant competent authorities, their designation, tasks, and working arrangements (point c above). A dedicated consultation report and draft RTS covering points (a), (b) and (d) has been published on 8 December 2023 and publicly consulted by the ESAs up to 4 March 2024. The final report is due to be published on 17 July 2024.

11. The draft RTS on joint examination team was publicly consulted between the 18 of April and
    18 of May 2024. The ESAs assessed the feedback from the stakeholders and amended, where appropriate, the draft RTS.

12. The review of the draft RTS taking into account the stakeholders feedback was limited and
    focused on providing clarifications on specific limited provisions mostly concentrated in one single recital and one Article.

13. More information on the feedback received and how this was taken on board by the ESAs is
    provided in the section “Feedback Statement”.
    1 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011, OJ L 333, 27.12.2022, p. 1.