DORA 欧盟数字运营韧性法案

DORA（Regulation (EU) 2022/2554）自2025年1月17日起适用。它把ICT风险治理、事件报告、韧性测试和第三方风险联系起来；不能仅准备一次渗透测试或一份供应商问卷即认为完成。

基础法规（EU）2022/2554：英中全文 · 第2条适用范围 · 第16条简化框架 · 第30条合同要求

事件分类条例（EU）2024/1772：英中全文 · 第8条重大事件 · 第9条分类阈值

事件报告配套条例（EU）2025/301：英中全文 · 第5条报告期限

先确认实体与适用范围

第2条列明金融实体类型及排除情形，包括相应支付机构、电子货币机构等。某类支付业务在其他制度下获豁免，不等于自动豁免DORA；微型实体及适用简化框架的主体，也需核对具体条款，不能只按员工人数整体排除。

区分金融实体自身义务、其ICT第三方合同义务，以及被指定为关键ICT第三方后适用的监督机制。普通供应商并非仅因向金融客户供货就自动取得关键第三方身份。

将治理与业务依赖联系起来

工作域	依据与核心任务	企业验收示例
治理和ICT风险	第二章：管理机构责任、资产和风险、保护检测、响应恢复、持续改进	关键服务能映射到资产、数据、身份、供应商和责任人
事件管理	第三章：识别、记录、分类和报告	系统故障与安全事件均可进入判断，分类有原始数据支持
韧性测试	第四章：风险相称的测试及适用的高级测试	用例覆盖关键依赖，发现有整改和复测
ICT第三方	第五章：合同登记、风险和集中度、退出等管理	合同主体、服务、数据位置、分包和实际权限相符

第26条的基于威胁情报的渗透测试（TLPT）有特定适用和选定条件，不能写成所有金融实体统一开展。具体测试范围和周期应按适用条款及主管机关要求核对。

重大ICT事件的报告时钟

事件是否达到重大分类，应按DORA第18条及条例（EU）2024/1772第6、8、9条判断，不能以企业内部P1直接替代。以下时限依据Delegated Regulation (EU) 2025/301第5条。

先分类，再启动对应报告流程。 2024/1772第8条第1款要求：事件已影响第6条所述关键服务，并且达到第9条第5款(b)项的特定恶意访问阈值，或达到第9条第1—6款中至少两项其他重大性阈值。同一分类标准内多个备选条件同时满足，不应重复计为两类阈值；具体比较符、分母和估算规则见第9条对照。

重复事件单独评估。 第8条第2款还要求对6个月内至少发生两次、具有相同表面根本原因、合并达到重大条件的事件进行判断，并按月评估重复事件。本款对微型企业和DORA第16条第1款所列金融实体有明确排除，不能把该排除扩展为整个事件报告制度的豁免。

阶段	一般规则	起算点
初始通知	尽早，重大分类后4小时内，通常同时不晚于获知后24小时	分类与获知两个时间分别保存
中间报告	初始通知提交后72小时内，即使状态或处置未变化；更新不得无故拖延，正常活动恢复时应更新	初始通知实际提交
最终报告	中间报告或适用的最新更新中间报告提交后一个月内	对应中间报告提交

分类较晚的情形。 若获知24小时后才分类为重大，第5条第2款规定从重大分类后4小时内提交初始通知。应保留分类变化的事实，不通过人为延迟分类规避报告。

无法按期与节假日。 第5条还规定无法按期时的通知和说明，以及周末、银行假日的特定规则和主体限制。不能把全部小时和日期统一改成工作日，也不能假定所有主体均可顺延。

报告应使用主管机关要求的渠道及配套格式，并核对规则版本。首报、后续报告和GDPR个人数据泄露通知属于不同义务，保留独立对象、条件和完成记录。

供应商退出与测试如何验收

金融实体使用第三方服务后，仍需履行自身适用责任。建议将关键或重要功能、服务和合同、依赖与分包、数据位置、访问权限、退出替代及恢复测试纳入同一清单。

示例。 两个云区域均可运行应用，但共享同一外部身份和密钥服务。仅切换应用流量不足以验证完整恢复能力，应检查共享服务故障时的身份获取、密钥使用、数据一致性与业务恢复，并验证退出方案能否取得必要数据和配置。

对第三方出具的审计报告，核对实体、地点、期间、范围及客户侧责任。不能以供应商声称“符合DORA”替代金融实体自己的适用性、合同和业务连续性验证。

发布与事件演练证据

建议保存实体适用判断、业务依赖图、风险控制、测试发现及复测、第三方登记、报告模板和一次完整事件演练。演练记录获知、分类、首报、中报、恢复、更新和最终报告对应的时间，检查主联系人不可达及渠道故障下的替代路径。

基础法规 · 事件分类与阈值 · 事件报告内容和时限 · GDPR并行义务。本文不替代成员国主管机关的实施要求，也不声称完整收录全部配套技术标准。

基础法规英中全文

收录范围。 本节收录Regulation (EU) 2022/2554的标题、制定依据、106段序言、9章64条正文、结束语、签署信息及39项原文脚注。第59—63条内嵌的修订引文和5项脚注也予保留。序言用于解释立法背景，具体义务应结合正文适用；本节不把摘要或实施建议混入条文。

版本与效力。 英文绑定2022年12月27日《欧盟官方公报》L 333第1—79页公布文本，即CELEX 32022R2554，并参照同一公布版本的官方PDF核对修订条款脚注。英文仅调整空白、分段、列表和脚注展示，不将后续修订、勘误或现行配套规则暗中写入原文。中文为本站AI辅助制作的**非官方参考译文**，未经主管机关或法律专业人员审定，不具有法律效力。实际适用应另行核对官方整合版本、勘误、成员国规则及监管解释。

阅读边界。 原文中的历史日期、待制定文件名称及交叉引用按公布文本保留，不表示这些事项截至当前仍未变化，也不表示本页已完成全部现行版本的逐字校勘。微型企业、简化ICT风险管理框架、特定条款豁免及关键第三方指定排除，应分别依据相应条款判断。

来源与使用。 英文来源为EUR-Lex／欧盟官方公报，©欧盟，2022；再利用条件见EUR-Lex法律声明。中文译文、导航、锚点和折叠排版由本站添加，不代表欧盟机构审定或背书。

术语说明（非原文）。 ICT为信息与通信技术；management body译为“管理机构”，competent authority译为“主管机关”，Lead Overseer译为“牵头监督机构”。resolution及resolution authorities使用金融处置语境，分别译为“处置”和“处置当局”。TLPT译为“基于威胁情报的渗透测试”。下方按原有条号、款项和条件对照阅读。

阅读范围	直达入口
标题、制定依据及106段序言	序言第1—10段 · 第11—20段 · 第21—30段 · 第31—40段 · 第41—50段 · 第51—60段 · 第61—70段 · 第71—80段 · 第81—90段 · 第91—100段 · 第101—106段
第一章：总则，第1—4条	事项、范围、定义和比例原则
第二章：ICT风险管理，第5—16条	治理与框架 · 响应恢复 · 简化框架
第三章：事件管理、分类与报告，第17—23条	事件管理 · 报告责任
第四章：数字运营韧性测试，第24—27条	一般测试 · TLPT
第五章：ICT第三方风险，第28—44条	一般原则 · 合同要求 · 关键第三方指定 · 监督权力
第六章：信息共享，第45条	信息共享安排
第七章：主管机关，第46—56条	主管机关 · 行政处罚 · 数据保护
第八章：授权法案，第57条	授权的行使
第九章：过渡和最后条款，第58—64条	审查及修订 · 生效和适用
结束语、签署及脚注	签署 · 脚注1—20 · 脚注21—39

查看法规原文

标题与制定依据 / Title and citations

展开标题与制定依据英中对照

English

REGULATION (EU) 2022/2554 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 14 December 2022

on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011

(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Central Bank (1),

Having regard to the opinion of the European Economic and Social Committee (2),

Acting in accordance with the ordinary legislative procedure (3),

Whereas:

中文参考译文

欧洲议会和理事会条例（EU）2022/2554

2022年12月14日

关于金融部门数字运营韧性，并修订条例（EC）第1060/2009号、（EU）第648/2012号、（EU）第600/2014号、（EU）第909/2014号和（EU）2016/1011

（与欧洲经济区相关的文本）

欧洲议会和欧洲联盟理事会，

鉴于《欧洲联盟运行条约》，尤其是其第114条，

鉴于欧盟委员会的提案，

在将立法法案草案送交各国议会后，

鉴于欧洲中央银行的意见(1)，

鉴于欧洲经济与社会委员会的意见(2)，

按照普通立法程序行事(3)，

鉴于：

序言第1—10段 / Recitals 1–10

序言（1）

English

(1) In the digital age, information and communication technology (ICT) supports complex systems used for everyday activities. It keeps our economies running in key sectors, including the financial sector, and enhances the functioning of the internal market. Increased digitalisation and interconnectedness also amplify ICT risk, making society as a whole, and the financial system in particular, more vulnerable to cyber threats or ICT disruptions. While the ubiquitous use of ICT systems and high digitalisation and connectivity are today core features of the activities of Union financial entities, their digital resilience has yet to be better addressed and integrated into their broader operational frameworks.

中文参考译文

（1）在数字时代，信息与通信技术（ICT）为日常活动中使用的复杂系统提供支撑。它维持包括金融部门在内的关键经济部门运行，并增进内部市场的运作。数字化和互联程度的提高也放大了ICT风险，使整个社会，尤其是金融体系，更易受到网络威胁或ICT中断的影响。尽管ICT系统的普遍使用、高度数字化和互联已成为当今欧盟金融实体活动的核心特征，其数字韧性仍有待得到更充分的重视，并纳入更广泛的运营框架。

序言（2）

English

(2) The use of ICT has in the past decades gained a pivotal role in the provision of financial services, to the point where it has now acquired a critical importance in the operation of typical daily functions of all financial entities. Digitalisation now covers, for instance, payments, which have increasingly moved from cash and paper-based methods to the use of digital solutions, as well as securities clearing and settlement, electronic and algorithmic trading, lending and funding operations, peer-to-peer finance, credit rating, claim management and back-office operations. The insurance sector has also been transformed by the use of ICT, from the emergence of insurance intermediaries offering their services online operating with InsurTech, to digital insurance underwriting. Finance has not only become largely digital throughout the whole sector, but digitalisation has also deepened interconnections and dependencies within the financial sector and with third-party infrastructure and service providers.

中文参考译文

（2）过去数十年，ICT的使用在金融服务提供中逐渐发挥枢纽作用，目前已对所有金融实体典型日常职能的运行具有关键重要性。例如，数字化现已覆盖支付——支付方式正日益从现金和纸质方式转向数字解决方案——以及证券清算与结算、电子交易与算法交易、贷款与融资业务、点对点金融、信用评级、理赔管理和后台业务。从运用保险科技在线提供服务的保险中介的出现，到数字化保险承保，ICT的使用也改变了保险部门。整个金融部门不仅已在很大程度上实现数字化，数字化还加深了金融部门内部，以及该部门与第三方基础设施和服务提供者之间的互联和依赖。

序言（3）

English

(3) The European Systemic Risk Board (ESRB) reaffirmed in a 2020 report addressing systemic cyber risk how the existing high level of interconnectedness across financial entities, financial markets and financial market infrastructures, and particularly the interdependencies of their ICT systems, could constitute a systemic vulnerability because localised cyber incidents could quickly spread from any of the approximately 22 000 Union financial entities to the entire financial system, unhindered by geographical boundaries. Serious ICT breaches that occur in the financial sector do not merely affect financial entities taken in isolation. They also smooth the way for the propagation of localised vulnerabilities across the financial transmission channels and potentially trigger adverse consequences for the stability of the Union’s financial system, such as generating liquidity runs and an overall loss of confidence and trust in financial markets.

中文参考译文

（3）欧洲系统性风险委员会（ESRB）在2020年一份研究系统性网络风险的报告中再次指出，金融实体、金融市场和金融市场基础设施之间现有的高度互联，尤其是其ICT系统的相互依赖，可能构成系统性脆弱性，因为局部网络事件能够不受地理边界阻碍，从约22 000家欧盟金融实体中的任何一家迅速传播至整个金融体系。金融部门发生的严重ICT安全破坏事件，不仅影响单个金融实体，也为局部脆弱性沿金融传导渠道传播提供便利，并可能对欧盟金融体系的稳定产生不利后果，例如引发流动性挤兑，以及对金融市场信心和信任的整体丧失。

序言（4）

English

(4) In recent years, ICT risk has attracted the attention of international, Union and national policy makers, regulators and standard-setting bodies in an attempt to enhance digital resilience, set standards and coordinate regulatory or supervisory work. At international level, the Basel Committee on Banking Supervision, the Committee on Payments and Market Infrastructures, the Financial Stability Board, the Financial Stability Institute, as well as the G7 and G20 aim to provide competent authorities and market operators across various jurisdictions with tools to bolster the resilience of their financial systems. That work has also been driven by the need to duly consider ICT risk in the context of a highly interconnected global financial system and to seek more consistency of relevant best practices.

中文参考译文

（4）近年来，国际、欧盟和各国政策制定者、监管者及标准制定机构为增强数字韧性、制定标准并协调监管或监督工作，已将注意力转向ICT风险。在国际层面，巴塞尔银行监管委员会、支付与市场基础设施委员会、金融稳定理事会、金融稳定学院，以及七国集团和二十国集团，致力于向不同司法管辖区的主管机关和市场经营者提供增强其金融体系韧性的工具。推动这项工作的另一个原因，是需要在高度互联的全球金融体系背景下充分考虑ICT风险，并提高有关最佳实践的一致性。

序言（5）

English

(5) Despite Union and national targeted policy and legislative initiatives, ICT risk continues to pose a challenge to the operational resilience, performance and stability of the Union financial system. The reforms that followed the 2008 financial crisis primarily strengthened the financial resilience of the Union financial sector and aimed to safeguard the competitiveness and stability of the Union from economic, prudential and market conduct perspectives. Although ICT security and digital resilience are part of operational risk, they have been less in the focus of the post-financial crisis regulatory agenda and have developed in only some areas of the Union’s financial services policy and regulatory landscape, or in only a few Member States.

中文参考译文

（5）尽管欧盟和各国已经采取有针对性的政策与立法举措，ICT风险仍持续对欧盟金融体系的运营韧性、绩效和稳定性构成挑战。2008年金融危机后的改革主要强化了欧盟金融部门的财务韧性，旨在从经济、审慎和市场行为角度维护欧盟的竞争力与稳定。ICT安全和数字韧性虽属于操作风险，但在金融危机后的监管议程中受到的关注相对较少，仅在欧盟金融服务政策和监管体系的部分领域，或者少数成员国中有所发展。

序言（6）

English

(6) In its Communication of 8 March 2018 entitled ‘FinTech Action plan: For a more competitive and innovative European financial sector’, the Commission highlighted the paramount importance of making the Union financial sector more resilient, including from an operational perspective to ensure its technological safety and good functioning, its quick recovery from ICT breaches and incidents, ultimately enabling the effective and smooth provision of financial services across the whole Union, including under situations of stress, while also preserving consumer and market trust and confidence.

中文参考译文

（6）欧盟委员会在2018年3月8日题为《金融科技行动计划：迈向更具竞争力和创新性的欧洲金融部门》的通报中，强调提高欧盟金融部门韧性的极端重要性，包括从运营角度确保技术安全和良好运作、在ICT安全破坏和事件后迅速恢复，最终实现包括压力情形下在整个欧盟有效、顺畅地提供金融服务，同时维护消费者和市场的信任与信心。

序言（7）

English

(7) In April 2019, the European Supervisory Authority (European Banking Authority), (EBA) established by Regulation (EU) No 1093/2010 of the European Parliament and of the Council (4), the European Supervisory Authority (European Insurance and Occupational Pensions Authority), (‘EIOPA’) established by Regulation (EU) No 1094/2010 of the European Parliament and of the Council (5) and the European Supervisory Authority (European Securities and Markets Authority), (‘ESMA’) established by Regulation (EU) No 1095/2010 of the European Parliament and of the Council (6) (known collectively as ‘European Supervisory Authorities’ or ‘ESAs’) jointly issued technical advice calling for a coherent approach to ICT risk in finance and recommending to strengthen, in a proportionate way, the digital operational resilience of the financial services industry through a sector-specific initiative of the Union.

中文参考译文

（7）2019年4月，由欧洲议会和理事会条例（EU）第1093/2010号(4)设立的欧洲监管当局（欧洲银行管理局，EBA），由欧洲议会和理事会条例（EU）第1094/2010号(5)设立的欧洲监管当局（欧洲保险和职业养老金管理局，EIOPA），以及由欧洲议会和理事会条例（EU）第1095/2010号(6)设立的欧洲监管当局（欧洲证券和市场管理局，ESMA）（统称“欧洲监管当局”或“ESAs”），联合发布技术建议，呼吁对金融领域ICT风险采取一致方法，并建议通过欧盟针对该行业的举措，以符合比例原则的方式强化金融服务业的数字运营韧性。

序言（8）

English

(8) The Union financial sector is regulated by a Single Rulebook and governed by a European system of financial supervision. Nonetheless, provisions tackling digital operational resilience and ICT security are not yet fully or consistently harmonised, despite digital operational resilience being vital for ensuring financial stability and market integrity in the digital age, and no less important than, for example, common prudential or market conduct standards. The Single Rulebook and system of supervision should therefore be developed to also cover digital operational resilience, by strengthening the mandates of competent authorities to enable them to supervise the management of ICT risk in the financial sector in order to protect the integrity and efficiency of the internal market, and to facilitate its orderly functioning.

中文参考译文

（8）欧盟金融部门受统一规则手册规制，并由欧洲金融监管体系管理。然而，尽管数字运营韧性对于确保数字时代的金融稳定和市场完整性至关重要，其重要性不亚于共同的审慎标准或市场行为标准等，处理数字运营韧性和ICT安全的规定仍未得到充分或一致的协调。因此，应发展统一规则手册及监管体系，使其也覆盖数字运营韧性，并通过强化主管机关的职权，使其能够监管金融部门的ICT风险管理，以保护内部市场的完整性和效率，促进其有序运作。

序言（9）

English

(9) Legislative disparities and uneven national regulatory or supervisory approaches with regard to ICT risk trigger obstacles to the functioning of the internal market in financial services, impeding the smooth exercise of the freedom of establishment and the provision of services for financial entities operating on a cross-border basis. Competition between the same type of financial entities operating in different Member States could also be distorted. This is the case, in particular, for areas where Union harmonisation has been very limited, such as digital operational resilience testing, or absent, such as the monitoring of ICT third-party risk. Disparities stemming from developments envisaged at national level could generate further obstacles to the functioning of the internal market to the detriment of market participants and financial stability.

中文参考译文

（9）有关ICT风险的立法差异及各国不一致的监管或监督方法，为金融服务内部市场的运作造成障碍，妨碍跨境经营的金融实体顺畅行使设立自由和提供服务的自由。不同成员国经营的同类金融实体之间的竞争也可能受到扭曲。欧盟协调非常有限的领域，例如数字运营韧性测试，或者尚无欧盟协调的领域，例如ICT第三方风险监测，尤为如此。各国拟议发展所产生的差异，可能进一步阻碍内部市场运作，损害市场参与者及金融稳定。

序言（10）

English

(10) To date, due to the ICT risk related provisions being only partially addressed at Union level, there are gaps or overlaps in important areas, such as ICT-related incident reporting and digital operational resilience testing, and inconsistencies as a result of emerging divergent national rules or cost-ineffective application of overlapping rules. This is particularly detrimental for an ICT-intensive user such as the financial sector since technology risks have no borders and the financial sector deploys its services on a wide cross-border basis within and outside the Union. Individual financial entities operating on a cross-border basis or holding several authorisations (e.g. one financial entity can have a banking, an investment firm, and a payment institution licence, each issued by a different competent authority in one or several Member States) face operational challenges in addressing ICT risk and mitigating adverse impacts of ICT incidents on their own and in a coherent cost-effective way.

中文参考译文

（10）迄今为止，由于欧盟层面仅部分处理了ICT风险相关规定，在ICT相关事件报告、数字运营韧性测试等重要领域仍存在空白或重叠；各国不断出现的分歧规则，或者重叠规则缺乏成本效益的适用方式，也造成了不一致。这对金融部门这样的ICT密集型使用者尤其不利，因为技术风险没有国界，而金融部门在欧盟内外广泛跨境提供服务。跨境经营或持有多项许可的单个金融实体，例如一家金融实体可能同时拥有分别由一个或多个成员国的不同主管机关签发的银行、投资公司和支付机构牌照，在独自以一致且具有成本效益的方式应对ICT风险、减轻ICT事件不利影响时，面临运营挑战。

查看法规原文

序言第11—20段 / Recitals 11–20

序言（11）

English

(11) As the Single Rulebook has not been accompanied by a comprehensive ICT or operational risk framework, further harmonisation of key digital operational resilience requirements for all financial entities is required. The development of ICT capabilities and overall resilience by financial entities, based on those key requirements, with a view to withstanding operational outages, would help preserve the stability and integrity of the Union financial markets and thus contribute to ensuring a high level of protection of investors and consumers in the Union. Since this Regulation aims to contribute to the smooth functioning of the internal market, it should be based on the provisions of Article 114 of the Treaty on the Functioning of the European Union (TFEU) as interpreted in accordance with the consistent case law of the Court of Justice of the European Union (Court of Justice).

中文参考译文

（11）由于统一规则手册尚未配套全面的ICT或操作风险框架，需要进一步协调对所有金融实体的关键数字运营韧性要求。金融实体基于这些关键要求发展ICT能力和整体韧性，以抵御运营中断，将有助于维护欧盟金融市场的稳定性和完整性，从而有助于确保欧盟投资者和消费者获得高水平保护。本条例旨在促进内部市场顺畅运作，因此应以《欧洲联盟运行条约》（TFEU）第114条为依据，并按照欧洲联盟法院（以下简称“法院”）的一贯判例解释该条规定。

序言（12）

English

(12) This Regulation aims to consolidate and upgrade ICT risk requirements as part of the operational risk requirements that have, up to this point, been addressed separately in various Union legal acts. While those acts covered the main categories of financial risk (e.g. credit risk, market risk, counterparty credit risk and liquidity risk, market conduct risk), they did not comprehensively tackle, at the time of their adoption, all components of operational resilience. The operational risk rules, when further developed in those Union legal acts, often favoured a traditional quantitative approach to addressing risk (namely setting a capital requirement to cover ICT risk) rather than targeted qualitative rules for the protection, detection, containment, recovery and repair capabilities against ICT-related incidents, or for reporting and digital testing capabilities. Those acts were primarily meant to cover and update essential rules on prudential supervision, market integrity or conduct. By consolidating and upgrading the different rules on ICT risk, all provisions addressing digital risk in the financial sector should for the first time be brought together in a consistent manner in one single legislative act. Therefore, this Regulation fills in the gaps or remedies inconsistencies in some of the prior legal acts, including in relation to the terminology used therein, and explicitly refers to ICT risk via targeted rules on ICT risk-management capabilities, incident reporting, operational resilience testing and ICT third-party risk monitoring. This Regulation should thus also raise awareness of ICT risk and acknowledge that ICT incidents and a lack of operational resilience have the possibility to jeopardise the soundness of financial entities.

中文参考译文

（12）本条例旨在整合并提升ICT风险要求；这些要求属于操作风险要求的一部分，迄今一直分散于欧盟不同法律文件。上述文件虽涵盖主要金融风险类别，例如信用风险、市场风险、交易对手信用风险和流动性风险、市场行为风险，但在通过时并未全面处理运营韧性的所有组成部分。欧盟上述法律文件在进一步发展操作风险规则时，往往倾向采用传统的定量风险应对方式，即设定覆盖ICT风险的资本要求，而非针对ICT相关事件的防护、检测、遏制、恢复和修复能力，或者报告与数字测试能力，制定有针对性的定性规则。这些文件主要旨在覆盖并更新审慎监管、市场完整性或市场行为方面的基本规则。通过整合和提升有关ICT风险的不同规则，应首次将金融部门所有应对数字风险的规定，以一致方式集中于一部立法法案。因此，本条例填补了部分既有法律文件中的空白，纠正了包括术语使用在内的不一致，并通过针对ICT风险管理能力、事件报告、运营韧性测试和ICT第三方风险监测的规则，明确处理ICT风险。本条例还应由此提高ICT风险意识，并承认ICT事件及运营韧性的缺乏可能危及金融实体的稳健性。

序言（13）

English

(13) Financial entities should follow the same approach and the same principle-based rules when addressing ICT risk taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations. Consistency contributes to enhancing confidence in the financial system and preserving its stability especially in times of high reliance on ICT systems, platforms and infrastructures, which entails increased digital risk. Observing basic cyber hygiene should also avoid imposing heavy costs on the economy by minimising the impact and costs of ICT disruptions.

中文参考译文

（13）金融实体应在考虑其规模、整体风险状况，以及服务、活动和运营的性质、范围及复杂性的基础上，以相同的方法及相同的原则性规则应对ICT风险。一致性有助于增强对金融体系的信心并维护其稳定，尤其是在高度依赖ICT系统、平台和基础设施、数字风险随之增加的情况下。遵守基本网络卫生要求，还应通过尽量减少ICT中断的影响与成本，避免给经济造成沉重负担。

序言（14）

English

(14) A Regulation helps reduce regulatory complexity, fosters supervisory convergence and increases legal certainty, and also contributes to limiting compliance costs, especially for financial entities operating across borders, and to reducing competitive distortions. Therefore, the choice of a Regulation for the establishment of a common framework for the digital operational resilience of financial entities is the most appropriate way to guarantee a homogenous and coherent application of all components of ICT risk management by the Union financial sector.

中文参考译文

（14）采用条例有助于降低监管复杂性、促进监管趋同和提高法律确定性，也有助于限制合规成本，尤其是跨境经营金融实体的合规成本，并减少竞争扭曲。因此，选择以条例建立金融实体数字运营韧性的共同框架，是确保欧盟金融部门统一、一致地适用ICT风险管理全部组成部分的最适当方式。

序言（15）

English

(15) Directive (EU) 2016/1148 of the European Parliament and of the Council (7) was the first horizontal cybersecurity framework enacted at Union level, applying also to three types of financial entities, namely credit institutions, trading venues and central counterparties. However, since Directive (EU) 2016/1148 set out a mechanism of identification at national level of operators of essential services, only certain credit institutions, trading venues and central counterparties that were identified by the Member States, have been brought into its scope in practice, and hence required to comply with the ICT security and incident notification requirements laid down in it. Directive (EU) 2022/2555 of the European Parliament and of the Council (8) sets a uniform criterion to determine the entities falling within its scope of application (size-cap rule) while also keeping the three types of financial entities in its scope.

中文参考译文

（15）欧洲议会和理事会指令（EU）2016/1148(7)是欧盟层面制定的首个横向网络安全框架，也适用于三类金融实体，即信贷机构、交易场所和中央交易对手。但是，由于该指令规定由各国识别基本服务运营者的机制，实践中只有经成员国识别的部分信贷机构、交易场所和中央交易对手被纳入其范围，并因此须遵守其中规定的ICT安全和事件通知要求。欧洲议会和理事会指令（EU）2022/2555(8)设定统一标准来确定其适用范围内的实体，即规模门槛规则，同时仍将上述三类金融实体纳入其范围。

序言（16）

English

(16) However, as this Regulation increases the level of harmonisation of the various digital resilience components, by introducing requirements on ICT risk management and ICT-related incident reporting that are more stringent in comparison to those laid down in the current Union financial services law, this higher level constitutes an increased harmonisation also in comparison with the requirements laid down in Directive (EU) 2022/2555. Consequently, this Regulation constitutes lex specialis with regard to Directive (EU) 2022/2555. At the same time, it is crucial to maintain a strong relationship between the financial sector and the Union horizontal cybersecurity framework as currently laid out in Directive (EU) 2022/2555 to ensure consistency with the cyber security strategies adopted by Member States and to allow financial supervisors to be made aware of cyber incidents affecting other sectors covered by that Directive.

中文参考译文

（16）然而，本条例通过引入比现有欧盟金融服务法律更严格的ICT风险管理和ICT相关事件报告要求，提高了各项数字韧性要素的协调水平；与指令（EU）2022/2555规定的要求相比，这也构成更高程度的协调。因此，本条例相对于指令（EU）2022/2555构成特别法。同时，必须保持金融部门与目前由指令（EU）2022/2555确立的欧盟横向网络安全框架之间的紧密联系，以确保与成员国制定的网络安全战略一致，并使金融监管者能够了解影响该指令所覆盖其他部门的网络事件。

序言（17）

English

(17) In accordance with Article 4(2) of the Treaty on European Union and without prejudice to the judicial review by the Court of Justice, this Regulation should not affect the responsibility of Member States with regard to essential State functions concerning public security, defence and the safeguarding of national security, for example concerning the supply of information which would be contrary to the safeguarding of national security.

中文参考译文

（17）依照《欧洲联盟条约》第4条第2款，在不影响法院司法审查的前提下，本条例不应影响成员国承担的公共安全、国防和维护国家安全等国家基本职能的责任，例如涉及提供可能有悖于维护国家安全的信息。

序言（18）

English

(18) To enable cross-sector learning and to effectively draw on experiences of other sectors in dealing with cyber threats, the financial entities referred to in Directive (EU) 2022/2555 should remain part of the ‘ecosystem’ of that Directive (for example, Cooperation Group and computer security incident response teams (CSIRTs)).The ESAs and national competent authorities should be able to participate in the strategic policy discussions and the technical workings of the Cooperation Group under that Directive, and to exchange information and further cooperate with the single points of contact designated or established in accordance with that Directive. The competent authorities under this Regulation should also consult and cooperate with the CSIRTs. The competent authorities should also be able to request technical advice from the competent authorities designated or established in accordance with Directive (EU) 2022/2555 and establish cooperation arrangements that aim to ensure effective and fast-response coordination mechanisms.

中文参考译文

（18）为开展跨部门学习并有效借鉴其他部门应对网络威胁的经验，指令（EU）2022/2555所述金融实体应继续作为该指令“生态体系”的一部分，例如参与合作组和计算机安全事件响应团队（CSIRTs）。欧洲监管当局及各国主管机关应能够参加该指令项下合作组的战略政策讨论和技术工作，与根据该指令指定或设立的单一联络点交换信息并进一步合作。本条例项下主管机关还应与CSIRTs磋商和合作。主管机关亦应能够向根据指令（EU）2022/2555指定或设立的主管机关请求技术意见，并建立旨在确保有效、快速响应协调机制的合作安排。

序言（19）

English

(19) Given the strong interlinkages between the digital resilience and the physical resilience of financial entities, a coherent approach with regard to the resilience of critical entities is necessary in this Regulation and Directive (EU) 2022/2557 of the European Parliament and the Council (9). Given that the physical resilience of financial entities is addressed in a comprehensive manner by the ICT risk management and reporting obligations covered by this Regulation, the obligations laid down in Chapters III and IV of Directive (EU) 2022/2557 should not apply to financial entities falling within the scope of that Directive.

中文参考译文

（19）鉴于金融实体数字韧性与物理韧性之间存在紧密联系，本条例与欧洲议会和理事会指令（EU）2022/2557(9)需要就关键实体韧性采取一致方法。金融实体的物理韧性已由本条例涵盖的ICT风险管理和报告义务全面处理，因此指令（EU）2022/2557第三章和第四章规定的义务，不应适用于该指令范围内的金融实体。

序言（20）

English

(20) Cloud computing service providers are one category of digital infrastructure covered by Directive (EU) 2022/2555. The Union Oversight Framework (‘Oversight Framework’) established by this Regulation applies to all critical ICT third-party service providers, including cloud computing service providers providing ICT services to financial entities, and should be considered complementary to the supervision carried out pursuant to Directive (EU) 2022/2555. Moreover, the Oversight Framework established by this Regulation should cover cloud computing service providers in the absence of a Union horizontal framework establishing a digital oversight authority.

中文参考译文

（20）云计算服务提供者是指令（EU）2022/2555涵盖的一类数字基础设施。本条例设立的欧盟监督框架（以下简称“监督框架”）适用于所有关键ICT第三方服务提供者，包括向金融实体提供ICT服务的云计算服务提供者，应视为对依据指令（EU）2022/2555实施监管的补充。此外，在欧盟尚无设立数字监督机关的横向框架时，本条例设立的监督框架应覆盖云计算服务提供者。

查看法规原文

序言第21—30段 / Recitals 21–30

序言（21）

English

(21) In order to maintain full control over ICT risk, financial entities need to have comprehensive capabilities to enable a strong and effective ICT risk management, as well as specific mechanisms and policies for handling all ICT-related incidents and for reporting major ICT-related incidents. Likewise, financial entities should have policies in place for the testing of ICT systems, controls and processes, as well as for managing ICT third-party risk. The digital operational resilience baseline for financial entities should be increased while also allowing for a proportionate application of requirements for certain financial entities, particularly microenterprises, as well as financial entities subject to a simplified ICT risk management framework. To facilitate an efficient supervision of institutions for occupational retirement provision that is proportionate and addresses the need to reduce administrative burdens on the competent authorities, the relevant national supervisory arrangements in respect of such financial entities should take into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations even when the relevant thresholds established in Article 5 of Directive (EU) 2016/2341 of the European Parliament and of the Council (10) are exceeded. In particular, supervisory activities should focus primarily on the need to address serious risks associated with the ICT risk management of a particular entity. Competent authorities should also maintain a vigilant but proportionate approach in relation to the supervision of institutions for occupational retirement provision which, in accordance with Article 31 of Directive (EU) 2016/2341, outsource a significant part of their core business, such as asset management, actuarial calculations, accounting and data management, to service providers.

中文参考译文

（21）为保持对ICT风险的全面控制，金融实体需要具备全面能力，以开展有力、有效的ICT风险管理，并设置处理所有ICT相关事件及报告重大ICT相关事件的专门机制和政策。同样，金融实体应制定测试ICT系统、控制措施和流程，以及管理ICT第三方风险的政策。在提高金融实体数字运营韧性基线的同时，也应允许对某些金融实体，特别是微型企业及适用简化ICT风险管理框架的金融实体，按比例适用要求。为促进对职业退休金机构实施符合比例原则的有效监管，并满足减轻主管机关行政负担的需要，各国针对这类金融实体的相关监管安排应考虑其规模、整体风险状况，以及服务、活动和运营的性质、范围及复杂性，即使已经超过欧洲议会和理事会指令（EU）2016/2341(10)第5条规定的有关门槛。尤其是，监管活动应主要关注应对特定实体ICT风险管理相关严重风险的需要。对于依照指令（EU）2016/2341第31条，将资产管理、精算、会计和数据管理等核心业务的重要部分外包给服务提供者的职业退休金机构，主管机关也应保持审慎关注、同时符合比例原则的监管方法。

序言（22）

English

(22) ICT-related incident reporting thresholds and taxonomies vary significantly at national level. While common ground may be achieved through the relevant work undertaken by the European Union Agency for Cybersecurity (ENISA) established by Regulation (EU) 2019/881 of the European Parliament and of the Council (11) and the Cooperation Group under Directive (EU) 2022/2555, divergent approaches on setting the thresholds and use of taxonomies still exist, or can emerge, for the remainder of financial entities. Due to those divergences, there are multiple requirements that financial entities must comply with, especially when operating across several Member States and when part of a financial group. Moreover, such divergences have the potential to hinder the creation of further uniform or centralised Union mechanisms that speed up the reporting process and support a quick and smooth exchange of information between competent authorities, which is crucial for addressing ICT risk in the event of large-scale attacks with potentially systemic consequences.

中文参考译文

（22）各国ICT相关事件报告门槛及分类体系存在显著差异。由欧洲议会和理事会条例（EU）2019/881(11)设立的欧盟网络安全局（ENISA），以及指令（EU）2022/2555项下合作组开展的有关工作，虽可能促进形成共同基础，但针对其他金融实体，在门槛设定及分类体系使用方面仍存在或可能出现不同方法。这些差异导致金融实体必须遵守多重要求，在多个成员国经营以及属于金融集团时尤为如此。此外，这些差异还可能妨碍进一步建立统一或集中的欧盟机制，以加快报告流程并支持主管机关间迅速、顺畅地交换信息；在发生可能产生系统性后果的大规模攻击时，这类机制对于应对ICT风险至关重要。

序言（23）

English

(23) To reduce the administrative burden and potentially duplicative reporting obligations for certain financial entities, the requirement for the incident reporting pursuant to Directive (EU) 2015/2366 of the European Parliament and of the Council (12) should cease to apply to payment service providers that fall within the scope of this Regulation. Consequently, credit institutions, e-money institutions, payment institutions and account information service providers, as referred to in Article 33(1) of that Directive, should, from the date of application of this Regulation, report pursuant to this Regulation, all operational or security payment-related incidents which have been previously reported pursuant to that Directive, irrespective of whether such incidents are ICT-related.

中文参考译文

（23）为减少某些金融实体的行政负担及可能重复的报告义务，欧洲议会和理事会指令（EU）2015/2366(12)项下事件报告要求，应停止适用于本条例范围内的支付服务提供者。因此，自本条例适用之日起，信贷机构、电子货币机构、支付机构，以及该指令第33条第1款所述账户信息服务提供者，应依本条例报告此前依该指令报告的所有支付相关操作或安全事件，无论这些事件是否与ICT有关。

序言（24）

English

(24) To enable competent authorities to fulfil supervisory roles by acquiring a complete overview of the nature, frequency, significance and impact of ICT-related incidents and to enhance the exchange of information between relevant public authorities, including law enforcement authorities and resolution authorities, this Regulation should lay down a robust ICT-related incident reporting regime whereby the relevant requirements address current gaps in financial services law, and remove existing overlaps and duplications to alleviate costs. It is essential to harmonise the ICT-related incident reporting regime by requiring all financial entities to report to their competent authorities through a single streamlined framework as set out in this Regulation. In addition, the ESAs should be empowered to further specify relevant elements for the ICT-related incident reporting framework, such as taxonomy, timeframes, data sets, templates and applicable thresholds. To ensure full consistency with Directive (EU) 2022/2555, financial entities should be allowed, on a voluntary basis, to notify significant cyber threats to the relevant competent authority, when they consider that the cyber threat is of relevance to the financial system, service users or clients.

中文参考译文

（24）为使主管机关通过全面掌握ICT相关事件的性质、频率、重要程度及影响来履行监管职责，并加强包括执法机关和处置当局在内的有关公共机关间的信息交换，本条例应建立健全的ICT相关事件报告制度，以相关要求填补金融服务法律的现有空白，消除既有重叠和重复，从而减轻成本。必须通过要求所有金融实体按照本条例所设单一、精简的框架向主管机关报告，协调ICT相关事件报告制度。此外，应授权欧洲监管当局进一步明确ICT相关事件报告框架的相关要素，例如分类体系、时限、数据集、模板及适用门槛。为确保与指令（EU）2022/2555完全一致，当金融实体认为某项网络威胁与金融体系、服务使用者或客户有关时，应允许其自愿向有关主管机关通知重大网络威胁。

序言（25）

English

(25) Digital operational resilience testing requirements have been developed in certain financial subsectors setting out frameworks that are not always fully aligned. This leads to a potential duplication of costs for cross-border financial entities and makes the mutual recognition of the results of digital operational resilience testing complex which, in turn, can fragment the internal market.

中文参考译文

（25）部分金融子行业已经制定数字运营韧性测试要求，但其框架并不总是完全一致。这可能导致跨境金融实体重复承担成本，并使数字运营韧性测试结果的相互认可变得复杂，进而可能造成内部市场分割。

序言（26）

English

(26) In addition, where no ICT testing is required, vulnerabilities remain undetected and result in exposing a financial entity to ICT risk and ultimately create a higher risk to the stability and integrity of the financial sector. Without Union intervention, digital operational resilience testing would continue to be inconsistent and would lack a system of mutual recognition of ICT testing results across different jurisdictions. In addition, as it is unlikely that other financial subsectors would adopt testing schemes on a meaningful scale, they would miss out on the potential benefits of a testing framework, in terms of revealing ICT vulnerabilities and risks, and testing defence capabilities and business continuity, which contributes to increasing the trust of customers, suppliers and business partners. To remedy those overlaps, divergences and gaps, it is necessary to lay down rules for a coordinated testing regime and thereby facilitate the mutual recognition of advanced testing for financial entities meeting the criteria set out in this Regulation.

中文参考译文

（26）此外，在未要求开展ICT测试的情况下，脆弱性可能无法被发现，使金融实体暴露于ICT风险，最终对金融部门的稳定性和完整性造成更高风险。没有欧盟层面的干预，数字运营韧性测试将继续不一致，并缺乏跨司法管辖区相互认可ICT测试结果的制度。其他金融子行业也不太可能大规模采用有实质意义的测试方案，因此将无法获得测试框架在揭示ICT脆弱性和风险、检验防御能力及业务连续性方面的潜在益处，而这些益处有助于增进客户、供应商和业务伙伴的信任。为纠正上述重叠、分歧和空白，有必要制定协调测试制度的规则，从而促进对符合本条例所定标准的金融实体所开展高级测试的相互认可。

序言（27）

English

(27) Financial entities’ reliance on the use of ICT services is partly driven by their need to adapt to an emerging competitive digital global economy, to boost their business efficiency and to meet consumer demand. The nature and extent of such reliance has been continuously evolving in recent years, driving cost reduction in financial intermediation, enabling business expansion and scalability in the deployment of financial activities while offering a wide range of ICT tools to manage complex internal processes.

中文参考译文

（27）金融实体对ICT服务使用的依赖，部分源于适应新兴、竞争性的数字化全球经济、提高业务效率以及满足消费者需求的需要。近年来，这种依赖的性质和程度持续演变，推动金融中介成本下降，使业务扩张及金融活动部署的规模化成为可能，同时提供广泛的ICT工具来管理复杂内部流程。

序言（28）

English

(28) The extensive use of ICT services is evidenced by complex contractual arrangements, whereby financial entities often encounter difficulties in negotiating contractual terms that are tailored to the prudential standards or other regulatory requirements to which they are subject, or otherwise in enforcing specific rights, such as access or audit rights, even when the latter are enshrined in their contractual arrangements. Moreover, many of those contractual arrangements do not provide for sufficient safeguards allowing for the fully-fledged monitoring of subcontracting processes, thus depriving the financial entity of its ability to assess the associated risks. In addition, as ICT third-party service providers often provide standardised services to different types of clients, such contractual arrangements do not always cater adequately for the individual or specific needs of financial industry actors.

中文参考译文

（28）复杂的合同安排体现了ICT服务的广泛使用。金融实体经常难以通过协商获得符合其所受审慎标准或其他监管要求的合同条款，或者难以行使访问权、审计权等特定权利，即使这些权利已被写入合同。此外，许多此类合同安排缺乏足够保障，不能支持对分包过程的全面监测，因而使金融实体无法评估相关风险。ICT第三方服务提供者还经常向不同类型客户提供标准化服务，因此这些合同安排并不总能充分满足金融行业参与者的个别或特殊需要。

序言（29）

English

(29) Even though Union financial services law contains certain general rules on outsourcing, monitoring of the contractual dimension is not fully anchored into Union law. In the absence of clear and bespoke Union standards applying to the contractual arrangements concluded with ICT third-party service providers, the external source of ICT risk is not comprehensively addressed. Consequently, it is necessary to set out certain key principles to guide financial entities’ management of ICT third-party risk, which are of particular importance when financial entities resort to ICT third-party service providers to support their critical or important functions. Those principles should be accompanied by a set of core contractual rights in relation to several elements in the performance and termination of contractual arrangements with a view to providing certain minimum safeguards in order to strengthen financial entities’ ability to effectively monitor all ICT risk emerging at the level of third-party service providers. Those principles are complementary to the sectoral law applicable to outsourcing.

中文参考译文

（29）虽然欧盟金融服务法律包含某些外包一般规则，合同层面的监测尚未在欧盟法律中得到充分确立。由于缺少适用于与ICT第三方服务提供者订立合同安排的明确、有针对性的欧盟标准，ICT风险的外部来源未被全面处理。因此，有必要规定若干关键原则，指导金融实体管理ICT第三方风险；当金融实体利用ICT第三方服务提供者支持其关键或重要功能时，这些原则尤其重要。这些原则应配套一组涉及合同安排履行和终止若干要素的核心合同权利，以提供一定最低保障，增强金融实体有效监测第三方服务提供者层面产生的所有ICT风险的能力。这些原则是适用于外包的行业法律的补充。

序言（30）

English

(30) A certain lack of homogeneity and convergence regarding the monitoring of ICT third-party risk and ICT third-party dependencies is evident today. Despite efforts to address outsourcing, such as EBA Guidelines on outsourcing of 2019 and ESMA Guidelines on outsourcing to cloud service providers of 2021 the broader issue of counteracting systemic risk which may be triggered by the financial sector’s exposure to a limited number of critical ICT third-party service providers is not sufficiently addressed by Union law. The lack of rules at Union level is compounded by the absence of national rules on mandates and tools that allow financial supervisors to acquire a good understanding of ICT third-party dependencies and to monitor adequately risks arising from the concentration of ICT third-party dependencies.

中文参考译文

（30）目前，ICT第三方风险及ICT第三方依赖关系的监测明显存在一定程度的统一性和趋同性不足。尽管已有2019年EBA外包指南和2021年ESMA向云服务提供者外包指南等应对外包问题的努力，欧盟法律仍未充分处理更广泛的问题，即应对金融部门因依赖数量有限的关键ICT第三方服务提供者而可能引发的系统性风险。欧盟层面规则的缺乏，还因各国未制定相关职权与工具规则而进一步加剧；这些规则本应使金融监管者能够充分了解ICT第三方依赖，并适当监测ICT第三方依赖集中产生的风险。

序言第31—40段 / Recitals 31–40

序言（31）

English

(31) Taking into account the potential systemic risk entailed by increased outsourcing practices and by the ICT third-party concentration, and mindful of the insufficiency of national mechanisms in providing financial supervisors with adequate tools to quantify, qualify and redress the consequences of ICT risk occurring at critical ICT third-party service providers, it is necessary to establish an appropriate Oversight Framework allowing for a continuous monitoring of the activities of ICT third-party service providers that are critical ICT third-party service providers to financial entities, while ensuring that the confidentiality and security of customers other than financial entities is preserved. While intra-group provision of ICT services entails specific risks and benefits, it should not be automatically considered less risky than the provision of ICT services by providers outside of a financial group and should therefore be subject to the same regulatory framework. However, when ICT services are provided from within the same financial group, financial entities might have a higher level of control over intra-group providers, which ought to be taken into account in the overall risk assessment.

中文参考译文

（31）考虑到日益增加的外包实践和ICT第三方集中所带来的潜在系统性风险，以及各国机制尚不足以向金融监管者提供适当工具，对关键ICT第三方服务提供者发生的ICT风险后果进行定量、定性分析和补救，有必要建立适当监督框架，对向金融实体提供关键ICT第三方服务的提供者持续开展活动监测，同时确保金融实体以外客户的保密性和安全得到保护。集团内部提供ICT服务虽有特殊风险和益处，也不应自动被认为比集团外部提供者提供ICT服务的风险更低，因此应适用相同监管框架。然而，在同一金融集团内部提供ICT服务时，金融实体可能对集团内部提供者具有更高控制程度，整体风险评估应考虑这一点。

序言（32）

English

(32) With ICT risk becoming more and more complex and sophisticated, good measures for the detection and prevention of ICT risk depend to a great extent on the regular sharing between financial entities of threat and vulnerability intelligence. Information sharing contributes to creating increased awareness of cyber threats. In turn, this enhances the capacity of financial entities to prevent cyber threats from becoming real ICT-related incidents and enables financial entities to more effectively contain the impact of ICT-related incidents and to recover faster. In the absence of guidance at Union level, several factors seem to have inhibited such intelligence sharing, in particular uncertainty about its compatibility with data protection, anti-trust and liability rules.

中文参考译文

（32）随着ICT风险日益复杂和精巧，良好的ICT风险检测与预防措施在很大程度上依赖金融实体定期共享威胁及脆弱性情报。信息共享有助于提高网络威胁意识，进而增强金融实体防止网络威胁演变为实际ICT相关事件的能力，使其更有效地遏制事件影响并更快恢复。由于缺少欧盟层面的指引，一些因素似乎阻碍了这种情报共享，尤其是对其是否符合数据保护、反垄断和责任规则的不确定性。

序言（33）

English

(33) In addition, doubts about the type of information that can be shared with other market participants, or with non-supervisory authorities (such as ENISA, for analytical input, or Europol, for law enforcement purposes) lead to useful information being withheld. Therefore, the extent and quality of information sharing currently remains limited and fragmented, with relevant exchanges mostly being local (by way of national initiatives) and with no consistent Union-wide information-sharing arrangements tailored to the needs of an integrated financial system. It is therefore important to strengthen those communication channels.

中文参考译文

（33）此外，对于可以与其他市场参与者，或者与非监管机关共享哪些类型的信息，仍存在疑虑，例如向ENISA提供分析材料，或者为执法目的向欧洲刑警组织提供信息，致使有用信息未被共享。因此，目前信息共享的范围和质量仍有限且零散，相关交流多为地方性的，主要通过各国举措进行，缺少适应一体化金融体系需要、覆盖整个欧盟的一致信息共享安排。因此，有必要强化这些沟通渠道。

序言（34）

English

(34) Financial entities should be encouraged to exchange among themselves cyber threat information and intelligence, and to collectively leverage their individual knowledge and practical experience at strategic, tactical and operational levels with a view to enhancing their capabilities to adequately assess, monitor, defend against, and respond to cyber threats, by participating in information sharing arrangements. It is therefore necessary to enable the emergence at Union level of mechanisms for voluntary information-sharing arrangements which, when conducted in trusted environments, would help the community of the financial industry to prevent and collectively respond to cyber threats by quickly limiting the spread of ICT risk and impeding potential contagion throughout the financial channels. Those mechanisms should comply with the applicable competition law rules of the Union set out in the Communication from the Commission of 14 January 2011 entitled ‘Guidelines on the applicability of Article 101 of the Treaty on the Functioning of the European Union to horizontal cooperation agreements’, as well as with Union data protection rules, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (13). They should operate based on the use of one or more of the legal bases that are laid down in Article 6 of that Regulation, such as in the context of the processing of personal data that is necessary for the purposes of the legitimate interest pursued by the controller or by a third party, as referred to in Article 6(1), point (f), of that Regulation, as well as in the context of the processing of personal data necessary for compliance with a legal obligation to which the controller is subject, necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, as referred to in Article 6(1), points (c) and (e), respectively, of that Regulation.

中文参考译文

（34）应鼓励金融实体参与信息共享安排，相互交换网络威胁信息和情报，并在战略、战术和运营层面共同利用各自知识与实践经验，以增强其适当评估、监测、防御和响应网络威胁的能力。因此，有必要推动在欧盟层面形成自愿信息共享安排机制。在可信环境中运行这些机制，可以通过迅速限制ICT风险传播、阻断风险沿金融渠道潜在蔓延，帮助金融行业共同体预防并集体应对网络威胁。这些机制应遵守欧盟委员会2011年1月14日题为《关于〈欧洲联盟运行条约〉第101条适用于横向合作协议的指南》的通报所载适用欧盟竞争法规则，以及欧盟数据保护规则，特别是欧洲议会和理事会条例（EU）2016/679(13)。这些机制应基于该条例第6条规定的一项或多项法律基础运行，例如该条例第6条第1款(f)项所述，为控制者或第三方追求的正当利益所必需的个人数据处理，以及该条例第6条第1款(c)项和(e)项分别所述，为履行控制者所承担法律义务所必需的处理，或为执行公共利益任务、行使赋予控制者的公权力所必需的处理。

序言（35）

English

(35) In order to maintain a high level of digital operational resilience for the whole financial sector, and at the same time to keep pace with technological developments, this Regulation should address risk stemming from all types of ICT services. To that end, the definition of ICT services in the context of this Regulation should be understood in a broad manner, encompassing digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis. That definition should, for instance, include so called ‘over the top’ services, which fall within the category of electronic communications services. It should exclude only the limited category of traditional analogue telephone services qualifying as Public Switched Telephone Network (PSTN) services, landline services, Plain Old Telephone Service (POTS), or fixed-line telephone services.

中文参考译文

（35）为使整个金融部门保持高水平数字运营韧性，同时跟上技术发展，本条例应处理所有类型ICT服务产生的风险。为此，应对本条例语境下的ICT服务定义作广义理解，涵盖通过ICT系统持续向一个或多个内部或外部使用者提供的数字和数据服务。例如，该定义应包括属于电子通信服务类别的所谓“OTT”服务。应仅排除有限类别的传统模拟电话服务，即公共交换电话网络（PSTN）服务、陆地线路服务、传统普通电话服务（POTS）或固定线路电话服务。

序言（36）

English

(36) Notwithstanding the broad coverage envisaged by this Regulation, the application of the digital operational resilience rules should take into account the significant differences between financial entities in terms of their size and overall risk profile. As a general principle, when distributing resources and capabilities for the implementation of the ICT risk management framework, financial entities should duly balance their ICT-related needs to their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations, while competent authorities should continue to assess and review the approach of such distribution.

中文参考译文

（36）尽管本条例拟覆盖广泛范围，数字运营韧性规则的适用仍应考虑不同金融实体在规模和整体风险状况方面的显著差异。作为一般原则，金融实体为实施ICT风险管理框架分配资源和能力时，应使ICT相关需要与其规模、整体风险状况，以及服务、活动和运营的性质、范围与复杂性保持适当平衡；主管机关则应持续评估和审查这种分配方法。

序言（37）

English

(37) Account information service providers, referred to in Article 33(1) of Directive (EU) 2015/2366, are explicitly included in the scope of this Regulation, taking into account the specific nature of their activities and the risks arising therefrom. In addition, electronic money institutions and payment institutions exempted pursuant to Article 9(1) of Directive 2009/110/EC of the European Parliament and of the Council (14) and Article 32(1) of Directive (EU) 2015/2366 are included in the scope of this Regulation even if they have not been granted authorisation in accordance Directive 2009/110/EC to issue electronic money, or if they have not been granted authorisation in accordance with Directive (EU) 2015/2366 to provide and execute payment services. However, post office giro institutions, referred to in Article 2(5), point (3), of Directive 2013/36/EU of the European Parliament and of the Council (15), are excluded from the scope of this Regulation. The competent authority for payment institutions exempted pursuant to Directive (EU) 2015/2366, electronic money institutions exempted pursuant to Directive 2009/110/EC and account information service providers as referred to in Article 33(1) of Directive (EU) 2015/2366, should be the competent authority designated in accordance with Article 22 of Directive (EU) 2015/2366.

中文参考译文

（37）考虑到其活动的特殊性质及由此产生的风险，指令（EU）2015/2366第33条第1款所述账户信息服务提供者被明确纳入本条例范围。此外，依据欧洲议会和理事会指令2009/110/EC(14)第9条第1款及指令（EU）2015/2366第32条第1款获豁免的电子货币机构和支付机构，也纳入本条例范围，即使其未获依据指令2009/110/EC发行电子货币的许可，或者未获依据指令（EU）2015/2366提供和执行支付服务的许可。但是，欧洲议会和理事会指令2013/36/EU(15)第2条第5款第(3)项所述邮政汇划机构，不纳入本条例范围。对于依据指令（EU）2015/2366获豁免的支付机构、依据指令2009/110/EC获豁免的电子货币机构，以及指令（EU）2015/2366第33条第1款所述账户信息服务提供者，其主管机关应为依指令（EU）2015/2366第22条指定的主管机关。

序言（38）

English

(38) As larger financial entities might enjoy wider resources and can swiftly deploy funds to develop governance structures and set up various corporate strategies, only financial entities that are not microenterprises in the sense of this Regulation should be required to establish more complex governance arrangements. Such entities are better equipped in particular to set up dedicated management functions for supervising arrangements with ICT third-party service providers or for dealing with crisis management, to organise their ICT risk management according to the three lines of defence model, or to set up an internal risk management and control model, and to submit their ICT risk management framework to internal audits.

中文参考译文

（38）较大的金融实体可能拥有更丰富资源，并可迅速调配资金发展治理结构、制定各类企业战略，因此，只有不属于本条例意义上微型企业的金融实体，才应被要求建立更复杂的治理安排。这些实体尤其更有能力设置专门管理职能，监督与ICT第三方服务提供者的安排或开展危机管理，按照三道防线模型组织ICT风险管理，或者建立内部风险管理与控制模型，并对其ICT风险管理框架开展内部审计。

序言（39）

English

(39) Some financial entities benefit from exemptions or are subject to a very light regulatory framework under the relevant sector-specific Union law. Such financial entities include managers of alternative investment funds referred to in Article 3(2) of Directive 2011/61/EU of the European Parliament and of the Council (16), insurance and reinsurance undertakings referred to in Article 4 of Directive 2009/138/EC of the European Parliament and of the Council (17), and institutions for occupational retirement provision which operate pension schemes which together do not have more than 15 members in total. In light of those exemptions it would not be proportionate to include such financial entities in the scope of this Regulation. In addition, this Regulation acknowledges the specificities of the insurance intermediation market structure, with the result that insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries qualifying as microenterprises or as small or medium-sized enterprises should not be subject to this Regulation.

中文参考译文

（39）某些金融实体依据欧盟相关行业专门法律享有豁免，或者适用非常宽松的监管框架。这些实体包括欧洲议会和理事会指令2011/61/EU(16)第3条第2款所述另类投资基金管理人，欧洲议会和理事会指令2009/138/EC(17)第4条所述保险及再保险企业，以及所运营养老金计划合计成员总数不超过15人的职业退休金机构。鉴于这些豁免，将上述实体纳入本条例范围不符合比例原则。此外，本条例承认保险中介市场结构的特殊性，因此符合微型、小型或中型企业条件的保险中介、再保险中介和附属保险中介，不应受本条例约束。

序言（40）

English

(40) Since the entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU are excluded from the scope of that Directive, Member States should consequently be able to choose to exempt from the application of this Regulation such entities located within their respective territories.

中文参考译文

（40）由于指令2013/36/EU第2条第5款第(4)至(23)项所述实体被排除在该指令范围之外，成员国因此应能够选择对位于各自领土内的这些实体豁免适用本条例。

查看法规原文

序言第41—50段 / Recitals 41–50

序言（41）

English

(41) Similarly, in order to align this Regulation to the scope of Directive 2014/65/EU of the European Parliament and of the Council (18), it is also appropriate to exclude from the scope of this Regulation natural and legal persons referred in Articles 2 and 3 of that Directive which are allowed to provide investment services without having to obtain an authorisation under Directive 2014/65/EU. However, Article 2 of Directive 2014/65/EU also excludes from the scope of that Directive entities which qualify as financial entities for the purposes of this Regulation such as, central securities depositories, collective investment undertakings or insurance and reinsurance undertakings. The exclusion from the scope of this Regulation of the persons and entities referred to in Articles 2 and 3 of that Directive should not encompass those central securities depositories, collective investment undertakings or insurance and reinsurance undertakings.

中文参考译文

（41）同样，为使本条例与欧洲议会和理事会指令2014/65/EU(18)的范围一致，也应将该指令第2条和第3条所述、无须依该指令取得许可即可提供投资服务的自然人和法人排除在本条例范围之外。但是，指令2014/65/EU第2条也将某些在本条例下属于金融实体的实体排除在该指令范围之外，例如中央证券存管机构、集合投资企业或保险及再保险企业。将该指令第2条和第3条所述人员和实体排除在本条例范围之外时，不应包括上述中央证券存管机构、集合投资企业或保险及再保险企业。

序言（42）

English

(42) Under sector-specific Union law, some financial entities are subject to lighter requirements or exemptions for reasons associated with their size or the services they provide. That category of financial entities includes small and non-interconnected investment firms, small institutions for occupational retirement provision which may be excluded from the scope of Directive (EU) 2016/2341 under the conditions laid down in Article 5 of that Directive by the Member State concerned and operate pension schemes which together do not have more than 100 members in total, as well as institutions exempted pursuant to Directive 2013/36/EU. Therefore, in accordance with the principle of proportionality and to preserve the spirit of sector-specific Union law, it is also appropriate to subject those financial entities to a simplified ICT risk management framework under this Regulation. The proportionate character of the ICT risk management framework covering those financial entities should not be altered by the regulatory technical standards that are to be developed by the ESAs. Moreover, in accordance with the principle of proportionality, it is appropriate to also subject payment institutions referred to in Article 32(1) of Directive (EU) 2015/2366 and electronic money institutions referred to in Article 9 of Directive 2009/110/EC exempted in accordance with national law transposing those Union legal acts to a simplified ICT risk management framework under this Regulation, while payment institutions and electronic money institutions which have not been exempted in accordance with their respective national law transposing sectoral Union law should comply with the general framework laid down by this Regulation.

中文参考译文

（42）根据欧盟行业专门法律，某些金融实体因规模或所提供服务的原因，适用较轻要求或享有豁免。这类实体包括小型且非互联的投资公司、小型职业退休金机构——有关成员国可按指令（EU）2016/2341第5条规定的条件将其排除在该指令范围之外，且其运营的养老金计划合计成员总数不超过100人——以及依据指令2013/36/EU获豁免的机构。因此，依照比例原则并为保持欧盟行业专门法律的精神，应使这些金融实体适用本条例项下简化ICT风险管理框架。欧洲监管当局拟制定的监管技术标准不应改变适用于这些金融实体的ICT风险管理框架的比例性。此外，依照比例原则，对指令（EU）2015/2366第32条第1款所述支付机构及指令2009/110/EC第9条所述电子货币机构，在其根据转化上述欧盟法律文件的国内法获豁免时，也宜适用本条例项下简化ICT风险管理框架；未根据各自转化欧盟行业法律的国内法获豁免的支付机构和电子货币机构，则应遵守本条例规定的一般框架。

序言（43）

English

(43) Similarly, financial entities which qualify as microenterprises or are subject to the simplified ICT risk management framework under this Regulation should not be required to establish a role to monitor their arrangements concluded with ICT third-party service providers on the use of ICT services; or to designate a member of senior management to be responsible for overseeing the related risk exposure and relevant documentation; to assign the responsibility for managing and overseeing ICT risk to a control function and ensure an appropriate level of independence of such control function in order to avoid conflicts of interest; to document and review at least once a year the ICT risk management framework; to subject to internal audit on a regular basis the ICT risk management framework; to perform in-depth assessments after major changes in their network and information system infrastructures and processes; to regularly conduct risk analyses on legacy ICT systems; to subject the implementation of the ICT Response and Recovery plans to independent internal audit reviews; to have a crisis management function, to expand the testing of business continuity and response and recovery plans to capture switchover scenarios between primary ICT infrastructure and redundant facilities; to report to competent authorities, upon their request, an estimation of aggregated annual costs and losses caused by major ICT-related incidents, to maintain redundant ICT capacities; to communicate to national competent authorities implemented changes following post ICT-related incident reviews; to monitor on a continuous basis relevant technological developments, to establish a comprehensive digital operational resilience testing programme as an integral part of the ICT risk management framework provided for in this Regulation, or to adopt and regularly review a strategy on ICT third-party risk. In addition, microenterprises should only be required to assess the need to maintain such redundant ICT capacities based on their risk profile. Microenterprises should benefit from a more flexible regime as regards digital operational resilience testing programmes. When considering the type and frequency of testing to be performed, they should properly balance the objective of maintaining a high digital operational resilience, the available resources and their overall risk profile. Microenterprises and financial entities subject to the simplified ICT risk management framework under this Regulation should be exempted from the requirement to perform advanced testing of ICT tools, systems and processes based on threat-led penetration testing (TLPT), as only financial entities meeting the criteria set out in this Regulation should be required to carry out such testing. In light of their limited capabilities, microenterprises should be able to agree with the ICT third-party service provider to delegate the financial entity’s rights of access, inspection and audit to an independent third-party, to be appointed by the ICT third-party service provider, provided that the financial entity is able to request, at any time, all relevant information and assurance on the ICT third-party service provider’s performance from the respective independent third-party.

中文参考译文

（43）同样，对于符合微型企业条件或者适用本条例简化ICT风险管理框架的金融实体，不应要求其：设置岗位来监测与ICT第三方服务提供者订立的ICT服务使用安排，或者指定一名高级管理人员负责监督相关风险敞口及有关文件；将ICT风险管理和监督责任交由控制职能承担，并确保该职能具有适当独立性以避免利益冲突；至少每年记录和审查ICT风险管理框架；定期对ICT风险管理框架开展内部审计；在网络和信息系统基础设施及流程发生重大变化后开展深入评估；定期对遗留ICT系统开展风险分析；对ICT响应和恢复计划的实施开展独立内部审计审查；设置危机管理职能；扩展业务连续性及响应和恢复计划的测试，以覆盖主要ICT基础设施与冗余设施之间的切换场景；应主管机关要求报告重大ICT相关事件造成的年度成本和损失总额估算；维持冗余ICT能力；将ICT相关事件事后审查后实施的变更告知本国主管机关；持续监测相关技术发展；制定全面数字运营韧性测试方案，作为本条例所定ICT风险管理框架的组成部分；或者制定并定期审查ICT第三方风险战略。此外，对于微型企业，仅应要求其依据自身风险状况评估维持这种冗余ICT能力的需要。微型企业在数字运营韧性测试方案方面应享有更灵活制度；考虑测试类型与频率时，应适当平衡维持高水平数字运营韧性的目标、可用资源与整体风险状况。微型企业及适用本条例简化ICT风险管理框架的金融实体，应免于对ICT工具、系统和流程开展基于威胁情报的渗透测试（TLPT）这一高级测试要求，因为只有符合本条例所定标准的金融实体才应被要求开展这种测试。鉴于能力有限，微型企业应能够与ICT第三方服务提供者约定，将金融实体的访问、检查和审计权委托给由该服务提供者指定的独立第三方，但前提是金融实体能够随时向该独立第三方要求提供关于ICT第三方服务提供者履约情况的全部相关信息和保证。

序言（44）

English

(44) As only those financial entities identified for the purposes of the advanced digital resilience testing should be required to conduct threat-led penetration tests, the administrative processes and financial costs entailed in the performance of such tests should be borne by a small percentage of financial entities.

中文参考译文

（44）由于只有为高级数字韧性测试而被确定的金融实体才应被要求开展基于威胁情报的渗透测试，开展这类测试涉及的行政程序和财务成本，应仅由一小部分金融实体承担。

序言（45）

English

(45) To ensure full alignment and overall consistency between financial entities’ business strategies, on the one hand, and the conduct of ICT risk management, on the other hand, the financial entities’ management bodies should be required to maintain a pivotal and active role in steering and adapting the ICT risk management framework and the overall digital operational resilience strategy. The approach to be taken by management bodies should not only focus on the means of ensuring the resilience of the ICT systems, but should also cover people and processes through a set of policies which cultivate, at each corporate layer, and for all staff, a strong sense of awareness about cyber risks and a commitment to observe a strict cyber hygiene at all levels. The ultimate responsibility of the management body in managing a financial entity’s ICT risk should be an overarching principle of that comprehensive approach, further translated into the continuous engagement of the management body in the control of the monitoring of the ICT risk management.

中文参考译文

（45）为确保金融实体业务战略与ICT风险管理活动充分协调、整体一致，应要求金融实体管理机构在引导和调整ICT风险管理框架及整体数字运营韧性战略方面保持核心、积极的作用。管理机构采取的方法不应只关注确保ICT系统韧性的手段，还应通过一组政策覆盖人员和流程，在企业各层级及全体员工中培养强烈网络风险意识，以及在各层级严格遵守网络卫生要求的承诺。管理机构对金融实体ICT风险管理承担最终责任，应成为这一综合方法的总原则，并进一步体现为管理机构持续参与对ICT风险管理监测的控制。

序言（46）

English

(46) Moreover, the principle of the management body’s full and ultimate responsibility for the management of the ICT risk of the financial entity goes hand in hand with the need to secure a level of ICT-related investments and an overall budget for the financial entity that would enable the financial entity to achieve a high level of digital operational resilience.

中文参考译文

（46）此外，管理机构对金融实体ICT风险管理承担全面且最终责任的原则，与保障ICT相关投资水平和金融实体整体预算的需要相伴而行；这些投入应足以使金融实体实现高水平数字运营韧性。

序言（47）

English

(47) Inspired by relevant international, national and industry best practices, guidelines, recommendations and approaches to the management of cyber risk, this Regulation promotes a set of principles that facilitate the overall structure of ICT risk management. Consequently, as long as the main capabilities which financial entities put in place address the various functions in the ICT risk management (identification, protection and prevention, detection, response and recovery, learning and evolving and communication) set out in this Regulation, financial entities should remain free to use ICT risk management models that are differently framed or categorised.

中文参考译文

（47）本条例借鉴有关国际、国家和行业网络风险管理的最佳实践、指南、建议及方法，提出一组有助于构建ICT风险管理整体结构的原则。因此，只要金融实体建立的主要能力能够覆盖本条例所定ICT风险管理各项职能，即识别、防护和预防、检测、响应和恢复、学习和演进以及沟通，金融实体应仍可自由采用不同构架或分类方式的ICT风险管理模型。

序言（48）

English

(48) To keep pace with an evolving cyber threat landscape, financial entities should maintain updated ICT systems that are reliable and capable, not only for guaranteeing the processing of data required for their services, but also for ensuring sufficient technological resilience to allow them to deal adequately with additional processing needs due to stressed market conditions or other adverse situations.

中文参考译文

（48）为跟上不断演变的网络威胁态势，金融实体应维护可靠、能力充足且保持更新的ICT系统，既保障处理其服务所需数据，也确保充分的技术韧性，使其能够适当应对市场承压或其他不利情况下增加的处理需要。

序言（49）

English

(49) Efficient business continuity and recovery plans are necessary to allow financial entities to promptly and quickly resolve ICT-related incidents, in particular cyber-attacks, by limiting damage and giving priority to the resumption of activities and recovery actions in accordance with their back-up policies. However, such resumption should in no way jeopardise the integrity and security of the network and information systems or the availability, authenticity, integrity or confidentiality of data.

中文参考译文

（49）高效的业务连续性和恢复计划，是使金融实体及时、迅速解决ICT相关事件，尤其是网络攻击的必要条件；实体应限制损害，并依备份政策优先安排活动恢复及恢复行动。然而，这种恢复绝不应危及网络和信息系统的完整性与安全，或者数据的可用性、真实性、完整性或保密性。

序言（50）

English

(50) While this Regulation allows financial entities to determine their recovery time and recovery point objectives in a flexible manner and hence to set such objectives by fully taking into account the nature and the criticality of the relevant functions and any specific business needs, it should nevertheless require them to carry out an assessment of the potential overall impact on market efficiency when determining such objectives.

中文参考译文

（50）本条例允许金融实体灵活确定恢复时间目标和恢复点目标，从而在设定目标时充分考虑相关功能的性质、关键程度及特定业务需要，但仍应要求其在确定这些目标时评估对市场效率可能产生的整体影响。

序言第51—60段 / Recitals 51–60

序言（51）

English

(51) The propagators of cyber-attacks tend to pursue financial gains directly at the source, thus exposing financial entities to significant consequences. To prevent ICT systems from losing integrity or becoming unavailable, and hence to avoid data breaches and damage to physical ICT infrastructure, the reporting of major ICT-related incidents by financial entities should be significantly improved and streamlined. ICT-related incident reporting should be harmonised through the introduction of a requirement for all financial entities to report directly to their relevant competent authorities. Where a financial entity is subject to supervision by more than one national competent authority, Member States should designate a single competent authority as the addressee of such reporting. Credit institutions classified as significant in accordance with Article 6(4) of Council Regulation (EU) No 1024/2013 (19) should submit such reporting to the national competent authorities, which should subsequently transmit the report to the European Central Bank (ECB).

中文参考译文

（51）网络攻击发起者往往直接在资金来源处追逐经济利益，因此可能给金融实体造成重大后果。为防止ICT系统丧失完整性或变得不可用，并由此避免数据安全破坏及物理ICT基础设施受损，应显著改进和精简金融实体的重大ICT相关事件报告。应要求所有金融实体直接向其有关主管机关报告，以协调ICT相关事件报告制度。金融实体受多个本国主管机关监管时，成员国应指定一个主管机关作为接报方。依理事会条例（EU）第1024/2013号(19)第6条第4款被划为重要机构的信贷机构，应向本国主管机关提交报告，后者随后应将报告转送欧洲中央银行（ECB）。

序言（52）

English

(52) The direct reporting should enable financial supervisors to have immediate access to information about major ICT-related incidents. Financial supervisors should in turn pass on details of major ICT-related incidents to public non-financial authorities (such as competent authorities and single points of contact under Directive (EU) 2022/2555, national data protection authorities, and to law enforcement authorities for major ICT-related incidents of a criminal nature) in order to enhance such authorities awareness of such incidents and, in the case of CSIRTs, to facilitate prompt assistance that may be given to financial entities, as appropriate. Member States should, in addition, be able to determine that financial entities themselves should provide such information to public authorities outside the financial services area. Those information flows should allow financial entities to swiftly benefit from any relevant technical input, advice about remedies, and subsequent follow-up from such authorities. The information on major ICT-related incidents should be mutually channelled: financial supervisors should provide all necessary feedback or guidance to the financial entity, while the ESAs should share anonymised data on cyber threats and vulnerabilities relating to an incident, to aid wider collective defence.

中文参考译文

（52）直接报告应使金融监管者能够即时获取重大ICT相关事件的信息。金融监管者随后应向非金融公共机关转送事件详情，例如指令（EU）2022/2555项下主管机关及单一联络点、各国数据保护机关，以及在事件具有犯罪性质时向执法机关提供信息，以增进这些机关对事件的了解；对于CSIRTs，还可在适当时促进其迅速向金融实体提供协助。此外，成员国应能够规定由金融实体自身向金融服务领域之外的公共机关提供这些信息。上述信息流应使金融实体迅速获得这些机关提供的有关技术意见、补救建议及后续跟进。重大ICT相关事件的信息应双向流动：金融监管者应向金融实体提供一切必要反馈或指引，欧洲监管当局则应共享事件相关网络威胁和脆弱性的匿名化数据，以支持更广泛的集体防御。

序言（53）

English

(53) While all financial entities should be required to carry out incident reporting, that requirement is not expected to affect all of them in the same manner. Indeed, relevant materiality thresholds, as well as reporting timelines, should be duly adjusted, in the context of delegated acts based on the regulatory technical standards to be developed by the ESAs, with a view to covering only major ICT-related incidents. In addition, the specificities of financial entities should be taken into account when setting timelines for reporting obligations.

中文参考译文

（53）虽然所有金融实体均应承担事件报告要求，但预计该要求对各实体的影响并不相同。事实上，应在基于欧洲监管当局拟制定监管技术标准的授权法案中，适当调整有关重大性门槛及报告时限，以仅覆盖重大ICT相关事件。此外，设定报告义务时限时应考虑金融实体的特殊性。

序言（54）

English

(54) This Regulation should require credit institutions, payment institutions, account information service providers and electronic money institutions to report all operational or security payment-related incidents – previously reported under Directive (EU) 2015/2366 – irrespective of the ICT nature of the incident.

中文参考译文

（54）本条例应要求信贷机构、支付机构、账户信息服务提供者和电子货币机构，报告此前依指令（EU）2015/2366报告的所有支付相关操作或安全事件，而不论该事件是否具有ICT性质。

序言（55）

English

(55) The ESAs should be tasked with assessing the feasibility and conditions for a possible centralisation of ICT-related incident reports at Union level. Such centralisation could consist of a single EU Hub for major ICT-related incident reporting either directly receiving relevant reports and automatically notifying national competent authorities, or merely centralising relevant reports forwarded by the national competent authorities and thus fulfilling a coordination role. The ESAs should be tasked with preparing, in consultation with the ECB and ENISA, a joint report exploring the feasibility of setting up a single EU Hub.

中文参考译文

（55）应责成欧洲监管当局评估在欧盟层面集中ICT相关事件报告的可行性和条件。这种集中可以采用单一欧盟重大ICT相关事件报告中心的形式，由其直接接收报告并自动通知本国主管机关，或者仅集中保存各国主管机关转送的报告，从而履行协调作用。应责成欧洲监管当局在征询ECB和ENISA意见后编制联合报告，研究设立单一欧盟中心的可行性。

序言（56）

English

(56) In order to achieve a high level of digital operational resilience, and in line with both the relevant international standards (e.g. the G7 Fundamental Elements for Threat-Led Penetration Testing) and with the frameworks applied in the Union, such as the TIBER-EU, financial entities should regularly test their ICT systems and staff having ICT-related responsibilities with regard to the effectiveness of their preventive, detection, response and recovery capabilities, to uncover and address potential ICT vulnerabilities. To reflect differences that exist across, and within, the various financial subsectors as regards financial entities’ level of cybersecurity preparedness, testing should include a wide variety of tools and actions, ranging from the assessment of basic requirements (e.g. vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing or end-to-end testing) to more advanced testing by means of TLPT. Such advanced testing should be required only of financial entities that are mature enough from an ICT perspective to reasonably carry it out. The digital operational resilience testing required by this Regulation should thus be more demanding for those financial entities meeting the criteria set out in this Regulation (for example, large, systemic and ICT-mature credit institutions, stock exchanges, central securities depositories and central counterparties) than for other financial entities. At the same time, the digital operational resilience testing by means of TLPT should be more relevant for financial entities operating in core financial services subsectors and playing a systemic role (for example, payments, banking, and clearing and settlement), and less relevant for other subsectors (for example, asset managers and credit rating agencies).

中文参考译文

（56）为实现高水平数字运营韧性，并符合有关国际标准，例如七国集团基于威胁情报的渗透测试基本要素，以及欧盟采用的TIBER-EU等框架，金融实体应定期测试其ICT系统和承担ICT相关职责的人员，评估预防、检测、响应及恢复能力的有效性，以发现并应对潜在ICT脆弱性。为反映各金融子行业之间及其内部实体网络安全准备水平的差异，测试应包含广泛的工具与行动，从基本要求评估，例如脆弱性评估与扫描、开源分析、网络安全评估、差距分析、物理安全审查、问卷及扫描软件方案、在可行情况下的源代码审查、场景测试、兼容性测试、性能测试或端到端测试，到通过TLPT开展更高级测试。只有在ICT方面足够成熟、能够合理开展高级测试的金融实体，才应被要求执行这种测试。因此，对于符合本条例所定标准的金融实体，例如大型、具有系统重要性且ICT成熟的信贷机构、证券交易所、中央证券存管机构及中央交易对手，本条例要求的数字运营韧性测试应严于其他金融实体。同时，以TLPT开展数字运营韧性测试，对于在核心金融服务子行业经营并发挥系统性作用的实体，例如支付、银行以及清算和结算，相关性更高；对于其他子行业，例如资产管理人和信用评级机构，相关性相对较低。

序言（57）

English

(57) Financial entities involved in cross-border activities and exercising the freedoms of establishment, or of provision of services within the Union, should comply with a single set of advanced testing requirements (i.e. TLPT) in their home Member State, which should include the ICT infrastructures in all jurisdictions where the cross-border financial group operates within the Union, thus allowing such cross-border financial groups to incur related ICT testing costs in one jurisdiction only.

中文参考译文

（57）在欧盟内从事跨境活动、行使设立自由或服务提供自由的金融实体，应在其母国成员国遵守一套统一高级测试要求，即TLPT；该测试应包括跨境金融集团在欧盟经营所涉及全部司法管辖区的ICT基础设施，从而使该集团仅在一个司法管辖区承担相关ICT测试成本。

序言（58）

English

(58) To draw on the expertise already acquired by certain competent authorities, in particular with regard to implementing the TIBER-EU framework, this Regulation should allow Member States to designate a single public authority as responsible in the financial sector, at national level, for all TLPT matters, or competent authorities, to delegate, in the absence of such designation, the exercise of TLPT related tasks to another national financial competent authority.

中文参考译文

（58）为利用某些主管机关已经取得的专业经验，尤其是实施TIBER-EU框架方面的经验，本条例应允许成员国指定一个公共机关，在国家层面负责金融部门全部TLPT事项；没有这种指定时，也应允许主管机关将TLPT相关任务委托给本国另一金融主管机关履行。

序言（59）

English

(59) Since this Regulation does not require financial entities to cover all critical or important functions in one single threat-led penetration test, financial entities should be free to determine which and how many critical or important functions should be included in the scope of such a test.

中文参考译文

（59）本条例不要求金融实体在单次基于威胁情报的渗透测试中覆盖所有关键或重要功能，因此金融实体应能够自行确定将哪些关键或重要功能，以及多少项此类功能纳入该次测试范围。

序言（60）

English

(60) Pooled testing within the meaning of this Regulation – involving the participation of several financial entities in a TLPT and for which an ICT third-party service provider can directly enter into contractual arrangements with an external tester – should be allowed only where the quality or security of services delivered by the ICT third-party service provider to customers that are entities falling outside the scope of this Regulation, or the confidentiality of the data related to such services, are reasonably expected to be adversely impacted. Pooled testing should also be subject to safeguards (direction by one designated financial entity, calibration of the number of participating financial entities) to ensure a rigorous testing exercise for the financial entities involved which meet the objectives of the TLPT pursuant to this Regulation.

中文参考译文

（60）本条例意义上的联合测试，是指多家金融实体共同参加TLPT，且ICT第三方服务提供者可直接与外部测试者订立合同安排。仅在合理预计测试会不利影响该ICT第三方服务提供者向本条例范围之外实体客户提供服务的质量或安全，或者这些服务相关数据的保密性时，才应允许采用联合测试。联合测试还应设定保障措施，例如由一家指定金融实体指导、合理确定参与金融实体数量，以确保相关实体接受符合本条例TLPT目标的严格测试。

查看法规原文

序言第61—70段 / Recitals 61–70

序言（61）

English

(61) In order to take advantage of internal resources available at corporate level, this Regulation should allow the use of internal testers for the purposes of carrying out TLPT, provided there is supervisory approval, no conflicts of interest, and periodical alternation of the use of internal and external testers (every three tests), while also requiring the provider of the threat intelligence in the TLPT to always be external to the financial entity. The responsibility for conducting TLPT should remain fully with the financial entity. Attestations provided by authorities should be solely for the purpose of mutual recognition and should not preclude any follow-up action needed to address the ICT risk to which the financial entity is exposed, nor should they be seen as a supervisory endorsement of a financial entity’s ICT risk management and mitigation capabilities.

中文参考译文

（61）为利用企业层面可用的内部资源，本条例应允许采用内部测试者开展TLPT，前提是获得监管批准、不存在利益冲突，并定期交替使用内部和外部测试者，即每三次测试进行轮换；同时应要求TLPT中的威胁情报提供者始终为金融实体外部主体。开展TLPT的责任应完全由金融实体承担。机关提供的证明应仅用于相互认可，不应排除为应对金融实体所暴露ICT风险而必须采取的后续行动，也不应被视为监管者对该实体ICT风险管理和缓解能力的认可背书。

序言（62）

English

(62) To ensure a sound monitoring of ICT third-party risk in the financial sector, it is necessary to lay down a set of principle-based rules to guide financial entities’ when monitoring risk arising in the context of functions outsourced to ICT third-party service providers, particularly for ICT services supporting critical or important functions, as well as more generally in the context of all ICT third-party dependencies.

中文参考译文

（62）为确保对金融部门ICT第三方风险进行健全监测，有必要制定一组原则性规则，指导金融实体监测将职能外包给ICT第三方服务提供者所产生的风险，尤其是支持关键或重要功能的ICT服务风险，以及更广泛意义上的所有ICT第三方依赖风险。

序言（63）

English

(63) To address the complexity of the various sources of ICT risk, while taking into account the multitude and diversity of providers of technological solutions which enable a smooth provision of financial services, this Regulation should cover a wide range of ICT third-party service providers, including providers of cloud computing services, software, data analytics services and providers of data centre services. Similarly, since financial entities should effectively and coherently identify and manage all types of risk, including in the context of ICT services procured within a financial group, it should be clarified that undertakings which are part of a financial group and provide ICT services predominantly to their parent undertaking, or to subsidiaries or branches of their parent undertaking, as well as financial entities providing ICT services to other financial entities, should also be considered as ICT third-party service providers under this Regulation. Lastly, in light of the evolving payment services market becoming increasingly dependent on complex technical solutions, and in view of emerging types of payment services and payment-related solutions, participants in the payment services ecosystem, providing payment-processing activities, or operating payment infrastructures, should also be considered to be ICT third-party service providers under this Regulation, with the exception of central banks when operating payment or securities settlement systems, and public authorities when providing ICT related services in the context of fulfilling State functions.

中文参考译文

（63）为应对ICT风险不同来源的复杂性，同时考虑到支持金融服务顺畅提供的技术解决方案提供者数量众多、类型多样，本条例应覆盖广泛的ICT第三方服务提供者，包括云计算服务、软件、数据分析服务及数据中心服务提供者。同样，金融实体应有效、一致地识别和管理所有类型风险，包括金融集团内部采购ICT服务产生的风险，因此应明确，属于金融集团并主要向其母公司，或母公司的子公司、分支机构提供ICT服务的企业，以及向其他金融实体提供ICT服务的金融实体，也应被视为本条例项下ICT第三方服务提供者。最后，考虑到不断发展的支付服务市场日益依赖复杂技术方案，以及新型支付服务和支付相关解决方案的出现，支付服务生态体系中提供支付处理活动或运营支付基础设施的参与者，也应视为本条例项下ICT第三方服务提供者；但中央银行运营支付或证券结算系统的情形，以及公共机关为履行国家职能而提供ICT相关服务的情形除外。

序言（64）

English

(64) A financial entity should at all times remain fully responsible for complying with its obligations set out in this Regulation. Financial entities should apply a proportionate approach to the monitoring of risks emerging at the level of the ICT third-party service providers, by duly considering the nature, scale, complexity and importance of their ICT-related dependencies, the criticality or importance of the services, processes or functions subject to the contractual arrangements and, ultimately, on the basis of a careful assessment of any potential impact on the continuity and quality of financial services at individual and at group level, as appropriate.

中文参考译文

（64）金融实体应始终对遵守本条例规定的自身义务承担全部责任。金融实体监测ICT第三方服务提供者层面产生的风险时，应采取符合比例原则的方法，充分考虑ICT相关依赖的性质、范围、复杂性和重要性，以及合同安排所涉服务、流程或功能的关键程度或重要性，并最终根据适当情况下对单体及集团层面金融服务连续性和质量的任何潜在影响所作的审慎评估开展监测。

序言（65）

English

(65) The conduct of such monitoring should follow a strategic approach to ICT third-party risk formalised through the adoption by the financial entity’s management body of a dedicated ICT third-party risk strategy, rooted in a continuous screening of all ICT third-party dependencies. To enhance supervisory awareness of ICT third-party dependencies, and with a view to further supporting the work in the context of the Oversight Framework established by this Regulation, all financial entities should be required to maintain a register of information with all contractual arrangements about the use of ICT services provided by ICT third-party service providers. Financial supervisors should be able to request the full register, or to ask for specific sections thereof, and thus to obtain essential information for acquiring a broader understanding of the ICT dependencies of financial entities.

中文参考译文

（65）这种监测应遵循ICT第三方风险的战略性方法，由金融实体管理机构制定专门ICT第三方风险战略予以正式确立，并以持续审视所有ICT第三方依赖为基础。为增强监管者对ICT第三方依赖的了解，并进一步支持本条例监督框架下的工作，应要求所有金融实体维护信息登记册，记录使用ICT第三方服务提供者所提供ICT服务的全部合同安排。金融监管者应能够要求提供完整登记册或其中特定部分，从而取得必要信息，更全面地了解金融实体的ICT依赖。

序言（66）

English

(66) A thorough pre-contracting analysis should underpin and precede the formal conclusion of contractual arrangements, in particular by focusing on elements such as the criticality or importance of the services supported by the envisaged ICT contract, the necessary supervisory approvals or other conditions, the possible concentration risk entailed, as well as applying due diligence in the process of selection and assessment of ICT third-party service providers and assessing potential conflicts of interest. For contractual arrangements concerning critical or important functions, financial entities should take into consideration the use by ICT third-party service providers of the most up-to-date and highest information security standards. Termination of contractual arrangements could be prompted at least by a series of circumstances showing shortfalls at the ICT third-party service provider level, in particular significant breaches of laws or contractual terms, circumstances revealing a potential alteration of the performance of the functions provided for in the contractual arrangements, evidence of weaknesses of the ICT third-party service provider in its overall ICT risk management, or circumstances indicating the inability of the relevant competent authority to effectively supervise the financial entity.

中文参考译文

（66）正式订立合同安排前，应开展充分的签约前分析，并以之为基础，重点关注拟议ICT合同支持服务的关键程度或重要性、必要的监管批准或其他条件、可能产生的集中风险等要素，在选择和评估ICT第三方服务提供者过程中实施尽职调查，并评估潜在利益冲突。涉及关键或重要功能的合同安排，金融实体应考虑ICT第三方服务提供者是否采用最新且最高的信息安全标准。至少在一系列显示提供者存在不足的情形下，可能需要终止合同安排，特别是严重违反法律或合同条款、显示合同功能履行可能发生变化的情形、证明提供者整体ICT风险管理薄弱的证据，或者表明有关主管机关无法有效监管金融实体的情形。

序言（67）

English

(67) To address the systemic impact of ICT third-party concentration risk, this Regulation promotes a balanced solution by means of taking a flexible and gradual approach to such concentration risk since the imposition of any rigid caps or strict limitations might hinder the conduct of business and restrain the contractual freedom. Financial entities should thoroughly assess their envisaged contractual arrangements to identify the likelihood of such risk emerging, including by means of in-depth analyses of subcontracting arrangements, in particular when concluded with ICT third-party service providers established in a third country. At this stage, and with a view to striking a fair balance between the imperative of preserving contractual freedom and that of guaranteeing financial stability, it is not considered appropriate to set out rules on strict caps and limits to ICT third-party exposures. In the context of the Oversight Framework, a Lead Overseer, appointed pursuant to this Regulation, should, in respect to critical ICT third-party service providers, pay particular attention to fully grasp the magnitude of interdependences, discover specific instances where a high degree of concentration of critical ICT third-party service providers in the Union is likely to put a strain on the Union financial system’s stability and integrity and maintain a dialogue with critical ICT third-party service providers where that specific risk is identified.

中文参考译文

（67）为应对ICT第三方集中风险的系统性影响，本条例提倡采取灵活、渐进的方法形成平衡解决方案，因为任何刚性上限或严格限制都可能妨碍业务开展并限制合同自由。金融实体应充分评估拟议合同安排，识别该风险出现的可能性，包括深入分析分包安排，尤其是与设立于第三国的ICT第三方服务提供者订立的安排。现阶段，为在维护合同自由与保障金融稳定的必要性之间取得合理平衡，不宜对ICT第三方风险敞口设定严格上限和限制规则。在监督框架下，依据本条例指定的牵头监督机构应对关键ICT第三方服务提供者特别关注，全面掌握相互依赖的程度，识别欧盟关键ICT第三方服务提供者高度集中可能使欧盟金融体系稳定性和完整性承压的具体情形，并在识别出该特定风险时与有关提供者保持对话。

序言（68）

English

(68) To evaluate and monitor on a regular basis the ability of an ICT third party service provider to securely provide services to a financial entity without adverse effects on a financial entity’s digital operational resilience, several key contractual elements with ICT third-party service providers should be harmonised. Such harmonisation should cover minimum areas which are crucial for enabling a full monitoring by the financial entity of the risks that could emerge from the ICT third-party service provider, from the perspective of a financial entity’s need to secure its digital resilience because it is deeply dependent on the stability, functionality, availability and security of the ICT services received.

中文参考译文

（68）为定期评估和监测ICT第三方服务提供者能否安全地向金融实体提供服务，且不对该实体数字运营韧性产生不利影响，应协调与ICT第三方服务提供者订立合同中的若干关键要素。金融实体高度依赖所接收ICT服务的稳定性、功能性、可用性和安全，因此，从保障自身数字韧性的需要出发，这种协调应覆盖使金融实体能够全面监测提供者可能产生风险所必不可少的最低领域。

序言（69）

English

(69) When renegotiating contractual arrangements to seek alignment with the requirements of this Regulation, financial entities and ICT third-party service providers should ensure the coverage of the key contractual provisions as provided for in this Regulation.

中文参考译文

（69）金融实体与ICT第三方服务提供者为符合本条例要求而重新协商合同安排时，应确保合同涵盖本条例规定的关键条款。

序言（70）

English

(70) The definition of ‘critical or important function’ provided for in this Regulation encompasses the ‘critical functions’ as defined in Article 2(1), point (35), of Directive 2014/59/EU of the European Parliament and of the Council (20). Accordingly, functions deemed to be critical pursuant to Directive 2014/59/EU are included in the definition of critical functions within the meaning of this Regulation.

中文参考译文

（70）本条例规定的“关键或重要功能”定义，涵盖欧洲议会和理事会指令2014/59/EU(20)第2条第1款第(35)项定义的“关键功能”。因此，依据指令2014/59/EU被认定为关键的功能，纳入本条例意义上的关键功能定义。

序言第71—80段 / Recitals 71–80

序言（71）

English

(71) Irrespective of the criticality or importance of the function supported by the ICT services, contractual arrangements should, in particular, provide for a specification of the complete descriptions of functions and services, of the locations where such functions are provided and where data is to be processed, as well as an indication of service level descriptions. Other essential elements to enable a financial entity’s monitoring of ICT third party risk are: contractual provisions specifying how the accessibility, availability, integrity, security and protection of personal data are ensured by the ICT third-party service provider, provisions laying down the relevant guarantees for enabling the access, recovery and return of data in the case of insolvency, resolution or discontinuation of the business operations of the ICT third-party service provider, as well as provisions requiring the ICT third-party service provider to provide assistance in case of ICT incidents in connection with the services provided, at no additional cost or at a cost determined ex-ante; provisions on the obligation of the ICT third-party service provider to fully cooperate with the competent authorities and resolution authorities of the financial entity; and provisions on termination rights and related minimum notice periods for the termination of the contractual arrangements, in accordance with the expectations of competent authorities and resolution authorities.

中文参考译文

（71）无论ICT服务所支持功能的关键程度或重要性如何，合同安排尤其应规定功能与服务的完整描述、提供功能和处理数据的地点，并注明服务水平说明。支持金融实体监测ICT第三方风险的其他必要要素包括：明确提供者如何确保个人数据可访问性、可用性、完整性、安全及保护的合同条款；规定在提供者破产、被处置或停止业务运营时能够访问、恢复和返还数据的有关保障条款；要求提供者在与所提供服务有关的ICT事件发生时，无额外收费或按事先确定的费用提供协助的条款；要求提供者与金融实体的主管机关及处置当局充分合作的条款；以及按照主管机关及处置当局预期，规定合同终止权和相关最短提前通知期的条款。

序言（72）

English

(72) In addition to such contractual provisions, and with a view to ensuring that financial entities remain in full control of all developments occurring at third-party level which may impair their ICT security, the contracts for the provision of ICT services supporting critical or important functions should also provide for the following: the specification of the full service level descriptions, with precise quantitative and qualitative performance targets, to enable without undue delay appropriate corrective actions when the agreed service levels are not met; the relevant notice periods and reporting obligations of the ICT third-party service provider in the event of developments with a potential material impact on the ICT third-party service provider’s ability to effectively provide their respective ICT services; a requirement upon the ICT third-party service provider to implement and test business contingency plans and have ICT security measures, tools and policies allowing for the secure provision of services, and to participate and fully cooperate in the TLPT carried out by the financial entity.

中文参考译文

（72）除上述条款外，为确保金融实体全面掌握第三方层面所有可能损害其ICT安全的变化，提供支持关键或重要功能ICT服务的合同，还应规定：完整服务水平说明及准确的定量和定性绩效目标，使未达到约定服务水平时能够不无故拖延地采取适当纠正行动；发生可能重大影响ICT第三方服务提供者有效提供相关ICT服务能力的变化时，提供者适用的提前通知期及报告义务；要求提供者实施和测试业务应急计划，具备能够安全提供服务的ICT安全措施、工具和政策，并参与、充分配合金融实体开展TLPT。

序言（73）

English

(73) Contracts for the provision of ICT services supporting critical or important functions should also contain provisions enabling the rights of access, inspection and audit by the financial entity, or an appointed third party, and the right to take copies as crucial instruments in the financial entities’ ongoing monitoring of the ICT third-party service provider’s performance, coupled with the service provider’s full cooperation during inspections. Similarly, the competent authority of the financial entity should have the right, based on notices, to inspect and audit the ICT third-party service provider, subject to the protection of confidential information.

中文参考译文

（73）提供支持关键或重要功能ICT服务的合同，还应包含使金融实体或其指定第三方能够行使访问、检查、审计及复制权的条款；这些权利是金融实体持续监测ICT第三方服务提供者履约情况的关键工具，并应配套提供者在检查中的充分合作。同样，在保护保密信息的前提下，金融实体的主管机关应有权经通知对ICT第三方服务提供者进行检查和审计。

序言（74）

English

(74) Such contractual arrangements should also provide for dedicated exit strategies to enable, in particular, mandatory transition periods during which ICT third-party service providers should continue providing the relevant services with a view to reducing the risk of disruptions at the level of the financial entity, or to allow the latter effectively to switch to the use of other ICT third-party service providers or, alternatively, to change to in-house solutions, consistent with the complexity of the provided ICT service. Moreover, financial entities within the scope of Directive 2014/59/EU should ensure that the relevant contracts for ICT services are robust and fully enforceable in the event of resolution of those financial entities. Therefore, in line with the expectations of the resolution authorities, those financial entities should ensure that the relevant contracts for ICT services are resolution resilient. As long as they continue meeting their payment obligations, those financial entities should ensure, among other requirements, that the relevant contracts for ICT services contain clauses for non-termination, non-suspension and non-modification on grounds of restructuring or resolution.

中文参考译文

（74）这类合同安排还应规定专门退出战略，尤其应设定强制过渡期，在此期间ICT第三方服务提供者应继续提供相关服务，以降低金融实体发生中断的风险，或者使实体能够根据所提供ICT服务的复杂性，有效转用其他ICT第三方服务提供者或内部解决方案。此外，指令2014/59/EU范围内的金融实体应确保相关ICT服务合同在这些实体被处置时仍然稳健且可全面执行。因此，按照处置当局的预期，这些金融实体应确保ICT服务合同具有处置韧性。在其持续履行付款义务的前提下，金融实体除其他要求外，还应确保相关ICT服务合同包含不得以重组或处置为由终止、暂停或修改合同的条款。

序言（75）

English

(75) Moreover, the voluntary use of standard contractual clauses developed by public authorities or Union institutions, in particular the use of contractual clauses developed by the Commission for cloud computing services could provide further comfort to the financial entities and ICT third-party service providers, by enhancing their level of legal certainty regarding the use of cloud computing services in the financial sector, in full alignment with the requirements and expectations set out by the Union financial services law. The development of standard contractual clauses builds on measures already envisaged in the 2018 Fintech Action Plan that announced the Commission’s intention to encourage and facilitate the development of standard contractual clauses for the use of cloud computing services outsourcing by financial entities, drawing on cross-sectorial cloud computing services stakeholders’ efforts, which the Commission has facilitated with the help of the financial sector’s involvement.

中文参考译文

（75）此外，自愿使用公共机关或欧盟机构制定的标准合同条款，尤其是欧盟委员会为云计算服务制定的条款，可以通过提高金融部门使用云计算服务的法律确定性，为金融实体和ICT第三方服务提供者提供更多保障，并与欧盟金融服务法律所定要求及预期完全一致。标准合同条款的制定以2018年金融科技行动计划已提出的措施为基础；该计划宣布委员会有意借助跨行业云计算服务利益相关方的努力，鼓励并促进制定金融实体使用云计算外包服务的标准合同条款，委员会已在金融部门参与协助下推动这些努力。

序言（76）

English

(76) With a view to promoting convergence and efficiency in relation to supervisory approaches when addressing ICT third-party risk in the financial sector, as well as to strengthening the digital operational resilience of financial entities which rely on critical ICT third-party service providers for the provision of ICT services that support the supply of financial services, and thereby to contributing to the preservation of the Union’s financial system stability and the integrity of the internal market for financial services, critical ICT third-party service providers should be subject to a Union Oversight Framework. While the set-up of the Oversight Framework is justified by the added value of taking action at Union level and by virtue of the inherent role and specificities of the use of ICT services in the provision of financial services, it should be recalled, at the same time, that this solution appears suitable only in the context of this Regulation specifically dealing with digital operational resilience in the financial sector. However, such Oversight Framework should not be regarded as a new model for Union supervision in other areas of financial services and activities.

中文参考译文

（76）为促进应对金融部门ICT第三方风险的监管方法趋同和提高效率，增强依赖关键ICT第三方服务提供者提供支撑金融服务ICT服务的金融实体的数字运营韧性，进而维护欧盟金融体系稳定和金融服务内部市场完整性，应使关键ICT第三方服务提供者适用欧盟监督框架。建立该框架，既有欧盟层面行动的附加价值作为依据，也基于ICT服务在金融服务提供中的固有作用及特殊性；但同时应认识到，这一方案看来仅适用于本条例专门处理金融部门数字运营韧性的语境。该监督框架不应被视为欧盟对其他金融服务和活动领域实施监管的新模型。

序言（77）

English

(77) The Oversight Framework should apply only to critical ICT third-party service providers. There should therefore be a designation mechanism to take into account the dimension and nature of the financial sector’s reliance on such ICT third-party service providers. That mechanism should involve a set of quantitative and qualitative criteria to set the criticality parameters as a basis for inclusion in the Oversight Framework. In order to ensure the accuracy of that assessment, and regardless of the corporate structure of the ICT third-party service provider, such criteria should, in the case of a ICT third-party service provider that is part of a wider group, take into consideration the entire ICT third-party service provider’s group structure. On the one hand, critical ICT third-party service providers, which are not automatically designated by virtue of the application of those criteria, should have the possibility to opt in to the Oversight Framework on a voluntary basis, on the other hand, ICT third-party service providers, that are already subject to oversight mechanism frameworks supporting the fulfilment of the tasks of the European System of Central Banks as referred to in Article 127(2) TFEU, should be exempted.

中文参考译文

（77）监督框架应仅适用于关键ICT第三方服务提供者。因此，应建立指定机制，考虑金融部门对这些提供者依赖的程度和性质。该机制应包括一组定量和定性标准，确定关键性参数，作为纳入监督框架的依据。为确保评估准确，无论ICT第三方服务提供者采取何种企业结构，如果其属于更大集团，标准均应考虑其整个集团结构。一方面，未因适用这些标准而被自动指定为关键的ICT第三方服务提供者，应能够自愿选择加入监督框架；另一方面，已经适用支持欧洲中央银行体系履行《欧洲联盟运行条约》第127条第2款任务的监督机制框架的ICT第三方服务提供者，应予豁免。

序言（78）

English

(78) Similarly, financial entities providing ICT services to other financial entities, while belonging to the category of ICT third-party service providers under this Regulation, should also be exempted from the Oversight Framework since they are already subject to supervisory mechanisms established by the relevant Union financial services law. Where applicable, competent authorities should take into account, in the context of their supervisory activities, the ICT risk posed to financial entities by financial entities providing ICT services. Likewise, due to the existing risk monitoring mechanisms at group level, the same exemption should be introduced for ICT third-party service providers delivering services predominantly to the entities of their own group. ICT third-party service providers providing ICT services solely in one Member State to financial entities that are active only in that Member State should also be exempted from the designation mechanism because of their limited activities and lack of cross-border impact.

中文参考译文

（78）同样，向其他金融实体提供ICT服务的金融实体，虽属于本条例下ICT第三方服务提供者类别，但由于已受欧盟有关金融服务法律所建立监管机制约束，也应免于适用监督框架。在适用情况下，主管机关开展监管活动时，应考虑提供ICT服务的金融实体给其他金融实体带来的ICT风险。类似地，鉴于集团层面已有风险监测机制，对主要向本集团实体提供服务的ICT第三方服务提供者，也应设置相同豁免。仅在一个成员国内向仅在该成员国活动的金融实体提供ICT服务的第三方服务提供者，因其活动有限且没有跨境影响，也应免于适用指定机制。

序言（79）

English

(79) The digital transformation experienced in financial services has brought about an unprecedented level of use of, and reliance upon, ICT services. Since it has become inconceivable to provide financial services without the use of cloud computing services, software solutions and data-related services, the Union financial ecosystem has become intrinsically co-dependent on certain ICT services provided by ICT service suppliers. Some of those suppliers, innovators in developing and applying ICT-based technologies, play a significant role in the delivery of financial services, or have become integrated into the financial services value chain. They have thus become critical to the stability and integrity of the Union financial system. This widespread reliance on services supplied by critical ICT third-party service providers, combined with the interdependence of the information systems of various market operators, create a direct, and potentially severe, risk to the Union financial services system and to the continuity of delivery of financial services if critical ICT third-party service providers were to be affected by operational disruptions or major cyber incidents. Cyber incidents have a distinctive ability to multiply and propagate throughout the financial system at a considerably faster pace than other types of risk monitored in the financial sector and can extend across sectors and beyond geographical borders. They have the potential to evolve into a systemic crisis, where trust in the financial system has been eroded due to the disruption of functions supporting the real economy, or to substantial financial losses, reaching a level which the financial system is unable to withstand, or which requires the deployment of heavy shock absorption measures. To prevent these scenarios from taking place and thereby endangering the financial stability and integrity of the Union, it is essential to provide the convergence of supervisory practices relating to ICT third-party risk in finance, in particular through new rules enabling the Union oversight of critical ICT third-party service providers.

中文参考译文

（79）金融服务经历的数字化转型，使ICT服务的使用及依赖达到前所未有的水平。由于在不使用云计算服务、软件方案和数据相关服务的情况下提供金融服务已难以想象，欧盟金融生态体系已内在地共同依赖ICT服务供应商提供的某些服务。其中一些供应商是开发和应用ICT技术的创新者，在金融服务交付中发挥重要作用，或者已融入金融服务价值链，因此对欧盟金融体系的稳定性和完整性变得至关重要。对关键ICT第三方服务的这种广泛依赖，加上不同市场经营者信息系统的相互依赖，意味着一旦这些关键提供者遭遇运营中断或重大网络事件，将对欧盟金融服务体系及金融服务持续交付产生直接且可能严重的风险。网络事件具有独特的扩散和传播能力，其在金融体系内蔓延的速度显著快于金融部门监测的其他风险类型，并能跨行业、跨地理边界传播。它们可能演变为系统性危机：支撑实体经济的功能中断或重大财务损失侵蚀了对金融体系的信任，达到金融体系无法承受，或者必须采取强力冲击吸收措施的程度。为防止这些情形发生并危及欧盟金融稳定和完整性，必须促进金融领域ICT第三方风险监管实践趋同，尤其通过新规则，使欧盟能够监督关键ICT第三方服务提供者。

序言（80）

English

(80) The Oversight Framework largely depends on the degree of collaboration between the Lead Overseer and the critical ICT third-party service provider delivering to financial entities services affecting the supply of financial services. Successful oversight is predicated, inter alia, upon the ability of the Lead Overseer to effectively conduct monitoring missions and inspections to assess the rules, controls and processes used by the critical ICT third-party service providers, as well as to assess the potential cumulative impact of their activities on financial stability and the integrity of the financial system. At the same time, it is crucial that critical ICT third-party service providers follow the Lead Overseer’s recommendations and address its concerns. Since a lack of cooperation by a critical ICT third-party service provider providing services that affect the supply of financial services, such as the refusal to grant access to its premises or to submit information, would ultimately deprive the Lead Overseer of its essential tools in appraising ICT third-party risk, and could adversely impact the financial stability and the integrity of the financial system, it is necessary to also provide for a commensurate sanctioning regime.

中文参考译文

（80）监督框架在很大程度上取决于牵头监督机构与向金融实体提供影响金融服务交付之服务的关键ICT第三方服务提供者之间的合作程度。成功监督的前提之一，是牵头监督机构能够有效开展监测任务和检查，评估关键ICT第三方服务提供者使用的规则、控制措施和流程，以及其活动对金融稳定和金融体系完整性的潜在累积影响。同时，关键ICT第三方服务提供者遵循牵头监督机构建议并回应其关切至关重要。如果提供影响金融服务交付之服务的关键ICT第三方服务提供者不予合作，例如拒绝允许进入场所或提交信息，最终将使牵头监督机构失去评估ICT第三方风险的必要工具，并可能损害金融稳定和金融体系完整性。因此，还必须规定相称的制裁制度。

查看法规原文

序言第81—90段 / Recitals 81–90

序言（81）

English

(81) Against this background, the need of the Lead Overseer to impose penalty payments to compel critical ICT third-party service providers to comply with the transparency and access-related obligations set out in this Regulation should not be jeopardised by difficulties raised by the enforcement of those penalty payments in relation to critical ICT third-party service providers established in third countries. In order to ensure the enforceability of such penalties, and to allow a swift roll out of procedures upholding the critical ICT third-party service providers’ rights of defence in the context of the designation mechanism and the issuance of recommendations, those critical ICT third-party service providers, providing services to financial entities that affect the supply of financial services, should be required to maintain an adequate business presence in the Union. Due to the nature of the oversight, and the absence of comparable arrangements in other jurisdictions, there are no suitable alternative mechanisms ensuring this objective by way of effective cooperation with financial supervisors in third countries in relation to the monitoring of the impact of digital operational risks posed by systemic ICT third-party service providers, qualifying as critical ICT third-party service providers established in third countries. Therefore, in order to continue its provision of ICT services to financial entities in the Union, an ICT third-party service provider established in a third country which has been designated as critical in accordance with this Regulation should undertake, within 12 months of such designation, all necessary arrangements to ensure its incorporation within the Union, by means of establishing a subsidiary, as defined throughout the Union acquis, namely in Directive 2013/34/EU of the European Parliament and of the Council (21).

中文参考译文

（81）在此背景下，牵头监督机构有必要处以强制性罚款，促使关键ICT第三方服务提供者遵守本条例透明度和访问相关义务；这一需要不应因对设立于第三国的关键提供者执行罚款所遇困难而受损。为确保罚款可执行，并使指定机制及建议发布过程中保障提供者辩护权的程序能够迅速展开，应要求这些向金融实体提供影响金融服务交付之服务的关键ICT第三方服务提供者，在欧盟维持适当商业存在。由于监督的性质，以及其他司法管辖区缺少可比安排，在监测设立于第三国、属于关键ICT第三方服务提供者的系统性ICT第三方服务提供者所带来数字运营风险影响方面，没有适当替代机制能够通过与第三国金融监管者有效合作实现上述目标。因此，为继续向欧盟金融实体提供ICT服务，设立于第三国并依本条例被指定为关键的ICT第三方服务提供者，应在指定后12个月内作出全部必要安排，通过设立欧盟法律体系，特别是欧洲议会和理事会指令2013/34/EU(21)所定义的子公司，确保其在欧盟内设立法人。

序言（82）

English

(82) The requirement to set up a subsidiary in the Union should not prevent the critical ICT third-party service provider from supplying ICT services and related technical support from facilities and infrastructure located outside the Union. This Regulation does not impose a data localisation obligation as it does not require data storage or processing to be undertaken in the Union.

中文参考译文

（82）在欧盟设立子公司的要求，不应阻止关键ICT第三方服务提供者利用欧盟以外的设施和基础设施提供ICT服务及相关技术支持。本条例不规定数据本地化义务，因为它并不要求数据存储或处理必须在欧盟内进行。

序言（83）

English

(83) Critical ICT third-party service providers should be able to provide ICT services from anywhere in the world, not necessarily or not only from premises located in the Union. Oversight activities should be first conducted on premises located in the Union and by interacting with entities located in the Union, including the subsidiaries established by critical ICT third-party service providers pursuant to this Regulation. However, such actions within the Union might be insufficient to allow the Lead Overseer to fully and effectively perform its duties under this Regulation. The Lead Overseer should therefore also be able to exercise its relevant oversight powers in third countries. Exercising those powers in third countries should allow the Lead Overseer to examine the facilities from which the ICT services or the technical support services are actually provided or managed by the critical ICT third-party service provider, and should give the Lead Overseer a comprehensive and operational understanding of the ICT risk management of the critical ICT third-party service provider. The possibility for the Lead Overseer, as a Union agency, to exercise powers outside the territory of the Union should be duly framed by relevant conditions, in particular the consent of the critical ICT third-party service provider concerned. Similarly, the relevant authorities of the third country should be informed of, and not have objected to, the exercise on their own territory of the activities of the Lead Overseer. However, in order to ensure efficient implementation, and without prejudice to the respective competences of the Union institutions and the Member States, such powers also need to be fully anchored in the conclusion of administrative cooperation arrangements with the relevant authorities of the third country concerned. This Regulation should therefore enable the ESAs to conclude administrative cooperation arrangements with the relevant authorities of third countries, which should not otherwise create legal obligations in respect of the Union and its Member States.

中文参考译文

（83）关键ICT第三方服务提供者应能够从全球任何地方提供ICT服务，而不必必须或仅从欧盟内场所提供。监督活动应首先在欧盟内场所开展，并与欧盟内实体互动，包括提供者依据本条例设立的子公司。然而，仅在欧盟内开展行动可能不足以使牵头监督机构充分、有效履行本条例职责，因此其还应能够在第三国行使相关监督权力。在第三国行使这些权力，应使牵头监督机构能够检查提供者实际提供或管理ICT服务、技术支持服务的设施，并对其ICT风险管理形成全面、贴近实际运营的了解。牵头监督机构作为欧盟机构，在欧盟领土外行使权力的可能性应受到相关条件的适当约束，特别是应取得相关关键ICT第三方服务提供者同意。同样，应告知第三国有关机关，且其不应反对牵头监督机构在其领土开展活动。但是，为确保有效实施，并在不影响欧盟机构及成员国各自权限的前提下，还须通过与有关第三国机关订立行政合作安排，充分确立这些权力。因此，本条例应允许欧洲监管当局与第三国有关机关订立行政合作安排，但这些安排不应另行对欧盟及其成员国产生法律义务。

序言（84）

English

(84) To facilitate communication with the Lead Overseer and to ensure adequate representation, critical ICT third-party service providers which are part of a group should designate one legal person as their coordination point.

中文参考译文

（84）为便利与牵头监督机构沟通并确保适当代表，属于集团的关键ICT第三方服务提供者应指定一个法人作为协调联络点。

序言（85）

English

(85) The Oversight Framework should be without prejudice to Member States’ competence to conduct their own oversight or monitoring missions in respect to ICT third-party service providers which are not designated as critical under this Regulation, but which are regarded as important at national level.

中文参考译文

（85）监督框架不应影响成员国的权限，即对未依本条例被指定为关键、但在国家层面被认为重要的ICT第三方服务提供者，自行开展监督或监测任务。

序言（86）

English

(86) To leverage the multi-layered institutional architecture in the financial services area, the Joint Committee of the ESAs should continue to ensure overall cross-sectoral coordination in relation to all matters pertaining to ICT risk, in accordance with its tasks on cybersecurity. It should be supported by a new Subcommittee (the ‘Oversight Forum’) carrying out preparatory work both for the individual decisions addressed to critical ICT third-party service providers, and for the issuing of collective recommendations, in particular in relation to benchmarking the oversight programmes for critical ICT third-party service providers, and identifying best practices for addressing ICT concentration risk issues.

中文参考译文

（86）为发挥金融服务领域多层级机构架构的作用，欧洲监管当局联合委员会应按照其网络安全任务，继续确保所有ICT风险事项的整体跨行业协调。应由一个新的分委员会，即“监督论坛”，为其提供支持，就向关键ICT第三方服务提供者作出个别决定，以及发布共同建议开展准备工作，特别是在比较关键提供者监督方案，以及识别应对ICT集中风险的最佳实践方面。

序言（87）

English

(87) To ensure that critical ICT third-party service providers are appropriately and effectively overseen on a Union level, this Regulation provides that any of the three ESAs could be designated as a Lead Overseer. The individual assignment of a critical ICT third-party service provider to one of the three ESAs should result from an assessment of the preponderance of financial entities operating in the financial sectors for which that ESA has responsibilities. This approach should lead to a balanced allocation of tasks and responsibilities between the three ESAs, in the context of exercising the oversight functions, and should make the best use of the human resources and technical expertise available in each of the three ESAs.

中文参考译文

（87）为确保在欧盟层面对关键ICT第三方服务提供者进行适当、有效监督，本条例规定，三家欧洲监管当局中的任何一家均可被指定为牵头监督机构。将特定关键提供者分配给其中一家，应根据对该当局负责金融行业内相关金融实体占主导程度的评估作出。这一方法应使三家当局在履行监督职能时均衡分配任务和责任，并充分利用各自的人力资源及技术专长。

序言（88）

English

(88) Lead Overseers should be granted the necessary powers to conduct investigations, to carry out onsite and offsite inspections at the premises and locations of critical ICT third-party service providers and to obtain complete and updated information. Those powers should enable the Lead Overseer to acquire real insight into the type, dimension and impact of the ICT third-party risk posed to financial entities and ultimately to the Union’s financial system. Entrusting the ESAs with the lead oversight role is a prerequisite for understanding and addressing the systemic dimension of ICT risk in finance. The impact of critical ICT third-party service providers on the Union financial sector and the potential issues caused by the ICT concentration risk entailed call for taking a collective approach at Union level. The simultaneous carrying out of multiple audits and access rights, performed separately by numerous competent authorities, with little or no coordination among them, would prevent financial supervisors from obtaining a complete and comprehensive overview of ICT third-party risk in the Union, while also creating redundancy, burden and complexity for critical ICT third-party service providers if they were subject to numerous monitoring and inspection requests.

中文参考译文

（88）应赋予牵头监督机构必要权力，以开展调查，对关键ICT第三方服务提供者的场所和地点进行现场及非现场检查，并取得完整、最新的信息。这些权力应使牵头监督机构深入了解ICT第三方风险对金融实体、最终对欧盟金融体系造成的风险类型、规模和影响。赋予欧洲监管当局牵头监督职责，是理解和处理金融领域ICT风险系统性维度的前提。关键ICT第三方服务提供者对欧盟金融部门的影响，以及由此产生的ICT集中风险潜在问题，要求在欧盟层面采取共同方法。多个主管机关在缺乏或几乎没有协调的情况下各自同时开展多重审计和访问，不仅会使金融监管者无法全面掌握欧盟ICT第三方风险，也会使面对大量监测和检查要求的关键ICT第三方服务提供者承受重复、负担和复杂性。

序言（89）

English

(89) Due to the significant impact of being designated as critical, this Regulation should ensure that the rights of critical ICT third-party service providers are observed throughout the implementation of the Oversight Framework. Prior to being designated as critical, such providers should, for example, have the right to submit to the Lead Overseer a reasoned statement containing any relevant information for the purposes of the assessment related to their designation. Since the Lead Overseer should be empowered to submit recommendations on ICT risk matters and suitable remedies thereto, which include the power to oppose certain contractual arrangements ultimately affecting the stability of the financial entity or the financial system, critical ICT third-party service providers should also be given the opportunity to provide, prior to the finalisation of those recommendations, explanations regarding the expected impact of the solutions, envisaged in the recommendations, on customers that are entities falling outside the scope of this Regulation and to formulate solutions to mitigate risks. Critical ICT third-party service providers disagreeing with the recommendations should submit a reasoned explanation of their intention not to endorse the recommendation. Where such reasoned explanation is not submitted or where it is considered to be insufficient, the Lead Overseer should issue a public notice summarily describing the matter of non-compliance.

中文参考译文

（89）鉴于被指定为关键具有重大影响，本条例应确保在监督框架实施全过程尊重关键ICT第三方服务提供者的权利。例如，在被指定为关键之前，提供者应有权向牵头监督机构提交附有理由的陈述，提供与指定评估有关的任何信息。牵头监督机构应有权就ICT风险及适当补救提出建议，包括反对最终影响金融实体或金融体系稳定的某些合同安排，因此还应给予关键提供者机会，在建议定稿前说明拟议方案预期对本条例范围之外实体客户的影响，并提出缓解风险的解决办法。不同意建议的关键ICT第三方服务提供者应提交附有理由的说明，解释其不拟接受建议的意图。未提交此类说明，或者说明被认为不充分时，牵头监督机构应发布公告，简要说明不遵守事项。

序言（90）

English

(90) Competent authorities should duly include the task of verifying substantive compliance with recommendations issued by the Lead Overseer in their functions with regard to prudential supervision of financial entities. Competent authorities should be able to require financial entities to take additional measures to address the risks identified in the Lead Overseer’s recommendations, and should, in due course, issue notifications to that effect. Where the Lead Overseer addresses recommendations to critical ICT third-party service providers that are supervised under Directive (EU) 2022/2555, the competent authorities should be able, on a voluntary basis and before adopting additional measures, to consult the competent authorities under that Directive in order to foster a coordinated approach to dealing with the critical ICT third-party service providers in question.

中文参考译文

（90）主管机关应将核实对牵头监督机构建议的实质遵守情况，适当纳入其对金融实体的审慎监管职能。主管机关应能够要求金融实体采取额外措施，应对牵头监督机构建议所识别风险，并适时就此发出通知。如果建议针对的是受指令（EU）2022/2555监管的关键ICT第三方服务提供者，主管机关在采取额外措施前，应能够自愿征询该指令项下主管机关的意见，以促进对有关提供者采取协调一致的方法。

序言第91—100段 / Recitals 91–100

序言（91）

English

(91) The exercise of the oversight should be guided by three operational principles seeking to ensure: (a) close coordination among the ESAs in their Lead Overseer roles, through a joint oversight network (JON), (b) consistency with the framework established by Directive (EU) 2022/2555 (through a voluntary consultation of bodies under that Directive to avoid duplication of measures directed at critical ICT third-party service providers), and (c) applying diligence to minimise the potential risk of disruption to services provided by the critical ICT third-party service providers to customers that are entities falling outside the scope of this Regulation.

中文参考译文

（91）监督的开展应遵循三项运行原则，以确保：(a)欧洲监管当局通过联合监督网络（JON），在各自牵头监督职责之间保持紧密协调；(b)与指令（EU）2022/2555建立的框架一致，通过自愿征询该指令项下机构意见，避免对关键ICT第三方服务提供者采取重复措施；(c)审慎尽责，尽量降低关键ICT第三方服务提供者向本条例范围之外实体客户提供服务发生中断的潜在风险。

序言（92）

English

(92) The Oversight Framework should not replace, or in any way or for any part substitute for, the requirement for financial entities to manage themselves the risks entailed by the use of ICT third-party service providers, including their obligation to maintain an ongoing monitoring of contractual arrangements concluded with critical ICT third-party service providers. Similarly, the Oversight Framework should not affect the full responsibility of financial entities for complying with, and discharging, all the legal obligations laid down in this Regulation and in the relevant financial services law.

中文参考译文

（92）监督框架不应取代，亦不应以任何方式或在任何部分替代，金融实体自行管理使用ICT第三方服务提供者所产生风险的要求，包括持续监测与关键ICT第三方服务提供者订立合同安排的义务。同样，监督框架不应影响金融实体对遵守和履行本条例及有关金融服务法律所规定全部法律义务承担的完整责任。

序言（93）

English

(93) To avoid duplications and overlaps, competent authorities should refrain from taking individually any measures aiming to monitor the critical ICT third-party service provider’s risks and should, in that respect, rely on the relevant Lead Overseer’s assessment. Any measures should in any case be coordinated and agreed in advance with the Lead Overseer in the context of the exercise of tasks in the Oversight Framework.

中文参考译文

（93）为避免重复和重叠，主管机关应避免单独采取旨在监测关键ICT第三方服务提供者风险的措施，而应依赖有关牵头监督机构的评估。在监督框架下履行任务时，无论采取何种措施，均应事先与牵头监督机构协调并取得一致。

序言（94）

English

(94) To promote convergence at international level as regards the use of best practices in the review and monitoring of ICT third-party service providers’ digital risk-management, the ESAs should be encouraged to conclude cooperation arrangements with relevant supervisory and regulatory third-country authorities.

中文参考译文

（94）为促进国际层面在审查和监测ICT第三方服务提供者数字风险管理时采用最佳实践的趋同性，应鼓励欧洲监管当局与第三国有关监督和监管机关订立合作安排。

序言（95）

English

(95) To leverage the specific competences, technical skills and expertise of staff specialising in operational and ICT risk within the competent authorities, the three ESAs and, on a voluntary basis, the competent authorities under Directive (EU) 2022/2555, the Lead Overseer should draw on national supervisory capabilities and knowledge and set up dedicated examination teams for each critical ICT third-party service provider, pooling multidisciplinary teams in support of the preparation and execution of oversight activities, including general investigations and inspections of critical ICT third-party service providers, as well as for any necessary follow-up thereto.

中文参考译文

（95）为利用主管机关、三家欧洲监管当局，以及自愿参与的指令（EU）2022/2555项下主管机关中，专门从事操作风险及ICT风险工作的人员的特定能力、技术技能和专业知识，牵头监督机构应利用各国监管能力与知识，为每家关键ICT第三方服务提供者组建专门检查团队，汇集多学科团队，支持监督活动的准备和执行，包括对关键提供者的一般调查和检查，以及任何必要后续工作。

序言（96）

English

(96) Whereas costs resulting from oversight tasks would be fully funded from fees levied on critical ICT third-party service providers, the ESAs are. however, likely to incur, before the start of the Oversight Framework, costs for the implementation of dedicated ICT systems supporting the upcoming oversight, since dedicated ICT systems would need to be developed and deployed beforehand. This Regulation therefore provides for a hybrid funding model, whereby the Oversight Framework would, as such, be fully fee-funded, while the development of the ESAs’ ICT systems would be funded from Union and national competent authorities’ contributions.

中文参考译文

（96）监督任务产生的成本将完全由向关键ICT第三方服务提供者征收的费用承担；然而，由于支持即将开展监督的专门ICT系统需要预先开发和部署，欧洲监管当局可能在监督框架启动之前即发生实施这些系统的成本。因此，本条例规定混合筹资模型：监督框架本身完全以收费融资，而欧洲监管当局ICT系统的开发则由欧盟和各国主管机关出资。

序言（97）

English

(97) Competent authorities should have all required supervisory, investigative and sanctioning powers to ensure the proper exercise of their duties under this Regulation. They should, in principle, publish notices of the administrative penalties they impose. Since financial entities and ICT third-party service providers can be established in different Member States and supervised by different competent authorities, the application of this Regulation should be facilitated by, on the one hand, close cooperation among relevant competent authorities, including the ECB with regard to specific tasks conferred on it by Council Regulation (EU) No 1024/2013, and, on the other hand, by consultation with the ESAs through the mutual exchange of information and the provision of assistance in the context of relevant supervisory activities.

中文参考译文

（97）主管机关应拥有确保适当履行本条例职责所需的全部监督、调查和制裁权力。原则上应公告所实施的行政处罚。由于金融实体和ICT第三方服务提供者可能设立于不同成员国并由不同主管机关监管，为促进本条例适用，一方面需要有关主管机关紧密合作，包括ECB就理事会条例（EU）第1024/2013号赋予其的特定任务开展合作；另一方面，需要在有关监管活动中通过相互交换信息、提供协助，与欧洲监管当局进行磋商。

序言（98）

English

(98) In order to further quantify and qualify the criteria for the designation of ICT third-party service providers as critical and to harmonise oversight fees, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission to supplement this Regulation by further specifying the systemic impact that a failure or operational outage of an ICT third-party service provider could have on the financial entities it provides ICT services to, the number of global systemically important institutions (G-SIIs), or other systemically important institutions (O-SIIs), that rely on the ICT third-party service provider in question, the number of ICT third-party service providers active on a given market, the costs of migrating data and ICT workloads to other ICT third-party service providers, as well as the amount of the oversight fees and the way in which they are to be paid. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making (22). In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council should receive all documents at the same time as Member States’ experts, and their experts should systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.

中文参考译文

（98）为进一步从定量和定性方面明确将ICT第三方服务提供者指定为关键的标准，并协调监督收费，应授权欧盟委员会依《欧洲联盟运行条约》第290条通过法案，补充本条例，进一步明确：提供者故障或运营中断可能对其服务的金融实体造成的系统性影响；依赖该提供者的全球系统重要性机构（G-SIIs）或其他系统重要性机构（O-SIIs）的数量；特定市场活跃ICT第三方服务提供者的数量；将数据和ICT工作负载迁移至其他提供者的成本；以及监督收费金额及支付方式。委员会在准备工作中开展适当磋商，包括专家层面的磋商，并按照2016年4月13日《改善立法机构间协议》(22)所定原则进行，尤为重要。特别是，为确保平等参与授权法案的准备，欧洲议会和理事会应与成员国专家同时收到所有文件，且其专家应能有系统地参加负责准备授权法案的委员会专家组会议。

序言（99）

English

(99) Regulatory technical standards should ensure the consistent harmonisation of the requirements laid down in this Regulation. In their roles as bodies endowed with highly specialised expertise, the ESAs should develop draft regulatory technical standards which do not involve policy choices, for submission to the Commission. Regulatory technical standards should be developed in the areas of ICT risk management, major ICT-related incident reporting, testing, as well as in relation to key requirements for a sound monitoring of ICT third-party risk. The Commission and the ESAs should ensure that those standards and requirements can be applied by all financial entities in a manner that is proportionate to their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations. The Commission should be empowered to adopt those regulatory technical standards by means of delegated acts pursuant to Article 290 TFEU and in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

中文参考译文

（99）监管技术标准应确保本条例各项要求得到一致协调。欧洲监管当局作为具有高度专门知识的机构，应制定不涉及政策选择的监管技术标准草案，提交委员会。应在ICT风险管理、重大ICT相关事件报告、测试，以及健全监测ICT第三方风险的关键要求等领域制定这些标准。委员会和欧洲监管当局应确保所有金融实体均能够按与自身规模、整体风险状况，以及服务、活动和运营的性质、范围及复杂性相称的方式适用这些标准和要求。应授权委员会依据《欧洲联盟运行条约》第290条，并按照条例（EU）第1093/2010号、第1094/2010号和第1095/2010号第10至14条，通过授权法案制定上述监管技术标准。

序言（100）

English

(100) To facilitate the comparability of reports on major ICT-related incidents and major operational or security payment-related incidents, as well as to ensure transparency regarding contractual arrangements for the use of ICT services provided by ICT third-party service providers, the ESAs should develop draft implementing technical standards establishing standardised templates, forms and procedures for financial entities to report a major ICT-related incident and a major operational or security payment-related incident, as well as standardised templates for the register of information. When developing those standards, the ESAs should take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations. The Commission should be empowered to adopt those implementing technical standards by means of implementing acts pursuant to Article 291 TFEU and in accordance with Article 15 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

中文参考译文

（100）为便于比较重大ICT相关事件和重大支付相关操作或安全事件报告，并确保使用ICT第三方服务提供者服务的合同安排透明，欧洲监管当局应制定实施技术标准草案，确立金融实体报告上述事件的标准化模板、表格和程序，以及信息登记册的标准化模板。制定标准时，应考虑金融实体规模、整体风险状况，以及服务、活动和运营的性质、范围及复杂性。应授权委员会依据《欧洲联盟运行条约》第291条，并按照条例（EU）第1093/2010号、第1094/2010号和第1095/2010号第15条，通过实施法案制定这些实施技术标准。

序言第101—106段 / Recitals 101–106

序言（101）

English

(101) Since further requirements have already been specified through delegated and implementing acts based on technical regulatory and implementing technical standards in Regulations (EC) No 1060/2009 (23), (EU) No 648/2012 (24), (EU) No 600/2014 (25) and (EU) No 909/2014 (26) of the European Parliament and of the Council, it is appropriate to mandate the ESAs, either individually or jointly through the Joint Committee, to submit regulatory and implementing technical standards to the Commission for adoption of delegated and implementing acts carrying over and updating existing ICT risk management rules.

中文参考译文

（101）由于基于欧洲议会和理事会条例（EC）第1060/2009号(23)、（EU）第648/2012号(24)、（EU）第600/2014号(25)和（EU）第909/2014号(26)中监管技术标准及实施技术标准的授权和实施法案，已进一步明确相关要求，因此应授权欧洲监管当局单独或通过联合委员会共同向委员会提交监管及实施技术标准，以通过授权和实施法案承接并更新既有ICT风险管理规则。

序言（102）

English

(102) Since this Regulation, together with Directive (EU) 2022/2556 of the European Parliament and of the Council (27), entails a consolidation of the ICT risk management provisions across multiple regulations and directives of the Union’s financial services acquis, including Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014 and (EU) No 909/2014, and Regulation (EU) 2016/1011 of the European Parliament and of the Council (28), in order to ensure full consistency, those Regulations should be amended to clarify that the applicable ICT risk-related provisions are laid down in this Regulation.

中文参考译文

（102）本条例与欧洲议会和理事会指令（EU）2022/2556(27)共同整合欧盟金融服务既有法律中多部条例和指令的ICT风险管理规定，包括条例（EC）第1060/2009号、（EU）第648/2012号、（EU）第600/2014号、（EU）第909/2014号，以及欧洲议会和理事会条例（EU）2016/1011(28)。为确保完全一致，应修订这些条例，明确适用的ICT风险相关规定载于本条例。

序言（103）

English

(103) Consequently, the scope of the relevant articles related to operational risk, upon which empowerments laid down in Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014, and (EU) 2016/1011 had mandated the adoption of delegated and implementing acts, should be narrowed down with a view to carry over into this Regulation all provisions covering the digital operational resilience aspects which today are part of those Regulations.

中文参考译文

（103）因此，应缩小操作风险相关条文的范围；条例（EC）第1060/2009号、（EU）第648/2012号、（EU）第600/2014号、（EU）第909/2014号和（EU）2016/1011曾依据这些条文授权通过授权及实施法案。缩小范围旨在将目前属于上述条例的所有数字运营韧性规定，承接至本条例。

序言（104）

English

(104) The potential systemic cyber risk associated with the use of ICT infrastructures that enable the operation of payment systems and the provision of payment processing activities should be duly addressed at Union level through harmonised digital resilience rules. To that effect, the Commission should swiftly assess the need for reviewing the scope of this Regulation while aligning such review with the outcome of the comprehensive review envisaged under Directive (EU) 2015/2366. Numerous large-scale attacks over the past decade demonstrate how payment systems have become exposed to cyber threats. Placed at the core of the payment services chain and showing strong interconnections with the overall financial system, payment systems and payment processing activities acquired a critical significance for the functioning of the Union financial markets. Cyber-attacks on such systems can cause severe operational business disruptions with direct repercussions on key economic functions, such as the facilitation of payments, and indirect effects on related economic processes. Until a harmonised regime and the supervision of operators of payment systems and processing entities are put in place at Union level, Member States may, with a view to applying similar market practices, draw inspiration from the digital operational resilience requirements laid down by this Regulation, when applying rules to operators of payment systems and processing entities supervised under their own jurisdictions.

中文参考译文

（104）使用支持支付系统运行及支付处理活动的ICT基础设施所产生的潜在系统性网络风险，应在欧盟层面通过协调的数字韧性规则予以适当处理。为此，委员会应迅速评估审查本条例范围的需要，并使之与指令（EU）2015/2366所拟全面审查结果一致。过去十年大量大规模攻击表明，支付系统已暴露于网络威胁。支付系统和支付处理活动位于支付服务链核心，与整个金融体系紧密互联，因而对欧盟金融市场运作具有关键意义。针对这些系统的网络攻击可能导致严重业务运营中断，直接影响支付便利化等关键经济功能，并间接影响相关经济过程。在欧盟层面建立支付系统运营者和处理实体的统一制度及监管之前，成员国为采用类似市场实践，在对本辖区监管的支付系统运营者和处理实体适用规则时，可以借鉴本条例规定的数字运营韧性要求。

序言（105）

English

(105) Since the objective of this Regulation, namely to achieve a high level of digital operational resilience for regulated financial entities, cannot be sufficiently achieved by the Member States because it requires harmonisation of various different rules in Union and national law, but can rather, by reason of its scale and effects, be better achieved at Union level, the Union may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective.

中文参考译文

（105）本条例的目标，即使受监管金融实体实现高水平数字运营韧性，需要协调欧盟及各国法律中不同规则，因而成员国无法充分实现；基于其规模和效果，在欧盟层面能够更好实现这一目标。因此，欧盟可以依照《欧洲联盟条约》第5条所定辅助性原则采取措施。依照该条所定比例原则，本条例不超出实现上述目标所必需的范围。

序言（106）

English

(106) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (29) and delivered an opinion on 10 May 2021 (30),

中文参考译文

（106）已依欧洲议会和理事会条例（EU）2018/1725(29)第42条第1款征询欧洲数据保护监督员意见，其于2021年5月10日提出意见(30)，

English

HAVE ADOPTED THIS REGULATION:

中文参考译文

兹通过本条例：

查看法规原文

第一章 总则 / CHAPTER I — General provisions

第1条 事项 / Article 1 — Subject matter

展开第1条英中对照

English

1. In order to achieve a high common level of digital operational resilience, this Regulation lays down uniform requirements concerning the security of network and information systems supporting the business processes of financial entities as follows:

(a) requirements applicable to financial entities in relation to:

(i) information and communication technology (ICT) risk management;

(ii) reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the competent authorities;

(iii) reporting of major operational or security payment-related incidents to the competent authorities by financial entities referred to in Article 2(1), points (a) to (d);

(iv) digital operational resilience testing;

(v) information and intelligence sharing in relation to cyber threats and vulnerabilities;

(vi) measures for the sound management of ICT third-party risk;

(b) requirements in relation to the contractual arrangements concluded between ICT third-party service providers and financial entities;

(c) rules for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when providing services to financial entities;

(d) rules on cooperation among competent authorities, and rules on supervision and enforcement by competent authorities in relation to all matters covered by this Regulation.

2. In relation to financial entities identified as essential or important entities pursuant to national rules transposing Article 3 of Directive (EU) 2022/2555, this Regulation shall be considered a sector-specific Union legal act for the purposes of Article 4 of that Directive.

3. This Regulation is without prejudice to the responsibility of Member States’ regarding essential State functions concerning public security, defence and national security in accordance with Union law.

中文参考译文

1. 为实现共同的高水平数字运营韧性，本条例对支持金融实体业务流程的网络和信息系统安全规定下列统一要求：

(a) 金融实体在下列方面适用的要求：

(i) 信息与通信技术（ICT）风险管理；

(ii) 向主管机关报告重大ICT相关事件，以及自愿通知重大网络威胁；

(iii) 第2条第1款(a)至(d)项所述金融实体向主管机关报告重大支付相关操作或安全事件；

(iv) 数字运营韧性测试；

(v) 有关网络威胁和脆弱性的信息与情报共享；

(vi) 健全管理ICT第三方风险的措施；

(b) ICT第三方服务提供者与金融实体之间订立的合同安排相关要求；

(c) 对向金融实体提供服务的关键ICT第三方服务提供者建立和实施监督框架的规则；

(d) 主管机关之间的合作规则，以及主管机关就本条例涵盖的所有事项开展监管和执法的规则。

2. 对于依据转化指令（EU）2022/2555第3条的国内规则，被识别为基本实体或重要实体的金融实体，为适用该指令第4条，本条例应视为欧盟行业专门法律文件。

3. 本条例不影响成员国依欧盟法律在公共安全、国防和国家安全等国家基本职能方面承担的责任。

第2条 适用范围 / Article 2 — Scope

展开第2条英中对照

English

1. Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities:

(a) credit institutions;

(b) payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366;

(c) account information service providers;

(d) electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC;

(e) investment firms;

(f) crypto-asset service providers as authorised under a Regulation of the European Parliament and of the Council on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (‘the Regulation on markets in crypto-assets’) and issuers of asset-referenced tokens;

(g) central securities depositories;

(h) central counterparties;

(i) trading venues;

(j) trade repositories;

(k) managers of alternative investment funds;

(l) management companies;

(m) data reporting service providers;

(n) insurance and reinsurance undertakings;

(o) insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries;

(p) institutions for occupational retirement provision;

(q) credit rating agencies;

(r) administrators of critical benchmarks;

(s) crowdfunding service providers;

(t) securitisation repositories;

(u) ICT third-party service providers.

2. For the purposes of this Regulation, entities referred to in paragraph 1, points (a) to (t), shall collectively be referred to as ‘financial entities’.

3. This Regulation does not apply to:

(a) managers of alternative investment funds as referred to in Article 3(2) of Directive 2011/61/EU;

(b) insurance and reinsurance undertakings as referred to in Article 4 of Directive 2009/138/EC;

(c) institutions for occupational retirement provision which operate pension schemes which together do not have more than 15 members in total;

(d) natural or legal persons exempted pursuant to Articles 2 and 3 of Directive 2014/65/EU;

(e) insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries which are microenterprises or small or medium-sized enterprises;

(f) post office giro institutions as referred to in Article 2(5), point (3), of Directive 2013/36/EU.

4. Member States may exclude from the scope of this Regulation entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU that are located within their respective territories. Where a Member State makes use of such option, it shall inform the Commission thereof as well as of any subsequent changes thereto. The Commission shall make that information publicly available on its website or other easily accessible means.

中文参考译文

1. 在不影响第3款和第4款的前提下，本条例适用于下列实体：

(a) 信贷机构；

(b) 支付机构，包括依据指令（EU）2015/2366获豁免的支付机构；

(c) 账户信息服务提供者；

(d) 电子货币机构，包括依据指令2009/110/EC获豁免的电子货币机构；

(e) 投资公司；

(f) 依据欧洲议会和理事会关于加密资产市场，并修订条例（EU）第1093/2010号、第1095/2010号及指令2013/36/EU和（EU）2019/1937的条例（以下简称“加密资产市场条例”）获得许可的加密资产服务提供者，以及资产参考代币发行人；

(g) 中央证券存管机构；

(h) 中央交易对手；

(i) 交易场所；

(j) 交易资料库；

(k) 另类投资基金管理人；

(l) 管理公司；

(m) 数据报告服务提供者；

(n) 保险和再保险企业；

(o) 保险中介、再保险中介和附属保险中介；

(p) 职业退休金机构；

(q) 信用评级机构；

(r) 关键基准管理人；

(s) 众筹服务提供者；

(t) 证券化资料库；

(u) ICT第三方服务提供者。

2. 就本条例而言，第1款(a)至(t)项所述实体统称“金融实体”。

3. 本条例不适用于：

(a) 指令2011/61/EU第3条第2款所述另类投资基金管理人；

(b) 指令2009/138/EC第4条所述保险和再保险企业；

(c) 所运营养老金计划合计成员总数不超过15人的职业退休金机构；

(d) 依据指令2014/65/EU第2条和第3条获豁免的自然人或法人；

(e) 属于微型、小型或中型企业的保险中介、再保险中介和附属保险中介；

(f) 指令2013/36/EU第2条第5款第(3)项所述邮政汇划机构。

4. 成员国可以将指令2013/36/EU第2条第5款第(4)至(23)项所述、位于其各自领土内的实体排除在本条例适用范围之外。成员国行使这一选择权时，应将此事项及其后续任何变化告知委员会。委员会应通过其网站或其他易于获取的方式公开这些信息。

查看法规原文

第3条 定义 / Article 3 — Definitions

展开第3条英中对照

English

For the purposes of this Regulation, the following definitions shall apply:

(1) ‘digital operational resilience’ means the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of the network and information systems which a financial entity uses, and which support the continued provision of financial services and their quality, including throughout disruptions;

(2) ‘network and information system’ means a network and information system as defined in Article 6, point 1, of Directive (EU) 2022/2555;

(3) ‘legacy ICT system’ means an ICT system that has reached the end of its lifecycle (end-of-life), that is not suitable for upgrades or fixes, for technological or commercial reasons, or is no longer supported by its supplier or by an ICT third-party service provider, but that is still in use and supports the functions of the financial entity;

(4) ‘security of network and information systems’ means security of network and information systems as defined in Article 6, point 2, of Directive (EU) 2022/2555;

(5) ‘ICT risk’ means any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment;

(6) ‘information asset’ means a collection of information, either tangible or intangible, that is worth protecting;

(7) ‘ICT asset’ means a software or hardware asset in the network and information systems used by the financial entity;

(8) ‘ICT-related incident’ means a single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity;

(9) ‘operational or security payment-related incident’ means a single event or a series of linked events unplanned by the financial entities referred to in Article 2(1), points (a) to (d), whether ICT-related or not, that has an adverse impact on the availability, authenticity, integrity or confidentiality of payment-related data, or on the payment-related services provided by the financial entity;

(10) ‘major ICT-related incident’ means an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity;

(11) ‘major operational or security payment-related incident’ means an operational or security payment-related incident that has a high adverse impact on the payment-related services provided;

(12) ‘cyber threat’ means ‘cyber threat’ as defined in Article 2, point (8), of Regulation (EU) 2019/881;

(13) ‘significant cyber threat’ means a cyber threat the technical characteristics of which indicate that it could have the potential to result in a major ICT-related incident or a major operational or security payment-related incident;

(14) ‘cyber-attack’ means a malicious ICT-related incident caused by means of an attempt perpetrated by any threat actor to destroy, expose, alter, disable, steal or gain unauthorised access to, or make unauthorised use of, an asset;

(15) ‘threat intelligence’ means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations;

(16) ‘vulnerability’ means a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited;

(17) ‘threat-led penetration testing (TLPT)’ means a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems;

(18) ‘ICT third-party risk’ means an ICT risk that may arise for a financial entity in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements;

(19) ‘ICT third-party service provider’ means an undertaking providing ICT services;

(20) ‘ICT intra-group service provider’ means an undertaking that is part of a financial group and that provides predominantly ICT services to financial entities within the same group or to financial entities belonging to the same institutional protection scheme, including to their parent undertakings, subsidiaries, branches or other entities that are under common ownership or control;

(21) ‘ICT services’ means digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services;

(22) ‘critical or important function’ means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;

(23) ‘critical ICT third-party service provider’ means an ICT third-party service provider designated as critical in accordance with Article 31;

(24) ‘ICT third-party service provider established in a third country’ means an ICT third-party service provider that is a legal person established in a third-country and that has entered into a contractual arrangement with a financial entity for the provision of ICT services;

(25) ‘subsidiary’ means a subsidiary undertaking within the meaning of Article 2, point (10), and Article 22 of Directive 2013/34/EU;

(26) ‘group’ means a group as defined in Article 2, point (11), of Directive 2013/34/EU;

(27) ‘parent undertaking’ means a parent undertaking within the meaning of Article 2, point (9), and Article 22 of Directive 2013/34/EU;

(28) ‘ICT subcontractor established in a third country’ means an ICT subcontractor that is a legal person established in a third-country and that has entered into a contractual arrangement either with an ICT third-party service provider, or with an ICT third-party service provider established in a third country;

(29) ‘ICT concentration risk’ means an exposure to individual or multiple related critical ICT third-party service providers creating a degree of dependency on such providers so that the unavailability, failure or other type of shortfall of such provider may potentially endanger the ability of a financial entity to deliver critical or important functions, or cause it to suffer other types of adverse effects, including large losses, or endanger the financial stability of the Union as a whole;

(30) ‘management body’ means a management body as defined in Article 4(1), point (36), of Directive 2014/65/EU, Article 3(1), point (7), of Directive 2013/36/EU, Article 2(1), point (s), of Directive 2009/65/EC of the European Parliament and of the Council (31), Article 2(1), point (45), of Regulation (EU) No 909/2014, Article 3(1), point (20), of Regulation (EU) 2016/1011, and in the relevant provision of the Regulation on markets in crypto-assets, or the equivalent persons who effectively run the entity or have key functions in accordance with relevant Union or national law;

(31) ‘credit institution’ means a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council (32);

(32) ‘institution exempted pursuant to Directive 2013/36/EU’ means an entity as referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU;

(33) ‘investment firm’ means an investment firm as defined in Article 4(1), point (1), of Directive 2014/65/EU;

(34) ‘small and non-interconnected investment firm’ means an investment firm that meets the conditions laid out in Article 12(1) of Regulation (EU) 2019/2033 of the European Parliament and of the Council (33);

(35) ‘payment institution’ means a payment institution as defined in Article 4, point (4), of Directive (EU) 2015/2366;

(36) ‘payment institution exempted pursuant to Directive (EU) 2015/2366’ means a payment institution exempted pursuant to Article 32(1) of Directive (EU) 2015/2366;

(37) ‘account information service provider’ means an account information service provider as referred to in Article 33(1) of Directive (EU) 2015/2366;

(38) ‘electronic money institution’ means an electronic money institution as defined in Article 2, point (1), of Directive 2009/110/EC of the European Parliament and of the Council;

(39) ‘electronic money institution exempted pursuant to Directive 2009/110/EC’ means an electronic money institution benefitting from a waiver as referred to in Article 9(1) of Directive 2009/110/EC;

(40) ‘central counterparty’ means a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012;

(41) ‘trade repository’ means a trade repository as defined in Article 2, point (2), of Regulation (EU) No 648/2012;

(42) ‘central securities depository’ means a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014;

(43) ‘trading venue’ means a trading venue as defined in Article 4(1), point (24), of Directive 2014/65/EU;

(44) ‘manager of alternative investment funds’ means a manager of alternative investment funds as defined in Article 4(1), point (b), of Directive 2011/61/EU;

(45) ‘management company’ means a management company as defined in Article 2(1), point (b), of Directive 2009/65/EC;

(46) ‘data reporting service provider’ means a data reporting service provider within the meaning of Regulation (EU) No 600/2014, as referred to in Article 2(1), points (34) to (36) thereof;

(47) ‘insurance undertaking’ means an insurance undertaking as defined in Article 13, point (1), of Directive 2009/138/EC;

(48) ‘reinsurance undertaking’ means a reinsurance undertaking as defined in Article 13, point (4), of Directive 2009/138/EC;

(49) ‘insurance intermediary’ means an insurance intermediary as defined in Article 2(1), point (3), of Directive (EU) 2016/97 of the European Parliament and of the Council (34);

(50) ‘ancillary insurance intermediary’ means an ancillary insurance intermediary as defined in Article 2(1), point (4), of Directive (EU) 2016/97;

(51) ‘reinsurance intermediary’ means a reinsurance intermediary as defined in Article 2(1), point (5), of Directive (EU) 2016/97;

(52) ‘institution for occupational retirement provision’ means an institution for occupational retirement provision as defined in Article 6, point (1), of Directive (EU) 2016/2341;

(53) ‘small institution for occupational retirement provision’ means an institution for occupational retirement provision which operates pension schemes which together have less than 100 members in total;

(54) ‘credit rating agency’ means a credit rating agency as defined in Article 3(1), point (b), of Regulation (EC) No 1060/2009;

(55) ‘crypto-asset service provider’ means a crypto-asset service provider as defined in the relevant provision of the Regulation on markets in crypto-assets;

(56) ‘issuer of asset-referenced tokens’ means an issuer of asset-referenced tokens as defined in the relevant provision of the Regulation on markets in crypto-assets;

(57) ‘administrator of critical benchmarks’ means an administrator of ‘critical benchmarks’ as defined in Article 3(1), point (25), of Regulation (EU) 2016/1011;

(58) ‘crowdfunding service provider’ means a crowdfunding service provider as defined in Article 2(1), point (e), of Regulation (EU) 2020/1503 of the European Parliament and of the Council (35);

(59) ‘securitisation repository’ means a securitisation repository as defined in Article 2, point (23), of Regulation (EU) 2017/2402 of the European Parliament and of the Council (36);

(60) ‘microenterprise’ means a financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million;

(61) ‘Lead Overseer’ means the European Supervisory Authority appointed in accordance with Article 31(1), point (b) of this Regulation;

(62) ‘Joint Committee’ means the committee referred to in Article 54 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010;

(63) ‘small enterprise’ means a financial entity that employs 10 or more persons, but fewer than 50 persons, and has an annual turnover and/or annual balance sheet total that exceeds EUR 2 million, but does not exceed EUR 10 million;

(64) ‘medium-sized enterprise’ means a financial entity that is not a small enterprise and employs fewer than 250 persons and has an annual turnover that does not exceed EUR 50 million and/or an annual balance sheet that does not exceed EUR 43 million;

(65) ‘public authority’ means any government or other public administration entity, including national central banks.

中文参考译文

就本条例而言，适用下列定义：

(1) “数字运营韧性”，指金融实体通过直接，或者间接利用ICT第三方服务提供者的服务，确保具备处理其所使用网络和信息系统安全所需的全部ICT相关能力，从而建立、保障和审查自身运营完整性及可靠性的能力；这些系统支持金融服务的持续提供及其质量，包括在中断期间。

(2) “网络和信息系统”，指指令（EU）2022/2555第6条第1项定义的网络和信息系统。

(3) “遗留ICT系统”，指已达到生命周期终点，因技术或商业原因不适合升级或修复，或者供应商或ICT第三方服务提供者已不再提供支持，但仍在使用并支持金融实体功能的ICT系统。

(4) “网络和信息系统安全”，指指令（EU）2022/2555第6条第2项定义的网络和信息系统安全。

(5) “ICT风险”，指与网络和信息系统使用有关、能够合理识别的任何情形；该情形一旦发生，可能通过在数字或物理环境中产生不利影响，损害网络和信息系统、任何依赖技术的工具或流程、运营与流程，或者服务提供的安全。

(6) “信息资产”，指值得保护的有形或无形信息集合。

(7) “ICT资产”，指金融实体使用的网络和信息系统中的软件或硬件资产。

(8) “ICT相关事件”，指金融实体未计划的单一事件或一系列关联事件，损害网络和信息系统安全，并对数据的可用性、真实性、完整性或保密性，或者金融实体提供的服务产生不利影响。

(9) “支付相关操作或安全事件”，指第2条第1款(a)至(d)项所述金融实体未计划的单一事件或一系列关联事件，无论是否与ICT有关，对支付相关数据的可用性、真实性、完整性或保密性，或者金融实体提供的支付相关服务产生不利影响。

(10) “重大ICT相关事件”，指对支持金融实体关键或重要功能的网络和信息系统产生高度不利影响的ICT相关事件。

(11) “重大支付相关操作或安全事件”，指对所提供支付相关服务产生高度不利影响的支付相关操作或安全事件。

(12) “网络威胁”，指条例（EU）2019/881第2条第(8)项定义的网络威胁。

(13) “重大网络威胁”，指其技术特征表明可能导致重大ICT相关事件或重大支付相关操作或安全事件的网络威胁。

(14) “网络攻击”，指由任何威胁行为者企图毁损、暴露、更改、停用、窃取、未经授权访问或使用资产而造成的恶意ICT相关事件。

(15) “威胁情报”，指经过汇总、转换、分析、解释或充实的信息，用于提供决策所需背景，并使相关方获得相关且充分的理解，以缓解ICT相关事件或网络威胁的影响，包括网络攻击技术细节、攻击责任方及其作案方式和动机。

(16) “脆弱性”，指资产、系统、流程或控制措施中可被利用的弱点、易受损性或缺陷。

(17) “基于威胁情报的渗透测试（TLPT）”，指模拟被认为构成真实网络威胁的现实威胁行为者的战术、技术和程序，对金融实体关键在线生产系统开展受控、定制、由情报引导的红队测试的框架。

(18) “ICT第三方风险”，指金融实体因使用ICT第三方服务提供者或其分包商提供的ICT服务，包括通过外包安排使用这些服务，而可能产生的ICT风险。

(19) “ICT第三方服务提供者”，指提供ICT服务的企业。

(20) “ICT集团内部服务提供者”，指属于金融集团、主要向同一集团内或属于同一机构保护计划的金融实体提供ICT服务的企业，包括向其母公司、子公司、分支机构，或者处于共同所有或控制之下的其他实体提供服务。

(21) “ICT服务”，指通过ICT系统持续向一个或多个内部或外部使用者提供的数字和数据服务，包括硬件即服务，以及包含由硬件提供者通过软件或固件更新提供技术支持的硬件服务，但不包括传统模拟电话服务。

(22) “关键或重要功能”，指其中断将重大损害金融实体财务表现，或者其服务和活动的稳健性或连续性；或者该功能停止履行、履行存在缺陷或履行失败，将重大损害金融实体持续遵守许可条件和义务，或者适用金融服务法律项下其他义务的功能。

(23) “关键ICT第三方服务提供者”，指依第31条被指定为关键的ICT第三方服务提供者。

(24) “设立于第三国的ICT第三方服务提供者”，指作为法人设立于第三国，并已与金融实体订立提供ICT服务合同安排的ICT第三方服务提供者。

(25) “子公司”，指指令2013/34/EU第2条第(10)项及第22条意义上的子企业。

(26) “集团”，指指令2013/34/EU第2条第(11)项定义的集团。

(27) “母公司”，指指令2013/34/EU第2条第(9)项及第22条意义上的母企业。

(28) “设立于第三国的ICT分包商”，指作为法人设立于第三国，并已与ICT第三方服务提供者或者设立于第三国的ICT第三方服务提供者订立合同安排的ICT分包商。

(29) “ICT集中风险”，指对单个或多个相关关键ICT第三方服务提供者的风险敞口，形成对这些提供者一定程度的依赖，以致提供者不可用、失效或其他不足，可能危及金融实体交付关键或重要功能的能力，使其受到包括重大损失在内的其他不利影响，或者危及整个欧盟的金融稳定。

(30) “管理机构”，指指令2014/65/EU第4条第1款第(36)项、指令2013/36/EU第3条第1款第(7)项、欧洲议会和理事会指令2009/65/EC(31)第2条第1款(s)项、条例（EU）第909/2014号第2条第1款第(45)项、条例（EU）2016/1011第3条第1款第(20)项，以及加密资产市场条例有关条款所定义的管理机构，或者依欧盟或各国有关法律实际管理实体或承担关键职能的同等人员。

(31) “信贷机构”，指欧洲议会和理事会条例（EU）第575/2013号(32)第4条第1款第(1)项定义的信贷机构。

(32) “依据指令2013/36/EU获豁免的机构”，指该指令第2条第5款第(4)至(23)项所述实体。

(33) “投资公司”，指指令2014/65/EU第4条第1款第(1)项定义的投资公司。

(34) “小型且非互联的投资公司”，指满足欧洲议会和理事会条例（EU）2019/2033(33)第12条第1款规定条件的投资公司。

(35) “支付机构”，指指令（EU）2015/2366第4条第(4)项定义的支付机构。

(36) “依据指令（EU）2015/2366获豁免的支付机构”，指依据该指令第32条第1款获豁免的支付机构。

(37) “账户信息服务提供者”，指指令（EU）2015/2366第33条第1款所述账户信息服务提供者。

(38) “电子货币机构”，指欧洲议会和理事会指令2009/110/EC第2条第(1)项定义的电子货币机构。

(39) “依据指令2009/110/EC获豁免的电子货币机构”，指享有该指令第9条第1款所述豁免的电子货币机构。

(40) “中央交易对手”，指条例（EU）第648/2012号第2条第(1)项定义的中央交易对手。

(41) “交易资料库”，指条例（EU）第648/2012号第2条第(2)项定义的交易资料库。

(42) “中央证券存管机构”，指条例（EU）第909/2014号第2条第1款第(1)项定义的中央证券存管机构。

(43) “交易场所”，指指令2014/65/EU第4条第1款第(24)项定义的交易场所。

(44) “另类投资基金管理人”，指指令2011/61/EU第4条第1款(b)项定义的另类投资基金管理人。

(45) “管理公司”，指指令2009/65/EC第2条第1款(b)项定义的管理公司。

(46) “数据报告服务提供者”，指条例（EU）第600/2014号意义上、该条例第2条第1款第(34)至(36)项所述的数据报告服务提供者。

(47) “保险企业”，指指令2009/138/EC第13条第(1)项定义的保险企业。

(48) “再保险企业”，指指令2009/138/EC第13条第(4)项定义的再保险企业。

(49) “保险中介”，指欧洲议会和理事会指令（EU）2016/97(34)第2条第1款第(3)项定义的保险中介。

(50) “附属保险中介”，指指令（EU）2016/97第2条第1款第(4)项定义的附属保险中介。

(51) “再保险中介”，指指令（EU）2016/97第2条第1款第(5)项定义的再保险中介。

(52) “职业退休金机构”，指指令（EU）2016/2341第6条第(1)项定义的职业退休金机构。

(53) “小型职业退休金机构”，指所运营养老金计划合计成员总数少于100人的职业退休金机构。

(54) “信用评级机构”，指条例（EC）第1060/2009号第3条第1款(b)项定义的信用评级机构。

(55) “加密资产服务提供者”，指加密资产市场条例有关条款定义的加密资产服务提供者。

(56) “资产参考代币发行人”，指加密资产市场条例有关条款定义的资产参考代币发行人。

(57) “关键基准管理人”，指条例（EU）2016/1011第3条第1款第(25)项定义的“关键基准”的管理人。

(58) “众筹服务提供者”，指欧洲议会和理事会条例（EU）2020/1503(35)第2条第1款(e)项定义的众筹服务提供者。

(59) “证券化资料库”，指欧洲议会和理事会条例（EU）2017/2402(36)第2条第(23)项定义的证券化资料库。

(60) “微型企业”，指交易场所、中央交易对手、交易资料库或中央证券存管机构以外，雇员少于10人，且年营业额和／或年度资产负债表总额不超过200万欧元的金融实体。

(61) “牵头监督机构”，指依据本条例第31条第1款(b)项指定的欧洲监管当局。

(62) “联合委员会”，指条例（EU）第1093/2010号、第1094/2010号和第1095/2010号第54条所述委员会。

(63) “小型企业”，指雇员不少于10人但少于50人，且年营业额和／或年度资产负债表总额超过200万欧元但不超过1 000万欧元的金融实体。

(64) “中型企业”，指不属于小型企业、雇员少于250人，且年营业额不超过5 000万欧元和／或年度资产负债表总额不超过4 300万欧元的金融实体。

(65) “公共机关”，指任何政府或其他公共行政实体，包括各国中央银行。

第4条 比例原则 / Article 4 — Proportionality principle

展开第4条英中对照

English

1. Financial entities shall implement the rules laid down in Chapter II in accordance with the principle of proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations.

2. In addition, the application by financial entities of Chapters III, IV and V, Section I, shall be proportionate to their size and overall risk profile, and to the nature, scale and complexity of their services, activities and operations, as specifically provided for in the relevant rules of those Chapters.

3. The competent authorities shall consider the application of the proportionality principle by financial entities when reviewing the consistency of the ICT risk management framework on the basis of the reports submitted upon the request of competent authorities pursuant to Article 6(5) and Article 16(2).

中文参考译文

1. 金融实体应依照比例原则实施第二章规则，考虑自身规模、整体风险状况，以及服务、活动和运营的性质、范围及复杂性。

2. 此外，金融实体适用第三章、第四章和第五章第一节时，应依这些章相关规则的具体规定，与自身规模、整体风险状况，以及服务、活动和运营的性质、范围及复杂性相称。

3. 主管机关依据按第6条第5款及第16条第2款应其要求提交的报告，审查ICT风险管理框架的一致性时，应考虑金融实体对比例原则的适用情况。

查看法规原文

第二章 ICT风险管理 / CHAPTER II — ICT risk management

第一节 / Section I

第5条 治理与组织 / Article 5 — Governance and organisation

展开第5条英中对照

English

1. Financial entities shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with Article 6(4), in order to achieve a high level of digital operational resilience.

2. The management body of the financial entity shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1).

For the purposes of the first subparagraph, the management body shall:

(a) bear the ultimate responsibility for managing the financial entity’s ICT risk;

(b) put in place policies that aim to ensure the maintenance of high standards of availability, authenticity, integrity and confidentiality, of data;

(c) set clear roles and responsibilities for all ICT-related functions and establish appropriate governance arrangements to ensure effective and timely communication, cooperation and coordination among those functions;

(d) bear the overall responsibility for setting and approving the digital operational resilience strategy as referred to in Article 6(8), including the determination of the appropriate risk tolerance level of ICT risk of the financial entity, as referred to in Article 6(8), point (b);

(e) approve, oversee and periodically review the implementation of the financial entity’s ICT business continuity policy and ICT response and recovery plans, referred to, respectively, in Article 11(1) and (3), which may be adopted as a dedicated specific policy forming an integral part of the financial entity’s overall business continuity policy and response and recovery plan;

(f) approve and periodically review the financial entity’s ICT internal audit plans, ICT audits and material modifications to them;

(g) allocate and periodically review the appropriate budget to fulfil the financial entity’s digital operational resilience needs in respect of all types of resources, including relevant ICT security awareness programmes and digital operational resilience training referred to in Article 13(6), and ICT skills for all staff;

(h) approve and periodically review the financial entity’s policy on arrangements regarding the use of ICT services provided by ICT third-party service providers;

(i) put in place, at corporate level, reporting channels enabling it to be duly informed of the following:

(i) arrangements concluded with ICT third-party service providers on the use of ICT services,

(ii) any relevant planned material changes regarding the ICT third-party service providers,

(iii) the potential impact of such changes on the critical or important functions subject to those arrangements, including a risk analysis summary to assess the impact of those changes, and at least major ICT-related incidents and their impact, as well as response, recovery and corrective measures.

3. Financial entities, other than microenterprises, shall establish a role in order to monitor the arrangements concluded with ICT third-party service providers on the use of ICT services, or shall designate a member of senior management as responsible for overseeing the related risk exposure and relevant documentation.

4. Members of the management body of the financial entity shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed.

中文参考译文

1. 金融实体应依第6条第4款建立内部治理和控制框架，确保有效、审慎地管理ICT风险，以实现高水平数字运营韧性。

2. 金融实体管理机构应确定、批准并监督第6条第1款所述ICT风险管理框架相关的全部安排，并对其实施负责。

为适用第一分段，管理机构应：

(a) 对金融实体ICT风险管理承担最终责任；

(b) 制定旨在确保维持数据可用性、真实性、完整性和保密性高标准的政策；

(c) 明确所有ICT相关职能的角色和责任，建立适当治理安排，确保这些职能之间有效、及时地沟通、合作与协调；

(d) 对制定和批准第6条第8款所述数字运营韧性战略承担总体责任，包括确定该款(b)项所述金融实体适当的ICT风险容忍水平；

(e) 批准、监督并定期审查分别在第11条第1款和第3款所述ICT业务连续性政策及ICT响应和恢复计划的实施；这些政策和计划可以作为专门政策制定，构成金融实体总体业务连续性政策及响应和恢复计划的组成部分；

(f) 批准并定期审查金融实体ICT内部审计计划、ICT审计及其重大修改；

(g) 分配并定期审查适当预算，满足金融实体在各类资源方面的数字运营韧性需要，包括第13条第6款所述相关ICT安全意识方案和数字运营韧性培训，以及全体员工的ICT技能；

(h) 批准并定期审查金融实体关于使用ICT第三方服务提供者所提供ICT服务之安排的政策；

(i) 在企业层面设置报告渠道，使其能够适当获悉：

(i) 与ICT第三方服务提供者订立的ICT服务使用安排；

(ii) 与ICT第三方服务提供者有关的任何计划中的重大变化；

(iii) 这些变化对安排所涉关键或重要功能的潜在影响，包括用于评估变化影响的风险分析摘要，以及至少包括重大ICT相关事件及其影响，还有响应、恢复和纠正措施。

3. 微型企业以外的金融实体应设置岗位，监测与ICT第三方服务提供者订立的ICT服务使用安排，或者指定一名高级管理人员负责监督相关风险敞口和有关文件。

4. 金融实体管理机构成员应主动保持知识和技能更新，充分理解和评估ICT风险及其对实体运营的影响，包括定期参加与所管理ICT风险相称的专门培训。

第二节 / Section II

第6条 ICT风险管理框架 / Article 6 — ICT risk management framework

展开第6条英中对照

English

1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience.

2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools that are necessary to duly and adequately protect all information assets and ICT assets, including computer software, hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks including damage and unauthorised access or usage.

3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.

4. Financial entities, other than microenterprises, shall assign the responsibility for managing and overseeing ICT risk to a control function and ensure an appropriate level of independence of such control function in order to avoid conflicts of interest. Financial entities shall ensure appropriate segregation and independence of ICT risk management functions, control functions, and internal audit functions, according to the three lines of defence model, or an internal risk management and control model.

5. The ICT risk management framework shall be documented and reviewed at least once a year, or periodically in the case of microenterprises, as well as upon the occurrence of major ICT-related incidents, and following supervisory instructions or conclusions derived from relevant digital operational resilience testing or audit processes. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A report on the review of the ICT risk management framework shall be submitted to the competent authority upon its request.

6. The ICT risk management framework of financial entities, other than microenterprises, shall be subject to internal audit by auditors on a regular basis in line with the financial entities’ audit plan. Those auditors shall possess sufficient knowledge, skills and expertise in ICT risk, as well as appropriate independence. The frequency and focus of ICT audits shall be commensurate to the ICT risk of the financial entity.

7. Based on the conclusions from the internal audit review, financial entities shall establish a formal follow-up process, including rules for the timely verification and remediation of critical ICT audit findings.

8. The ICT risk management framework shall include a digital operational resilience strategy setting out how the framework shall be implemented. To that end, the digital operational resilience strategy shall include methods to address ICT risk and attain specific ICT objectives, by:

(a) explaining how the ICT risk management framework supports the financial entity’s business strategy and objectives;

(b) establishing the risk tolerance level for ICT risk, in accordance with the risk appetite of the financial entity, and analysing the impact tolerance for ICT disruptions;

(c) setting out clear information security objectives, including key performance indicators and key risk metrics;

(d) explaining the ICT reference architecture and any changes needed to reach specific business objectives;

(e) outlining the different mechanisms put in place to detect ICT-related incidents, prevent their impact and provide protection from it;

(f) evidencing the current digital operational resilience situation on the basis of the number of major ICT-related incidents reported and the effectiveness of preventive measures;

(g) implementing digital operational resilience testing, in accordance with Chapter IV of this Regulation;

(h) outlining a communication strategy in the event of ICT-related incidents the disclosure of which is required in accordance with Article 14.

9. Financial entities may, in the context of the digital operational resilience strategy referred to in paragraph 8, define a holistic ICT multi-vendor strategy, at group or entity level, showing key dependencies on ICT third-party service providers and explaining the rationale behind the procurement mix of ICT third-party service providers.

10. Financial entities may, in accordance with Union and national sectoral law, outsource the tasks of verifying compliance with ICT risk management requirements to intra-group or external undertakings. In case of such outsourcing, the financial entity remains fully responsible for the verification of compliance with the ICT risk management requirements.

中文参考译文

1. 金融实体应具备健全、全面且记录充分的ICT风险管理框架，作为总体风险管理体系的组成部分，使其能够迅速、高效、全面地应对ICT风险，并确保高水平数字运营韧性。

2. ICT风险管理框架至少应包含适当、充分保护所有信息资产及ICT资产所必需的战略、政策、程序、ICT协议和工具，包括保护计算机软件、硬件、服务器，以及场所、数据中心、划定的敏感区域等所有相关物理组件和基础设施，确保所有信息资产及ICT资产得到充分保护，免受包括损坏、未授权访问或使用在内的风险。

3. 金融实体应按照其ICT风险管理框架，部署适当战略、政策、程序、ICT协议和工具，尽量减少ICT风险影响，并应主管机关要求提供有关ICT风险及其ICT风险管理框架的完整、最新信息。

4. 微型企业以外的金融实体应将ICT风险管理和监督责任交由控制职能承担，并确保该职能具备适当独立性，以避免利益冲突。金融实体应按照三道防线模型，或者内部风险管理和控制模型，确保ICT风险管理职能、控制职能和内部审计职能适当分离并保持独立。

5. ICT风险管理框架应予以记录，并至少每年审查一次；微型企业则应定期审查。在发生重大ICT相关事件后，以及依据监管指示或有关数字运营韧性测试、审计过程得出的结论后，也应进行审查。该框架应根据实施和监测中取得的经验教训持续改进。应主管机关要求，应提交ICT风险管理框架审查报告。

6. 微型企业以外金融实体的ICT风险管理框架，应由审计人员按照实体审计计划定期开展内部审计。审计人员应具备充分的ICT风险知识、技能和专业能力，并具有适当独立性。ICT审计频率和重点应与金融实体的ICT风险相称。

7. 金融实体应根据内部审计审查结论建立正式跟进流程，包括及时核实和补救关键ICT审计发现的规则。

8. ICT风险管理框架应包含数字运营韧性战略，说明如何实施该框架。为此，数字运营韧性战略应通过下列内容，纳入应对ICT风险、实现特定ICT目标的方法：

(a) 说明ICT风险管理框架如何支持金融实体业务战略和目标；

(b) 根据实体风险偏好设定ICT风险容忍水平，并分析对ICT中断影响的容忍度；

(c) 规定明确的信息安全目标，包括关键绩效指标和关键风险指标；

(d) 说明ICT参考架构及实现特定业务目标所需的任何变化；

(e) 概述为检测ICT相关事件、预防其影响并提供防护而建立的不同机制；

(f) 根据已报告重大ICT相关事件的数量及预防措施的有效性，以证据说明当前数字运营韧性状况；

(g) 依本条例第四章实施数字运营韧性测试；

(h) 概述发生依第14条要求披露的ICT相关事件时所采用的沟通战略。

9. 金融实体可以在第8款所述数字运营韧性战略下，于集团或实体层面制定整体ICT多供应商战略，展示对ICT第三方服务提供者的关键依赖，并解释选择该供应商采购组合的理由。

10. 金融实体可以依欧盟及各国行业法律，将核实遵守ICT风险管理要求的任务外包给集团内部或外部企业。进行此类外包时，金融实体仍对核实ICT风险管理要求的遵守情况承担全部责任。

第7条 ICT系统、协议和工具 / Article 7 — ICT systems, protocols and tools

展开第7条英中对照

English

In order to address and manage ICT risk, financial entities shall use and maintain updated ICT systems, protocols and tools that are:

(a) appropriate to the magnitude of operations supporting the conduct of their activities, in accordance with the proportionality principle as referred to in Article 4;

(b) reliable;

(c) equipped with sufficient capacity to accurately process the data necessary for the performance of activities and the timely provision of services, and to deal with peak orders, message or transaction volumes, as needed, including where new technology is introduced;

(d) technologically resilient in order to adequately deal with additional information processing needs as required under stressed market conditions or other adverse situations.

中文参考译文

为应对和管理ICT风险，金融实体应使用并维护保持更新且符合下列条件的ICT系统、协议和工具：

(a) 依第4条所述比例原则，与支持其活动开展的运营规模相适应；

(b) 可靠；

(c) 具备足够容量，准确处理开展活动及及时提供服务所必需的数据，并按需要应对订单、消息或交易量高峰，包括引入新技术的情形；

(d) 具有技术韧性，以适当应对市场承压或其他不利情况下增加的信息处理需要。

第8条 识别 / Article 8 — Identification

展开第8条英中对照

English

1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and their roles and dependencies in relation to ICT risk. Financial entities shall review as needed, and at least yearly, the adequacy of this classification and of any relevant documentation.

2. Financial entities shall, on a continuous basis, identify all sources of ICT risk, in particular the risk exposure to and from other financial entities, and assess cyber threats and ICT vulnerabilities relevant to their ICT supported business functions, information assets and ICT assets. Financial entities shall review on a regular basis, and at least yearly, the risk scenarios impacting them.

3. Financial entities, other than microenterprises, shall perform a risk assessment upon each major change in the network and information system infrastructure, in the processes or procedures affecting their ICT supported business functions, information assets or ICT assets.

4. Financial entities shall identify all information assets and ICT assets, including those on remote sites, network resources and hardware equipment, and shall map those considered critical. They shall map the configuration of the information assets and ICT assets and the links and interdependencies between the different information assets and ICT assets.

5. Financial entities shall identify and document all processes that are dependent on ICT third-party service providers, and shall identify interconnections with ICT third-party service providers that provide services that support critical or important functions.

6. For the purposes of paragraphs 1, 4 and 5, financial entities shall maintain relevant inventories and update them periodically and every time any major change as referred to in paragraph 3 occurs.

7. Financial entities, other than microenterprises, shall on a regular basis, and at least yearly, conduct a specific ICT risk assessment on all legacy ICT systems and, in any case before and after connecting technologies, applications or systems.

中文参考译文

1. 作为第6条第1款所述ICT风险管理框架的一部分，金融实体应识别、分类并充分记录所有由ICT支持的业务功能、角色和责任，支持这些功能的信息资产和ICT资产，以及它们在ICT风险方面的作用和依赖关系。金融实体应按需要且至少每年审查该分类及相关文件的充分性。

2. 金融实体应持续识别所有ICT风险来源，尤其是对其他金融实体及来自其他金融实体的风险敞口，并评估与ICT支持的业务功能、信息资产和ICT资产有关的网络威胁及ICT脆弱性。金融实体应定期且至少每年审查影响自身的风险场景。

3. 微型企业以外的金融实体，每逢网络和信息系统基础设施，或影响ICT支持业务功能、信息资产或ICT资产的流程、程序发生重大变化时，应进行风险评估。

4. 金融实体应识别所有信息资产及ICT资产，包括远程地点的资产、网络资源和硬件设备，并为其中被认为关键的资产建立映射。还应建立信息资产及ICT资产配置，以及不同资产之间联系和相互依赖的映射。

5. 金融实体应识别并记录所有依赖ICT第三方服务提供者的流程，并识别与提供支持关键或重要功能之服务的ICT第三方服务提供者之间的互联。

6. 为适用第1款、第4款和第5款，金融实体应维护有关清单，并定期以及在每次发生第3款所述重大变化时更新。

7. 微型企业以外的金融实体，应定期且至少每年对所有遗留ICT系统开展专门ICT风险评估，并在任何情况下均须在连接技术、应用或系统之前及之后开展评估。

查看法规原文

第9条 防护和预防 / Article 9 — Protection and prevention

展开第9条英中对照

English

1. For the purposes of adequately protecting ICT systems and with a view to organising response measures, financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures.

2. Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, in particular for those supporting critical or important functions, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit.

3. In order to achieve the objectives referred to in paragraph 2, financial entities shall use ICT solutions and processes that are appropriate in accordance with Article 4. Those ICT solutions and processes shall:

(a) ensure the security of the means of transfer of data;

(b) minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity;

(c) prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data;

(d) ensure that data is protected from risks arising from data management, including poor administration, processing-related risks and human error.

4. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall:

(a) develop and document an information security policy defining rules to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers, where applicable;

(b) following a risk-based approach, establish a sound network and infrastructure management structure using appropriate techniques, methods and protocols that may include implementing automated mechanisms to isolate affected information assets in the event of cyber-attacks;

(c) implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof;

(d) implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes;

(e) implement documented policies, procedures and controls for ICT change management, including changes to software, hardware, firmware components, systems or security parameters, that are based on a risk assessment approach and are an integral part of the financial entity’s overall change management process, in order to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner;

(f) have appropriate and comprehensive documented policies for patches and updates.

For the purposes of the first subparagraph, point (b), financial entities shall design the network connection infrastructure in a way that allows it to be instantaneously severed or segmented in order to minimise and prevent contagion, especially for interconnected financial processes.

For the purposes of the first subparagraph, point (e), the ICT change management process shall be approved by appropriate lines of management and shall have specific protocols in place.

中文参考译文

1. 为充分保护ICT系统并组织响应措施，金融实体应持续监测和控制ICT系统及工具的安全与运行，并部署适当ICT安全工具、政策和程序，尽量减少ICT风险对ICT系统的影响。

2. 金融实体应设计、采购和实施ICT安全政策、程序、协议和工具，以确保ICT系统，尤其是支持关键或重要功能系统的韧性、连续性和可用性，并使静态、使用中或传输中的数据均保持高标准的可用性、真实性、完整性和保密性。

3. 为实现第2款目标，金融实体应使用依第4条判断为适当的ICT解决方案及流程。这些方案及流程应：

(a) 确保数据传输手段的安全；

(b) 尽量减少数据损坏或丢失、未经授权访问，以及可能妨碍业务活动的技术缺陷风险；

(c) 防止数据不可用、真实性和完整性受损、保密性遭破坏及数据丢失；

(d) 确保数据免受数据管理产生的风险，包括管理不善、处理相关风险和人为错误。

4. 作为第6条第1款所述ICT风险管理框架的一部分，金融实体应：

(a) 制定并记录信息安全政策，规定保护数据、信息资产和ICT资产的可用性、真实性、完整性及保密性的规则，在适用情况下包括客户的这些资产；

(b) 按照基于风险的方法，使用适当技术、方法和协议建立健全的网络及基础设施管理结构，可包括在网络攻击发生时通过自动化机制隔离受影响信息资产；

(c) 实施政策，将对信息资产及ICT资产的物理或逻辑访问，仅限于合法且经批准的功能和活动所需范围；为此制定一组涉及访问权并确保健全管理访问权的政策、程序和控制措施；

(d) 根据相关标准及专门控制系统，实施强认证机制的政策和协议，以及密码密钥保护措施，使数据按照经批准的数据分类及ICT风险评估流程的结果进行加密；

(e) 实施书面ICT变更管理政策、程序和控制措施，涵盖软件、硬件、固件组件、系统或安全参数变更，以风险评估为基础，并构成实体总体变更管理流程的组成部分，确保ICT系统全部变更均以受控方式记录、测试、评估、批准、实施和验证；

(f) 制定适当、全面且有书面记录的补丁和更新政策。

为适用第一分段(b)项，金融实体应将网络连接基础设施设计为能够立即切断或分段，以尽量减少并防止风险传播，尤其是互联金融流程中的传播。

为适用第一分段(e)项，ICT变更管理流程应由适当管理层级批准，并设置专门协议。

第10条 检测 / Article 10 — Detection

展开第10条英中对照

English

1. Financial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure.

All detection mechanisms referred to in the first subparagraph shall be regularly tested in accordance with Article 25.

2. The detection mechanisms referred to in paragraph 1 shall enable multiple layers of control, define alert thresholds and criteria to trigger and initiate ICT-related incident response processes, including automatic alert mechanisms for relevant staff in charge of ICT-related incident response.

3. Financial entities shall devote sufficient resources and capabilities to monitor user activity, the occurrence of ICT anomalies and ICT-related incidents, in particular cyber-attacks.

4. Data reporting service providers shall, in addition, have in place systems that can effectively check trade reports for completeness, identify omissions and obvious errors, and request re-transmission of those reports.

中文参考译文

1. 金融实体应依第17条建立机制，及时检测异常活动，包括ICT网络性能问题和ICT相关事件，并识别潜在重大单点故障。

第一分段所述全部检测机制应依第25条定期测试。

2. 第1款所述检测机制应支持多层控制，规定触发和启动ICT相关事件响应流程的告警门槛和标准，包括向负责ICT相关事件响应的有关人员自动告警的机制。

3. 金融实体应投入充足资源和能力，监测用户活动、ICT异常及ICT相关事件的发生，尤其是网络攻击。

4. 数据报告服务提供者还应建立系统，能够有效检查交易报告的完整性、识别遗漏和明显错误，并要求重新传送报告。

第11条 响应与恢复 / Article 11 — Response and recovery

展开第11条英中对照

English

1. As part of the ICT risk management framework referred to in Article 6(1) and based on the identification requirements set out in Article 8, financial entities shall put in place a comprehensive ICT business continuity policy, which may be adopted as a dedicated specific policy, forming an integral part of the overall business continuity policy of the financial entity.

2. Financial entities shall implement the ICT business continuity policy through dedicated, appropriate and documented arrangements, plans, procedures and mechanisms aiming to:

(a) ensure the continuity of the financial entity’s critical or important functions;

(b) quickly, appropriately and effectively respond to, and resolve, all ICT-related incidents in a way that limits damage and prioritises the resumption of activities and recovery actions;

(c) activate, without delay, dedicated plans that enable containment measures, processes and technologies suited to each type of ICT-related incident and prevent further damage, as well as tailored response and recovery procedures established in accordance with Article 12;

(d) estimate preliminary impacts, damages and losses;

(e) set out communication and crisis management actions that ensure that updated information is transmitted to all relevant internal staff and external stakeholders in accordance with Article 14, and report to the competent authorities in accordance with Article 19.

3. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall implement associated ICT response and recovery plans which, in the case of financial entities other than microenterprises, shall be subject to independent internal audit reviews.

4. Financial entities shall put in place, maintain and periodically test appropriate ICT business continuity plans, notably with regard to critical or important functions outsourced or contracted through arrangements with ICT third-party service providers.

5. As part of the overall business continuity policy, financial entities shall conduct a business impact analysis (BIA) of their exposures to severe business disruptions. Under the BIA, financial entities shall assess the potential impact of severe business disruptions by means of quantitative and qualitative criteria, using internal and external data and scenario analysis, as appropriate. The BIA shall consider the criticality of identified and mapped business functions, support processes, third-party dependencies and information assets, and their interdependencies. Financial entities shall ensure that ICT assets and ICT services are designed and used in full alignment with the BIA, in particular with regard to adequately ensuring the redundancy of all critical components.

6. As part of their comprehensive ICT risk management, financial entities shall:

(a) test the ICT business continuity plans and the ICT response and recovery plans in relation to ICT systems supporting all functions at least yearly, as well as in the event of any substantive changes to ICT systems supporting critical or important functions;

(b) test the crisis communication plans established in accordance with Article 14.

For the purposes of the first subparagraph, point (a), financial entities, other than microenterprises, shall include in the testing plans scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities necessary to meet the obligations set out in Article 12.

Financial entities shall regularly review their ICT business continuity policy and ICT response and recovery plans, taking into account the results of tests carried out in accordance with the first subparagraph and recommendations stemming from audit checks or supervisory reviews.

7. Financial entities, other than microenterprises, shall have a crisis management function, which, in the event of activation of their ICT business continuity plans or ICT response and recovery plans, shall, inter alia, set out clear procedures to manage internal and external crisis communications in accordance with Article 14.

8. Financial entities shall keep readily accessible records of activities before and during disruption events when their ICT business continuity plans and ICT response and recovery plans are activated.

9. Central securities depositories shall provide the competent authorities with copies of the results of the ICT business continuity tests, or of similar exercises.

10. Financial entities, other than microenterprises, shall report to the competent authorities, upon their request, an estimation of aggregated annual costs and losses caused by major ICT-related incidents.

11. In accordance with Article 16 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, the ESAs, through the Joint Committee, shall by 17 July 2024 develop common guidelines on the estimation of aggregated annual costs and losses referred to in paragraph 10.

中文参考译文

1. 作为第6条第1款所述ICT风险管理框架的一部分，并根据第8条的识别要求，金融实体应建立全面ICT业务连续性政策。该政策可以作为专门政策制定，构成实体总体业务连续性政策的组成部分。

2. 金融实体应通过专门、适当且有书面记录的安排、计划、程序和机制，实施ICT业务连续性政策，以：

(a) 确保金融实体关键或重要功能的连续性；

(b) 以限制损害、优先恢复活动和开展恢复行动的方式，迅速、适当、有效地响应和解决所有ICT相关事件；

(c) 不拖延地启动专门计划，实施适合各类ICT相关事件的遏制措施、流程和技术，防止进一步损害，并启动依第12条建立的针对性响应和恢复程序；

(d) 初步估算影响、损害和损失；

(e) 规定沟通和危机管理行动，确保依第14条向所有有关内部人员和外部利益相关方传达最新信息，并依第19条向主管机关报告。

3. 作为第6条第1款所述ICT风险管理框架的一部分，金融实体应实施相应ICT响应和恢复计划；对微型企业以外的实体，这些计划应接受独立内部审计审查。

4. 金融实体应建立、维护并定期测试适当ICT业务连续性计划，尤其涉及通过与ICT第三方服务提供者的安排外包或订约提供的关键或重要功能。

5. 作为总体业务连续性政策的一部分，金融实体应对其严重业务中断风险敞口开展业务影响分析（BIA）。在BIA中，应适当使用内部和外部数据及场景分析，通过定量和定性标准评估严重业务中断的潜在影响。BIA应考虑已识别并建立映射的业务功能、支持流程、第三方依赖和信息资产的关键程度，以及它们的相互依赖。实体应确保ICT资产及服务的设计和使用与BIA完全一致，尤其应充分确保所有关键组件的冗余。

6. 作为全面ICT风险管理的一部分，金融实体应：

(a) 至少每年测试与支持全部功能的ICT系统有关的ICT业务连续性计划、ICT响应和恢复计划；支持关键或重要功能的ICT系统发生任何实质变化时，也应开展测试；

(b) 测试依第14条建立的危机沟通计划。

为适用第一分段(a)项，微型企业以外的金融实体应在测试计划中纳入网络攻击场景，以及主要ICT基础设施与为满足第12条义务所需的冗余容量、备份及冗余设施之间的切换场景。

金融实体应定期审查ICT业务连续性政策及ICT响应和恢复计划，考虑依第一分段开展测试的结果，以及审计检查或监管审查提出的建议。

7. 微型企业以外的金融实体应设置危机管理职能；在启动ICT业务连续性计划或ICT响应和恢复计划时，该职能除其他任务外，还应依第14条规定管理内部及外部危机沟通的明确程序。

8. ICT业务连续性计划和ICT响应及恢复计划启动时，金融实体应保存中断事件发生前及期间活动的记录，并确保记录易于获取。

9. 中央证券存管机构应向主管机关提供ICT业务连续性测试或类似演练结果的副本。

10. 微型企业以外的金融实体应主管机关要求，应报告重大ICT相关事件导致的年度成本和损失总额估算。

11. 欧洲监管当局应依条例（EU）第1093/2010号、第1094/2010号及第1095/2010号第16条，通过联合委员会在2024年7月17日前，就第10款所述年度成本和损失总额估算制定共同指南。

第12条 备份政策与程序、还原和恢复程序及方法 / Article 12 — Backup policies and procedures, restoration and recovery procedures and methods

展开第12条英中对照

English

1. For the purpose of ensuring the restoration of ICT systems and data with minimum downtime, limited disruption and loss, as part of their ICT risk management framework, financial entities shall develop and document:

(a) backup policies and procedures specifying the scope of the data that is subject to the backup and the minimum frequency of the backup, based on the criticality of information or the confidentiality level of the data;

(b) restoration and recovery procedures and methods.

2. Financial entities shall set up backup systems that can be activated in accordance with the backup policies and procedures, as well as restoration and recovery procedures and methods. The activation of backup systems shall not jeopardise the security of the network and information systems or the availability, authenticity, integrity or confidentiality of data. Testing of the backup procedures and restoration and recovery procedures and methods shall be undertaken periodically.

3. When restoring backup data using own systems, financial entities shall use ICT systems that are physically and logically segregated from the source ICT system. The ICT systems shall be securely protected from any unauthorised access or ICT corruption and allow for the timely restoration of services making use of data and system backups as necessary.

For central counterparties, the recovery plans shall enable the recovery of all transactions at the time of disruption to allow the central counterparty to continue to operate with certainty and to complete settlement on the scheduled date.

Data reporting service providers shall additionally maintain adequate resources and have back-up and restoration facilities in place in order to offer and maintain their services at all times.

4. Financial entities, other than microenterprises, shall maintain redundant ICT capacities equipped with resources, capabilities and functions that are adequate to ensure business needs. Microenterprises shall assess the need to maintain such redundant ICT capacities based on their risk profile.

5. Central securities depositories shall maintain at least one secondary processing site endowed with adequate resources, capabilities, functions and staffing arrangements to ensure business needs.

The secondary processing site shall be:

(a) located at a geographical distance from the primary processing site to ensure that it bears a distinct risk profile and to prevent it from being affected by the event which has affected the primary site;

(b) capable of ensuring the continuity of critical or important functions identically to the primary site, or providing the level of services necessary to ensure that the financial entity performs its critical operations within the recovery objectives;

(c) immediately accessible to the financial entity’s staff to ensure continuity of critical or important functions in the event that the primary processing site has become unavailable.

6. In determining the recovery time and recovery point objectives for each function, financial entities shall take into account whether it is a critical or important function and the potential overall impact on market efficiency. Such time objectives shall ensure that, in extreme scenarios, the agreed service levels are met.

7. When recovering from an ICT-related incident, financial entities shall perform necessary checks, including any multiple checks and reconciliations, in order to ensure that the highest level of data integrity is maintained. These checks shall also be performed when reconstructing data from external stakeholders, in order to ensure that all data is consistent between systems.

中文参考译文

1. 为确保以尽可能短的停机时间、有限中断和损失还原ICT系统及数据，作为ICT风险管理框架的一部分，金融实体应制定并记录：

(a) 备份政策及程序，根据信息关键程度或数据保密等级，明确备份数据范围和最低备份频率；

(b) 还原和恢复程序及方法。

2. 金融实体应设置能够依备份政策和程序，以及还原和恢复程序及方法启动的备份系统。启动备份系统不得危及网络和信息系统安全，或者数据的可用性、真实性、完整性或保密性。应定期测试备份程序及还原和恢复程序与方法。

3. 使用自有系统还原备份数据时，金融实体应使用与源ICT系统在物理和逻辑上隔离的ICT系统。这些系统应得到安全保护，免受任何未授权访问或ICT损坏，并能够按需要利用数据和系统备份及时还原服务。

对于中央交易对手，恢复计划应能够恢复中断时的全部交易，使中央交易对手能够确定地继续运营，并在预定日期完成结算。

数据报告服务提供者还应保持充分资源并设置备份和还原设施，以随时提供和维持其服务。

4. 微型企业以外的金融实体，应维持配备充分资源、能力和功能的冗余ICT容量，以满足业务需要。微型企业应根据自身风险状况评估维持这种冗余ICT容量的需要。

5. 中央证券存管机构应维持至少一个辅助处理地点，配备充分资源、能力、功能及人员安排，以满足业务需要。

辅助处理地点应：

(a) 与主要处理地点保持地理距离，确保其风险状况不同，防止受到影响主要地点的同一事件波及；

(b) 能够与主要地点相同地确保关键或重要功能连续，或者提供使金融实体在恢复目标内执行关键操作所需的服务水平；

(c) 在主要处理地点不可用时，金融实体人员能够立即访问，以确保关键或重要功能连续。

6. 为各项功能确定恢复时间和恢复点目标时，金融实体应考虑其是否属于关键或重要功能，以及对市场效率的潜在整体影响。上述时间目标应确保在极端场景下达到约定服务水平。

7. 从ICT相关事件中恢复时，金融实体应进行必要检查，包括所需的多重检查和核对，以确保维持最高水平的数据完整性。从外部利益相关方重建数据时，也应进行这些检查，以确保系统之间全部数据一致。

查看法规原文

第13条 学习与演进 / Article 13 — Learning and evolving

展开第13条英中对照

English

1. Financial entities shall have in place capabilities and staff to gather information on vulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse the impact they are likely to have on their digital operational resilience.

2. Financial entities shall put in place post ICT-related incident reviews after a major ICT-related incident disrupts their core activities, analysing the causes of disruption and identifying required improvements to the ICT operations or within the ICT business continuity policy referred to in Article 11.

Financial entities, other than microenterprises, shall, upon request, communicate to the competent authorities, the changes that were implemented following post ICT-related incident reviews as referred to in the first subparagraph.

The post ICT-related incident reviews referred to in the first subparagraph shall determine whether the established procedures were followed and the actions taken were effective, including in relation to the following:

(a) the promptness in responding to security alerts and determining the impact of ICT-related incidents and their severity;

(b) the quality and speed of performing a forensic analysis, where deemed appropriate;

(c) the effectiveness of incident escalation within the financial entity;

(d) the effectiveness of internal and external communication.

3. Lessons derived from the digital operational resilience testing carried out in accordance with Articles 26 and 27 and from real life ICT-related incidents, in particular cyber-attacks, along with challenges faced upon the activation of ICT business continuity plans and ICT response and recovery plans, together with relevant information exchanged with counterparts and assessed during supervisory reviews, shall be duly incorporated on a continuous basis into the ICT risk assessment process. Those findings shall form the basis for appropriate reviews of relevant components of the ICT risk management framework referred to in Article 6(1).

4. Financial entities shall monitor the effectiveness of the implementation of their digital operational resilience strategy set out in Article 6(8). They shall map the evolution of ICT risk over time, analyse the frequency, types, magnitude and evolution of ICT-related incidents, in particular cyber-attacks and their patterns, with a view to understanding the level of ICT risk exposure, in particular in relation to critical or important functions, and enhance the cyber maturity and preparedness of the financial entity.

5. Senior ICT staff shall report at least yearly to the management body on the findings referred to in paragraph 3 and put forward recommendations.

6. Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions. Where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i).

7. Financial entities, other than microenterprises, shall monitor relevant technological developments on a continuous basis, also with a view to understanding the possible impact of the deployment of such new technologies on ICT security requirements and digital operational resilience. They shall keep up-to-date with the latest ICT risk management processes, in order to effectively combat current or new forms of cyber-attacks.

中文参考译文

1. 金融实体应具备收集脆弱性、网络威胁及ICT相关事件，尤其是网络攻击信息的能力和人员，并分析这些事项可能对自身数字运营韧性造成的影响。

2. 重大ICT相关事件中断核心活动后，金融实体应开展ICT相关事件事后审查，分析中断原因，识别ICT运营或第11条所述ICT业务连续性政策需要改进之处。

微型企业以外的金融实体应要求，应将第一分段所述事后审查后实施的变更告知主管机关。

第一分段所述事后审查应确定是否遵守既定程序，以及所采取行动是否有效，包括：

(a) 响应安全告警、判断ICT相关事件影响和严重程度的及时性；

(b) 在认为适当时，开展取证分析的质量与速度；

(c) 金融实体内部事件升级的有效性；

(d) 内部和外部沟通的有效性。

3. 应持续、适当地将依第26条和第27条开展数字运营韧性测试、实际ICT相关事件尤其是网络攻击所取得的经验教训，启动ICT业务连续性计划及ICT响应和恢复计划时面临的挑战，以及与交易对手交换并在监管审查中评估的相关信息，纳入ICT风险评估流程。这些发现应成为适当审查第6条第1款所述ICT风险管理框架相关组成部分的基础。

4. 金融实体应监测第6条第8款所定数字运营韧性战略实施的有效性，描绘ICT风险随时间变化的情况，分析ICT相关事件，尤其是网络攻击及其模式的频率、类型、规模和演变，以了解ICT风险敞口水平，特别是关键或重要功能相关敞口，并提高实体网络安全成熟度及准备程度。

5. 高级ICT人员应至少每年向管理机构报告第3款所述发现并提出建议。

6. 金融实体应制定ICT安全意识方案和数字运营韧性培训，作为员工培训计划的必修模块。这些方案及培训适用于全体员工和高级管理人员，其复杂程度应与各自职能范围相称。在适当情况下，金融实体还应依第30条第2款(i)项，将ICT第三方服务提供者纳入相关培训计划。

7. 微型企业以外的金融实体应持续监测相关技术发展，以了解部署新技术对ICT安全要求及数字运营韧性的可能影响，并及时掌握最新ICT风险管理流程，以有效应对现有或新形式的网络攻击。

第14条 沟通 / Article 14 — Communication

展开第14条英中对照

English

1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate.

2. As part of the ICT risk management framework, financial entities shall implement communication policies for internal staff and for external stakeholders. Communication policies for staff shall take into account the need to differentiate between staff involved in ICT risk management, in particular the staff responsible for response and recovery, and staff that needs to be informed.

3. At least one person in the financial entity shall be tasked with implementing the communication strategy for ICT-related incidents and fulfil the public and media function for that purpose.

中文参考译文

1. 作为第6条第1款所述ICT风险管理框架的一部分，金融实体应制定危机沟通计划，使其能够适当地向客户、交易对手及公众负责任地披露至少重大ICT相关事件或脆弱性。

2. 作为ICT风险管理框架的一部分，金融实体应实施面向内部人员及外部利益相关方的沟通政策。员工沟通政策应考虑区分参与ICT风险管理的人员，特别是负责响应和恢复的人员，与需要获知情况的人员。

3. 金融实体应至少指定一人实施ICT相关事件沟通战略，并为此履行公众和媒体沟通职能。

第15条 进一步协调ICT风险管理工具、方法、流程和政策 / Article 15 — Further harmonisation of ICT risk management tools, methods, processes and policies

展开第15条英中对照

English

The ESAs shall, through the Joint Committee, in consultation with the European Union Agency on Cybersecurity (ENISA), develop common draft regulatory technical standards in order to:

(a) specify further elements to be included in the ICT security policies, procedures, protocols and tools referred to in Article 9(2), with a view to ensuring the security of networks, enable adequate safeguards against intrusions and data misuse, preserve the availability, authenticity, integrity and confidentiality of data, including cryptographic techniques, and guarantee an accurate and prompt data transmission without major disruptions and undue delays;

(b) develop further components of the controls of access management rights referred to in Article 9(4), point (c), and associated human resource policy specifying access rights, procedures for granting and revoking rights, monitoring anomalous behaviour in relation to ICT risk through appropriate indicators, including for network use patterns, hours, IT activity and unknown devices;

(c) develop further the mechanisms specified in Article 10(1) enabling a prompt detection of anomalous activities and the criteria set out in Article 10(2) triggering ICT-related incident detection and response processes;

(d) specify further the components of the ICT business continuity policy referred to in Article 11(1);

(e) specify further the testing of ICT business continuity plans referred to in Article 11(6) to ensure that such testing duly takes into account scenarios in which the quality of the provision of a critical or important function deteriorates to an unacceptable level or fails, and duly considers the potential impact of the insolvency, or other failures, of any relevant ICT third-party service provider and, where relevant, the political risks in the respective providers’ jurisdictions;

(f) specify further the components of the ICT response and recovery plans referred to in Article 11(3);

(g) specifying further the content and format of the report on the review of the ICT risk management framework referred to in Article 6(5);

When developing those draft regulatory technical standards, the ESAs shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations, while duly taking into consideration any specific feature arising from the distinct nature of activities across different financial services sectors.

The ESAs shall submit those draft regulatory technical standards to the Commission by 17 January 2024.

Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first paragraph in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

中文参考译文

欧洲监管当局应通过联合委员会，在征询欧盟网络安全局（ENISA）意见后，制定共同监管技术标准草案，以：

(a) 进一步明确第9条第2款所述ICT安全政策、程序、协议及工具应包含的要素，确保网络安全，对入侵和数据滥用提供充分保障，保持数据可用性、真实性、完整性及保密性，包括密码技术，并保障数据准确、及时传输，避免重大中断和不当延迟；

(b) 进一步制定第9条第4款(c)项所述访问权管理控制的组成部分及相关人力资源政策，明确访问权、授予及撤销权限程序，通过适当指标监测ICT风险相关异常行为，包括网络使用模式、时段、IT活动及未知设备指标；

(c) 进一步制定第10条第1款所定及时检测异常活动的机制，以及第10条第2款所定触发ICT相关事件检测和响应流程的标准；

(d) 进一步明确第11条第1款所述ICT业务连续性政策的组成部分；

(e) 进一步明确第11条第6款所述ICT业务连续性计划测试，确保充分考虑关键或重要功能提供质量降至不可接受水平或失效的场景，充分考虑有关ICT第三方服务提供者破产或其他失效的潜在影响，并在相关情况下考虑其所在司法管辖区的政治风险；

(f) 进一步明确第11条第3款所述ICT响应和恢复计划的组成部分；

(g) 进一步明确第6条第5款所述ICT风险管理框架审查报告的内容和格式。

制定上述监管技术标准草案时，欧洲监管当局应考虑金融实体的规模、整体风险状况，以及服务、活动和运营的性质、范围及复杂性，并充分考虑不同金融服务行业活动性质差异所产生的任何特殊特征。

欧洲监管当局应在2024年1月17日前将上述草案提交委员会。

授权委员会依条例（EU）第1093/2010号、第1094/2010号和第1095/2010号第10至14条，通过第一段所述监管技术标准，补充本条例。

第16条 简化ICT风险管理框架 / Article 16 — Simplified ICT risk management framework

展开第16条英中对照

English

1. Articles 5 to 15 of this Regulation shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366; institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in Article 2(4) of this Regulation; electronic money institutions exempted pursuant to Directive 2009/110/EC; and small institutions for occupational retirement provision.

Without prejudice to the first subparagraph, the entities listed in the first subparagraph shall:

(a) put in place and maintain a sound and documented ICT risk management framework that details the mechanisms and measures aimed at a quick, efficient and comprehensive management of ICT risk, including for the protection of relevant physical components and infrastructures;

(b) continuously monitor the security and functioning of all ICT systems;

(c) minimise the impact of ICT risk through the use of sound, resilient and updated ICT systems, protocols and tools which are appropriate to support the performance of their activities and the provision of services and adequately protect availability, authenticity, integrity and confidentiality of data in the network and information systems;

(d) allow sources of ICT risk and anomalies in the network and information systems to be promptly identified and detected and ICT-related incidents to be swiftly handled;

(e) identify key dependencies on ICT third-party service providers;

(f) ensure the continuity of critical or important functions, through business continuity plans and response and recovery measures, which include, at least, back-up and restoration measures;

(g) test, on a regular basis, the plans and measures referred to in point (f), as well as the effectiveness of the controls implemented in accordance with points (a) and (c);

(h) implement, as appropriate, relevant operational conclusions resulting from the tests referred to in point (g) and from post-incident analysis into the ICT risk assessment process and develop, according to needs and ICT risk profile, ICT security awareness programmes and digital operational resilience training for staff and management.

2. The ICT risk management framework referred to in paragraph 1, second subparagraph, point (a), shall be documented and reviewed periodically and upon the occurrence of major ICT-related incidents in compliance with supervisory instructions. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A report on the review of the ICT risk management framework shall be submitted to the competent authority upon its request.

3. The ESAs shall, through the Joint Committee, in consultation with the ENISA, develop common draft regulatory technical standards in order to:

(a) specify further the elements to be included in the ICT risk management framework referred to in paragraph 1, second subparagraph, point (a);

(b) specify further the elements in relation to systems, protocols and tools to minimise the impact of ICT risk referred to in paragraph 1, second subparagraph, point (c), with a view to ensuring the security of networks, enabling adequate safeguards against intrusions and data misuse and preserving the availability, authenticity, integrity and confidentiality of data;

(c) specify further the components of the ICT business continuity plans referred to in paragraph 1, second subparagraph, point (f);

(d) specify further the rules on the testing of business continuity plans and ensure the effectiveness of the controls referred to in paragraph 1, second subparagraph, point (g) and ensure that such testing duly takes into account scenarios in which the quality of the provision of a critical or important function deteriorates to an unacceptable level or fails;

(e) specify further the content and format of the report on the review of the ICT risk management framework referred to in paragraph 2.

When developing those draft regulatory technical standards, the ESAs shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations.

The ESAs shall submit those draft regulatory technical standards to the Commission by 17 January 2024.

Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

中文参考译文

1. 本条例第5至15条不适用于小型且非互联的投资公司；依据指令（EU）2015/2366获豁免的支付机构；依据指令2013/36/EU获豁免、且成员国决定不行使本条例第2条第4款所述选择权的机构；依据指令2009/110/EC获豁免的电子货币机构；以及小型职业退休金机构。

在不影响第一分段的前提下，该分段所列实体应：

(a) 建立并维持健全、有书面记录的ICT风险管理框架，详细规定迅速、高效和全面管理ICT风险的机制及措施，包括保护有关物理组件和基础设施；

(b) 持续监测全部ICT系统的安全与运行；

(c) 使用健全、有韧性且保持更新的ICT系统、协议和工具，尽量减少ICT风险影响；这些系统、协议和工具应能够适当支持活动开展和服务提供，充分保护网络和信息系统中数据的可用性、真实性、完整性及保密性；

(d) 使ICT风险来源及网络和信息系统中的异常能够被及时识别和检测，ICT相关事件能够被迅速处理；

(e) 识别对ICT第三方服务提供者的关键依赖；

(f) 通过至少包含备份及还原措施的业务连续性计划、响应和恢复措施，确保关键或重要功能连续；

(g) 定期测试(f)项所述计划和措施，以及依(a)项和(c)项实施控制的有效性；

(h) 适当地将(g)项测试及事件事后分析得出的有关运营结论纳入ICT风险评估流程，并根据需要及ICT风险状况，为员工和管理层制定ICT安全意识方案与数字运营韧性培训。

2. 第1款第二分段(a)项所述ICT风险管理框架应予记录，并按照监管指示定期以及在发生重大ICT相关事件时审查。应根据实施和监测中的经验教训持续改进。应主管机关要求，应提交ICT风险管理框架审查报告。

3. 欧洲监管当局应通过联合委员会，在征询ENISA意见后，制定共同监管技术标准草案，以：

(a) 进一步明确第1款第二分段(a)项所述ICT风险管理框架应包含的要素；

(b) 进一步明确第1款第二分段(c)项所述用于减少ICT风险影响的系统、协议和工具相关要素，以确保网络安全，充分防范入侵和数据滥用，维护数据可用性、真实性、完整性及保密性；

(c) 进一步明确第1款第二分段(f)项所述ICT业务连续性计划的组成部分；

(d) 进一步明确业务连续性计划测试规则，确保第1款第二分段(g)项所述控制有效，并确保测试充分考虑关键或重要功能提供质量降至不可接受水平或失效的场景；

(e) 进一步明确第2款所述ICT风险管理框架审查报告的内容和格式。

制定这些监管技术标准草案时，欧洲监管当局应考虑金融实体规模、整体风险状况，以及服务、活动和运营的性质、范围及复杂性。

欧洲监管当局应在2024年1月17日前将草案提交委员会。

授权委员会依条例（EU）第1093/2010号、第1094/2010号和第1095/2010号第10至14条，通过第一分段所述监管技术标准，补充本条例。

查看法规原文

第三章 ICT相关事件管理、分类和报告 / CHAPTER III — ICT-related incident management, classification and reporting

第17条 ICT相关事件管理流程 / Article 17 — ICT-related incident management process

展开第17条英中对照

English

1. Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents.

2. Financial entities shall record all ICT-related incidents and significant cyber threats. Financial entities shall establish appropriate procedures and processes to ensure a consistent and integrated monitoring, handling and follow-up of ICT-related incidents, to ensure that root causes are identified, documented and addressed in order to prevent the occurrence of such incidents.

3. The ICT-related incident management process referred to in paragraph 1 shall:

(a) put in place early warning indicators;

(b) establish procedures to identify, track, log, categorise and classify ICT-related incidents according to their priority and severity and according to the criticality of the services impacted, in accordance with the criteria set out in Article 18(1);

(c) assign roles and responsibilities that need to be activated for different ICT-related incident types and scenarios;

(d) set out plans for communication to staff, external stakeholders and media in accordance with Article 14 and for notification to clients, for internal escalation procedures, including ICT-related customer complaints, as well as for the provision of information to financial entities that act as counterparts, as appropriate;

(e) ensure that at least major ICT-related incidents are reported to relevant senior management and inform the management body of at least major ICT-related incidents, explaining the impact, response and additional controls to be established as a result of such ICT-related incidents;

(f) establish ICT-related incident response procedures to mitigate impacts and ensure that services become operational and secure in a timely manner.

中文参考译文

1. 金融实体应确定、建立和实施ICT相关事件管理流程，以检测、管理和通知ICT相关事件。

2. 金融实体应记录所有ICT相关事件及重大网络威胁，建立适当程序和流程，确保对ICT相关事件进行一致、综合的监测、处理及跟进，确保识别、记录并解决根本原因，以防止此类事件发生。

3. 第1款所述ICT相关事件管理流程应：

(a) 设置预警指标；

(b) 依第18条第1款所定标准，建立按照事件优先级、严重程度及受影响服务关键程度，对ICT相关事件进行识别、跟踪、记录、分类和分级的程序；

(c) 分配在不同ICT相关事件类型和场景下需要启动的角色与责任；

(d) 制定依第14条向员工、外部利益相关方及媒体沟通、向客户通知的计划，制定包括ICT相关客户投诉在内的内部升级程序，以及适当向作为交易对手的金融实体提供信息的计划；

(e) 确保至少将重大ICT相关事件报告有关高级管理层，并至少将重大ICT相关事件告知管理机构，说明事件影响、响应及由此需要建立的额外控制措施；

(f) 建立ICT相关事件响应程序，缓解影响并确保服务及时恢复运行和安全。

第18条 ICT相关事件及网络威胁分类 / Article 18 — Classification of ICT-related incidents and cyber threats

展开第18条英中对照

English

1. Financial entities shall classify ICT-related incidents and shall determine their impact based on the following criteria:

(a) the number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the ICT-related incident, and whether the ICT-related incident has caused reputational impact;

(b) the duration of the ICT-related incident, including the service downtime;

(c) the geographical spread with regard to the areas affected by the ICT-related incident, particularly if it affects more than two Member States;

(d) the data losses that the ICT-related incident entails, in relation to availability, authenticity, integrity or confidentiality of data;

(e) the criticality of the services affected, including the financial entity’s transactions and operations;

(f) the economic impact, in particular direct and indirect costs and losses, of the ICT-related incident in both absolute and relative terms.

2. Financial entities shall classify cyber threats as significant based on the criticality of the services at risk, including the financial entity’s transactions and operations, number and/or relevance of clients or financial counterparts targeted and the geographical spread of the areas at risk.

3. The ESAs shall, through the Joint Committee and in consultation with the ECB and ENISA, develop common draft regulatory technical standards further specifying the following:

(a) the criteria set out in paragraph 1, including materiality thresholds for determining major ICT-related incidents or, as applicable, major operational or security payment-related incidents, that are subject to the reporting obligation laid down in Article 19(1);

(b) the criteria to be applied by competent authorities for the purpose of assessing the relevance of major ICT-related incidents or, as applicable, major operational or security payment-related incidents, to relevant competent authorities in other Member States’, and the details of reports of major ICT-related incidents or, as applicable, major operational or security payment-related incidents, to be shared with other competent authorities pursuant to Article 19(6) and (7);

(c) the criteria set out in paragraph 2 of this Article, including high materiality thresholds for determining significant cyber threats.

4. When developing the common draft regulatory technical standards referred to in paragraph 3 of this Article, the ESAs shall take into account the criteria set out in Article 4(2), as well as international standards, guidance and specifications developed and published by ENISA, including, where appropriate, specifications for other economic sectors.

For the purposes of applying the criteria set out in Article 4(2), the ESAs shall duly consider the need for microenterprises and small and medium-sized enterprises to mobilise sufficient resources and capabilities to ensure that ICT-related incidents are managed swiftly.

The ESAs shall submit those common draft regulatory technical standards to the Commission by 17 January 2024.

Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in paragraph 3 in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

中文参考译文

1. 金融实体应对ICT相关事件进行分类，并按下列标准确定其影响：

(a) 受影响客户或金融交易对手的数量和／或重要性，在适用情况下事件影响的交易金额或数量，以及事件是否造成声誉影响；

(b) ICT相关事件持续时间，包括服务停机时间；

(c) 事件影响区域的地理分布，尤其是影响超过两个成员国的情形；

(d) 事件在数据可用性、真实性、完整性或保密性方面造成的数据损失；

(e) 受影响服务的关键程度，包括金融实体交易及运营；

(f) 以绝对及相对数值衡量的事件经济影响，特别是直接和间接成本及损失。

2. 金融实体应根据面临风险服务的关键程度，包括实体交易及运营，目标客户或金融交易对手的数量和／或重要性，以及风险区域的地理分布，将网络威胁划分为重大威胁。

3. 欧洲监管当局应通过联合委员会，在征询ECB及ENISA意见后制定共同监管技术标准草案，进一步明确：

(a) 第1款所定标准，包括确定适用第19条第1款报告义务的重大ICT相关事件，或者在适用情况下重大支付相关操作或安全事件的重大性阈值；

(b) 主管机关评估重大ICT相关事件，或者在适用情况下重大支付相关操作或安全事件，与其他成员国有关主管机关的相关性时所适用标准，以及依第19条第6款和第7款与其他主管机关共享的上述事件报告详情；

(c) 本条第2款所定标准，包括确定重大网络威胁的高重大性阈值。

4. 制定本条第3款所述共同监管技术标准草案时，欧洲监管当局应考虑第4条第2款标准，以及国际标准和ENISA制定、公布的指南与规范，在适当情况下包括其他经济部门的规范。

为适用第4条第2款标准，欧洲监管当局应充分考虑微型、小型和中型企业调动足够资源和能力以迅速管理ICT相关事件的需要。

欧洲监管当局应在2024年1月17日前将上述草案提交委员会。

授权委员会依条例（EU）第1093/2010号、第1094/2010号和第1095/2010号第10至14条，通过第3款所述监管技术标准，补充本条例。

第19条 重大ICT相关事件报告及重大网络威胁自愿通知 / Article 19 — Reporting of major ICT-related incidents and voluntary notification of significant cyber threats

展开第19条英中对照

English

1. Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article.

Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying out the functions and duties provided for in this Article.

Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall report major ICT-related incidents to the relevant national competent authority designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit that report to the ECB.

For the purpose of the first subparagraph, financial entities shall produce, after collecting and analysing all relevant information, the initial notification and reports referred to in paragraph 4 of this Article using the templates referred to in Article 20 and submit them to the competent authority. In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entities shall notify the competent authority about it via alternative means.

The initial notification and reports referred to in paragraph 4 shall include all information necessary for the competent authority to determine the significance of the major ICT-related incident and assess possible cross-border impacts.

Without prejudice to the reporting pursuant to the first subparagraph by the financial entity to the relevant competent authority, Member States may additionally determine that some or all financial entities shall also provide the initial notification and each report referred to in paragraph 4 of this Article using the templates referred to in Article 20 to the competent authorities or the computer security incident response teams (CSIRTs) designated or established in accordance with Directive (EU) 2022/2555.

2. Financial entities may, on a voluntary basis, notify significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.

Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, may, on a voluntary basis, notify significant cyber threats to relevant national competent authority, designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit the notification to the ECB.

Member States may determine that those financial entities that on a voluntary basis notify in accordance with the first subparagraph may also transmit that notification to the CSIRTs designated or established in accordance with Directive (EU) 2022/2555.

3. Where a major ICT-related incident occurs and has an impact on the financial interests of clients, financial entities shall, without undue delay as soon as they become aware of it, inform their clients about the major ICT-related incident and about the measures that have been taken to mitigate the adverse effects of such incident.

In the case of a significant cyber threat, financial entities shall, where applicable, inform their clients that are potentially affected of any appropriate protection measures which the latter may consider taking.

4. Financial entities shall, within the time limits to be laid down in accordance with Article 20, first paragraph, point (a), point (ii), submit the following to the relevant competent authority:

(a) an initial notification;

(b) an intermediate report after the initial notification referred to in point (a), as soon as the status of the original incident has changed significantly or the handling of the major ICT-related incident has changed based on new information available, followed, as appropriate, by updated notifications every time a relevant status update is available, as well as upon a specific request of the competent authority;

(c) a final report, when the root cause analysis has been completed, regardless of whether mitigation measures have already been implemented, and when the actual impact figures are available to replace estimates.

5. Financial entities may outsource, in accordance with Union and national sectoral law, the reporting obligations under this Article to a third-party service provider. In case of such outsourcing, the financial entity remains fully responsible for the fulfilment of the incident reporting requirements.

6. Upon receipt of the initial notification and of each report referred to in paragraph 4, the competent authority shall, in a timely manner, provide details of the major ICT-related incident to the following recipients based, as applicable, on their respective competences:

(a) EBA, ESMA or EIOPA;

(b) the ECB, in the case of financial entities referred to in Article 2(1), points (a), (b) and (d);

(c) the competent authorities, single points of contact or CSIRTs designated or established in accordance with Directive (EU) 2022/2555;

(d) the resolution authorities, as referred to in Article 3 of Directive 2014/59/EU, and the Single Resolution Board (SRB) with respect to entities referred to in Article 7(2) of Regulation (EU) No 806/2014 of the European Parliament and of the Council (37), and with respect to entities and groups referred to in Article 7(4)(b) and (5) of Regulation (EU) No 806/2014 if such details concern incidents that pose a risk to ensuring critical functions within the meaning of Article 2(1), point (35), of Directive 2014/59/EU; and

(e) other relevant public authorities under national law.

7. Following receipt of information in accordance with paragraph 6, EBA, ESMA or EIOPA and the ECB, in consultation with ENISA and in cooperation with the relevant competent authority, shall assess whether the major ICT-related incident is relevant for competent authorities in other Member States. Following that assessment, EBA, ESMA or EIOPA shall, as soon as possible, notify relevant competent authorities in other Member States accordingly. The ECB shall notify the members of the European System of Central Banks on issues relevant to the payment system. Based on that notification, the competent authorities shall, where appropriate, take all of the necessary measures to protect the immediate stability of the financial system.

8. The notification to be done by ESMA pursuant to paragraph 7 of this Article shall be without prejudice to the responsibility of the competent authority to urgently transmit the details of the major ICT-related incident to the relevant authority in the host Member State, where a central securities depository has significant cross-border activity in the host Member State, the major ICT-related incident is likely to have severe consequences for the financial markets of the host Member State and where there are cooperation arrangements among competent authorities related to the supervision of financial entities.

中文参考译文

1. 金融实体应依本条第4款，向第46条所述有关主管机关报告重大ICT相关事件。

金融实体受第46条所述一个以上本国主管机关监管时，成员国应指定一个主管机关，负责履行本条规定的职能和职责。

依条例（EU）第1024/2013号第6条第4款被划为重要机构的信贷机构，应向依指令2013/36/EU第4条指定的有关本国主管机关报告重大ICT相关事件，后者应立即将报告转送ECB。

为适用第一分段，金融实体收集和分析全部相关信息后，应使用第20条所述模板，编制本条第4款所述初始通知和报告并提交主管机关。因技术上无法实现而不能使用模板提交初始通知时，应通过替代方式向主管机关通知有关情况。

第4款所述初始通知和报告应包含主管机关确定重大ICT相关事件重要程度及评估可能跨境影响所必需的全部信息。

在不影响金融实体依第一分段向有关主管机关报告的前提下，成员国还可以规定，部分或全部金融实体也应使用第20条模板，将本条第4款所述初始通知和每份报告，提供给依指令（EU）2022/2555指定或设立的主管机关或计算机安全事件响应团队（CSIRTs）。

2. 金融实体认为重大网络威胁与金融体系、服务使用者或客户有关时，可以自愿向有关主管机关通知。该机关可以向第6款所述其他有关机关提供这些信息。

依条例（EU）第1024/2013号第6条第4款被划为重要机构的信贷机构，可以自愿向依指令2013/36/EU第4条指定的有关本国主管机关通知重大网络威胁，后者应立即将通知转送ECB。

成员国可以规定，依第一分段自愿通知的金融实体，也可以将通知传送依指令（EU）2022/2555指定或设立的CSIRTs。

3. 重大ICT相关事件发生并影响客户经济利益时，金融实体应在知悉后尽快且不无故拖延地告知客户事件情况，以及为缓解不利影响已经采取的措施。

出现重大网络威胁时，金融实体应在适用情况下，向可能受影响客户告知其可以考虑采取的适当保护措施。

4. 金融实体应在依第20条第一段(a)项(ii)目规定的时限内，向有关主管机关提交：

(a) 初始通知；

(b) 在(a)项初始通知之后，一旦原事件状态发生重大变化，或者根据获得的新信息对重大ICT相关事件的处理发生变化，即提交中间报告；此后，在每次有相关状态更新时，以及应主管机关具体要求时，适当提交更新通知；

(c) 在完成根本原因分析，且已有实际影响数字可替代估算时提交最终报告，无论缓解措施是否已经实施。

5. 金融实体可以依欧盟及各国行业法律，将本条报告义务外包给第三方服务提供者。此类外包不改变金融实体对履行事件报告要求承担的全部责任。

6. 主管机关收到第4款所述初始通知和每份报告后，应按适用情况及下列接收方各自权限，及时向其提供重大ICT相关事件详情：

(a) EBA、ESMA或EIOPA；

(b) 涉及第2条第1款(a)、(b)及(d)项金融实体时，提供给ECB；

(c) 依指令（EU）2022/2555指定或设立的主管机关、单一联络点或CSIRTs；

(d) 指令2014/59/EU第3条所述处置当局；涉及欧洲议会和理事会条例（EU）第806/2014号(37)第7条第2款所述实体，以及该条例第7条第4款(b)项和第5款所述实体与集团时，还包括单一处置委员会（SRB），前提是详情涉及的事件危及指令2014/59/EU第2条第1款第(35)项意义上关键功能的保障；以及

(e) 国内法规定的其他有关公共机关。

7. 依第6款收到信息后，EBA、ESMA或EIOPA及ECB应在征询ENISA意见并与有关主管机关合作的情况下，评估重大ICT相关事件是否与其他成员国主管机关有关。完成评估后，EBA、ESMA或EIOPA应尽快相应通知其他成员国有关主管机关。ECB应就支付系统相关事项通知欧洲中央银行体系成员。主管机关应根据该通知，在适当情况下采取一切必要措施，保障金融体系即时稳定。

8. 如果中央证券存管机构在东道成员国开展重大跨境活动，重大ICT相关事件可能对该成员国金融市场造成严重后果，且主管机关之间存在有关金融实体监管的合作安排，则ESMA依本条第7款发出的通知，不影响主管机关将事件详情紧急传送东道成员国有关机关的责任。

第20条 报告内容及模板协调 / Article 20 — Harmonisation of reporting content and templates

展开第20条英中对照

English

The ESAs, through the Joint Committee, and in consultation with ENISA and the ECB, shall develop:

(a) common draft regulatory technical standards in order to:

(i) establish the content of the reports for major ICT-related incidents in order to reflect the criteria laid down in Article 18(1) and incorporate further elements, such as details for establishing the relevance of the reporting for other Member States and whether it constitutes a major operational or security payment-related incident or not;

(ii) determine the time limits for the initial notification and for each report referred to in Article 19(4);

(iii) establish the content of the notification for significant cyber threats.

When developing those draft regulatory technical standards, the ESAs shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations, and in particular, with a view to ensuring that, for the purposes of this paragraph, point (a), point (ii), different time limits may reflect, as appropriate, specificities of financial sectors, without prejudice to maintaining a consistent approach to ICT-related incident reporting pursuant to this Regulation and to Directive (EU) 2022/2555. The ESAs shall, as applicable, provide justification when deviating from the approaches taken in the context of that Directive;

(b) common draft implementing technical standards in order to establish the standard forms, templates and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat.

The ESAs shall submit the common draft regulatory technical standards referred to in the first paragraph, point (a), and the common draft implementing technical standards referred to in the first paragraph, point (b), to the Commission by 17 July 2024.

Power is delegated to the Commission to supplement this Regulation by adopting the common regulatory technical standards referred to in the first paragraph, point (a), in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

Power is conferred on the Commission to adopt the common implementing technical standards referred to in the first paragraph, point (b), in accordance with Article 15 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

中文参考译文

欧洲监管当局应通过联合委员会，在征询ENISA和ECB意见后，制定：

(a) 共同监管技术标准草案，以：

(i) 确立重大ICT相关事件报告内容，反映第18条第1款标准并纳入其他要素，例如确定报告与其他成员国相关性的详情，以及是否构成重大支付相关操作或安全事件；

(ii) 确定第19条第4款所述初始通知及每份报告的时限；

(iii) 确立重大网络威胁通知的内容。

制定草案时，欧洲监管当局应考虑金融实体规模、整体风险状况，以及服务、活动和运营的性质、范围及复杂性；尤其为适用本段(a)项(ii)目，应确保不同时限能够适当反映金融行业特殊性，同时不影响本条例及指令（EU）2022/2555下ICT相关事件报告方法的一致性。偏离该指令所采用方法时，应按适用情况提供理由；

(b) 共同实施技术标准草案，确立金融实体报告重大ICT相关事件和通知重大网络威胁的标准表格、模板及程序。

欧洲监管当局应在2024年7月17日前，将第一段(a)项所述共同监管技术标准草案及(b)项所述共同实施技术标准草案提交委员会。

授权委员会依条例（EU）第1093/2010号、第1094/2010号及第1095/2010号第10至14条，通过第一段(a)项所述共同监管技术标准，补充本条例。

赋予委员会权力，依上述三部条例第15条，通过第一段(b)项所述共同实施技术标准。

查看法规原文

第21条 重大ICT相关事件报告集中化 / Article 21 — Centralisation of reporting of major ICT-related incidents

展开第21条英中对照

English

1. The ESAs, through the Joint Committee, and in consultation with the ECB and ENISA, shall prepare a joint report assessing the feasibility of further centralisation of incident reporting through the establishment of a single EU Hub for major ICT-related incident reporting by financial entities. The joint report shall explore ways to facilitate the flow of ICT-related incident reporting, reduce associated costs and underpin thematic analyses with a view to enhancing supervisory convergence.

2. The joint report referred to in paragraph 1 shall comprise at least the following elements:

(a) prerequisites for the establishment of a single EU Hub;

(b) benefits, limitations and risks, including risks associated with the high concentration of sensitive information;

(c) the necessary capability to ensure interoperability with regard to other relevant reporting schemes;

(d) elements of operational management;

(e) conditions of membership;

(f) technical arrangements for financial entities and national competent authorities to access the single EU Hub;

(g) a preliminary assessment of financial costs incurred by setting-up the operational platform supporting the single EU Hub, including the requisite expertise.

3. The ESAs shall submit the report referred to in paragraph 1 to the European Parliament, to the Council and to the Commission by 17 January 2025.

中文参考译文

1. 欧洲监管当局应通过联合委员会，在征询ECB及ENISA意见后编制联合报告，评估通过设立单一欧盟中心，进一步集中金融实体重大ICT相关事件报告的可行性。报告应研究促进ICT相关事件报告信息流动、降低相关成本并支持专题分析的方法，以增强监管趋同。

2. 第1款所述联合报告至少应包括：

(a) 设立单一欧盟中心的前提条件；

(b) 益处、限制及风险，包括敏感信息高度集中相关风险；

(c) 确保与其他有关报告制度互操作所需的能力；

(d) 运营管理要素；

(e) 加入条件；

(f) 金融实体和各国主管机关接入单一欧盟中心的技术安排；

(g) 对建立支持单一欧盟中心的运营平台所需财务成本的初步评估，包括所需专业能力。

3. 欧洲监管当局应在2025年1月17日前，将第1款所述报告提交欧洲议会、理事会和委员会。

第22条 监管反馈 / Article 22 — Supervisory feedback

展开第22条英中对照

English

1. Without prejudice to the technical input, advice or remedies and subsequent follow-up which may be provided, where applicable, in accordance with national law, by the CSIRTs under Directive (EU) 2022/2555, the competent authority shall, upon receipt of the initial notification and of each report as referred to in Article 19(4), acknowledge receipt and may, where feasible, provide in a timely manner relevant and proportionate feedback or high-level guidance to the financial entity, in particular by making available any relevant anonymised information and intelligence on similar threats, and may discuss remedies applied at the level of the financial entity and ways to minimise and mitigate adverse impact across the financial sector.

Without prejudice to the supervisory feedback received, financial entities shall remain fully responsible for the handling and for consequences of the ICT-related incidents reported pursuant to Article 19(1).

2. The ESAs shall, through the Joint Committee, on an anonymised and aggregated basis, report yearly on major ICT-related incidents, the details of which shall be provided by competent authorities in accordance with Article 19(6), setting out at least the number of major ICT-related incidents, their nature and their impact on the operations of financial entities or clients, remedial actions taken and costs incurred.

The ESAs shall issue warnings and produce high-level statistics to support ICT threat and vulnerability assessments.

中文参考译文

1. 在不影响指令（EU）2022/2555项下CSIRTs按适用情况依国内法提供技术意见、建议或补救及后续跟进的前提下，主管机关收到第19条第4款所述初始通知和每份报告后，应确认收悉，并可在可行时及时向金融实体提供相关且相称的反馈或高层次指引，尤其可提供有关类似威胁的匿名化信息和情报，也可讨论实体层面采取的补救，以及尽量减少和缓解整个金融部门不利影响的方法。

无论收到何种监管反馈，金融实体仍对依第19条第1款报告的ICT相关事件的处理及后果承担全部责任。

2. 欧洲监管当局应通过联合委员会，以匿名化和汇总方式每年报告重大ICT相关事件，其详情由主管机关依第19条第6款提供；报告至少列明事件数量、性质及其对金融实体或客户运营的影响、已采取的补救行动和所发生成本。

欧洲监管当局应发布警示并编制高层次统计资料，支持ICT威胁及脆弱性评估。

第23条 涉及信贷机构、支付机构、账户信息服务提供者和电子货币机构的支付相关操作或安全事件 / Article 23 — Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions

展开第23条英中对照

English

The requirements laid down in this Chapter shall also apply to operational or security payment-related incidents and to major operational or security payment-related incidents, where they concern credit institutions, payment institutions, account information service providers, and electronic money institutions.

中文参考译文

本章规定的要求也适用于涉及信贷机构、支付机构、账户信息服务提供者和电子货币机构的支付相关操作或安全事件，以及重大支付相关操作或安全事件。

第四章 数字运营韧性测试 / CHAPTER IV — Digital operational resilience testing

第24条 开展数字运营韧性测试的一般要求 / Article 24 — General requirements for the performance of digital operational resilience testing

展开第24条英中对照

English

1. For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.

2. The digital operational resilience testing programme shall include a range of assessments, tests, methodologies, practices and tools to be applied in accordance with Articles 25 and 26.

3. When conducting the digital operational resilience testing programme referred to in paragraph 1 of this Article, financial entities, other than microenterprises, shall follow a risk-based approach taking into account the criteria set out in Article 4(2) duly considering the evolving landscape of ICT risk, any specific risks to which the financial entity concerned is or might be exposed, the criticality of information assets and of services provided, as well as any other factor the financial entity deems appropriate.

4. Financial entities, other than microenterprises, shall ensure that tests are undertaken by independent parties, whether internal or external. Where tests are undertaken by an internal tester, financial entities shall dedicate sufficient resources and ensure that conflicts of interest are avoided throughout the design and execution phases of the test.

5. Financial entities, other than microenterprises, shall establish procedures and policies to prioritise, classify and remedy all issues revealed throughout the performance of the tests and shall establish internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed.

6. Financial entities, other than microenterprises, shall ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions.

中文参考译文

1. 为评估处理ICT相关事件的准备程度，识别数字运营韧性的弱点、缺陷和空白，并及时实施纠正措施，微型企业以外的金融实体应考虑第4条第2款标准，建立、维护和审查健全、全面的数字运营韧性测试方案，作为第6条ICT风险管理框架的组成部分。

2. 数字运营韧性测试方案应包含一系列依第25条及第26条适用的评估、测试、方法、实践和工具。

3. 开展本条第1款测试方案时，微型企业以外的金融实体应采用基于风险的方法，考虑第4条第2款标准，充分考虑不断演变的ICT风险态势、实体已经或可能面临的特定风险、信息资产及所提供服务的关键程度，以及实体认为适当的其他因素。

4. 微型企业以外的金融实体应确保由独立的内部或外部主体开展测试。采用内部测试者时，应投入充足资源，并确保在测试设计和执行全过程避免利益冲突。

5. 微型企业以外的金融实体应建立程序和政策，对测试过程中发现的所有问题确定优先级、分类并补救，建立内部验证方法，确认已识别的所有弱点、缺陷或空白均得到充分解决。

6. 微型企业以外的金融实体应确保至少每年对支持关键或重要功能的全部ICT系统和应用开展适当测试。

第25条 ICT工具和系统测试 / Article 25 — Testing of ICT tools and systems

展开第25条英中对照

English

1. The digital operational resilience testing programme referred to in Article 24 shall provide, in accordance with the criteria set out in Article 4(2), for the execution of appropriate tests, such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.

2. Central securities depositories and central counterparties shall perform vulnerability assessments before any deployment or redeployment of new or existing applications and infrastructure components, and ICT services supporting critical or important functions of the financial entity.

3. Microenterprises shall perform the tests referred to in paragraph 1 by combining a risk-based approach with a strategic planning of ICT testing, by duly considering the need to maintain a balanced approach between the scale of resources and the time to be allocated to the ICT testing provided for in this Article, on the one hand, and the urgency, type of risk, criticality of information assets and of services provided, as well as any other relevant factor, including the financial entity’s ability to take calculated risks, on the other hand.

中文参考译文

1. 第24条所述数字运营韧性测试方案应依第4条第2款标准，规定开展适当测试，例如脆弱性评估与扫描、开源分析、网络安全评估、差距分析、物理安全审查、问卷及扫描软件方案、在可行时开展源代码审查，以及场景测试、兼容性测试、性能测试、端到端测试和渗透测试。

2. 中央证券存管机构和中央交易对手，在部署或重新部署新的或现有的应用、基础设施组件，以及支持金融实体关键或重要功能的ICT服务之前，应进行脆弱性评估。

3. 微型企业应将基于风险的方法与ICT测试战略规划结合，开展第1款所述测试；应充分考虑平衡以下两方面的需要：一方面是拟分配给本条ICT测试的资源规模和时间，另一方面是紧迫性、风险类型、信息资产和所提供服务的关键程度，以及包括实体承担经过审慎评估之风险的能力在内的其他相关因素。

查看法规原文

第26条 基于TLPT的ICT工具、系统和流程高级测试 / Article 26 — Advanced testing of ICT tools, systems and processes based on TLPT

展开第26条英中对照

English

1. Financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, which are identified in accordance with paragraph 8, third subparagraph, of this Article, shall carry out at least every 3 years advanced testing by means of TLPT. Based on the risk profile of the financial entity and taking into account operational circumstances, the competent authority may, where necessary, request the financial entity to reduce or increase this frequency.

2. Each threat-led penetration test shall cover several or all critical or important functions of a financial entity, and shall be performed on live production systems supporting such functions.

Financial entities shall identify all relevant underlying ICT systems, processes and technologies supporting critical or important functions and ICT services, including those supporting the critical or important functions which have been outsourced or contracted to ICT third-party service providers.

Financial entities shall assess which critical or important functions need to be covered by the TLPT. The result of this assessment shall determine the precise scope of TLPT and shall be validated by the competent authorities.

3. Where ICT third-party service providers are included in the scope of TLPT, the financial entity shall take the necessary measures and safeguards to ensure the participation of such ICT third-party service providers in the TLPT and shall retain at all times full responsibility for ensuring compliance with this Regulation.

4. Without prejudice to paragraph 2, first and second subparagraphs, where the participation of an ICT third-party service provider in the TLPT, referred to in paragraph 3, is reasonably expected to have an adverse impact on the quality or security of services delivered by the ICT third-party service provider to customers that are entities falling outside the scope of this Regulation, or on the confidentiality of the data related to such services, the financial entity and the ICT third-party service provider may agree in writing that the ICT third-party service provider directly enters into contractual arrangements with an external tester, for the purpose of conducting, under the direction of one designated financial entity, a pooled TLPT involving several financial entities (pooled testing) to which the ICT third-party service provider provides ICT services.

That pooled testing shall cover the relevant range of ICT services supporting critical or important functions contracted to the respective ICT third-party service provider by the financial entities. The pooled testing shall be considered TLPT carried out by the financial entities participating in the pooled testing.

The number of financial entities participating in the pooled testing shall be duly calibrated taking into account the complexity and types of services involved.

5. Financial entities shall, with the cooperation of ICT third-party service providers and other parties involved, including the testers but excluding the competent authorities, apply effective risk management controls to mitigate the risks of any potential impact on data, damage to assets, and disruption to critical or important functions, services or operations at the financial entity itself, its counterparts or to the financial sector.

6. At the end of the testing, after reports and remediation plans have been agreed, the financial entity and, where applicable, the external testers shall provide to the authority, designated in accordance with paragraph 9 or 10, a summary of the relevant findings, the remediation plans and the documentation demonstrating that the TLPT has been conducted in accordance with the requirements.

7. Authorities shall provide financial entities with an attestation confirming that the test was performed in accordance with the requirements as evidenced in the documentation in order to allow for mutual recognition of threat led penetration tests between competent authorities. The financial entity shall notify the relevant competent authority of the attestation, the summary of the relevant findings and the remediation plans.

Without prejudice to such attestation, financial entities shall remain at all times fully responsible for the impact of the tests referred to in paragraph 4.

8. Financial entities shall contract testers for the purposes of undertaking TLPT in accordance with Article 27. When financial entities use internal testers for the purposes of undertaking TLPT, they shall contract external testers every three tests.

Credit institutions that are classified as significant in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall only use external testers in accordance with Article 27(1), points (a) to (e).

Competent authorities shall identify financial entities that are required to perform TLPT taking into account the criteria set out in Article 4(2), based on an assessment of the following:

(a) impact-related factors, in particular the extent to which the services provided and activities undertaken by the financial entity impact the financial sector;

(b) possible financial stability concerns, including the systemic character of the financial entity at Union or national level, as applicable;

(c) specific ICT risk profile, level of ICT maturity of the financial entity or technology features involved.

9. Member States may designate a single public authority in the financial sector to be responsible for TLPT-related matters in the financial sector at national level and shall entrust it with all competences and tasks to that effect.

10. In the absence of a designation in accordance with paragraph 9 of this Article, and without prejudice to the power to identify the financial entities that are required to perform TLPT, a competent authority may delegate the exercise of some or all of the tasks referred to in this Article and Article 27 to another national authority in the financial sector.

11. The ESAs shall, in agreement with the ECB, develop joint draft regulatory technical standards in accordance with the TIBER-EU framework in order to specify further:

(a) the criteria used for the purpose of the application of paragraph 8, second subparagraph;

(b) the requirements and standards governing the use of internal testers;

(c) the requirements in relation to:

(i) the scope of TLPT referred to in paragraph 2;

(ii) the testing methodology and approach to be followed for each specific phase of the testing process;

(iii) the results, closure and remediation stages of the testing;

(d) the type of supervisory and other relevant cooperation which are needed for the implementation of TLPT, and for the facilitation of mutual recognition of that testing, in the context of financial entities that operate in more than one Member State, to allow an appropriate level of supervisory involvement and a flexible implementation to cater for specificities of financial sub-sectors or local financial markets.

When developing those draft regulatory technical standards, the ESAs shall give due consideration to any specific feature arising from the distinct nature of activities across different financial services sectors.

The ESAs shall submit those draft regulatory technical standards to the Commission by 17 July 2024.

Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

中文参考译文

1. 除第16条第1款第一分段所述实体及微型企业外，依本条第8款第三分段确定的金融实体，应至少每三年通过TLPT开展一次高级测试。主管机关可根据实体风险状况并考虑运营情况，在必要时要求降低或提高这一频率。

2. 每次基于威胁情报的渗透测试应覆盖实体若干项或全部关键或重要功能，并在支持这些功能的在线生产系统中开展。

金融实体应识别支持关键或重要功能及ICT服务的所有相关底层ICT系统、流程和技术，包括支持已外包或订约交由ICT第三方服务提供者承担的关键或重要功能的系统、流程和技术。

金融实体应评估哪些关键或重要功能需要纳入TLPT。评估结果应确定TLPT的准确范围，并由主管机关验证。

3. ICT第三方服务提供者纳入TLPT范围时，金融实体应采取必要措施和保障，确保提供者参与测试，并始终对确保遵守本条例承担全部责任。

4. 在不影响第2款第一及第二分段的前提下，如果合理预计第3款所述ICT第三方服务提供者参与TLPT，将不利影响其向本条例范围之外实体客户提供服务的质量或安全，或者相关数据的保密性，金融实体和提供者可以书面约定，由提供者直接与外部测试者订约，在一家指定金融实体指导下，对其服务的多家金融实体开展联合TLPT（联合测试）。

联合测试应覆盖金融实体交由该提供者承担、支持关键或重要功能的有关ICT服务范围。联合测试应视为参加联合测试的金融实体所开展的TLPT。

应根据所涉服务复杂性和类型，适当确定参加联合测试的金融实体数量。

5. 金融实体应在ICT第三方服务提供者及其他有关主体的合作下，包括测试者但不包括主管机关，实施有效风险管理控制，缓解金融实体自身、其交易对手或金融部门面临的任何潜在数据影响、资产损害，以及关键或重要功能、服务或运营中断风险。

6. 测试结束，在就报告和补救计划达成一致后，金融实体以及在适用情况下的外部测试者，应向依第9款或第10款指定的机关提供有关发现摘要、补救计划，以及证明TLPT依要求开展的文件。

7. 机关应向金融实体出具证明，确认文件所显示的测试符合要求，以支持主管机关之间对基于威胁情报的渗透测试相互认可。金融实体应将证明、有关发现摘要及补救计划通知有关主管机关。

无论有无该证明，金融实体均始终对第4款所述测试的影响承担全部责任。

8. 金融实体应依第27条通过合同聘请测试者开展TLPT。使用内部测试者开展TLPT时，每三次测试应聘用一次外部测试者。

依条例（EU）第1024/2013号第6条第4款被划为重要机构的信贷机构，仅可使用符合第27条第1款(a)至(e)项的外部测试者。

主管机关应考虑第4条第2款标准，根据对下列事项的评估，确定须开展TLPT的金融实体：

(a) 影响相关因素，尤其是实体所提供服务及所开展活动对金融部门的影响程度；

(b) 可能的金融稳定关切，包括实体在欧盟或国家层面的系统性特征，视情况而定；

(c) 特定ICT风险状况、实体ICT成熟度，或者所涉技术特征。

9. 成员国可以指定金融部门的一个公共机关，在国家层面负责金融部门TLPT相关事项，并应将为此所需的全部权限和任务交给该机关。

10. 未按本条第9款作出指定时，在不影响确定须开展TLPT的金融实体之权力的前提下，主管机关可以将本条及第27条所述部分或全部任务，委托给本国金融部门另一机关履行。

11. 欧洲监管当局应与ECB达成一致，按照TIBER-EU框架制定联合监管技术标准草案，进一步明确：

(a) 适用第8款第二分段所使用的标准；

(b) 使用内部测试者的要求和标准；

(c) 下列方面的要求：

(i) 第2款所述TLPT范围；

(ii) 测试流程各具体阶段应遵循的方法和路径；

(iii) 测试结果、结束和补救阶段；

(d) 对在一个以上成员国经营的金融实体，实施TLPT并促进测试相互认可所需的监管及其他有关合作类型，以实现适当监管参与，并灵活实施，适应金融子行业或当地金融市场特殊性。

制定草案时，欧洲监管当局应充分考虑不同金融服务行业活动性质差异产生的任何特殊特征。

欧洲监管当局应在2024年7月17日前将草案提交委员会。

授权委员会依条例（EU）第1093/2010号、第1094/2010号及第1095/2010号第10至14条，通过第一分段所述监管技术标准，补充本条例。

第27条 开展TLPT的测试者要求 / Article 27 — Requirements for testers for the carrying out of TLPT

展开第27条英中对照

English

1. Financial entities shall only use testers for the carrying out of TLPT, that:

(a) are of the highest suitability and reputability;

(b) possess technical and organisational capabilities and demonstrate specific expertise in threat intelligence, penetration testing and red team testing;

(c) are certified by an accreditation body in a Member State or adhere to formal codes of conduct or ethical frameworks;

(d) provide an independent assurance, or an audit report, in relation to the sound management of risks associated with the carrying out of TLPT, including the due protection of the financial entity’s confidential information and redress for the business risks of the financial entity;

(e) are duly and fully covered by relevant professional indemnity insurances, including against risks of misconduct and negligence.

2. When using internal testers, financial entities shall ensure that, in addition to the requirements in paragraph 1, the following conditions are met:

(a) such use has been approved by the relevant competent authority or by the single public authority designated in accordance with Article 26(9) and (10);

(b) the relevant competent authority has verified that the financial entity has sufficient dedicated resources and ensured that conflicts of interest are avoided throughout the design and execution phases of the test; and

(c) the threat intelligence provider is external to the financial entity.

3. Financial entities shall ensure that contracts concluded with external testers require a sound management of the TLPT results and that any data processing thereof, including any generation, store, aggregation, draft, report, communication or destruction, do not create risks to the financial entity.

中文参考译文

1. 金融实体仅可使用符合下列条件的测试者开展TLPT：

(a) 具有最高程度的适格性和信誉；

(b) 具备技术和组织能力，并证明其在威胁情报、渗透测试和红队测试方面具有专门能力；

(c) 获得某成员国认可机构的认证，或者遵守正式行为准则或伦理框架；

(d) 提供有关健全管理TLPT相关风险的独立保证或审计报告，包括充分保护实体保密信息，以及对实体业务风险的补救；

(e) 受到相关职业责任保险适当、充分的保障，包括针对不当行为及过失风险的保障。

2. 使用内部测试者时，金融实体除满足第1款要求外，还应确保：

(a) 已获有关主管机关，或者依第26条第9款和第10款指定的单一公共机关批准；

(b) 有关主管机关已核实实体具有足够专门资源，并确保在测试设计和执行全过程避免利益冲突；以及

(c) 威胁情报提供者为金融实体外部主体。

3. 金融实体应确保与外部测试者订立的合同要求健全管理TLPT结果，以及对结果开展的任何数据处理，包括生成、存储、汇总、起草、报告、沟通或销毁，均不对金融实体产生风险。

查看法规原文

第五章 ICT第三方风险管理 / CHAPTER V — Managing of ICT third-party risk

第一节 ICT第三方风险健全管理的关键原则 / Section I — Key principles for a sound management of ICT third-party risk

第28条 一般原则 / Article 28 — General principles

展开第28条英中对照

English

1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles:

(a) financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law;

(b) financial entities’ management of ICT third-party risk shall be implemented in light of the principle of proportionality, taking into account:

(i) the nature, scale, complexity and importance of ICT-related dependencies,

(ii) the risks arising from contractual arrangements on the use of ICT services concluded with ICT third-party service providers, taking into account the criticality or importance of the respective service, process or function, and the potential impact on the continuity and availability of financial services and activities, at individual and at group level.

2. As part of their ICT risk management framework, financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, shall adopt, and regularly review, a strategy on ICT third-party risk, taking into account the multi-vendor strategy referred to in Article 6(9), where applicable.

The strategy on ICT third-party risk shall include a policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers and shall apply on an individual basis and, where relevant, on a sub-consolidated and consolidated basis.

The management body shall, on the basis of an assessment of the overall risk profile of the financial entity and the scale and complexity of the business services, regularly review the risks identified in respect to contractual arrangements on the use of ICT services supporting critical or important functions.

3. As part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers.

The contractual arrangements referred to in the first subparagraph shall be appropriately documented, distinguishing between those that cover ICT services supporting critical or important functions and those that do not.

Financial entities shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided.

Financial entities shall make available to the competent authority, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity.

Financial entities shall inform the competent authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions as well as when a function has become critical or important.

4. Before entering into a contractual arrangement on the use of ICT services, financial entities shall:

(a) assess whether the contractual arrangement covers the use of ICT services supporting a critical or important function;

(b) assess if supervisory conditions for contracting are met;

(c) identify and assess all relevant risks in relation to the contractual arrangement, including the possibility that such contractual arrangement may contribute to reinforcing ICT concentration risk as referred to in Article 29;

(d) undertake all due diligence on prospective ICT third-party service providers and ensure throughout the selection and assessment processes that the ICT third-party service provider is suitable;

(e) identify and assess conflicts of interest that the contractual arrangement may cause.

5. Financial entities may only enter into contractual arrangements with ICT third-party service providers that comply with appropriate information security standards. When those contractual arrangements concern critical or important functions, financial entities shall, prior to concluding the arrangements, take due consideration of the use, by ICT third-party service providers, of the most up-to-date and highest quality information security standards.

6. In exercising access, inspection and audit rights over the ICT third-party service provider, financial entities shall, on the basis of a risk-based approach, pre-determine the frequency of audits and inspections as well as the areas to be audited through adhering to commonly accepted audit standards in line with any supervisory instruction on the use and incorporation of such audit standards.

Where contractual arrangements concluded with ICT third-party service providers on the use of ICT services entail high technical complexity, the financial entity shall verify that auditors, whether internal or external, or a pool of auditors, possess appropriate skills and knowledge to effectively perform the relevant audits and assessments.

7. Financial entities shall ensure that contractual arrangements on the use of ICT services may be terminated in any of the following circumstances:

(a) significant breach by the ICT third-party service provider of applicable laws, regulations or contractual terms;

(b) circumstances identified throughout the monitoring of ICT third-party risk that are deemed capable of altering the performance of the functions provided through the contractual arrangement, including material changes that affect the arrangement or the situation of the ICT third-party service provider;

(c) ICT third-party service provider’s evidenced weaknesses pertaining to its overall ICT risk management and in particular in the way it ensures the availability, authenticity, integrity and, confidentiality, of data, whether personal or otherwise sensitive data, or non-personal data;

(d) where the competent authority can no longer effectively supervise the financial entity as a result of the conditions of, or circumstances related to, the respective contractual arrangement.

8. For ICT services supporting critical or important functions, financial entities shall put in place exit strategies.

The exit strategies shall take into account risks that may emerge at the level of ICT third-party service providers, in particular a possible failure on their part, a deterioration of the quality of the ICT services provided, any business disruption due to inappropriate or failed provision of ICT services or any material risk arising in relation to the appropriate and continuous deployment of the respective ICT service, or the termination of contractual arrangements with ICT third-party service providers under any of the circumstances listed in paragraph 7.

Financial entities shall ensure that they are able to exit contractual arrangements without:

(a) disruption to their business activities,

(b) limiting compliance with regulatory requirements,

(c) detriment to the continuity and quality of services provided to clients.

Exit plans shall be comprehensive, documented and, in accordance with the criteria set out in Article 4(2), shall be sufficiently tested and reviewed periodically.

Financial entities shall identify alternative solutions and develop transition plans enabling them to remove the contracted ICT services and the relevant data from the ICT third-party service provider and to securely and integrally transfer them to alternative providers or reincorporate them in-house.

Financial entities shall have appropriate contingency measures in place to maintain business continuity in the event of the circumstances referred to in the first subparagraph.

9. The ESAs shall, through the Joint Committee, develop draft implementing technical standards to establish the standard templates for the purposes of the register of information referred to in paragraph 3, including information that is common to all contractual arrangements on the use of ICT services. The ESAs shall submit those draft implementing technical standards to the Commission by 17 January 2024.

Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

10. The ESAs shall, through the Joint Committee, develop draft regulatory technical standards to further specify the detailed content of the policy referred to in paragraph 2 in relation to the contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers.

When developing those draft regulatory technical standards, the ESAs shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations. The ESAs shall submit those draft regulatory technical standards to the Commission by 17 January 2024.

Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

中文参考译文

1. 金融实体应在第6条第1款所述ICT风险管理框架内，将ICT第三方风险作为ICT风险的组成部分加以管理，并遵循：

(a) 通过合同安排使用ICT服务开展业务运营的金融实体，应始终对遵守和履行本条例及适用金融服务法律项下全部义务承担全部责任；

(b) ICT第三方风险管理应遵循比例原则，考虑：

(i) ICT相关依赖的性质、范围、复杂性及重要性；

(ii) 与ICT第三方服务提供者订立ICT服务使用合同安排所产生的风险，考虑相关服务、流程或功能的关键程度或重要性，以及对单体和集团层面金融服务及活动连续性和可用性的潜在影响。

2. 作为ICT风险管理框架的一部分，除第16条第1款第一分段所述实体及微型企业外，金融实体应制定并定期审查ICT第三方风险战略，在适用情况下考虑第6条第9款所述多供应商战略。

ICT第三方风险战略应包含使用第三方提供者所提供、支持关键或重要功能之ICT服务的政策，并适用于单体层面，以及在相关情况下适用于次级合并和合并层面。

管理机构应根据对实体整体风险状况，以及业务服务范围及复杂性的评估，定期审查在使用支持关键或重要功能ICT服务的合同安排方面识别出的风险。

3. 作为ICT风险管理框架的一部分，金融实体应在实体、次级合并及合并层面，维护和更新有关使用ICT第三方服务提供者所提供ICT服务的全部合同安排的信息登记册。

第一分段所述合同安排应适当记录，区分是否涵盖支持关键或重要功能的ICT服务。

金融实体应至少每年向主管机关报告新增ICT服务使用安排数量、ICT第三方服务提供者类别、合同安排类型，以及正在提供的ICT服务和功能。

应主管机关要求，金融实体应提供完整信息登记册或所要求的特定部分，以及被认为有效监管实体所必需的其他信息。

金融实体应及时告知主管机关任何计划中的、使用支持关键或重要功能ICT服务的合同安排，以及某项功能已变为关键或重要功能的情况。

4. 订立ICT服务使用合同安排前，金融实体应：

(a) 评估该安排是否涵盖使用支持关键或重要功能的ICT服务；

(b) 评估是否满足订约监管条件；

(c) 识别并评估该安排的全部相关风险，包括可能增强第29条所述ICT集中风险的情况；

(d) 对潜在ICT第三方服务提供者开展全部应有的尽职调查，并在选择和评估全过程确保其适格；

(e) 识别并评估该安排可能导致的利益冲突。

5. 金融实体仅可与符合适当信息安全标准的ICT第三方服务提供者订立合同安排。涉及关键或重要功能时，应在订约前充分考虑提供者是否采用最新且最高质量的信息安全标准。

6. 对ICT第三方服务提供者行使访问、检查及审计权时，金融实体应采用基于风险的方法，预先确定审计和检查频率及审计领域，遵守普遍接受的审计标准，并符合有关使用和纳入这些标准的监管指示。

与ICT第三方服务提供者订立的ICT服务使用安排具有高度技术复杂性时，金融实体应核实内部或外部审计人员，或者审计人员团队，具备有效开展相关审计和评估所需技能与知识。

7. 金融实体应确保在下列任一情形可以终止ICT服务使用合同安排：

(a) 提供者严重违反适用法律、法规或合同条款；

(b) 在ICT第三方风险监测中识别出被认为可能改变合同功能履行的情况，包括影响安排或提供者状况的重大变化；

(c) 有证据表明提供者整体ICT风险管理薄弱，尤其是确保数据可用性、真实性、完整性和保密性的方式存在弱点，无论涉及个人数据、其他敏感数据或非个人数据；

(d) 由于合同安排的条件或有关情况，主管机关无法继续有效监管金融实体。

8. 对支持关键或重要功能的ICT服务，金融实体应制定退出战略。

退出战略应考虑ICT第三方服务提供者层面可能产生的风险，尤其是可能失效、服务质量下降、ICT服务提供不当或失败导致业务中断、与有关ICT服务适当和持续部署有关的任何重大风险，以及发生第7款所列任一情形时终止与提供者的合同安排。

金融实体应确保能够退出合同安排，且不：

(a) 中断自身业务活动；

(b) 限制对监管要求的遵守；

(c) 损害向客户提供服务的连续性和质量。

退出计划应全面、有书面记录，并依第4条第2款标准充分测试及定期审查。

金融实体应识别替代方案并制定过渡计划，使其能够将订约ICT服务及有关数据从提供者处移出，安全、完整地转移给替代提供者或重新纳入内部。

金融实体应采取适当应急措施，在第一分段所述情形下维持业务连续性。

9. 欧洲监管当局应通过联合委员会制定实施技术标准草案，为第3款信息登记册确定标准模板，包括所有ICT服务使用合同安排共有的信息，并在2024年1月17日前提交委员会。

赋予委员会权力，依条例（EU）第1093/2010号、第1094/2010号及第1095/2010号第15条，通过第一分段所述实施技术标准。

10. 欧洲监管当局应通过联合委员会制定监管技术标准草案，进一步明确第2款政策中有关使用ICT第三方服务提供者所提供、支持关键或重要功能ICT服务的合同安排之详细内容。

制定草案时，应考虑金融实体规模、整体风险状况，以及服务、活动和运营的性质、范围及复杂性，并在2024年1月17日前提交委员会。

授权委员会依上述三部条例第10至14条，通过第一分段所述监管技术标准，补充本条例。

第29条 实体层面ICT集中风险初步评估 / Article 29 — Preliminary assessment of ICT concentration risk at entity level

展开第29条英中对照

English

1. When performing the identification and assessment of risks referred to in Article 28(4), point (c), financial entities shall also take into account whether the envisaged conclusion of a contractual arrangement in relation to ICT services supporting critical or important functions would lead to any of the following:

(a) contracting an ICT third-party service provider that is not easily substitutable; or

(b) having in place multiple contractual arrangements in relation to the provision of ICT services supporting critical or important functions with the same ICT third-party service provider or with closely connected ICT third-party service providers.

Financial entities shall weigh the benefits and costs of alternative solutions, such as the use of different ICT third-party service providers, taking into account if and how envisaged solutions match the business needs and objectives set out in their digital resilience strategy.

2. Where the contractual arrangements on the use of ICT services supporting critical or important functions include the possibility that an ICT third-party service provider further subcontracts ICT services supporting a critical or important function to other ICT third-party service providers, financial entities shall weigh benefits and risks that may arise in connection with such subcontracting, in particular in the case of an ICT subcontractor established in a third-country.

Where contractual arrangements concern ICT services supporting critical or important functions, financial entities shall duly consider the insolvency law provisions that would apply in the event of the ICT third-party service provider’s bankruptcy as well as any constraint that may arise in respect to the urgent recovery of the financial entity’s data.

Where contractual arrangements on the use of ICT services supporting critical or important functions are concluded with an ICT third-party service provider established in a third country, financial entities shall, in addition to the considerations referred to in the second subparagraph, also consider the compliance with Union data protection rules and the effective enforcement of the law in that third country.

Where the contractual arrangements on the use of ICT services supporting critical or important functions provide for subcontracting, financial entities shall assess whether and how potentially long or complex chains of subcontracting may impact their ability to fully monitor the contracted functions and the ability of the competent authority to effectively supervise the financial entity in that respect.

中文参考译文

1. 开展第28条第4款(c)项风险识别及评估时，金融实体还应考虑拟议的、与支持关键或重要功能ICT服务有关的合同安排，是否会导致：

(a) 与不易替代的ICT第三方服务提供者订约；或者

(b) 与同一ICT第三方服务提供者，或者关系密切的ICT第三方服务提供者，就支持关键或重要功能的ICT服务订立多项合同安排。

金融实体应权衡使用不同ICT第三方服务提供者等替代方案的益处及成本，并考虑拟议方案是否以及如何符合数字韧性战略所定业务需要和目标。

2. 如果支持关键或重要功能ICT服务的使用合同，允许提供者将支持关键或重要功能的ICT服务进一步分包给其他ICT第三方服务提供者，金融实体应权衡此类分包可能产生的益处及风险，尤其是分包商设立于第三国的情形。

合同涉及支持关键或重要功能ICT服务时，应充分考虑提供者破产时适用的破产法规定，以及紧急恢复金融实体数据可能受到的任何限制。

与设立于第三国的ICT第三方服务提供者订立上述合同时，金融实体除第二分段所列考虑外，还应考虑遵守欧盟数据保护规则的情况，以及该第三国法律的有效执行。

上述合同允许分包时，金融实体应评估潜在的长链条或复杂分包链是否以及如何影响自身全面监测订约功能的能力，以及主管机关在这方面有效监管实体的能力。

查看法规原文

第30条 关键合同条款 / Article 30 — Key contractual provisions

展开第30条英中对照

English

1. The rights and obligations of the financial entity and of the ICT third-party service provider shall be clearly allocated and set out in writing. The full contract shall include the service level agreements and be documented in one written document which shall be available to the parties on paper, or in a document with another downloadable, durable and accessible format.

2. The contractual arrangements on the use of ICT services shall include at least the following elements:

(a) a clear and complete description of all functions and ICT services to be provided by the ICT third-party service provider, indicating whether subcontracting of an ICT service supporting a critical or important function, or material parts thereof, is permitted and, when that is the case, the conditions applying to such subcontracting;

(b) the locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location, and the requirement for the ICT third-party service provider to notify the financial entity in advance if it envisages changing such locations;

(c) provisions on availability, authenticity, integrity and confidentiality in relation to the protection of data, including personal data;

(d) provisions on ensuring access, recovery and return in an easily accessible format of personal and non-personal data processed by the financial entity in the event of the insolvency, resolution or discontinuation of the business operations of the ICT third-party service provider, or in the event of the termination of the contractual arrangements;

(e) service level descriptions, including updates and revisions thereof;

(f) the obligation of the ICT third-party service provider to provide assistance to the financial entity at no additional cost, or at a cost that is determined ex-ante, when an ICT incident that is related to the ICT service provided to the financial entity occurs;

(g) the obligation of the ICT third-party service provider to fully cooperate with the competent authorities and the resolution authorities of the financial entity, including persons appointed by them;

(h) termination rights and related minimum notice periods for the termination of the contractual arrangements, in accordance with the expectations of competent authorities and resolution authorities;

(i) the conditions for the participation of ICT third-party service providers in the financial entities’ ICT security awareness programmes and digital operational resilience training in accordance with Article 13(6).

3. The contractual arrangements on the use of ICT services supporting critical or important functions shall include, in addition to the elements referred to in paragraph 2, at least the following:

(a) full service level descriptions, including updates and revisions thereof with precise quantitative and qualitative performance targets within the agreed service levels to allow effective monitoring by the financial entity of ICT services and enable appropriate corrective actions to be taken, without undue delay, when agreed service levels are not met;

(b) notice periods and reporting obligations of the ICT third-party service provider to the financial entity, including notification of any development that might have a material impact on the ICT third-party service provider’s ability to effectively provide the ICT services supporting critical or important functions in line with agreed service levels;

(c) requirements for the ICT third-party service provider to implement and test business contingency plans and to have in place ICT security measures, tools and policies that provide an appropriate level of security for the provision of services by the financial entity in line with its regulatory framework;

(d) the obligation of the ICT third-party service provider to participate and fully cooperate in the financial entity’s TLPT as referred to in Articles 26 and 27;

(e) the right to monitor, on an ongoing basis, the ICT third-party service provider’s performance, which entails the following:

(i) unrestricted rights of access, inspection and audit by the financial entity, or an appointed third party, and by the competent authority, and the right to take copies of relevant documentation on-site if they are critical to the operations of the ICT third-party service provider, the effective exercise of which is not impeded or limited by other contractual arrangements or implementation policies;

(ii) the right to agree on alternative assurance levels if other clients’ rights are affected;

(iii) the obligation of the ICT third-party service provider to fully cooperate during the onsite inspections and audits performed by the competent authorities, the Lead Overseer, financial entity or an appointed third party; and

(iv) the obligation to provide details on the scope, procedures to be followed and frequency of such inspections and audits;

(f) exit strategies, in particular the establishment of a mandatory adequate transition period:

(i) during which the ICT third-party service provider will continue providing the respective functions, or ICT services, with a view to reducing the risk of disruption at the financial entity or to ensure its effective resolution and restructuring;

(ii) allowing the financial entity to migrate to another ICT third-party service provider or change to in-house solutions consistent with the complexity of the service provided.

By way of derogation from point (e), the ICT third-party service provider and the financial entity that is a microenterprise may agree that the financial entity’s rights of access, inspection and audit can be delegated to an independent third party, appointed by the ICT third-party service provider, and that the financial entity is able to request information and assurance on the ICT third-party service provider’s performance from the third party at any time.

4. When negotiating contractual arrangements, financial entities and ICT third-party service providers shall consider the use of standard contractual clauses developed by public authorities for specific services.

5. The ESAs shall, through the Joint Committee, develop draft regulatory technical standards to specify further the elements referred to in paragraph 2, point (a), which a financial entity needs to determine and assess when subcontracting ICT services supporting critical or important functions.

When developing those draft regulatory technical standards, the ESAs shall take into consideration the size and overall risk profile of the financial entity, and the nature, scale and complexity of its services, activities and operations.

The ESAs shall submit those draft regulatory technical standards to the Commission by 17 July 2024.

Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

中文参考译文

1. 金融实体与ICT第三方服务提供者的权利和义务，应明确分配并书面规定。完整合同应包含服务水平协议，并记录于一份书面文件，向各方提供纸质文本，或者其他可下载、持久保存且可访问格式的文件。

2. ICT服务使用合同安排至少应包括：

(a) 清晰、完整描述提供者拟提供的全部功能和ICT服务，注明是否允许分包支持关键或重要功能的ICT服务或其重大部分；允许时，明确适用的分包条件；

(b) 订约或分包功能及ICT服务的提供地点、数据处理地点，包括存储地点，即相关地区或国家；并规定提供者拟变更地点时，须提前通知金融实体；

(c) 关于数据保护，包括个人数据保护的可用性、真实性、完整性和保密性条款；

(d) 规定在提供者破产、被处置、停止业务运营，或者合同安排终止时，确保金融实体所处理个人及非个人数据能够被访问、恢复，并以易于访问的格式返还；

(e) 服务水平说明，包括更新及修订；

(f) 发生与向金融实体提供的ICT服务有关的ICT事件时，提供者有义务无额外收费或者按事先确定的费用向实体提供协助；

(g) 提供者有义务与金融实体的主管机关及处置当局，包括其指定人员充分合作；

(h) 按照主管机关和处置当局预期规定合同终止权，以及相关最短提前通知期；

(i) 依第13条第6款，提供者参与金融实体ICT安全意识方案及数字运营韧性培训的条件。

3. 使用支持关键或重要功能ICT服务的合同安排，除第2款要素外，至少还应包括：

(a) 完整服务水平说明，包括更新和修订，在约定服务水平内规定准确的定量及定性绩效目标，使金融实体能够有效监测ICT服务，并在未达到约定水平时不无故拖延地采取适当纠正行动；

(b) 提供者向金融实体履行通知的期限及报告义务，包括通知任何可能重大影响其按照约定服务水平有效提供支持关键或重要功能ICT服务之能力的变化；

(c) 要求提供者实施和测试业务应急计划，并具备ICT安全措施、工具和政策，按照实体所受监管框架，为其服务提供适当安全水平；

(d) 提供者参与并充分配合金融实体开展第26条和第27条所述TLPT的义务；

(e) 持续监测提供者履约情况的权利，包括：

(i) 金融实体或其指定第三方，以及主管机关不受限制的访问、检查及审计权；如有关文件对提供者运营至关重要，还包括现场复制权；其他合同安排或实施政策不得妨碍或限制这些权利有效行使；

(ii) 其他客户权利受到影响时，约定替代保证水平的权利；

(iii) 提供者在主管机关、牵头监督机构、金融实体或指定第三方开展现场检查及审计期间充分合作的义务；以及

(iv) 提供这些检查和审计的范围、应遵循程序及频率详情的义务；

(f) 退出战略，尤其是设立强制且充分的过渡期：

(i) 在此期间提供者继续提供相关功能或ICT服务，以降低实体中断风险，或者确保其有效处置和重组；

(ii) 使实体能够根据所提供服务的复杂性，迁移至另一ICT第三方服务提供者或转用内部解决方案。

作为(e)项的例外，ICT第三方服务提供者与属于微型企业的金融实体可以约定，将实体访问、检查及审计权委托给提供者指定的独立第三方，并使实体能够随时向该第三方要求提供关于提供者履约情况的信息和保证。

4. 协商合同安排时，金融实体和ICT第三方服务提供者应考虑使用公共机关针对特定服务制定的标准合同条款。

5. 欧洲监管当局应通过联合委员会制定监管技术标准草案，进一步明确金融实体分包支持关键或重要功能ICT服务时，须确定和评估的第2款(a)项要素。

制定草案时，应考虑金融实体规模、整体风险状况，以及服务、活动和运营的性质、范围及复杂性。

欧洲监管当局应在2024年7月17日前将草案提交委员会。

授权委员会依条例（EU）第1093/2010号、第1094/2010号及第1095/2010号第10至14条，通过第一分段所述监管技术标准，补充本条例。

第二节 关键ICT第三方服务提供者监督框架 / Section II — Oversight Framework of critical ICT third-party service providers

第31条 关键ICT第三方服务提供者的指定 / Article 31 — Designation of critical ICT third-party service providers

展开第31条英中对照

English

1. The ESAs, through the Joint Committee and upon recommendation from the Oversight Forum established pursuant to Article 32(1), shall:

(a) designate the ICT third-party service providers that are critical for financial entities, following an assessment that takes into account the criteria specified in paragraph 2;

(b) appoint as Lead Overseer for each critical ICT third-party service provider the ESA that is responsible, in accordance with Regulations (EU) No 1093/2010, (EU) No 1094/2010 or (EU) No 1095/2010, for the financial entities having together the largest share of total assets out of the value of total assets of all financial entities using the services of the relevant critical ICT third-party service provider, as evidenced by the sum of the individual balance sheets of those financial entities.

2. The designation referred to in paragraph 1, point (a), shall be based on all of the following criteria in relation to ICT services provided by the ICT third-party service provider:

(a) the systemic impact on the stability, continuity or quality of the provision of financial services in the event that the relevant ICT third-party service provider would face a large scale operational failure to provide its services, taking into account the number of financial entities and the total value of assets of financial entities to which the relevant ICT third-party service provider provides services;

(b) the systemic character or importance of the financial entities that rely on the relevant ICT third-party service provider, assessed in accordance with the following parameters:

(i) the number of global systemically important institutions (G-SIIs) or other systemically important institutions (O-SIIs) that rely on the respective ICT third-party service provider;

(ii) the interdependence between the G-SIIs or O-SIIs referred to in point (i) and other financial entities, including situations where the G-SIIs or O-SIIs provide financial infrastructure services to other financial entities;

(c) the reliance of financial entities on the services provided by the relevant ICT third-party service provider in relation to critical or important functions of financial entities that ultimately involve the same ICT third-party service provider, irrespective of whether financial entities rely on those services directly or indirectly, through subcontracting arrangements;

(d) the degree of substitutability of the ICT third-party service provider, taking into account the following parameters:

(i) the lack of real alternatives, even partial, due to the limited number of ICT third-party service providers active on a specific market, or the market share of the relevant ICT third-party service provider, or the technical complexity or sophistication involved, including in relation to any proprietary technology, or the specific features of the ICT third-party service provider’s organisation or activity;

(ii) difficulties in relation to partially or fully migrating the relevant data and workloads from the relevant ICT third-party service provider to another ICT third-party service provider, due either to significant financial costs, time or other resources that the migration process may entail, or to increased ICT risk or other operational risks to which the financial entity may be exposed through such migration.

3. Where the ICT third-party service provider belongs to a group, the criteria referred to in paragraph 2 shall be considered in relation to the ICT services provided by the group as a whole.

4. Critical ICT third-party service providers which are part of a group shall designate one legal person as a coordination point to ensure adequate representation and communication with the Lead Overseer.

5. The Lead Overseer shall notify the ICT third-party service provider of the outcome of the assessment leading to the designation referred in paragraph 1, point (a). Within 6 weeks from the date of the notification, the ICT third-party service provider may submit to the Lead Overseer a reasoned statement with any relevant information for the purposes of the assessment.

The Lead Overseer shall consider the reasoned statement and may request additional information to be submitted within 30 calendar days of the receipt of such statement.

After designating an ICT third-party service provider as critical, the ESAs, through the Joint Committee, shall notify the ICT third-party service provider of such designation and the starting date as from which they will effectively be subject to oversight activities. That starting date shall be no later than one month after the notification. The ICT third-party service provider shall notify the financial entities to which they provide services of their designation as critical.

6. The Commission is empowered to adopt a delegated act in accordance with Article 57 to supplement this Regulation by specifying further the criteria referred to in paragraph 2 of this Article, by 17 July 2024.

7. The designation referred to in paragraph 1, point (a), shall not be used until the Commission has adopted a delegated act in accordance with paragraph 6.

8. The designation referred to in paragraph 1, point (a), shall not apply to the following:

(i) financial entities providing ICT services to other financial entities;

(ii) ICT third-party service providers that are subject to oversight frameworks established for the purposes of supporting the tasks referred to in Article 127(2) of the Treaty on the Functioning of the European Union;

(iii) ICT intra-group service providers;

(iv) ICT third-party service providers providing ICT services solely in one Member State to financial entities that are only active in that Member State.

9. The ESAs, through the Joint Committee, shall establish, publish and update yearly the list of critical ICT third-party service providers at Union level.

10. For the purposes of paragraph 1, point (a), competent authorities shall, on a yearly and aggregated basis, transmit the reports referred to in Article 28(3), third subparagraph, to the Oversight Forum established pursuant to Article 32. The Oversight Forum shall assess the ICT third-party dependencies of financial entities based on the information received from the competent authorities.

11. The ICT third-party service providers that are not included in the list referred to in paragraph 9 may request to be designated as critical in accordance with paragraph 1, point (a).

For the purpose of the first subparagraph, the ICT third-party service provider shall submit a reasoned application to EBA, ESMA or EIOPA, which, through the Joint Committee, shall decide whether to designate that ICT third-party service provider as critical in accordance with paragraph 1, point (a).

The decision referred to in the second subparagraph shall be adopted and notified to the ICT third-party service provider within 6 months of receipt of the application.

12. Financial entities shall only make use of the services of an ICT third-party service provider established in a third country and which has been designated as critical in accordance with paragraph 1, point (a), if the latter has established a subsidiary in the Union within the 12 months following the designation.

13. The critical ICT third-party service provider referred to in paragraph 12 shall notify the Lead Overseer of any changes to the structure of the management of the subsidiary established in the Union.

中文参考译文

1. 欧洲监管当局应通过联合委员会，并根据依第32条第1款设立的监督论坛建议：

(a) 在考虑第2款标准完成评估后，指定对金融实体具有关键意义的ICT第三方服务提供者；

(b) 为每家关键ICT第三方服务提供者指定牵头监督机构：根据使用该提供者服务的全部金融实体资产总值，以及各实体单体资产负债表合计显示的资产份额，选择依据条例（EU）第1093/2010号、第1094/2010号或第1095/2010号，负责监管合计资产份额最大之金融实体的欧洲监管当局。

2. 第1款(a)项指定，应以提供者所提供ICT服务相关的下列全部标准为基础：

(a) 提供者大规模运营失效、不能提供服务时，对金融服务提供的稳定性、连续性或质量造成的系统性影响，考虑其服务的金融实体数量及这些实体的资产总值；

(b) 依赖提供者的金融实体之系统性特征或重要性，按下列参数评估：

(i) 依赖该提供者的全球系统重要性机构（G-SIIs）或其他系统重要性机构（O-SIIs）数量；

(ii) (i)目所述机构与其他金融实体的相互依赖，包括其向其他金融实体提供金融基础设施服务的情况；

(c) 在最终涉及同一ICT第三方服务提供者的关键或重要功能方面，金融实体对有关提供者服务的依赖，无论是直接依赖，还是通过分包安排间接依赖；

(d) 提供者的可替代程度，考虑：

(i) 由于特定市场活跃提供者数量有限、有关提供者市场份额、所涉技术复杂性或精巧程度，包括任何专有技术，或者提供者组织或活动特殊性，而缺乏真正替代方案，即使部分替代也不可得；

(ii) 由于迁移可能涉及重大财务成本、时间或其他资源，或者迁移可能增加金融实体面临的ICT风险或其他操作风险，而难以将相关数据和工作负载部分或全部迁移至另一提供者。

3. ICT第三方服务提供者属于集团时，应就整个集团提供的ICT服务考虑第2款标准。

4. 属于集团的关键ICT第三方服务提供者应指定一个法人作为协调联络点，确保适当代表及与牵头监督机构沟通。

5. 牵头监督机构应向提供者通知导致第1款(a)项指定的评估结果。自通知之日起六周内，提供者可以提交附有理由的陈述，提供与评估有关的任何信息。

牵头监督机构应考虑该陈述，并可以要求在收到陈述后30个日历日内提交补充信息。

指定提供者为关键后，欧洲监管当局应通过联合委员会通知该指定及实际开始监督活动的日期。开始日期不得晚于通知后一个月。提供者应将其关键指定情况通知所服务的金融实体。

6. 授权委员会依第57条，在2024年7月17日前通过授权法案，进一步明确本条第2款标准，补充本条例。

7. 委员会依第6款通过授权法案之前，不得实施第1款(a)项所述指定。

8. 第1款(a)项指定不适用于：

(i) 向其他金融实体提供ICT服务的金融实体；

(ii) 已适用为支持《欧洲联盟运行条约》第127条第2款任务而建立之监督框架的ICT第三方服务提供者；

(iii) ICT集团内部服务提供者；

(iv) 仅在一个成员国内，向仅在该成员国活动的金融实体提供ICT服务的第三方服务提供者。

9. 欧洲监管当局应通过联合委员会建立、公布并每年更新欧盟层面关键ICT第三方服务提供者名单。

10. 为适用第1款(a)项，主管机关应每年以汇总方式，将第28条第3款第三分段所述报告传送依第32条设立的监督论坛。监督论坛应根据收到的信息评估金融实体的ICT第三方依赖。

11. 未列入第9款名单的ICT第三方服务提供者，可以申请依第1款(a)项被指定为关键。

为此，提供者应向EBA、ESMA或EIOPA提交附有理由的申请；相关当局应通过联合委员会决定是否依第1款(a)项作出关键指定。

应在收到申请后六个月内作出第二分段所述决定，并通知提供者。

12. 对设立于第三国并依第1款(a)项被指定为关键的ICT第三方服务提供者，只有其在被指定后的12个月内在欧盟设立子公司，金融实体才可使用其服务。

13. 第12款所述关键ICT第三方服务提供者，应将欧盟子公司管理结构的任何变化通知牵头监督机构。

查看法规原文

第32条 监督框架结构 / Article 32 — Structure of the Oversight Framework

展开第32条英中对照

English

1. The Joint Committee, in accordance with Article 57(1) of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, shall establish the Oversight Forum as a sub-committee for the purposes of supporting the work of the Joint Committee and of the Lead Overseer referred to in Article 31(1), point (b), in the area of ICT third-party risk across financial sectors. The Oversight Forum shall prepare the draft joint positions and the draft common acts of the Joint Committee in that area.

The Oversight Forum shall regularly discuss relevant developments on ICT risk and vulnerabilities and promote a consistent approach in the monitoring of ICT third-party risk at Union level.

2. The Oversight Forum shall, on a yearly basis, undertake a collective assessment of the results and findings of the oversight activities conducted for all critical ICT third-party service providers and promote coordination measures to increase the digital operational resilience of financial entities, foster best practices on addressing ICT concentration risk and explore mitigants for cross-sector risk transfers.

3. The Oversight Forum shall submit comprehensive benchmarks for critical ICT third-party service providers to be adopted by the Joint Committee as joint positions of the ESAs in accordance with Article 56(1) of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

4. The Oversight Forum shall be composed of:

(a) the Chairpersons of the ESAs;

(b) one high-level representative from the current staff of the relevant competent authority referred to in Article 46 from each Member State;

(c) the Executive Directors of each ESA and one representative from the Commission, from the ESRB, from ECB and from ENISA as observers;

(d) where appropriate, one additional representative of a competent authority referred to in Article 46 from each Member State as observer;

(e) where applicable, one representative of the competent authorities designated or established in accordance with Directive (EU) 2022/2555 responsible for the supervision of an essential or important entity subject to that Directive, which has been designated as a critical ICT third-party service provider, as observer.

The Oversight Forum may, where appropriate, seek the advice of independent experts appointed in accordance with paragraph 6.

5. Each Member State shall designate the relevant competent authority whose staff member shall be the high-level representative referred in paragraph 4, first subparagraph, point (b), and shall inform the Lead Overseer thereof.

The ESAs shall publish on their website the list of high-level representatives from the current staff of the relevant competent authority designated by Member States.

6. The independent experts referred to in paragraph 4, second subparagraph, shall be appointed by the Oversight Forum from a pool of experts selected following a public and transparent application process.

The independent experts shall be appointed on the basis of their expertise in financial stability, digital operational resilience and ICT security matters. They shall act independently and objectively in the sole interest of the Union as a whole and shall neither seek nor take instructions from Union institutions or bodies, from any government of a Member State or from any other public or private body.

7. In accordance with Article 16 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, the ESAs shall by 17 July 2024 issue, for the purposes of this Section, guidelines on the cooperation between the ESAs and the competent authorities covering the detailed procedures and conditions for the allocation and execution of tasks between competent authorities and the ESAs and the details on the exchanges of information which are necessary for competent authorities to ensure the follow-up of recommendations pursuant to Article 35(1), point (d), addressed to critical ICT third-party service providers.

8. The requirements set out in this Section shall be without prejudice to the application of Directive (EU) 2022/2555 and of other Union rules on oversight applicable to providers of cloud computing services.

9. The ESAs, through the Joint Committee and based on preparatory work conducted by the Oversight Forum, shall, on yearly basis, submit a report on the application of this Section to the European Parliament, the Council and the Commission.

中文参考译文

1. 联合委员会应依条例（EU）第1093/2010号、第1094/2010号及第1095/2010号第57条第1款，设立监督论坛作为分委员会，支持联合委员会及第31条第1款(b)项所述牵头监督机构在跨金融行业ICT第三方风险领域的工作。监督论坛应为该领域准备联合委员会共同立场及共同行为草案。

监督论坛应定期讨论ICT风险和脆弱性的有关发展，促进欧盟层面ICT第三方风险监测方法一致。

2. 监督论坛应每年对针对所有关键ICT第三方服务提供者开展监督活动的结果和发现进行集体评估，促进提高金融实体数字运营韧性的协调措施，推动应对ICT集中风险的最佳实践，并研究缓解跨行业风险传递的措施。

3. 监督论坛应提交关键ICT第三方服务提供者的全面基准，由联合委员会依上述三部条例第56条第1款，作为欧洲监管当局共同立场通过。

4. 监督论坛由下列人员组成：

(a) 各欧洲监管当局主席；

(b) 每个成员国第46条所述有关主管机关现职人员中的一名高级代表；

(c) 各欧洲监管当局执行主任，以及委员会、ESRB、ECB和ENISA各一名代表，作为观察员；

(d) 在适当情况下，每个成员国第46条所述主管机关另增一名代表，作为观察员；

(e) 在适用情况下，依指令（EU）2022/2555指定或设立、负责监管已被指定为关键ICT第三方服务提供者之基本或重要实体的主管机关的一名代表，作为观察员。

监督论坛可在适当情况下征询依第6款聘任的独立专家意见。

5. 各成员国应指定有关主管机关，由其现职人员担任第4款第一分段(b)项所述高级代表，并告知牵头监督机构。

欧洲监管当局应在其网站公布各成员国指定主管机关现职高级代表的名单。

6. 第4款第二分段所述独立专家，由监督论坛从经公开、透明申请程序选出的专家库中聘任。

应依据其在金融稳定、数字运营韧性及ICT安全方面的专长聘任专家。专家应独立、客观地仅为欧盟整体利益行事，不得向欧盟机构或机关、成员国政府或任何其他公私机构寻求或接受指示。

7. 欧洲监管当局应依上述三部条例第16条，在2024年7月17日前，为适用本节发布与主管机关合作的指南，涵盖双方任务分配及执行的详细程序和条件，以及主管机关为跟进第35条第1款(d)项向关键ICT第三方服务提供者提出的建议所必需的信息交换细节。

8. 本节要求不影响指令（EU）2022/2555及其他适用于云计算服务提供者的欧盟监督规则的适用。

9. 欧洲监管当局应通过联合委员会，根据监督论坛的准备工作，每年向欧洲议会、理事会和委员会提交本节适用情况报告。

第33条 牵头监督机构的任务 / Article 33 — Tasks of the Lead Overseer

展开第33条英中对照

English

1. The Lead Overseer, appointed in accordance with Article 31(1), point (b), shall conduct the oversight of the assigned critical ICT third-party service providers and shall be, for the purposes of all matters related to the oversight, the primary point of contact for those critical ICT third-party service providers.

2. For the purposes of paragraph 1, the Lead Overseer shall assess whether each critical ICT third-party service provider has in place comprehensive, sound and effective rules, procedures, mechanisms and arrangements to manage the ICT risk which it may pose to financial entities.

The assessment referred to in the first subparagraph shall focus mainly on ICT services provided by the critical ICT third-party service provider supporting the critical or important functions of financial entities. Where necessary to address all relevant risks, that assessment shall extend to ICT services supporting functions other than those that are critical or important.

3. The assessment referred to in paragraph 2 shall cover:

(a) ICT requirements to ensure, in particular, the security, availability, continuity, scalability and quality of services which the critical ICT third-party service provider provides to financial entities, as well as the ability to maintain at all times high standards of availability, authenticity, integrity or confidentiality of data;

(b) the physical security contributing to ensuring the ICT security, including the security of premises, facilities, data centres;

(c) the risk management processes, including ICT risk management policies, ICT business continuity policy and ICT response and recovery plans;

(d) the governance arrangements, including an organisational structure with clear, transparent and consistent lines of responsibility and accountability rules enabling effective ICT risk management;

(e) the identification, monitoring and prompt reporting of material ICT-related incidents to financial entities, the management and resolution of those incidents, in particular cyber-attacks;

(f) the mechanisms for data portability, application portability and interoperability, which ensure an effective exercise of termination rights by the financial entities;

(g) the testing of ICT systems, infrastructure and controls;

(h) the ICT audits;

(i) the use of relevant national and international standards applicable to the provision of its ICT services to the financial entities.

4. Based on the assessment referred to in paragraph 2, and in coordination with the Joint Oversight Network (JON) referred to in Article 34(1), the Lead Overseer shall adopt a clear, detailed and reasoned individual oversight plan describing the annual oversight objectives and the main oversight actions planned for each critical ICT third-party service provider. That plan shall be communicated yearly to the critical ICT third-party service provider.

Prior to the adoption of the oversight plan, the Lead Overseer shall communicate the draft oversight plan to the critical ICT third-party service provider.

Upon receipt of the draft oversight plan, the critical ICT third-party service provider may submit a reasoned statement within 15 calendar days evidencing the expected impact on customers which are entities falling outside of the scope of this Regulation and where appropriate, formulating solutions to mitigate risks.

5. Once the annual oversight plans referred to in paragraph 4 have been adopted and notified to the critical ICT third-party service providers, competent authorities may take measures concerning such critical ICT third-party service providers only in agreement with the Lead Overseer.

中文参考译文

1. 依第31条第1款(b)项指定的牵头监督机构，应监督分配给它的关键ICT第三方服务提供者，并就全部监督相关事项担任这些提供者的主要联络点。

2. 为适用第1款，牵头监督机构应评估每家关键提供者是否具备全面、健全及有效的规则、程序、机制和安排，以管理其可能给金融实体带来的ICT风险。

第一分段评估应主要聚焦于提供者所提供、支持金融实体关键或重要功能的ICT服务。为应对所有有关风险确有必要时，评估应扩展至支持其他功能的ICT服务。

3. 第2款评估应覆盖：

(a) 确保提供者向金融实体提供服务的安全、可用性、连续性、可扩展性和质量的ICT要求，以及始终维持数据可用性、真实性、完整性或保密性高标准的能力；

(b) 有助于ICT安全的物理安全，包括场所、设施和数据中心安全；

(c) 风险管理流程，包括ICT风险管理政策、ICT业务连续性政策及ICT响应和恢复计划；

(d) 治理安排，包括具有清晰、透明和一致责任链及问责规则的组织结构，使ICT风险管理有效开展；

(e) 识别、监测并及时向金融实体报告重大ICT相关事件，以及管理和解决这些事件，特别是网络攻击；

(f) 确保金融实体有效行使终止权的数据可携带性、应用可迁移性及互操作机制；

(g) ICT系统、基础设施及控制措施测试；

(h) ICT审计；

(i) 采用适用于向金融实体提供ICT服务的有关国家及国际标准。

4. 牵头监督机构应根据第2款评估，并与第34条第1款联合监督网络（JON）协调，制定清晰、详细且附有理由的单独监督计划，说明每家关键提供者的年度监督目标和拟开展的主要行动。应每年向提供者传达该计划。

通过监督计划前，应向提供者传达计划草案。

收到草案后，关键提供者可以在15个日历日内提交附有理由的陈述，以证据说明对本条例范围之外实体客户的预期影响，并在适当情况下提出缓解风险的方案。

5. 第4款年度监督计划通过并通知提供者后，主管机关仅可在与牵头监督机构达成一致的情况下，对该提供者采取措施。

第34条 牵头监督机构之间的运行协调 / Article 34 — Operational coordination between Lead Overseers

展开第34条英中对照

English

1. To ensure a consistent approach to oversight activities and with a view to enabling coordinated general oversight strategies and cohesive operational approaches and work methodologies, the three Lead Overseers appointed in accordance with Article 31(1), point (b), shall set up a JON to coordinate among themselves in the preparatory stages and to coordinate the conduct of oversight activities over their respective overseen critical ICT third-party service providers, as well as in the course of any action that may be needed pursuant to Article 42.

2. For the purposes of paragraph 1, the Lead Overseers shall draw up a common oversight protocol specifying the detailed procedures to be followed for carrying out the day-to-day coordination and for ensuring swift exchanges and reactions. The protocol shall be periodically revised to reflect operational needs, in particular the evolution of practical oversight arrangements.

3. The Lead Overseers may, on an ad-hoc basis, call on the ECB and ENISA to provide technical advice, share hands-on experience or join specific coordination meetings of the JON.

中文参考译文

1. 为确保监督方法一致，使总体监督战略协调、运行方法和工作方法衔接，依第31条第1款(b)项指定的三家牵头监督机构应设立JON，在准备阶段协调彼此工作，协调对各自负责关键ICT第三方服务提供者的监督活动，以及依第42条可能需要开展的行动。

2. 为此，牵头监督机构应制定共同监督协议，明确日常协调及确保迅速交换信息和反应所需的详细程序。应定期修订该协议以反映运行需要，特别是实际监督安排的演变。

3. 牵头监督机构可以按具体情况邀请ECB和ENISA提供技术意见、分享实践经验，或者参加JON特定协调会议。

查看法规原文

第35条 牵头监督机构的权力 / Article 35 — Powers of the Lead Overseer

展开第35条英中对照

English

1. For the purposes of carrying out the duties laid down in this Section, the Lead Overseer shall have the following powers in respect of the critical ICT third-party service providers:

(a) to request all relevant information and documentation in accordance with Article 37;

(b) to conduct general investigations and inspections in accordance with Articles 38 and 39, respectively;

(c) to request, after the completion of the oversight activities, reports specifying the actions that have been taken or the remedies that have been implemented by the critical ICT third-party service providers in relation to the recommendations referred to in point (d) of this paragraph;

(d) to issue recommendations on the areas referred to in Article 33(3), in particular concerning the following:

(i) the use of specific ICT security and quality requirements or processes, in particular in relation to the roll-out of patches, updates, encryption and other security measures which the Lead Overseer deems relevant for ensuring the ICT security of services provided to financial entities;

(ii) the use of conditions and terms, including their technical implementation, under which the critical ICT third-party service providers provide ICT services to financial entities, which the Lead Overseer deems relevant for preventing the generation of single points of failure, the amplification thereof, or for minimising the possible systemic impact across the Union’s financial sector in the event of ICT concentration risk;

(iii) any planned subcontracting, where the Lead Overseer deems that further subcontracting, including subcontracting arrangements which the critical ICT third-party service providers plan to enter into with ICT third-party service providers or with ICT subcontractors established in a third country, may trigger risks for the provision of services by the financial entity, or risks to the financial stability, based on the examination of the information gathered in accordance with Articles 37 and 38;

(iv) refraining from entering into a further subcontracting arrangement, where the following cumulative conditions are met:

— the envisaged subcontractor is an ICT third-party service provider or an ICT subcontractor established in a third country;

— the subcontracting concerns critical or important functions of the financial entity; and

— the Lead Overseer deems that the use of such subcontracting poses a clear and serious risk to the financial stability of the Union or to financial entities, including to the ability of financial entities to comply with supervisory requirements.

For the purpose of point (iv) of this point, ICT third-party service providers shall, using the template referred to in Article 41(1), point (b), transmit the information regarding subcontracting to the Lead Overseer.

2. When exercising the powers referred to in this Article, the Lead Overseer shall:

(a) ensure regular coordination within the JON, and in particular shall seek consistent approaches, as appropriate, with regard to the oversight of critical ICT third-party service providers;

(b) take due account of the framework established by Directive (EU) 2022/2555 and, where necessary, consult the relevant competent authorities designated or established in accordance with that Directive, in order to avoid duplication of technical and organisational measures that might apply to critical ICT third-party service providers pursuant to that Directive;

(c) seek to minimise, to the extent possible, the risk of disruption to services provided by critical ICT third-party service providers to customers that are entities falling outside the scope of this Regulation.

3. The Lead Overseer shall consult the Oversight Forum before exercising the powers referred to in paragraph 1.

Before issuing recommendations in accordance with paragraph 1, point (d), the Lead Overseer shall give the opportunity to the ICT third-party service provider to provide, within 30 calendar days, relevant information evidencing the expected impact on customers that are entities falling outside the scope of this Regulation and, where appropriate, formulating solutions to mitigate risks.

4. The Lead Overseer shall inform the JON of the outcome of the exercise of the powers referred to in paragraph 1, points (a) and (b). The Lead Overseer shall, without undue delay, transmit the reports referred to in paragraph 1, point (c), to the JON and to the competent authorities of the financial entities using the ICT services of that critical ICT third-party service provider.

5. Critical ICT third-party service providers shall cooperate in good faith with the Lead Overseer, and assist it in the fulfilment of its tasks.

6. In the event of whole or partial non-compliance with the measures required to be taken pursuant to the exercise of the powers under paragraph 1, points (a), (b) and (c), and after the expiry of a period of at least 30 calendar days from the date on which the critical ICT third-party service provider received notification of the respective measures, the Lead Overseer shall adopt a decision imposing a periodic penalty payment to compel the critical ICT third-party service provider to comply with those measures.

7. The periodic penalty payment referred to in paragraph 6 shall be imposed on a daily basis until compliance is achieved and for no more than a period of six months following the notification of the decision to impose a periodic penalty payment to the critical ICT third-party service provider.

8. The amount of the periodic penalty payment, calculated from the date stipulated in the decision imposing the periodic penalty payment, shall be up to 1 % of the average daily worldwide turnover of the critical ICT third-party service provider in the preceding business year. When determining the amount of the penalty payment, the Lead Overseer shall take into account the following criteria regarding non-compliance with the measures referred to in paragraph 6:

(a) the gravity and the duration of non-compliance;

(b) whether non-compliance has been committed intentionally or negligently;

(c) the level of cooperation of the ICT third-party service provider with the Lead Overseer.

For the purposes of the first subparagraph, in order to ensure a consistent approach, the Lead Overseer shall engage in consultation within the JON.

9. Penalty payments shall be of an administrative nature and shall be enforceable. Enforcement shall be governed by the rules of civil procedure in force in the Member State on the territory of which inspections and access shall be carried out. Courts of the Member State concerned shall have jurisdiction over complaints related to irregular conduct of enforcement. The amounts of the penalty payments shall be allocated to the general budget of the European Union.

10. The Lead Overseer shall disclose to the public every periodic penalty payment that has been imposed, unless such disclosure would seriously jeopardise the financial markets or cause disproportionate damage to the parties involved.

11. Before imposing a periodic penalty payment under paragraph 6, the Lead Overseer shall give the representatives of the critical ICT third-party service provider subject to the proceedings the opportunity to be heard on the findings and shall base its decisions only on findings on which the critical ICT third-party service provider subject to the proceedings has had an opportunity to comment.

The rights of the defence of the persons subject to the proceedings shall be fully respected in the proceedings. The critical ICT third-party service provider subject to the proceedings shall be entitled to have access to the file, subject to the legitimate interest of other persons in the protection of their business secrets. The right of access to the file shall not extend to confidential information or to the Lead Overseer’s internal preparatory documents.

中文参考译文

1. 为履行本节职责，牵头监督机构对关键ICT第三方服务提供者具有下列权力：

(a) 依第37条要求提供所有有关信息和文件；

(b) 分别依第38条及第39条开展一般调查和检查；

(c) 监督活动完成后，要求提供者报告针对本款(d)项建议已采取的行动或已实施的补救；

(d) 就第33条第3款所述领域提出建议，尤其涉及：

(i) 使用特定ICT安全和质量要求或流程，特别是部署补丁、更新、加密，以及牵头监督机构认为与确保向金融实体提供服务的ICT安全有关的其他安全措施；

(ii) 使用牵头监督机构认为有助于防止单点故障产生或扩大，或者在ICT集中风险发生时尽量减少对整个欧盟金融部门潜在系统性影响的服务条件和条款，包括其技术实施；

(iii) 根据审查依第37条及第38条收集的信息，如果认为进一步分包，包括提供者计划与ICT第三方服务提供者或设立于第三国的ICT分包商订立的安排，可能对金融实体服务提供或金融稳定产生风险，则就任何计划中的分包提出建议；

(iv) 同时满足下列条件时，建议不再订立进一步分包安排：

— 拟议分包商为设立于第三国的ICT第三方服务提供者或ICT分包商；

— 分包涉及金融实体关键或重要功能；以及

— 牵头监督机构认为使用这种分包对欧盟金融稳定或金融实体，包括其遵守监管要求的能力，构成明显且严重的风险。

为适用本项(iv)目，ICT第三方服务提供者应使用第41条第1款(b)项模板，向牵头监督机构传送分包信息。

2. 行使本条权力时，牵头监督机构应：

(a) 确保在JON内定期协调，尤其应适当寻求对关键提供者监督方法的一致性；

(b) 充分考虑指令（EU）2022/2555建立的框架，并在必要时征询依该指令指定或设立的有关主管机关意见，避免重复适用该指令可能要求关键提供者采取的技术和组织措施；

(c) 尽可能降低关键提供者向本条例范围之外实体客户提供服务的中断风险。

3. 行使第1款权力前，牵头监督机构应征询监督论坛意见。

依第1款(d)项提出建议前，应给予提供者机会，在30个日历日内提交相关信息，以证据说明对本条例范围之外实体客户的预期影响，并在适当情况下提出风险缓解方案。

4. 牵头监督机构应将行使第1款(a)、(b)项权力的结果告知JON，并应不无故拖延地将第1款(c)项报告传送JON，以及使用该关键提供者ICT服务的金融实体的主管机关。

5. 关键ICT第三方服务提供者应诚信地与牵头监督机构合作，协助其履行任务。

6. 如果全部或部分未遵守根据第1款(a)、(b)、(c)项权力要求采取的措施，并且自提供者收到有关措施通知之日起已过至少30个日历日，牵头监督机构应作出处以按期罚款的决定，迫使其遵守措施。

7. 第6款罚款应按日计处，直至达到遵守要求的状态；自向提供者通知罚款决定后，计罚期间最长不得超过六个月。

8. 罚款从决定所定日期开始计算，金额最高可达提供者上一营业年度全球日均营业额的1%。确定罚款金额时，牵头监督机构应考虑不遵守第6款措施的以下标准：

(a) 严重程度和持续时间；

(b) 属于故意还是过失；

(c) 提供者与牵头监督机构的合作程度。

为确保方法一致，适用第一分段时，牵头监督机构应在JON内磋商。

9. 罚款具有行政性质并应可执行。执行适用实施检查和访问所在成员国现行民事诉讼规则。有关成员国法院有权管辖对执行不当行为的申诉。罚款收入归入欧盟总预算。

10. 牵头监督机构应公开每项已处以的按期罚款，除非公开会严重危及金融市场，或者对有关各方造成不成比例的损害。

11. 依第6款处以罚款前，应给予程序所涉提供者的代表机会，就调查发现陈述意见；决定仅可依据该提供者已有机会评论的发现作出。

程序中应充分尊重所涉主体的辩护权。在保护其他主体商业秘密之正当利益的前提下，程序所涉提供者有权查阅案卷；该权利不包括保密信息或牵头监督机构的内部准备文件。

第36条 在欧盟以外行使牵头监督机构权力 / Article 36 — Exercise of the powers of the Lead Overseer outside the Union

展开第36条英中对照

English

1. When oversight objectives cannot be attained by means of interacting with the subsidiary set up for the purpose of Article 31(12), or by exercising oversight activities on premises located in the Union, the Lead Overseer may exercise the powers, referred to in the following provisions, on any premises located in a third-country which is owned, or used in any way, for the purposes of providing services to Union financial entities, by a critical ICT third-party service provider, in connection with its business operations, functions or services, including any administrative, business or operational offices, premises, lands, buildings or other properties:

(a) in Article 35(1), point (a); and

(b) in Article 35(1), point (b), in accordance with Article 38(2), points (a), (b) and (d), and in Article 39(1) and (2), point (a).

The powers referred to in the first subparagraph may be exercised subject to all of the following conditions:

(i) the conduct of an inspection in a third-country is deemed necessary by the Lead Overseer to allow it to fully and effectively perform its duties under this Regulation;

(ii) the inspection in a third-country is directly related to the provision of ICT services to financial entities in the Union;

(iii) the critical ICT third-party service provider concerned consents to the conduct of an inspection in a third-country; and

(iv) the relevant authority of the third-country concerned has been officially notified by the Lead Overseer and raised no objection thereto.

2. Without prejudice to the respective competences of the Union institutions and of Member States, for the purposes of paragraph 1, EBA, ESMA or EIOPA shall conclude administrative cooperation arrangements with the relevant authority of the third country in order to enable the smooth conduct of inspections in the third country concerned by the Lead Overseer and its designated team for its mission in that third country.

Those cooperation arrangements shall not create legal obligations in respect of the Union and its Member States nor shall they prevent Member States and their competent authorities from concluding bilateral or multilateral arrangements with those third countries and their relevant authorities.

Those cooperation arrangements shall specify at least the following elements:

(a) the procedures for the coordination of oversight activities carried out under this Regulation and any analogous monitoring of ICT third-party risk in the financial sector exercised by the relevant authority of the third country concerned, including details for transmitting the agreement of the latter to allow the conduct, by the Lead Overseer and its designated team, of general investigations and on-site inspections as referred to in paragraph 1, first subparagraph, on the territory under its jurisdiction;

(b) the mechanism for the transmission of any relevant information between EBA, ESMA or EIOPA and the relevant authority of the third country concerned, in particular in connection with information that may be requested by the Lead Overseer pursuant to Article 37;

(c) the mechanisms for the prompt notification by the relevant authority of the third-country concerned to EBA, ESMA or EIOPA of cases where an ICT third-party service provider established in a third country and designated as critical in accordance with Article 31(1), point (a), is deemed to have infringed the requirements to which it is obliged to adhere pursuant to the applicable law of the third country concerned when providing services to financial institutions in that third country, as well as the remedies and penalties applied;

(d) the regular transmission of updates on regulatory or supervisory developments on the monitoring of ICT third-party risk of financial institutions in the third country concerned;

(e) the details for allowing, if needed, the participation of one representative of the relevant third-country authority in the inspections conducted by the Lead Overseer and the designated team.

3. When the Lead Overseer is not able to conduct oversight activities outside the Union, referred to in paragraphs 1 and 2, the Lead Overseer shall:

(a) exercise its powers under Article 35 on the basis of all facts and documents available to it;

(b) document and explain any consequence of its inability to conduct the envisaged oversight activities as referred to in this Article.

The potential consequences referred to in point (b) of this paragraph shall be taken into consideration in the Lead Overseer’s recommendations issued pursuant to Article 35(1), point (d).

中文参考译文

1. 如果通过与为适用第31条第12款设立的子公司互动，或者在欧盟内场所开展监督活动，无法实现监督目标，牵头监督机构可以就关键ICT第三方服务提供者为向欧盟金融实体提供服务而拥有或以任何方式使用的、位于第三国且与其业务运营、功能或服务有关的场所，行使下列条款权力，包括行政、业务或运营办公室、场所、土地、建筑物或其他财产：

(a) 第35条第1款(a)项；以及

(b) 按照第38条第2款(a)、(b)、(d)项及第39条第1款和第2款(a)项，行使第35条第1款(b)项权力。

行使第一分段权力须同时满足：

(i) 牵头监督机构认为在第三国检查对于全面、有效履行本条例职责是必要的；

(ii) 检查直接涉及向欧盟金融实体提供ICT服务；

(iii) 有关关键ICT第三方服务提供者同意在第三国开展检查；以及

(iv) 牵头监督机构已正式通知有关第三国机关，且其未提出反对。

2. 在不影响欧盟机构与成员国各自权限的前提下，为适用第1款，EBA、ESMA或EIOPA应与第三国有关机关订立行政合作安排，使牵头监督机构及其指定任务团队能够顺利在该国开展检查。

这些安排不得对欧盟及成员国产生法律义务，也不得妨碍成员国和其主管机关与上述第三国及其有关机关订立双边或多边安排。

合作安排至少应明确：

(a) 协调本条例监督活动与第三国有关机关对金融部门ICT第三方风险开展类似监测的程序，包括传送该机关同意的具体安排，使牵头监督机构及指定团队能在该国管辖领土开展第1款第一分段所述一般调查及现场检查；

(b) EBA、ESMA或EIOPA与第三国有关机关传送有关信息的机制，尤其涉及牵头监督机构依第37条可能要求的信息；

(c) 第三国有关机关及时向EBA、ESMA或EIOPA通知以下情况的机制：设立于第三国且依第31条第1款(a)项被指定为关键的提供者，在向该国金融机构提供服务时，被认为违反其依该国适用法律须遵守的要求，以及所采取补救和处罚；

(d) 定期传送该第三国监测金融机构ICT第三方风险之监管发展更新；

(e) 在需要时，允许第三国有关机关一名代表参加牵头监督机构和指定团队检查的具体安排。

3. 无法开展第1款和第2款所述欧盟外监督活动时，牵头监督机构应：

(a) 根据其可获得的全部事实和文件，行使第35条权力；

(b) 记录并说明无法开展本条拟议监督活动的任何后果。

依第35条第1款(d)项提出建议时，应考虑本款(b)项所述潜在后果。

查看法规原文

第37条 信息请求 / Article 37 — Request for information

展开第37条英中对照

English

1. The Lead Overseer may, by simple request or by decision, require critical ICT third-party service providers to provide all information that is necessary for the Lead Overseer to carry out its duties under this Regulation, including all relevant business or operational documents, contracts, policies, documentation, ICT security audit reports, ICT-related incident reports, as well as any information relating to parties to whom the critical ICT third-party service provider has outsourced operational functions or activities.

2. When sending a simple request for information under paragraph 1, the Lead Overseer shall:

(a) refer to this Article as the legal basis of the request;

(b) state the purpose of the request;

(c) specify what information is required;

(d) set a time limit within which the information is to be provided;

(e) inform the representative of the critical ICT third-party service provider from whom the information is requested that he or she is not obliged to provide the information, but in the event of a voluntary reply to the request the information provided must not be incorrect or misleading.

3. When requiring by decision to supply information under paragraph 1, the Lead Overseer shall:

(a) refer to this Article as the legal basis of the request;

(b) state the purpose of the request;

(c) specify what information is required;

(d) set a time limit within which the information is to be provided;

(e) indicate the periodic penalty payments provided for in Article 35(6) where the production of the required information is incomplete or when such information is not provided within the time limit referred to in point (d) of this paragraph;

(f) indicate the right to appeal the decision to ESA’s Board of Appeal and to have the decision reviewed by the Court of Justice of the European Union (Court of Justice) in accordance with Articles 60 and 61 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

4. The representatives of the critical ICT third-party service providers shall supply the information requested. Lawyers duly authorised to act may supply the information on behalf of their clients. The critical ICT third-party service provider shall remain fully responsible if the information supplied is incomplete, incorrect or misleading.

5. The Lead Overseer shall, without delay, transmit a copy of the decision to supply information to the competent authorities of the financial entities using the services of the relevant critical ICT third-party service providers and to the JON.

中文参考译文

1. 牵头监督机构可以通过一般请求或决定，要求关键ICT第三方服务提供者提供其履行本条例职责所必需的全部信息，包括所有有关业务或运营文件、合同、政策、文档、ICT安全审计报告、ICT相关事件报告，以及与提供者将运营职能或活动外包给的主体有关的任何信息。

2. 依第1款发出一般信息请求时，牵头监督机构应：

(a) 引用本条作为请求的法律依据；

(b) 说明请求目的；

(c) 明确所需信息；

(d) 设定提供信息的期限；

(e) 告知被请求提供信息的关键ICT第三方服务提供者代表，其没有提供信息的义务，但自愿回复请求时，所提供信息不得错误或具有误导性。

3. 依第1款通过决定要求提供信息时，牵头监督机构应：

(a) 引用本条作为请求的法律依据；

(b) 说明请求目的；

(c) 明确所需信息；

(d) 设定提供信息的期限；

(e) 告知所提供信息不完整，或者未在本款(d)项期限内提供信息时，第35条第6款规定的按期罚款；

(f) 告知依据条例（EU）第1093/2010号、第1094/2010号和第1095/2010号第60条及第61条，向欧洲监管当局上诉委员会对决定提出上诉，以及请求欧洲联盟法院（以下简称“法院”）审查决定的权利。

4. 关键ICT第三方服务提供者的代表应提供所要求的信息。经适当授权的律师可以代表客户提供信息。如果提供的信息不完整、错误或具有误导性，关键ICT第三方服务提供者仍应承担全部责任。

5. 牵头监督机构应不拖延地将要求提供信息的决定副本，传送使用有关关键ICT第三方服务提供者服务的金融实体的主管机关及JON。

第38条 一般调查 / Article 38 — General investigations

展开第38条英中对照

English

1. In order to carry out its duties under this Regulation, the Lead Overseer, assisted by the joint examination team referred to in Article 40(1), may, where necessary, conduct investigations of critical ICT third-party service providers.

2. The Lead Overseer shall have the power to:

(a) examine records, data, procedures and any other material relevant to the execution of its tasks, irrespective of the medium on which they are stored;

(b) take or obtain certified copies of, or extracts from, such records, data, documented procedures and any other material;

(c) summon representatives of the critical ICT third-party service provider for oral or written explanations on facts or documents relating to the subject matter and purpose of the investigation and to record the answers;

(d) interview any other natural or legal person who consents to be interviewed for the purpose of collecting information relating to the subject matter of an investigation;

(e) request records of telephone and data traffic.

3. The officials and other persons authorised by the Lead Overseer for the purposes of the investigation referred to in paragraph 1 shall exercise their powers upon production of a written authorisation specifying the subject matter and purpose of the investigation.

That authorisation shall also indicate the periodic penalty payments provided for in Article 35(6) where the production of the required records, data, documented procedures or any other material, or the answers to questions asked to representatives of the ICT third-party service provider are not provided or are incomplete.

4. The representatives of the critical ICT third-party service providers are required to submit to the investigations on the basis of a decision of the Lead Overseer. The decision shall specify the subject matter and purpose of the investigation, the periodic penalty payments provided for in Article 35(6), the legal remedies available under Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, and the right to have the decision reviewed by the Court of Justice.

5. In good time before the start of the investigation, the Lead Overseer shall inform competent authorities of the financial entities using the ICT services of that critical ICT third-party service provider of the envisaged investigation and of the identity of the authorised persons.

The Lead Overseer shall communicate to the JON all information transmitted pursuant to the first subparagraph.

中文参考译文

1. 为履行本条例职责，牵头监督机构可以在第40条第1款所述联合检查团队协助下，于必要时对关键ICT第三方服务提供者开展调查。

2. 牵头监督机构有权：

(a) 审查与执行其任务有关的记录、数据、程序及其他任何材料，无论其存储介质为何；

(b) 获取或取得上述记录、数据、书面程序及其他材料经核证的副本或摘录；

(c) 传唤关键ICT第三方服务提供者代表，就与调查事项及目的有关的事实或文件作出口头或书面解释，并记录回答；

(d) 为收集与调查事项有关的信息，访谈同意接受访谈的其他自然人或法人；

(e) 要求提供电话及数据流量记录。

3. 获牵头监督机构授权开展第1款调查的工作人员及其他人员，应出示载明调查事项和目的的书面授权后行使权力。

授权书还应说明，未提供或未完整提供所要求的记录、数据、书面程序或其他材料，或者未回答或未完整回答向提供者代表提出的问题时，第35条第6款规定的按期罚款。

4. 关键ICT第三方服务提供者代表必须接受依据牵头监督机构决定开展的调查。决定应明确调查事项及目的、第35条第6款按期罚款、上述三部欧洲监管当局条例规定的法律救济，以及请求法院审查决定的权利。

5. 牵头监督机构应在调查开始前适当提前，将拟议调查及获授权人员身份，告知使用该关键提供者ICT服务的金融实体的主管机关。

牵头监督机构应将依第一分段传送的全部信息告知JON。

第39条 检查 / Article 39 — Inspections

展开第39条英中对照

English

1. In order to carry out its duties under this Regulation, the Lead Overseer, assisted by the joint examination teams referred to in Article 40(1), may enter in, and conduct all necessary onsite inspections on, any business premises, land or property of the ICT third-party service providers, such as head offices, operation centres, secondary premises, as well as to conduct off-site inspections.

For the purposes of exercising the powers referred to in the first subparagraph, the Lead Overseer shall consult the JON.

2. The officials and other persons authorised by the Lead Overseer to conduct an on-site inspection shall have the power to:

(a) enter any such business premises, land or property; and

(b) seal any such business premises, books or records, for the period of, and to the extent necessary for, the inspection.

The officials and other persons authorised by the Lead Overseer shall exercise their powers upon production of a written authorisation specifying the subject matter and the purpose of the inspection, and the periodic penalty payments provided for in Article 35(6) where the representatives of the critical ICT third-party service providers concerned do not submit to the inspection.

3. In good time before the start of the inspection, the Lead Overseer shall inform the competent authorities of the financial entities using that ICT third-party service provider.

4. Inspections shall cover the full range of relevant ICT systems, networks, devices, information and data either used for, or contributing to, the provision of ICT services to financial entities.

5. Before any planned on-site inspection, the Lead Overseer shall give reasonable notice to the critical ICT third-party service providers, unless such notice is not possible due to an emergency or crisis situation, or if it would lead to a situation where the inspection or audit would no longer be effective.

6. The critical ICT third-party service provider shall submit to on-site inspections ordered by decision of the Lead Overseer.

The decision shall specify the subject matter and purpose of the inspection, fix the date on which the inspection shall begin and shall indicate the periodic penalty payments provided for in Article 35(6), the legal remedies available under Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010, as well as the right to have the decision reviewed by the Court of Justice.

7. Where the officials and other persons authorised by the Lead Overseer find that a critical ICT third-party service provider opposes an inspection ordered pursuant to this Article, the Lead Overseer shall inform the critical ICT third-party service provider of the consequences of such opposition, including the possibility for competent authorities of the relevant financial entities to require financial entities to terminate the contractual arrangements concluded with that critical ICT third-party service provider.

中文参考译文

1. 为履行本条例职责，牵头监督机构可以在第40条第1款联合检查团队协助下，进入ICT第三方服务提供者的任何营业场所、土地或财产，例如总部、运营中心、辅助场所，开展一切必要现场检查，也可以开展非现场检查。

为行使第一分段权力，牵头监督机构应征询JON意见。

2. 获授权开展现场检查的工作人员及其他人员有权：

(a) 进入上述任何营业场所、土地或财产；以及

(b) 在检查所需期间和必要范围内，查封上述营业场所、账簿或记录。

获授权人员应出示书面授权后行使权力；授权书应载明检查事项及目的，以及有关关键提供者代表不接受检查时，第35条第6款规定的按期罚款。

3. 牵头监督机构应在检查开始前适当提前，告知使用该ICT第三方服务提供者的金融实体的主管机关。

4. 检查应覆盖用于向金融实体提供ICT服务，或者有助于提供这些服务的全部相关ICT系统、网络、设备、信息和数据。

5. 在任何计划中的现场检查前，应合理提前通知关键提供者，除非因紧急或危机情况无法通知，或者通知会使检查或审计不再有效。

6. 关键ICT第三方服务提供者应接受牵头监督机构通过决定要求开展的现场检查。

决定应明确检查事项及目的、检查开始日期、第35条第6款按期罚款、上述三部欧洲监管当局条例规定的法律救济，以及请求法院审查决定的权利。

7. 获授权工作人员或其他人员发现关键提供者抵制依本条决定的检查时，牵头监督机构应告知其抵制后果，包括有关金融实体的主管机关可能要求实体终止与该关键提供者订立的合同安排。

第40条 持续监督 / Article 40 — Ongoing oversight

展开第40条英中对照

English

1. When conducting oversight activities, in particular general investigations or inspections, the Lead Overseer shall be assisted by a joint examination team established for each critical ICT third-party service provider.

2. The joint examination team referred to in paragraph 1 shall be composed of staff members from:

(a) the ESAs;

(b) the relevant competent authorities supervising the financial entities to which the critical ICT third-party service provider provides ICT services;

(c) the national competent authority referred to in Article 32(4), point (e), on a voluntary basis;

(d) one national competent authority from the Member State where the critical ICT third-party service provider is established, on a voluntary basis.

Members of the joint examination team shall have expertise in ICT matters and in operational risk. The joint examination team shall work under the coordination of a designated Lead Overseer staff member (the ‘Lead Overseer coordinator’).

3. Within 3 months of the completion of an investigation or inspection, the Lead Overseer, after consulting the Oversight Forum, shall adopt recommendations to be addressed to the critical ICT third-party service provider pursuant to the powers referred to in Article 35.

4. The recommendations referred to in paragraph 3 shall be immediately communicated to the critical ICT third-party service provider and to the competent authorities of the financial entities to which it provides ICT services.

For the purposes of fulfilling the oversight activities, the Lead Overseer may take into consideration any relevant third-party certifications and ICT third-party internal or external audit reports made available by the critical ICT third-party service provider.

中文参考译文

1. 开展监督活动，特别是一般调查或检查时，应由为每家关键ICT第三方服务提供者组建的联合检查团队协助牵头监督机构。

2. 第1款联合检查团队由下列机构的人员组成：

(a) 欧洲监管当局；

(b) 监管该关键提供者所服务金融实体的有关主管机关；

(c) 自愿参与的第32条第4款(e)项所述本国主管机关；

(d) 自愿参与的关键提供者设立所在成员国的一家本国主管机关。

团队成员应具备ICT及操作风险专长。团队应在指定的牵头监督机构工作人员（“牵头监督协调员”）协调下开展工作。

3. 调查或检查完成后三个月内，牵头监督机构应在征询监督论坛意见后，依据第35条权力，通过向关键提供者提出的建议。

4. 第3款建议应立即传达给关键提供者及其所服务金融实体的主管机关。

为开展监督活动，牵头监督机构可以考虑关键提供者提供的任何相关第三方认证，以及ICT第三方内部或外部审计报告。

查看法规原文

第41条 开展监督活动所需条件的协调 / Article 41 — Harmonisation of conditions enabling the conduct of the oversight activities

展开第41条英中对照

English

1. The ESAs shall, through the Joint Committee, develop draft regulatory technical standards to specify:

(a) the information to be provided by an ICT third-party service provider in the application for a voluntary request to be designated as critical under Article 31(11);

(b) the content, structure and format of the information to be submitted, disclosed or reported by the ICT third-party service providers pursuant to Article 35(1), including the template for providing information on subcontracting arrangements;

(c) the criteria for determining the composition of the joint examination team ensuring a balanced participation of staff members from the ESAs and from the relevant competent authorities, their designation, tasks, and working arrangements.

(d) the details of the competent authorities’ assessment of the measures taken by critical ICT third-party service providers based on the recommendations of the Lead Overseer pursuant to Article 42(3).

2. The ESAs shall submit those draft regulatory technical standards to the Commission by 17 July 2024.

Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in paragraph 1 in accordance with the procedure laid down in Articles 10 to 14 of Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010.

中文参考译文

1. 欧洲监管当局应通过联合委员会制定监管技术标准草案，明确：

(a) ICT第三方服务提供者依第31条第11款自愿申请被指定为关键时应提供的信息；

(b) 提供者依第35条第1款须提交、披露或报告信息的内容、结构及格式，包括分包安排信息模板；

(c) 确定联合检查团队组成的标准，以确保欧洲监管当局和有关主管机关人员均衡参与，以及人员指定、任务及工作安排；

(d) 主管机关依第42条第3款，评估关键提供者根据牵头监督机构建议采取措施的详细安排。

2. 欧洲监管当局应在2024年7月17日前，将上述监管技术标准草案提交委员会。

授权委员会依条例（EU）第1093/2010号、第1094/2010号及第1095/2010号第10至14条所定程序，通过第1款监管技术标准，补充本条例。

第42条 主管机关的后续跟进 / Article 42 — Follow-up by competent authorities

展开第42条英中对照

English

1. Within 60 calendar days of the receipt of the recommendations issued by the Lead Overseer pursuant to Article 35(1), point (d), critical ICT third-party service providers shall either notify the Lead Overseer of their intention to follow the recommendations or provide a reasoned explanation for not following such recommendations. The Lead Overseer shall immediately transmit this information to the competent authorities of the financial entities concerned.

2. The Lead Overseer shall publicly disclose where a critical ICT third-party service provider fails to notify the Lead Overseer in accordance with paragraph 1 or where the explanation provided by the critical ICT third-party service provider is not deemed sufficient. The information published shall disclose the identity of the critical ICT third-party service provider as well as information on the type and nature of the non-compliance.

Such information shall be limited to what is relevant and proportionate for the purpose of ensuring public awareness, unless such publication would cause disproportionate damage to the parties involved or could seriously jeopardise the orderly functioning and integrity of financial markets or the stability of the whole or part of the financial system of the Union.

The Lead Overseer shall notify the ICT third-party service provider of that public disclosure.

3. Competent authorities shall inform the relevant financial entities of the risks identified in the recommendations addressed to critical ICT third-party service providers in accordance with Article 35(1), point (d).

When managing ICT third-party risk, financial entities shall take into account the risks referred to in the first subparagraph.

4. Where a competent authority deems that a financial entity fails to take into account or to sufficiently address within its management of ICT third-party risk the specific risks identified in the recommendations, it shall notify the financial entity of the possibility of a decision being taken, within 60 calendar days of the receipt of such notification, pursuant to paragraph 6, in the absence of appropriate contractual arrangements aiming to address such risks.

5. Upon receiving the reports referred to in Article 35(1), point (c), and prior to taking a decision as referred to in paragraph 6 of this Article, competent authorities may, on a voluntary basis, consult the competent authorities designated or established in accordance with Directive (EU) 2022/2555 responsible for the supervision of an essential or important entity subject to that Directive, which has been designated as a critical ICT third-party service provider.

6. Competent authorities may, as a measure of last resort, following the notification and, if appropriate, the consultation as set out in paragraph 4 and 5 of this Article, in accordance with Article 50, take a decision requiring financial entities to temporarily suspend, either in part or completely, the use or deployment of a service provided by the critical ICT third-party service provider until the risks identified in the recommendations addressed to critical ICT third-party service providers have been addressed.

Where necessary, they may require financial entities to terminate, in part or completely, the relevant contractual arrangements concluded with the critical ICT third-party service providers.

7. Where a critical ICT third-party service provider refuses to endorse recommendations, based on a divergent approach from the one advised by the Lead Overseer, and such a divergent approach may adversely impact a large number of financial entities, or a significant part of the financial sector, and individual warnings issued by competent authorities have not resulted in consistent approaches mitigating the potential risk to financial stability, the Lead Overseer may, after consulting the Oversight Forum, issue non-binding and non-public opinions to competent authorities, in order to promote consistent and convergent supervisory follow-up measures, as appropriate.

8. Upon receiving the reports referred to in Article 35(1), point (c), competent authorities, when taking a decision as referred to in paragraph 6 of this Article, shall take into account the type and magnitude of risk that is not addressed by the critical ICT third-party service provider, as well as the seriousness of the non-compliance, having regard to the following criteria:

(a) the gravity and the duration of the non-compliance;

(b) whether the non-compliance has revealed serious weaknesses in the critical ICT third-party service provider’s procedures, management systems, risk management and internal controls;

(c) whether a financial crime was facilitated, occasioned or is otherwise attributable to the non-compliance;

(d) whether the non-compliance has been intentional or negligent;

(e) whether the suspension or termination of the contractual arrangements introduces a risk for continuity of the financial entity’s business operations notwithstanding the financial entity’s efforts to avoid disruption in the provision of its services;

(f) where applicable, the opinion of the competent authorities designated or established in accordance with Directive (EU) 2022/2555 responsible for the supervision of an essential or important entity subject to that Directive, which has been designated as a critical ICT third-party service provider, requested on a voluntary basis in accordance with paragraph 5 of this Article.

Competent authorities shall grant financial entities the necessary period of time to enable them to adjust the contractual arrangements with critical ICT third-party service providers in order to avoid detrimental effects on their digital operational resilience and to allow them to deploy exit strategies and transition plans as referred to in Article 28.

9. The decision referred to in paragraph 6 of this Article shall be notified to the members of the Oversight Forum referred to in Article 32(4), points (a), (b) and (c), and to the JON.

The critical ICT third-party service providers affected by the decisions provided for in paragraph 6 shall fully cooperate with the financial entities impacted, in particular in the context of the process of suspension or termination of their contractual arrangements.

10. Competent authorities shall regularly inform the Lead Overseer on the approaches and measures taken in their supervisory tasks in relation to financial entities as well as on the contractual arrangements concluded by financial entities where critical ICT third-party service providers have not endorsed in part or entirely recommendations addressed to them by the Lead Overseer.

11. The Lead Overseer may, upon request, provide further clarifications on the recommendations issued to guide the competent authorities on the follow-up measures.

中文参考译文

1. 收到牵头监督机构依第35条第1款(d)项提出的建议后60个日历日内，关键ICT第三方服务提供者应通知其拟遵循建议，或者提供不遵循建议的附理由解释。牵头监督机构应立即将这些信息传送有关金融实体的主管机关。

2. 关键提供者未依第1款通知，或者其解释被认为不充分时，牵头监督机构应公开披露。公开信息应包括提供者身份及不遵守的类型和性质。

该信息应限于为使公众知情而相关且相称的范围，除非公开会对有关各方造成不成比例的损害，或者可能严重危及金融市场有序运作和完整性，或欧盟整个或部分金融体系的稳定。

牵头监督机构应将公开披露事项通知ICT第三方服务提供者。

3. 主管机关应将依第35条第1款(d)项向关键提供者提出的建议中识别出的风险，告知有关金融实体。

金融实体管理ICT第三方风险时，应考虑第一分段所述风险。

4. 主管机关认为金融实体未在ICT第三方风险管理中考虑或充分应对建议所识别的特定风险时，应通知该实体：如缺乏旨在应对这些风险的适当合同安排，可能在其收到通知后60个日历日内依第6款作出决定。

5. 收到第35条第1款(c)项报告后、作出本条第6款决定之前，主管机关可以自愿征询依指令（EU）2022/2555指定或设立、负责监管已被指定为关键ICT第三方服务提供者之基本或重要实体的主管机关意见。

6. 按本条第4款和第5款通知，并在适当时磋商后，主管机关可以作为最后手段，依第50条决定要求金融实体暂时部分或全部暂停使用或部署关键提供者的服务，直至向关键提供者提出的建议所识别风险得到解决。

必要时，可以要求金融实体部分或全部终止与关键提供者订立的有关合同安排。

7. 关键提供者基于不同于牵头监督机构建议的方法而拒绝接受建议，且这种不同方法可能不利影响大量金融实体或金融部门的重要部分，而主管机关个别警告尚未促成一致方法以缓解金融稳定潜在风险时，牵头监督机构可以在征询监督论坛意见后，向主管机关提出不具约束力且不公开的意见，以适当促进一致、趋同的监管跟进措施。

8. 收到第35条第1款(c)项报告后，主管机关作出本条第6款决定时，应考虑关键提供者尚未解决的风险类型和规模，以及不遵守的严重程度，并考虑：

(a) 不遵守的严重程度和持续时间；

(b) 是否暴露出关键提供者在程序、管理体系、风险管理及内部控制方面的严重弱点；

(c) 是否便利、引发金融犯罪，或者金融犯罪以其他方式可归因于不遵守；

(d) 属于故意还是过失；

(e) 尽管金融实体已努力避免服务中断，暂停或终止合同安排是否仍为其业务运营连续性带来风险；

(f) 在适用情况下，依本条第5款自愿征询的指令（EU）2022/2555项下主管机关的意见；该机关负责监管已被指定为关键ICT第三方服务提供者的基本或重要实体。

主管机关应给予金融实体必要时间，调整与关键提供者的合同安排，避免对数字运营韧性造成不利影响，并使其能够实施第28条退出战略及过渡计划。

9. 本条第6款决定应通知第32条第4款(a)、(b)、(c)项所述监督论坛成员及JON。

受第6款决定影响的关键提供者应与受影响金融实体充分合作，尤其是在暂停或终止合同安排的过程中。

10. 对关键提供者未部分或全部接受牵头监督机构建议的情况，主管机关应定期将其监管金融实体所采取的方法和措施，以及金融实体订立的合同安排告知牵头监督机构。

11. 牵头监督机构可以应要求进一步说明已提出的建议，以指导主管机关采取后续措施。

第43条 监督费用 / Article 43 — Oversight fees

展开第43条英中对照

English

1. The Lead Overseer shall, in accordance with the delegated act referred to in paragraph 2 of this Article, charge critical ICT third-party service providers fees that fully cover the Lead Overseer’s necessary expenditure in relation to the conduct of oversight tasks pursuant to this Regulation, including the reimbursement of any costs which may be incurred as a result of work carried out by the joint examination team referred to in Article 40, as well as the costs of advice provided by the independent experts as referred to in Article 32(4), second subparagraph, in relation to matters falling under the remit of direct oversight activities.

The amount of a fee charged to a critical ICT third-party service provider shall cover all costs derived from the execution of the duties set out in this Section and shall be proportionate to its turnover.

2. The Commission is empowered to adopt a delegated act in accordance with Article 57 to supplement this Regulation by determining the amount of the fees and the way in which they are to be paid by 17 July 2024.

中文参考译文

1. 牵头监督机构应依本条第2款授权法案，向关键ICT第三方服务提供者收费，充分覆盖依本条例开展监督任务的必要支出，包括偿付第40条联合检查团队工作可能产生的任何成本，以及第32条第4款第二分段独立专家就直接监督活动范围内事项提供意见的费用。

对关键提供者收取的费用应覆盖履行本节职责产生的全部成本，并与其营业额相称。

2. 授权委员会依第57条，在2024年7月17日前通过授权法案，确定费用金额和支付方式，补充本条例。

第44条 国际合作 / Article 44 — International cooperation

展开第44条英中对照

English

1. Without prejudice to Article 36, EBA, ESMA and EIOPA may, in accordance with Article 33 of Regulations (EU) No 1093/2010, (EU) No 1095/2010 and (EU) No 1094/2010, respectively, conclude administrative arrangements with third-country regulatory and supervisory authorities to foster international cooperation on ICT third-party risk across different financial sectors, in particular by developing best practices for the review of ICT risk management practices and controls, mitigation measures and incident responses.

2. The ESAs shall, through the Joint Committee, submit every five years a joint confidential report to the European Parliament, to the Council and to the Commission, summarising the findings of relevant discussions held with the third countries’ authorities referred to in paragraph 1, focusing on the evolution of ICT third-party risk and the implications for financial stability, market integrity, investor protection and the functioning of the internal market.

中文参考译文

1. 在不影响第36条的前提下，EBA、ESMA及EIOPA可以分别依条例（EU）第1093/2010号、第1095/2010号及第1094/2010号第33条，与第三国监管和监督机关订立行政安排，促进不同金融行业ICT第三方风险方面的国际合作，尤其通过制定审查ICT风险管理实践及控制措施、缓解措施和事件响应的最佳实践。

2. 欧洲监管当局应通过联合委员会，每五年向欧洲议会、理事会和委员会提交联合保密报告，概述与第1款第三国机关有关讨论的发现，重点关注ICT第三方风险演变及其对金融稳定、市场完整性、投资者保护和内部市场运作的影响。

第六章 信息共享安排 / CHAPTER VI — Information-sharing arrangements

第45条 网络威胁信息和情报共享安排 / Article 45 — Information-sharing arrangements on cyber threat information and intelligence

展开第45条英中对照

English

1. Financial entities may exchange amongst themselves cyber threat information and intelligence, including indicators of compromise, tactics, techniques, and procedures, cyber security alerts and configuration tools, to the extent that such information and intelligence sharing:

(a) aims to enhance the digital operational resilience of financial entities, in particular through raising awareness in relation to cyber threats, limiting or impeding the cyber threats’ ability to spread, supporting defence capabilities, threat detection techniques, mitigation strategies or response and recovery stages;

(b) takes places within trusted communities of financial entities;

(c) is implemented through information-sharing arrangements that protect the potentially sensitive nature of the information shared, and that are governed by rules of conduct in full respect of business confidentiality, protection of personal data in accordance with Regulation (EU) 2016/679 and guidelines on competition policy.

2. For the purpose of paragraph 1, point (c), the information-sharing arrangements shall define the conditions for participation and, where appropriate, shall set out the details on the involvement of public authorities and the capacity in which they may be associated to the information-sharing arrangements, on the involvement of ICT third-party service providers, and on operational elements, including the use of dedicated IT platforms.

3. Financial entities shall notify competent authorities of their participation in the information-sharing arrangements referred to in paragraph 1, upon validation of their membership, or, as applicable, of the cessation of their membership, once it takes effect.

中文参考译文

1. 在满足下列条件的范围内，金融实体可以相互交换网络威胁信息及情报，包括失陷指标、战术、技术和程序、网络安全告警及配置工具：

(a) 共享旨在增强金融实体数字运营韧性，尤其通过提高网络威胁意识、限制或阻止威胁传播能力，以及支持防御能力、威胁检测技术、缓解战略或响应及恢复阶段；

(b) 在可信的金融实体共同体内进行；

(c) 通过保护共享信息潜在敏感性的信息共享安排实施，并受充分尊重商业保密、依条例（EU）2016/679保护个人数据及竞争政策指南的行为规则管理。

2. 为适用第1款(c)项，共享安排应规定参与条件，并在适当时明确公共机关的参与及其参与身份、ICT第三方服务提供者的参与，以及包括专门IT平台使用在内的运行要素。

3. 金融实体的成员资格获确认后，应向主管机关通知参与第1款共享安排的情况；或者在适用时，于成员资格终止生效后通知终止情况。

查看法规原文

第七章 主管机关 / CHAPTER VII — Competent authorities

第46条 主管机关 / Article 46 — Competent authorities

展开第46条英中对照

English

Without prejudice to the provisions on the Oversight Framework for critical ICT third-party service providers referred to in Chapter V, Section II, of this Regulation, compliance with this Regulation shall be ensured by the following competent authorities in accordance with the powers granted by the respective legal acts:

(a) for credit institutions and for institutions exempted pursuant to Directive 2013/36/EU, the competent authority designated in accordance with Article 4 of that Directive, and for credit institutions classified as significant in accordance with Article 6(4) of Regulation (EU) No 1024/2013, the ECB in accordance with the powers and tasks conferred by that Regulation;

(b) for payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366, electronic money institutions, including those exempted pursuant to Directive 2009/110/EC, and account information service providers as referred to in Article 33(1) of Directive (EU) 2015/2366, the competent authority designated in accordance with Article 22 of Directive (EU) 2015/2366;

(c) for investment firms, the competent authority designated in accordance with Article 4 of Directive (EU) 2019/2034 of the European Parliament and of the Council (38);

(d) for crypto-asset service providers as authorised under the Regulation on markets in crypto-assets and issuers of asset-referenced tokens, the competent authority designated in accordance with the relevant provision of that Regulation;

(e) for central securities depositories, the competent authority designated in accordance with Article 11 of Regulation (EU) No 909/2014;

(f) for central counterparties, the competent authority designated in accordance with Article 22 of Regulation (EU) No 648/2012;

(g) for trading venues and data reporting service providers, the competent authority designated in accordance with Article 67 of Directive 2014/65/EU, and the competent authority as defined in Article 2(1), point (18), of Regulation (EU) No 600/2014;

(h) for trade repositories, the competent authority designated in accordance with Article 22 of Regulation (EU) No 648/2012;

(i) for managers of alternative investment funds, the competent authority designated in accordance with Article 44 of Directive 2011/61/EU;

(j) for management companies, the competent authority designated in accordance with Article 97 of Directive 2009/65/EC;

(k) for insurance and reinsurance undertakings, the competent authority designated in accordance with Article 30 of Directive 2009/138/EC;

(l) for insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries, the competent authority designated in accordance with Article 12 of Directive (EU) 2016/97;

(m) for institutions for occupational retirement provision, the competent authority designated in accordance with Article 47 of Directive (EU) 2016/2341;

(n) for credit rating agencies, the competent authority designated in accordance with Article 21 of Regulation (EC) No 1060/2009;

(o) for administrators of critical benchmarks, the competent authority designated in accordance with Articles 40 and 41 of Regulation (EU) 2016/1011;

(p) for crowdfunding service providers, the competent authority designated in accordance with Article 29 of Regulation (EU) 2020/1503;

(q) for securitisation repositories, the competent authority designated in accordance with Articles 10 and 14(1) of Regulation (EU) 2017/2402.

中文参考译文

在不影响本条例第五章第二节所述关键ICT第三方服务提供者监督框架规定的前提下，由下列主管机关依据各有关法律文件赋予的权力，确保本条例得到遵守：

(a) 对信贷机构及依据指令2013/36/EU获豁免的机构，由依该指令第4条指定的主管机关负责；对依条例（EU）第1024/2013号第6条第4款被划为重要机构的信贷机构，由ECB按该条例赋予的权力和任务负责；

(b) 对支付机构，包括依据指令（EU）2015/2366获豁免的支付机构，电子货币机构，包括依据指令2009/110/EC获豁免的机构，以及指令（EU）2015/2366第33条第1款所述账户信息服务提供者，由依指令（EU）2015/2366第22条指定的主管机关负责；

(c) 对投资公司，由依欧洲议会和理事会指令（EU）2019/2034(38)第4条指定的主管机关负责；

(d) 对依据加密资产市场条例获许可的加密资产服务提供者及资产参考代币发行人，由依该条例有关条款指定的主管机关负责；

(e) 对中央证券存管机构，由依条例（EU）第909/2014号第11条指定的主管机关负责；

(f) 对中央交易对手，由依条例（EU）第648/2012号第22条指定的主管机关负责；

(g) 对交易场所及数据报告服务提供者，由依指令2014/65/EU第67条指定的主管机关，以及条例（EU）第600/2014号第2条第1款第(18)项定义的主管机关负责；

(h) 对交易资料库，由依条例（EU）第648/2012号第22条指定的主管机关负责；

(i) 对另类投资基金管理人，由依指令2011/61/EU第44条指定的主管机关负责；

(j) 对管理公司，由依指令2009/65/EC第97条指定的主管机关负责；

(k) 对保险和再保险企业，由依指令2009/138/EC第30条指定的主管机关负责；

(l) 对保险中介、再保险中介及附属保险中介，由依指令（EU）2016/97第12条指定的主管机关负责；

(m) 对职业退休金机构，由依指令（EU）2016/2341第47条指定的主管机关负责；

(n) 对信用评级机构，由依条例（EC）第1060/2009号第21条指定的主管机关负责；

(o) 对关键基准管理人，由依条例（EU）2016/1011第40条和第41条指定的主管机关负责；

(p) 对众筹服务提供者，由依条例（EU）2020/1503第29条指定的主管机关负责；

(q) 对证券化资料库，由依条例（EU）2017/2402第10条和第14条第1款指定的主管机关负责。

第47条 与指令（EU）2022/2555设立的组织和机关合作 / Article 47 — Cooperation with structures and authorities established by Directive (EU) 2022/2555

展开第47条英中对照

English

1. To foster cooperation and enable supervisory exchanges between the competent authorities designated under this Regulation and the Cooperation Group established by Article 14 of Directive (EU) 2022/2555, the ESAs and the competent authorities may participate in the activities of the Cooperation Group for matters that concern their supervisory activities in relation to financial entities.

The ESAs and the competent authorities may request to be invited to participate in the activities of the Cooperation Group for matters in relation to essential or important entities subject to Directive (EU) 2022/2555 that have also been designated as critical ICT third-party service providers pursuant to Article 31 of this Regulation.

2. Where appropriate, competent authorities may consult and share information with the single points of contact and the CSIRTs designated or established in accordance with Directive (EU) 2022/2555.

3. Where appropriate, competent authorities may request any relevant technical advice and assistance from the competent authorities designated or established in accordance with Directive (EU) 2022/2555 and establish cooperation arrangements to allow effective and fast-response coordination mechanisms to be set up.

4. The arrangements referred to in paragraph 3 of this Article may, inter alia, specify the procedures for the coordination of supervisory and oversight activities in relation to essential or important entities subject to Directive (EU) 2022/2555 that have been designated as critical ICT third-party service providers pursuant to Article 31 of this Regulation, including for the conduct, in accordance with national law, of investigations and on-site inspections, as well as for mechanisms for the exchange of information between the competent authorities under this Regulation and the competent authorities designated or established in accordance with that Directive which includes access to information requested by the latter authorities.

中文参考译文

1. 为促进本条例项下主管机关与指令（EU）2022/2555第14条所设合作组之间的合作及监管交流，欧洲监管当局和主管机关可以就其监管金融实体的有关事项，参加合作组活动。

对于适用指令（EU）2022/2555并依本条例第31条被指定为关键ICT第三方服务提供者的基本或重要实体，欧洲监管当局和主管机关可以请求获邀参加合作组有关活动。

2. 在适当情况下，主管机关可以与依指令（EU）2022/2555指定或设立的单一联络点和CSIRTs磋商及共享信息。

3. 在适当情况下，主管机关可以向依该指令指定或设立的主管机关请求有关技术意见和协助，并建立合作安排，以形成有效、快速响应的协调机制。

4. 本条第3款安排可特别明确，就适用该指令且依本条例第31条被指定为关键ICT第三方服务提供者的基本或重要实体，协调监管及监督活动的程序，包括依国内法开展调查和现场检查，以及本条例主管机关与该指令项下主管机关的信息交换机制，包括获取后者所要求的信息。

第48条 机关之间的合作 / Article 48 — Cooperation between authorities

展开第48条英中对照

English

1. Competent authorities shall cooperate closely among themselves and, where applicable, with the Lead Overseer.

2. Competent authorities and the Lead Overseer shall, in a timely manner, mutually exchange all relevant information concerning critical ICT third-party service providers which is necessary for them to carry out their respective duties under this Regulation, in particular in relation to identified risks, approaches and measures taken as part of the Lead Overseer’s oversight tasks.

中文参考译文

1. 主管机关应相互紧密合作，并在适用情况下与牵头监督机构紧密合作。

2. 主管机关和牵头监督机构应及时相互交换履行本条例各自职责所必需的、涉及关键ICT第三方服务提供者的全部有关信息，尤其是牵头监督机构执行监督任务时识别的风险、采用的方法和措施。

第49条 金融跨行业演练、沟通与合作 / Article 49 — Financial cross-sector exercises, communication and cooperation

展开第49条英中对照

English

1. The ESAs, through the Joint Committee and in collaboration with competent authorities, resolution authorities as referred to in Article 3 of Directive 2014/59/EU, the ECB, the Single Resolution Board as regards information relating to entities falling under the scope of Regulation (EU) No 806/2014, the ESRB and ENISA, as appropriate, may establish mechanisms to enable the sharing of effective practices across financial sectors to enhance situational awareness and identify common cyber vulnerabilities and risks across sectors.

They may develop crisis management and contingency exercises involving cyber-attack scenarios with a view to developing communication channels and gradually enabling an effective coordinated response at Union level in the event of a major cross-border ICT-related incident or related threat having a systemic impact on the Union’s financial sector as a whole.

Those exercises may, as appropriate, also test the financial sector’s dependencies on other economic sectors.

2. Competent authorities, ESAs and the ECB shall cooperate closely with each other and exchange information to carry out their duties pursuant to Articles 47 to 54. They shall closely coordinate their supervision in order to identify and remedy breaches of this Regulation, develop and promote best practices, facilitate collaboration, foster consistency of interpretation and provide cross-jurisdictional assessments in the event of any disagreements.

中文参考译文

1. 欧洲监管当局可以通过联合委员会，适当与主管机关、指令2014/59/EU第3条处置当局、ECB、单一处置委员会（就条例（EU）第806/2014号范围内实体相关信息）、ESRB和ENISA合作，建立机制，在金融行业之间共享有效实践，以增强态势感知并识别跨行业共同网络脆弱性及风险。

它们可以制定涉及网络攻击场景的危机管理和应急演练，发展沟通渠道，并在重大跨境ICT相关事件或相关威胁对整个欧盟金融部门产生系统性影响时，逐步实现欧盟层面的有效协调响应。

这些演练也可以适当测试金融部门对其他经济部门的依赖。

2. 主管机关、欧洲监管当局及ECB应紧密合作并交换信息，以履行第47至54条职责。应紧密协调监管，以识别和补救违反本条例的行为，制定和推广最佳实践、促进协作、增进解释一致性，并在存在分歧时提供跨司法管辖区评估。

第50条 行政处罚与补救措施 / Article 50 — Administrative penalties and remedial measures

展开第50条英中对照

English

1. Competent authorities shall have all supervisory, investigatory and sanctioning powers necessary to fulfil their duties under this Regulation.

2. The powers referred to in paragraph 1 shall include at least the following powers to:

(a) have access to any document or data held in any form that the competent authority considers relevant for the performance of its duties and receive or take a copy of it;

(b) carry out on-site inspections or investigations, which shall include but shall not be limited to;

(i) summoning representatives of the financial entities for oral or written explanations on facts or documents relating to the subject matter and purpose of the investigation and to record the answers;

(ii) interviewing any other natural or legal person who consents to be interviewed for the purpose of collecting information relating to the subject matter of an investigation;

(c) require corrective and remedial measures for breaches of the requirements of this Regulation.

3. Without prejudice to the right of Member States to impose criminal penalties in accordance with Article 52, Member States shall lay down rules establishing appropriate administrative penalties and remedial measures for breaches of this Regulation and shall ensure their effective implementation.

Those penalties and measures shall be effective, proportionate and dissuasive.

4. Member States shall confer on competent authorities the power to apply at least the following administrative penalties or remedial measures for breaches of this Regulation:

(a) issue an order requiring the natural or legal person to cease conduct that is in breach of this Regulation and to desist from a repetition of that conduct;

(b) require the temporary or permanent cessation of any practice or conduct that the competent authority considers to be contrary to the provisions of this Regulation and prevent repetition of that practice or conduct;

(c) adopt any type of measure, including of pecuniary nature, to ensure that financial entities continue to comply with legal requirements;

(d) require, insofar as permitted by national law, existing data traffic records held by a telecommunication operator, where there is a reasonable suspicion of a breach of this Regulation and where such records may be relevant to an investigation into breaches of this Regulation; and

(e) issue public notices, including public statements indicating the identity of the natural or legal person and the nature of the breach.

5. Where paragraph 2, point (c), and paragraph 4 apply to legal persons, Member States shall confer on competent authorities the power to apply the administrative penalties and remedial measures, subject to the conditions provided for in national law, to members of the management body, and to other individuals who under national law are responsible for the breach.

6. Member States shall ensure that any decision imposing administrative penalties or remedial measures set out in paragraph 2, point (c), is properly reasoned and is subject to a right of appeal.

中文参考译文

1. 主管机关应拥有履行本条例职责所必需的全部监管、调查及制裁权力。

2. 第1款权力至少包括：

(a) 获取主管机关认为与履行职责有关、以任何形式保存的任何文件或数据，并接收或制作副本；

(b) 开展现场检查或调查，包括但不限于：

(i) 传唤金融实体代表，就与调查事项及目的有关的事实或文件作出口头或书面解释，并记录回答；

(ii) 为收集与调查事项有关的信息，访谈同意接受访谈的其他自然人或法人；

(c) 要求就违反本条例要求的行为采取纠正和补救措施。

3. 在不影响成员国依第52条实施刑事处罚的权利的前提下，成员国应制定规则，为违反本条例的行为规定适当行政处罚及补救措施，并确保有效实施。

这些处罚和措施应有效、相称并具有威慑力。

4. 成员国应赋予主管机关权力，至少对违反本条例的行为采取下列行政处罚或补救措施：

(a) 发布命令，要求自然人或法人停止违反本条例的行为，并避免重复实施；

(b) 要求暂时或永久停止其认为违反本条例的任何做法或行为，并防止重复；

(c) 采取任何类型措施，包括金钱性措施，确保金融实体持续遵守法律要求；

(d) 在国内法允许范围内，有合理理由怀疑违反本条例，且相关记录可能与调查违法行为有关时，要求电信运营商提供所持有的现存数据流量记录；以及

(e) 发布公告，包括注明自然人或法人身份及违法行为性质的公开声明。

5. 第2款(c)项及第4款适用于法人时，成员国应赋予主管机关权力，按照国内法条件，对管理机构成员及依国内法对违法行为负责的其他个人实施行政处罚和补救措施。

6. 成员国应确保任何实施第2款(c)项所述行政处罚或补救措施的决定，均具备充分理由并可被上诉。

第51条 实施行政处罚和补救措施权力的行使 / Article 51 — Exercise of the power to impose administrative penalties and remedial measures

展开第51条英中对照

English

1. Competent authorities shall exercise the powers to impose administrative penalties and remedial measures referred to in Article 50 in accordance with their national legal frameworks, where appropriate, as follows:

(a) directly;

(b) in collaboration with other authorities;

(c) under their responsibility by delegation to other authorities; or

(d) by application to the competent judicial authorities.

2. Competent authorities, when determining the type and level of an administrative penalty or remedial measure to be imposed under Article 50, shall take into account the extent to which the breach is intentional or results from negligence, and all other relevant circumstances, including the following, where appropriate:

(a) the materiality, gravity and the duration of the breach;

(b) the degree of responsibility of the natural or legal person responsible for the breach;

(c) the financial strength of the responsible natural or legal person;

(d) the importance of profits gained or losses avoided by the responsible natural or legal person, insofar as they can be determined;

(e) the losses for third parties caused by the breach, insofar as they can be determined;

(f) the level of cooperation of the responsible natural or legal person with the competent authority, without prejudice to the need to ensure disgorgement of profits gained or losses avoided by that natural or legal person;

(g) previous breaches by the responsible natural or legal person.

中文参考译文

1. 主管机关应依本国法律框架，适当通过下列方式行使第50条行政处罚及补救措施权力：

(a) 直接行使；

(b) 与其他机关合作；

(c) 由其承担责任，委托其他机关行使；或者

(d) 向有管辖权的司法机关申请。

2. 确定依第50条实施行政处罚或补救措施的类型及程度时，主管机关应考虑违法行为出于故意或过失的程度，以及其他所有相关情况，适当包括：

(a) 违法行为的重要性、严重程度及持续时间；

(b) 负责的自然人或法人的责任程度；

(c) 负责的自然人或法人的财务实力；

(d) 在能够确定的范围内，该自然人或法人取得利润或避免损失的规模；

(e) 在能够确定的范围内，违法行为给第三方造成的损失；

(f) 负责的自然人或法人与主管机关的合作程度，但不影响确保追缴其所获利润或所避免损失的需要；

(g) 负责的自然人或法人此前的违法行为。

第52条 刑事处罚 / Article 52 — Criminal penalties

展开第52条英中对照

English

1. Member States may decide not to lay down rules for administrative penalties or remedial measures for breaches that are subject to criminal penalties under their national law.

2. Where Member States have chosen to lay down criminal penalties for breaches of this Regulation, they shall ensure that appropriate measures are in place so that competent authorities have all the necessary powers to liaise with judicial, prosecuting, or criminal justice authorities within their jurisdiction to receive specific information related to criminal investigations or proceedings commenced for breaches of this Regulation, and to provide the same information to other competent authorities, as well as EBA, ESMA or EIOPA to fulfil their obligations to cooperate for the purposes of this Regulation.

中文参考译文

1. 对依国内法受到刑事处罚的违法行为，成员国可以决定不制定行政处罚或补救措施规则。

2. 成员国选择对违反本条例的行为规定刑事处罚时，应确保采取适当措施，使主管机关拥有与本辖区司法、检察或刑事司法机关联系所必需的全部权力，以取得因违反本条例而启动的刑事调查或程序的特定信息，并向其他主管机关及EBA、ESMA或EIOPA提供相同信息，履行本条例项下合作义务。

查看法规原文

第53条 通知义务 / Article 53 — Notification duties

展开第53条英中对照

English

Member States shall notify the laws, regulations and administrative provisions implementing this Chapter, including any relevant criminal law provisions, to the Commission, ESMA, the EBA and EIOPA by 17 January 2025. Member States shall notify the Commission, ESMA, the EBA and EIOPA without undue delay of any subsequent amendments thereto.

中文参考译文

成员国应在2025年1月17日前，将实施本章的法律、法规和行政规定，包括有关刑事法律规定，通知委员会、ESMA、EBA及EIOPA。对其后续任何修订，应不无故拖延地通知上述机构。

第54条 行政处罚的公布 / Article 54 — Publication of administrative penalties

展开第54条英中对照

English

1. Competent authorities shall publish on their official websites, without undue delay, any decision imposing an administrative penalty against which there is no appeal after the addressee of the penalty has been notified of that decision.

2. The publication referred to in paragraph 1 shall include information on the type and nature of the breach, the identity of the persons responsible and the penalties imposed.

3. Where the competent authority, following a case-by-case assessment, considers that the publication of the identity, in the case of legal persons, or of the identity and personal data, in the case of natural persons, would be disproportionate, including risks in relation to the protection of personal data, jeopardise the stability of financial markets or the pursuit of an ongoing criminal investigation, or cause, insofar as these can be determined, disproportionate damages to the person involved, it shall adopt one of the following solutions in respect of the decision imposing an administrative penalty:

(a) defer its publication until all reasons for non-publication cease to exist;

(b) publish it on an anonymous basis, in accordance with national law; or

(c) refrain from publishing it, where the options set out in points (a) and (b) are deemed either insufficient to guarantee a lack of any danger for the stability of financial markets, or where such a publication would not be proportionate to the leniency of the imposed penalty.

4. In the case of a decision to publish an administrative penalty on an anonymous basis in accordance with paragraph 3, point (b), the publication of the relevant data may be postponed.

5. Where a competent authority publishes a decision imposing an administrative penalty against which there is an appeal before the relevant judicial authorities, competent authorities shall immediately add on their official website that information and, at later stages, any subsequent related information on the outcome of such appeal. Any judicial decision annulling a decision imposing an administrative penalty shall also be published.

6. Competent authorities shall ensure that any publication referred to in paragraphs 1 to 4 shall remain on their official website only for the period which is necessary to bring forth this Article. This period shall not exceed five years after its publication.

中文参考译文

1. 主管机关在行政处罚相对人获知决定后，应不无故拖延地在官方网站公布未被上诉的行政处罚决定。

2. 第1款公布内容应包括违法行为的类型和性质、责任主体身份及所处处罚。

3. 主管机关逐案评估后认为，公布法人身份，或者自然人身份及个人数据，将不成比例，包括涉及个人数据保护的风险；或者将危及金融市场稳定、正在开展的刑事调查；或者在能够确定的范围内，将给有关主体造成不成比例的损害时，应对处罚决定采取下列一种处理方式：

(a) 推迟公布，直至所有不公布理由均已消失；

(b) 依国内法匿名公布；或者

(c) 如果(a)、(b)项不足以确保金融市场稳定不受任何危害，或者公布与所处较轻处罚不相称，则不予公布。

4. 依第3款(b)项决定匿名公布行政处罚时，可以推迟公布有关数据。

5. 主管机关公布的行政处罚决定正在有关司法机关被上诉时，应立即在官方网站补充这一信息，并在后续阶段补充上诉结果的相关信息。撤销行政处罚决定的司法裁判也应公布。

6. 第1至4款所述公布信息仅应在实施本条所必需的期间保留于官方网站，期限不得超过公布后五年。

第55条 职业保密 / Article 55 — Professional secrecy

展开第55条英中对照

English

1. Any confidential information received, exchanged or transmitted pursuant to this Regulation shall be subject to the conditions of professional secrecy laid down in paragraph 2.

2. The obligation of professional secrecy applies to all persons who work, or who have worked, for the competent authorities pursuant to this Regulation, or for any authority or market undertaking or natural or legal person to whom those competent authorities have delegated their powers, including auditors and experts contracted by them.

3. Information covered by professional secrecy, including the exchange of information among competent authorities under this Regulation and competent authorities designated or established in accordance with Directive (EU) 2022/2555, shall not be disclosed to any other person or authority except by virtue of provisions laid down by Union or national law;

4. All information exchanged between the competent authorities pursuant to this Regulation that concerns business or operational conditions and other economic or personal affairs shall be considered confidential and shall be subject to the requirements of professional secrecy, except where the competent authority states, at the time of communication, that such information may be disclosed or where such disclosure is necessary for legal proceedings.

中文参考译文

1. 依本条例接收、交换或传送的任何保密信息，均适用第2款职业保密条件。

2. 职业保密义务适用于为本条例主管机关工作或曾工作的所有人员，以及为获这些主管机关授权的其他机关、市场企业、自然人或法人工作或曾工作的所有人员，包括其通过合同聘请的审计人员及专家。

3. 除依欧盟或国内法规定外，不得向其他人员或机关披露受职业保密保护的信息，包括本条例主管机关与依指令（EU）2022/2555指定或设立的主管机关之间交换的信息。

4. 主管机关依本条例交换的有关业务或运营状况，以及其他经济或个人事务的全部信息，均应视为保密并适用职业保密要求，但主管机关在传达时声明可以披露，或者法律程序需要披露的除外。

第56条 数据保护 / Article 56 — Data Protection

展开第56条英中对照

English

1. The ESAs and the competent authorities shall be allowed to process personal data only where necessary for the purpose of carrying out their respective obligations and duties pursuant to this Regulation, in particular for investigation, inspection, request for information, communication, publication, evaluation, verification, assessment and drafting of oversight plans.

The personal data shall be processed in accordance with Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, whichever is applicable.

2. Except where otherwise provided in other sectoral acts, the personal data referred to in paragraph 1 shall be retained until the discharge of the applicable supervisory duties and in any case for a maximum period of 15 years, except in the event of pending court proceedings requiring further retention of such data.

中文参考译文

1. 欧洲监管当局和主管机关仅可在履行本条例各自义务及职责所必需时处理个人数据，特别是为调查、检查、信息请求、沟通、公布、评价、核实、评估及拟订监督计划之目的。

个人数据应按适用情况，依条例（EU）2016/679或条例（EU）2018/1725处理。

2. 除其他行业法律另有规定外，第1款个人数据应保存至有关监管职责履行完毕，并在任何情况下最长保存15年，但尚未结束的法院程序要求进一步保存的除外。

第八章 授权法案 / CHAPTER VIII — Delegated acts

第57条 授权的行使 / Article 57 — Exercise of the delegation

展开第57条英中对照

English

1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

2. The power to adopt delegated acts referred to in Articles 31(6) and 43(2) shall be conferred on the Commission for a period of five years from 17 January 2024. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five-year period.

The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period.

3. The delegation of power referred to in Articles 31(6) and 43(2) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making.

5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

6. A delegated act adopted pursuant to Articles 31(6) and 43(2) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of three months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object.

That period shall be extended by three months at the initiative of the European Parliament or of the Council.

中文参考译文

1. 按本条规定的条件，赋予委员会通过授权法案的权力。

2. 第31条第6款及第43条第2款所述通过授权法案的权力，自2024年1月17日起授予委员会五年。委员会应不迟于五年期限届满前九个月，就授权编制报告。

除欧洲议会或理事会不迟于每期期限届满前三个月反对延长外，授权自动延长相同期限。

3. 欧洲议会或理事会可以随时撤销第31条第6款及第43条第2款授权。撤销决定终止其载明的授权，自在《欧盟官方公报》公布次日或决定规定的较晚日期生效，不影响已生效授权法案的效力。

4. 通过授权法案前，委员会应依2016年4月13日《改善立法机构间协议》的原则，征询各成员国指定专家意见。

5. 委员会通过授权法案后，应立即同时通知欧洲议会和理事会。

6. 依第31条第6款及第43条第2款通过的授权法案，仅在通知欧洲议会及理事会后三个月内双方均未提出反对，或者期限届满前双方均已通知委员会不会反对时，方可生效。

欧洲议会或理事会提出要求时，该期限延长三个月。

第九章 过渡和最后条款 / CHAPTER IX — Transitional and final provisions

第一节 / Section I

第58条 审查条款 / Article 58 — Review clause

展开第58条英中对照

English

1. By 17 January 2028, the Commission shall, after consulting the ESAs and the ESRB, as appropriate, carry out a review and submit a report to the European Parliament and the Council, accompanied, where appropriate, by a legislative proposal. The review shall include at least the following:

(a) the criteria for the designation of critical ICT third-party service providers in accordance with Article 31(2);

(b) the voluntary nature of the notification of significant cyber threats referred to in Article 19;

(c) the regime referred to in Article 31(12) and the powers of the Lead Overseer provided for in Article 35(1), point (d), point (iv), first indent, with a view to evaluating the effectiveness of those provisions with regard to ensuring effective oversight of critical ICT third-party service providers established in a third country, and the necessity to establish a subsidiary in the Union.

For the purposes of the first subparagraph of this point, the review shall include an analysis of the regime referred to in Article 31(12), including in terms of access for Union financial entities to services from third countries and availability of such services on the Union market and it shall take into account further developments in the markets for the services covered by this Regulation, the practical experience of financial entities and financial supervisors with regard to the application and, respectively, supervision of that regime, and any relevant regulatory and supervisory developments taking place at international level.

(d) the appropriateness of including in the scope of this Regulation financial entities referred to in Article 2(3), point (e), making use of automated sales systems, in light of future market developments on the use of such systems;

(e) the functioning and effectiveness of the JON in supporting the consistency of the oversight and the efficiency of the exchange of information within the Oversight Framework.

2. In the context of the review of Directive (EU) 2015/2366, the Commission shall assess the need for increased cyber resilience of payment systems and payment-processing activities and the appropriateness of extending the scope of this Regulation to operators of payment systems and entities involved in payment-processing activities.

In light of this assessment, the Commission shall submit, as part of the review of Directive (EU) 2015/2366, a report to the European Parliament and the Council no later than 17 July 2023.

Based on that review report, and after consulting ESAs, ECB and the ESRB, the Commission may submit, where appropriate and as part of the legislative proposal that it may adopt pursuant to Article 108, second paragraph, of Directive (EU) 2015/2366, a proposal to ensure that all operators of payment systems and entities involved in payment-processing activities are subject to an appropriate oversight, while taking into account existing oversight by the central bank.

3. By 17 January 2026, the Commission shall, after consulting the ESAs and the Committee of European Auditing Oversight Bodies, carry out a review and submit a report to the European Parliament and the Council, accompanied, where appropriate, by a legislative proposal, on the appropriateness of strengthened requirements for statutory auditors and audit firms as regards digital operational resilience, by means of the inclusion of statutory auditors and audit firms into the scope of this Regulation or by means of amendments to Directive 2006/43/EC of the European Parliament and of the Council (39).

中文参考译文

1. 委员会应在2028年1月17日前，适当征询欧洲监管当局及ESRB意见后开展审查，并向欧洲议会和理事会提交报告，适当附上立法提案。审查至少包括：

(a) 依第31条第2款指定关键ICT第三方服务提供者的标准；

(b) 第19条重大网络威胁通知的自愿性质；

(c) 第31条第12款制度及第35条第1款(d)项(iv)目第一破折号所述牵头监督机构权力，以评估这些规定在确保有效监督设立于第三国的关键提供者方面的有效性，以及在欧盟设立子公司的必要性。

为适用本项第一分段，审查应分析第31条第12款制度，包括欧盟金融实体获取第三国服务，以及这些服务在欧盟市场的可获得性，并考虑本条例所涵盖服务市场的进一步发展、金融实体适用和金融监管者监督该制度的实践经验，以及国际层面任何有关监管发展；

(d) 考虑自动化销售系统使用的未来市场发展，将使用此类系统的第2条第3款(e)项金融实体纳入本条例范围是否适当；

(e) JON在支持监督一致性，以及监督框架内信息交换效率方面的运行和有效性。

2. 审查指令（EU）2015/2366时，委员会应评估提高支付系统及支付处理活动网络韧性的需要，以及将本条例范围扩大至支付系统运营者及参与支付处理活动实体的适当性。

根据这一评估，委员会应不迟于2023年7月17日，作为该指令审查的一部分，向欧洲议会和理事会提交报告。

根据审查报告并征询欧洲监管当局、ECB及ESRB意见后，委员会可以适当地作为其依该指令第108条第二段可能通过的立法提案的一部分，提出方案，确保所有支付系统运营者及参与支付处理活动的实体受到适当监督，同时考虑中央银行既有监督。

3. 委员会应在2026年1月17日前，征询欧洲监管当局及欧洲审计监督机构委员会意见后，就通过将法定审计师和审计公司纳入本条例范围，或者修订欧洲议会和理事会指令2006/43/EC(39)，加强其数字运营韧性要求的适当性开展审查，向欧洲议会和理事会提交报告，并适当附上立法提案。

查看法规原文

第二节 修订 / Section II — Amendments

第59条 对条例（EC）第1060/2009号的修订 / Article 59 — Amendments to Regulation (EC) No 1060/2009

展开第59条英中对照

English

Regulation (EC) No 1060/2009 is amended as follows:

(1) in Annex I, Section A, point 4, the first subparagraph is replaced by the following:

‘A credit rating agency shall have sound administrative and accounting procedures, internal control mechanisms, effective procedures for risk assessment, and effective control and safeguard arrangements for managing ICT systems in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*1).

(*1) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).’;

(2) in Annex III, point 12 is replaced by the following:

‘12. The credit rating agency infringes Article 6(2), in conjunction with point 4 of Section A of Annex I, by not having sound administrative or accounting procedures, internal control mechanisms, effective procedures for risk assessment, or effective control or safeguard arrangements for managing ICT systems in accordance with Regulation (EU) 2022/2554; or by not implementing or maintaining decision-making procedures or organisational structures as required by that point.’.

中文参考译文

条例（EC）第1060/2009号作如下修订：

(1) 附件I的A节第4项第一分段替换为：

“信用评级机构应具备健全的行政和会计程序、内部控制机制、有效的风险评估程序，以及依欧洲议会和理事会条例（EU）2022/2554（*1）管理ICT系统的有效控制和保障安排。

（*1）欧洲议会和理事会2022年12月14日条例（EU）2022/2554，关于金融部门数字运营韧性，并修订条例（EC）第1060/2009号、（EU）第648/2012号、（EU）第600/2014号、（EU）第909/2014号和（EU）2016/1011（《欧盟官方公报》L 333，2022年12月27日，第1页）。”；

(2) 附件III第12项替换为：

“12. 信用评级机构未具备健全的行政或会计程序、内部控制机制、有效的风险评估程序，或者依条例（EU）2022/2554管理ICT系统的有效控制或保障安排；或者未实施或维持附件I的A节第4项所要求的决策程序或组织结构，即违反第6条第2款结合该项规定的要求。”

第60条 对条例（EU）第648/2012号的修订 / Article 60 — Amendments to Regulation (EU) No 648/2012

展开第60条英中对照

English

Regulation (EU) No 648/2012 is amended as follows:

(1) Article 26 is amended as follows:

(a) paragraph 3 is replaced by the following:

‘3. A CCP shall maintain and operate an organisational structure that ensures continuity and orderly functioning in the performance of its services and activities. It shall employ appropriate and proportionate systems, resources and procedures, including ICT systems managed in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*2).

(*2) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).’;

(b) paragraph 6 is deleted;

(2) Article 34 is amended as follows:

(a) paragraph 1 is replaced by the following:

‘1. A CCP shall establish, implement and maintain an adequate business continuity policy and disaster recovery plan, which shall include ICT business continuity policy and ICT response and recovery plans put in place and implemented in accordance with Regulation (EU) 2022/2554, aiming to ensure the preservation of its functions, the timely recovery of operations and the fulfilment of the CCP’s obligations.’;

(b) in paragraph 3, the first subparagraph is replaced by the following:

‘3. In order to ensure consistent application of this Article, ESMA shall, after consulting the members of the ESCB, develop draft regulatory technical standards specifying the minimum content and requirements of the business continuity policy and of the disaster recovery plan, excluding ICT business continuity policy and disaster recovery plans.’;

(3) in Article 56(3), the first subparagraph is replaced by the following:

‘3. In order to ensure consistent application of this Article, ESMA shall develop draft regulatory technical standards specifying the details, other than for requirements related to ICT risk management, of the application for registration referred to in paragraph 1.’;

(4) in Article 79, paragraphs 1 and 2 are replaced by the following:

‘1. A trade repository shall identify sources of operational risk and minimise them also through the development of appropriate systems, controls and procedures, including ICT systems managed in accordance with Regulation (EU) 2022/2554.

2. A trade repository shall establish, implement and maintain an adequate business continuity policy and disaster recovery plan including ICT business continuity policy and ICT response and recovery plans established in accordance with Regulation (EU) 2022/2554, aiming to ensure the maintenance of its functions, the timely recovery of operations and the fulfilment of the trade repository’s obligations.’;

(5) in Article 80, paragraph 1 is deleted.

(6) in Annex I, Section II is amended as follows:

(a) points (a) and (b) are replaced by the following:

‘(a) a trade repository infringes Article 79(1) by not identifying sources of operational risk or by not minimising those risks through the development of appropriate systems, controls and procedures including ICT systems managed in accordance with Regulation (EU) 2022/2554;

(b) a trade repository infringes Article 79(2) by not establishing, implementing or maintaining an adequate business continuity policy and disaster recovery plan established in accordance with Regulation (EU) 2022/2554, aiming to ensure the maintenance of its functions, the timely recovery of operations and the fulfilment of the trade repository’s obligations;’;

(b) point (c) is deleted.

(7) Annex III is amended as follows:

(a) Section II is amended as follows:

(i) point (c) is replaced by the following:

‘(c) a Tier 2 CCP infringes Article 26(3) by not maintaining or operating an organisational structure that ensures continuity and orderly functioning in the performance of its services and activities or by not employing appropriate and proportionate systems, resources or procedures including ICT systems managed in accordance with Regulation (EU) 2022/2554;’;

(ii) point (f) is deleted.

(b) in Section III, point (a) is replaced by the following:

‘(a) a Tier 2 CCP infringes Article 34(1) by not establishing, implementing or maintaining an adequate business continuity policy and response and recovery plan set up in accordance with Regulation (EU) 2022/2554, aiming to ensure the preservation of its functions, the timely recovery of operations and the fulfilment of the CCP’s obligations, which at least allows for the recovery of all transactions at the time of disruption to allow the CCP to continue to operate with certainty and to complete settlement on the scheduled date;’.

中文参考译文

条例（EU）第648/2012号作如下修订：

(1) 第26条修订如下：

(a) 第3款替换为：

“3. 中央交易对手（CCP）应维持并运行能够确保其服务及活动连续、有序开展的组织结构，采用适当且相称的系统、资源和程序，包括依欧洲议会和理事会条例（EU）2022/2554（*2）管理的ICT系统。

（*2）欧洲议会和理事会2022年12月14日条例（EU）2022/2554，关于金融部门数字运营韧性，并修订条例（EC）第1060/2009号、（EU）第648/2012号、（EU）第600/2014号、（EU）第909/2014号和（EU）2016/1011（《欧盟官方公报》L 333，2022年12月27日，第1页）。”；

(b) 删除第6款；

(2) 第34条修订如下：

(a) 第1款替换为：

“1. 中央交易对手应建立、实施和维持适当的业务连续性政策及灾难恢复计划，包括依条例（EU）2022/2554建立并实施的ICT业务连续性政策及ICT响应和恢复计划，以确保功能维持、运营及时恢复及中央交易对手义务的履行。”；

(b) 第3款第一分段替换为：

“3. 为确保本条一致适用，ESMA应在征询欧洲中央银行体系（ESCB）成员意见后，制定监管技术标准草案，明确业务连续性政策和灾难恢复计划的最低内容及要求，但不包括ICT业务连续性政策和灾难恢复计划。”；

(3) 第56条第3款第一分段替换为：

“3. 为确保本条一致适用，ESMA应制定监管技术标准草案，明确第1款所述登记申请的详细内容，但不包括ICT风险管理相关要求。”；

(4) 第79条第1款及第2款替换为：

“1. 交易资料库应识别操作风险来源，并通过建立适当系统、控制措施及程序，包括依条例（EU）2022/2554管理的ICT系统，尽量减少这些风险。

2. 交易资料库应建立、实施并维持适当业务连续性政策和灾难恢复计划，包括依条例（EU）2022/2554建立的ICT业务连续性政策及ICT响应和恢复计划，以确保功能维持、运营及时恢复及交易资料库义务的履行。”；

(5) 删除第80条第1款。

(6) 附件I第二节修订如下：

(a) (a)项和(b)项替换为：

“(a) 交易资料库未识别操作风险来源，或者未通过建立适当系统、控制措施和程序，包括依条例（EU）2022/2554管理的ICT系统，尽量减少这些风险，即违反第79条第1款；

(b) 交易资料库未建立、实施或维持依条例（EU）2022/2554制定、旨在确保功能维持、运营及时恢复及义务履行的适当业务连续性政策和灾难恢复计划，即违反第79条第2款；”；

(b) 删除(c)项。

(7) 附件III修订如下：

(a) 第二节修订如下：

(i) (c)项替换为：

“(c) 第二层级中央交易对手未维持或运行确保服务及活动连续、有序开展的组织结构，或者未采用适当且相称的系统、资源或程序，包括依条例（EU）2022/2554管理的ICT系统，即违反第26条第3款；”；

(ii) 删除(f)项。

(b) 第三节(a)项替换为：

“(a) 第二层级中央交易对手未建立、实施或维持依条例（EU）2022/2554制定的适当业务连续性政策及响应和恢复计划，即违反第34条第1款；该政策和计划旨在确保功能维持、运营及时恢复及中央交易对手义务的履行，且至少能够恢复中断时的全部交易，使中央交易对手能够确定地继续运营，并于预定日期完成结算；”。

查看法规原文

第61条 对条例（EU）第909/2014号的修订 / Article 61 — Amendments to Regulation (EU) No 909/2014

展开第61条英中对照

English

Article 45 of Regulation (EU) No 909/2014 is amended as follows:

(1) paragraph 1 is replaced by the following:

‘1. A CSD shall identify sources of operational risk, both internal and external, and minimise their impact also through the deployment of appropriate ICT tools, processes and policies set up and managed in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*3), as well as through any other relevant appropriate tools, controls and procedures for other types of operational risk, including for all the securities settlement systems it operates.

(*3) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).’;

(2) paragraph 2 is deleted;

(3) paragraphs 3 and 4 are replaced by the following:

‘3. For services that it provides as well as for each securities settlement system that it operates, a CSD shall establish, implement and maintain an adequate business continuity policy and disaster recovery plan, including ICT business continuity policy and ICT response and recovery plans established in accordance with Regulation (EU) 2022/2554, to ensure the preservation of its services, the timely recovery of operations and the fulfilment of the CSD’s obligations in the case of events that pose a significant risk to disrupting operations.

4. The plan referred to in paragraph 3 shall provide for the recovery of all transactions and participants’ positions at the time of disruption to allow the participants of a CSD to continue to operate with certainty and to complete settlement on the scheduled date, including by ensuring that critical IT systems can resume operations from the time of disruption as provided for in Article 12(5) and (7) of Regulation (EU) 2022/2554.’;

(4) paragraph 6 is replaced by the following:

‘6. A CSD shall identify, monitor and manage the risks that key participants in the securities settlement systems it operates, as well as service and utility providers, and other CSDs or other market infrastructures might pose to its operations. It shall, upon request, provide competent and relevant authorities with information on any such risk identified. It shall also inform the competent authority and relevant authorities without delay of any operational incidents, other than in relation to ICT risk, resulting from such risks.’;

(5) in paragraph 7, the first subparagraph is replaced by the following:

‘7. ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the operational risks referred to in paragraphs 1 and 6, other than ICT risk, and the methods to test, to address or to minimise those risks, including the business continuity policies and disaster recovery plans referred to in paragraphs 3 and 4 and the methods of assessment thereof.’.

中文参考译文

条例（EU）第909/2014号第45条作如下修订：

(1) 第1款替换为：

“1. 中央证券存管机构（CSD）应识别内部及外部操作风险来源，并通过部署依欧洲议会和理事会条例（EU）2022/2554（*3）建立和管理的适当ICT工具、流程及政策，以及针对其他操作风险采用有关适当工具、控制措施和程序，尽量减少其影响，包括针对其运营的全部证券结算系统。

（*3）欧洲议会和理事会2022年12月14日条例（EU）2022/2554，关于金融部门数字运营韧性，并修订条例（EC）第1060/2009号、（EU）第648/2012号、（EU）第600/2014号、（EU）第909/2014号和（EU）2016/1011（《欧盟官方公报》L 333，2022年12月27日，第1页）。”；

(2) 删除第2款；

(3) 第3款及第4款替换为：

“3. 对其提供的服务及运营的每个证券结算系统，中央证券存管机构应建立、实施和维持适当业务连续性政策及灾难恢复计划，包括依条例（EU）2022/2554建立的ICT业务连续性政策和ICT响应及恢复计划，以在发生可能严重干扰运营的事件时，确保服务维持、运营及时恢复及其义务的履行。

4. 第3款计划应规定恢复中断时的全部交易及参与者头寸，使参与者能够确定地继续运营并在预定日期完成结算，包括按条例（EU）2022/2554第12条第5款和第7款，确保关键IT系统能从中断时点恢复运营。”；

(4) 第6款替换为：

“6. 中央证券存管机构应识别、监测及管理其运营证券结算系统的关键参与者，服务和公用事业提供者，以及其他中央证券存管机构或市场基础设施可能给自身运营带来的风险，并应要求向主管机关及有关机关提供任何已识别风险的信息。还应不拖延地告知这些机关由上述风险导致、但与ICT风险无关的任何操作事件。”；

(5) 第7款第一分段替换为：

“7. ESMA应与ESCB成员紧密合作，制定监管技术标准草案，明确第1款及第6款所述ICT风险以外的操作风险，以及测试、应对或尽量减少这些风险的方法，包括第3款及第4款业务连续性政策和灾难恢复计划，以及其评估方法。”

第62条 对条例（EU）第600/2014号的修订 / Article 62 — Amendments to Regulation (EU) No 600/2014

展开第62条英中对照

English

Regulation (EU) No 600/2014 is amended as follows:

(1) Article 27g is amended as follows:

(a) paragraph 4 is replaced by the following:

‘4. An APA shall comply with the requirements concerning the security of network and information systems set out in Regulation (EU) 2022/2554 of the European Parliament and of the Council (*4).

(*4) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).’;

(b) in paragraph 8, point (c) is replaced by the following:

‘(c) the concrete organisational requirements laid down in paragraphs 3 and 5.’;

(2) Article 27h is amended as follows:

(a) paragraph 5 is replaced by the following:

‘5. A CTP shall comply with the requirements concerning the security of network and information systems set out in Regulation (EU) 2022/2554.’.

(b) in paragraph 8, point (e) is replaced by the following:

‘(e) the concrete organisational requirements laid down in paragraph 4.’;

(3) Article 27i is amended as follows:

(a) paragraph 3 is replaced by the following:

‘3. An ARM shall comply with the requirements concerning the security of network and information systems set out in Regulation (EU) 2022/2554.’;

(b) in paragraph 5, point (b) is replaced by the following:

‘(b) the concrete organisational requirements laid down in paragraphs 2 and 4.’.

中文参考译文

条例（EU）第600/2014号作如下修订：

(1) 第27g条修订如下：

(a) 第4款替换为：

“4. 获准公布安排（APA）应遵守欧洲议会和理事会条例（EU）2022/2554（*4）规定的网络和信息系统安全要求。

（*4）欧洲议会和理事会2022年12月14日条例（EU）2022/2554，关于金融部门数字运营韧性，并修订条例（EC）第1060/2009号、（EU）第648/2012号、（EU）第600/2014号、（EU）第909/2014号和（EU）2016/1011（《欧盟官方公报》L 333，2022年12月27日，第1页）。”；

(b) 第8款(c)项替换为：

“(c) 第3款和第5款规定的具体组织要求。”；

(2) 第27h条修订如下：

(a) 第5款替换为：

“5. 综合行情提供者（CTP）应遵守条例（EU）2022/2554规定的网络和信息系统安全要求。”

(b) 第8款(e)项替换为：

“(e) 第4款规定的具体组织要求。”；

(3) 第27i条修订如下：

(a) 第3款替换为：

“3. 获准报告机制（ARM）应遵守条例（EU）2022/2554规定的网络和信息系统安全要求。”；

(b) 第5款(b)项替换为：

“(b) 第2款和第4款规定的具体组织要求。”

第63条 对条例（EU）2016/1011的修订 / Article 63 — Amendment to Regulation (EU) 2016/1011

展开第63条英中对照

English

In Article 6 of Regulation (EU) 2016/1011, the following paragraph is added:

‘6. For critical benchmarks, an administrator shall have sound administrative and accounting procedures, internal control mechanisms, effective procedures for risk assessment, and effective control and safeguard arrangements for managing ICT systems in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*5).

(*5) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).’.

中文参考译文

在条例（EU）2016/1011第6条增加下列一款：

“6. 对关键基准，管理人应具备健全的行政和会计程序、内部控制机制、有效的风险评估程序，以及依欧洲议会和理事会条例（EU）2022/2554（*5）管理ICT系统的有效控制和保障安排。

（*5）欧洲议会和理事会2022年12月14日条例（EU）2022/2554，关于金融部门数字运营韧性，并修订条例（EC）第1060/2009号、（EU）第648/2012号、（EU）第600/2014号、（EU）第909/2014号和（EU）2016/1011（《欧盟官方公报》L 333，2022年12月27日，第1页）。”

第64条 生效和适用 / Article 64 — Entry into force and application

展开第64条英中对照

English

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 17 January 2025.

中文参考译文

本条例自其在《欧盟官方公报》公布之日后的第二十日生效。

本条例自2025年1月17日起适用。

结束语与签署 / Closing formula and signatures

English

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Strasbourg, 14 December 2022.

For the European Parliament

The President

R. METSOLA

For the Council

The President

M. BEK

中文参考译文

本条例整体具有约束力，并在所有成员国直接适用。

2022年12月14日订于斯特拉斯堡。

代表欧洲议会

议长

R. METSOLA

代表理事会

主席

M. BEK

查看法规原文

原文脚注第1—20项 / Original footnotes 1–20

脚注（1）

English

(1) OJ C 343, 26.8.2021, p. 1.

中文参考译文

（1）《欧盟官方公报》C 343，2021年8月26日，第1页。

脚注（2）

English

(2) OJ C 155, 30.4.2021, p. 38.

中文参考译文

（2）《欧盟官方公报》C 155，2021年4月30日，第38页。

脚注（3）

English

(3) Position of the European Parliament of 10 November 2022 (not yet published in the Official Journal) and decision of the Council of 28 November 2022.

中文参考译文

（3）欧洲议会2022年11月10日立场（尚未在《欧盟官方公报》公布）及理事会2022年11月28日决定。

脚注（4）

English

(4) Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).

中文参考译文

（4）欧洲议会和理事会2010年11月24日条例（EU）第1093/2010号，设立欧洲监管当局（欧洲银行管理局），修订决定第716/2009/EC号并废止委员会决定2009/78/EC（《欧盟官方公报》L 331，2010年12月15日，第12页）。

脚注（5）

English

(5) Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48).

中文参考译文

（5）欧洲议会和理事会2010年11月24日条例（EU）第1094/2010号，设立欧洲监管当局（欧洲保险和职业养老金管理局），修订决定第716/2009/EC号并废止委员会决定2009/79/EC（《欧盟官方公报》L 331，2010年12月15日，第48页）。

脚注（6）

English

(6) Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84).

中文参考译文

（6）欧洲议会和理事会2010年11月24日条例（EU）第1095/2010号，设立欧洲监管当局（欧洲证券和市场管理局），修订决定第716/2009/EC号并废止委员会决定2009/77/EC（《欧盟官方公报》L 331，2010年12月15日，第84页）。

脚注（7）

English

(7) Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

中文参考译文

（7）欧洲议会和理事会2016年7月6日指令（EU）2016/1148，关于在整个欧盟实现共同的高水平网络和信息系统安全的措施（《欧盟官方公报》L 194，2016年7月19日，第1页）。

脚注（8）

English

(8) Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (see page 80 of this Official Journal).

中文参考译文

（8）欧洲议会和理事会2022年12月14日指令（EU）2022/2555，关于在整个欧盟实现共同的高水平网络安全的措施，修订条例（EU）第910/2014号及指令（EU）2018/1972，并废止指令（EU）2016/1148（NIS 2指令）（见本期《欧盟官方公报》第80页）。

脚注（9）

English

(9) Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC (see page 164 of this Official Journal).

中文参考译文

（9）欧洲议会和理事会2022年12月14日指令（EU）2022/2557，关于关键实体韧性并废止理事会指令2008/114/EC（见本期《欧盟官方公报》第164页）。

脚注（10）

English

(10) Directive (EU) 2016/2341 of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (OJ L 354, 23.12.2016, p. 37).

中文参考译文

（10）欧洲议会和理事会2016年12月14日指令（EU）2016/2341，关于职业退休金机构（IORPs）的活动及监管（《欧盟官方公报》L 354，2016年12月23日，第37页）。

脚注（11）

English

(11) Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (OJ L 151, 7.6.2019, p. 15).

中文参考译文

（11）欧洲议会和理事会2019年4月17日条例（EU）2019/881，关于ENISA（欧盟网络安全局）及信息与通信技术网络安全认证，并废止条例（EU）第526/2013号（网络安全法案）（《欧盟官方公报》L 151，2019年6月7日，第15页）。

脚注（12）

English

(12) Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35).

中文参考译文

（12）欧洲议会和理事会2015年11月25日指令（EU）2015/2366，关于内部市场支付服务，修订指令2002/65/EC、2009/110/EC及2013/36/EU和条例（EU）第1093/2010号，并废止指令2007/64/EC（《欧盟官方公报》L 337，2015年12月23日，第35页）。

脚注（13）

English

(13) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

中文参考译文

（13）欧洲议会和理事会2016年4月27日条例（EU）2016/679，关于个人数据处理方面的自然人保护及此类数据自由流动，并废止指令95/46/EC（通用数据保护条例）（《欧盟官方公报》L 119，2016年5月4日，第1页）。

脚注（14）

English

(14) Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC (OJ L 267, 10.10.2009, p. 7).

中文参考译文

（14）欧洲议会和理事会2009年9月16日指令2009/110/EC，关于电子货币机构业务的准入、开展及审慎监管，修订指令2005/60/EC和2006/48/EC，并废止指令2000/46/EC（《欧盟官方公报》L 267，2009年10月10日，第7页）。

脚注（15）

English

(15) Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).

中文参考译文

（15）欧洲议会和理事会2013年6月26日指令2013/36/EU，关于信贷机构业务准入及对信贷机构和投资公司的审慎监管，修订指令2002/87/EC并废止指令2006/48/EC和2006/49/EC（《欧盟官方公报》L 176，2013年6月27日，第338页）。

脚注（16）

English

(16) Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010 (OJ L 174, 1.7.2011, p. 1).

中文参考译文

（16）欧洲议会和理事会2011年6月8日指令2011/61/EU，关于另类投资基金管理人，并修订指令2003/41/EC和2009/65/EC，以及条例（EC）第1060/2009号和（EU）第1095/2010号（《欧盟官方公报》L 174，2011年7月1日，第1页）。

脚注（17）

English

(17) Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (OJ L 335, 17.12.2009, p. 1).

中文参考译文

（17）欧洲议会和理事会2009年11月25日指令2009/138/EC，关于保险和再保险业务的准入及开展（偿付能力II）（《欧盟官方公报》L 335，2009年12月17日，第1页）。

脚注（18）

English

(18) Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).

中文参考译文

（18）欧洲议会和理事会2014年5月15日指令2014/65/EU，关于金融工具市场，并修订指令2002/92/EC及指令2011/61/EU（《欧盟官方公报》L 173，2014年6月12日，第349页）。

脚注（19）

English

(19) Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63).

中文参考译文

（19）理事会2013年10月15日条例（EU）第1024/2013号，赋予欧洲中央银行有关信贷机构审慎监管政策的特定任务（《欧盟官方公报》L 287，2013年10月29日，第63页）。

脚注（20）

English

(20) Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190).

中文参考译文

（20）欧洲议会和理事会2014年5月15日指令2014/59/EU，建立信贷机构及投资公司恢复和处置框架，修订理事会指令82/891/EEC，以及欧洲议会和理事会指令2001/24/EC、2002/47/EC、2004/25/EC、2005/56/EC、2007/36/EC、2011/35/EU、2012/30/EU和2013/36/EU，以及条例（EU）第1093/2010号和（EU）第648/2012号（《欧盟官方公报》L 173，2014年6月12日，第190页）。

查看法规原文

原文脚注第21—39项 / Original footnotes 21–39

脚注（21）

English

(21) Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC (OJ L 182, 29.6.2013, p. 19).

中文参考译文

（21）欧洲议会和理事会2013年6月26日指令2013/34/EU，关于某些类型企业的年度财务报表、合并财务报表及相关报告，修订欧洲议会和理事会指令2006/43/EC，并废止理事会指令78/660/EEC和83/349/EEC（《欧盟官方公报》L 182，2013年6月29日，第19页）。

脚注（22）

English

(22) OJ L 123, 12.5.2016, p. 1.

中文参考译文

（22）《欧盟官方公报》L 123，2016年5月12日，第1页。

脚注（23）

English

(23) Regulation (EC) No 1060/2009 of the European Parliament and of the Council of 16 September 2009 on credit rating agencies (OJ L 302, 17.11.2009, p. 1).

中文参考译文

（23）欧洲议会和理事会2009年9月16日条例（EC）第1060/2009号，关于信用评级机构（《欧盟官方公报》L 302，2009年11月17日，第1页）。

脚注（24）

English

(24) Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories (OJ L 201, 27.7.2012, p. 1).

中文参考译文

（24）欧洲议会和理事会2012年7月4日条例（EU）第648/2012号，关于场外衍生品、中央交易对手及交易资料库（《欧盟官方公报》L 201，2012年7月27日，第1页）。

脚注（25）

English

(25) Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Regulation (EU) No 648/2012 (OJ L 173, 12.6.2014, p. 84).

中文参考译文

（25）欧洲议会和理事会2014年5月15日条例（EU）第600/2014号，关于金融工具市场并修订条例（EU）第648/2012号（《欧盟官方公报》L 173，2014年6月12日，第84页）。

脚注（26）

English

(26) Regulation (EU) No 909/2014 of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories and amending Directive 98/26/EC and 2014/65/EU and Regulation (EU) No 236/2012 (OJ L 257, 28.8.2014, p. 1).

中文参考译文

（26）欧洲议会和理事会2014年7月23日条例（EU）第909/2014号，关于改善欧盟证券结算及中央证券存管机构，并修订指令98/26/EC和2014/65/EU及条例（EU）第236/2012号（《欧盟官方公报》L 257，2014年8月28日，第1页）。

脚注（27）

English

(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital operational resilience for the financial sector (see page 153 of this Official Journal).

中文参考译文

（27）欧洲议会和理事会2022年12月14日指令（EU）2022/2556，就金融部门数字运营韧性修订指令2009/65/EC、2009/138/EC、2011/61/EU、2013/36/EU、2014/59/EU、2014/65/EU、（EU）2015/2366和（EU）2016/2341（见本期《欧盟官方公报》第153页）。

脚注（28）

English

(28) Regulation (EU) 2016/1011 of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/2014 (OJ L 171, 29.6.2016, p. 1).

中文参考译文

（28）欧洲议会和理事会2016年6月8日条例（EU）2016/1011，关于在金融工具和金融合同中作为基准或用于衡量投资基金业绩的指数，并修订指令2008/48/EC和2014/17/EU及条例（EU）第596/2014号（《欧盟官方公报》L 171，2016年6月29日，第1页）。

脚注（29）

English

(29) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

中文参考译文

（29）欧洲议会和理事会2018年10月23日条例（EU）2018/1725，关于欧盟机构、机关、办事处及专门机构处理个人数据方面的自然人保护及此类数据自由流动，并废止条例（EC）第45/2001号及决定第1247/2002/EC号（《欧盟官方公报》L 295，2018年11月21日，第39页）。

脚注（30）

English

(30) OJ C 229, 15.6.2021, p. 16.

中文参考译文

（30）《欧盟官方公报》C 229，2021年6月15日，第16页。

脚注（31）

English

(31) Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS) (OJ L 302, 17.11.2009, p. 32).

中文参考译文

（31）欧洲议会和理事会2009年7月13日指令2009/65/EC，关于协调可转让证券集合投资企业（UCITS）相关法律、法规及行政规定（《欧盟官方公报》L 302，2009年11月17日，第32页）。

脚注（32）

English

(32) Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1).

中文参考译文

（32）欧洲议会和理事会2013年6月26日条例（EU）第575/2013号，关于信贷机构和投资公司的审慎要求，并修订条例（EU）第648/2012号（《欧盟官方公报》L 176，2013年6月27日，第1页）。

脚注（33）

English

(33) Regulation (EU) 2019/2033 of the European Parliament and of the Council of 27 November 2019 on the prudential requirements of investment firms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No 806/2014 (OJ L 314, 5.12.2019, p. 1).

中文参考译文

（33）欧洲议会和理事会2019年11月27日条例（EU）2019/2033，关于投资公司的审慎要求，并修订条例（EU）第1093/2010号、（EU）第575/2013号、（EU）第600/2014号和（EU）第806/2014号（《欧盟官方公报》L 314，2019年12月5日，第1页）。

脚注（34）

English

(34) Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution (OJ L 26, 2.2.2016, p. 19).

中文参考译文

（34）欧洲议会和理事会2016年1月20日指令（EU）2016/97，关于保险分销（《欧盟官方公报》L 26，2016年2月2日，第19页）。

脚注（35）

English

(35) Regulation (EU) 2020/1503 of the European Parliament and of the Council of 7 October 2020 on European crowdfunding service providers for business, and amending Regulation (EU) 2017/1129 and Directive (EU) 2019/1937 (OJ L 347, 20.10.2020, p. 1).

中文参考译文

（35）欧洲议会和理事会2020年10月7日条例（EU）2020/1503，关于面向企业的欧洲众筹服务提供者，并修订条例（EU）2017/1129和指令（EU）2019/1937（《欧盟官方公报》L 347，2020年10月20日，第1页）。

脚注（36）

English

(36) Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation and creating a specific framework for simple, transparent and standardised securitisation, and amending Directives 2009/65/EC, 2009/138/EC and 2011/61/EU and Regulations (EC) No 1060/2009 and (EU) No 648/2012 (OJ L 347, 28.12.2017, p. 35).

中文参考译文

（36）欧洲议会和理事会2017年12月12日条例（EU）2017/2402，规定证券化一般框架，建立简单、透明和标准化证券化专门框架，并修订指令2009/65/EC、2009/138/EC和2011/61/EU，以及条例（EC）第1060/2009号和（EU）第648/2012号（《欧盟官方公报》L 347，2017年12月28日，第35页）。

脚注（37）

English

(37) Regulation (EU) No 806/2014 of the European Parliament and of the Council of 15 July 2014 establishing uniform rules and a uniform procedure for the resolution of credit institutions and certain investment firms in the framework of a Single Resolution Mechanism and a Single Resolution Fund and amending Regulation (EU) No 1093/2010 (OJ L 225, 30.7.2014, p. 1).

中文参考译文

（37）欧洲议会和理事会2014年7月15日条例（EU）第806/2014号，在单一处置机制及单一处置基金框架下，为处置信贷机构和某些投资公司制定统一规则和程序，并修订条例（EU）第1093/2010号（《欧盟官方公报》L 225，2014年7月30日，第1页）。

脚注（38）

English

(38) Directive (EU) 2019/2034 of the European Parliament and of the Council of 27 November 2019 on the prudential supervision of investment firms and amending Directives 2002/87/EC, 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU (OJ L 314, 5.12.2019, p. 64).

中文参考译文

（38）欧洲议会和理事会2019年11月27日指令（EU）2019/2034，关于投资公司审慎监管，并修订指令2002/87/EC、2009/65/EC、2011/61/EU、2013/36/EU、2014/59/EU和2014/65/EU（《欧盟官方公报》L 314，2019年12月5日，第64页）。

脚注（39）

English

(39) Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC (OJ L 157, 9.6.2006, p. 87).

中文参考译文

（39）欧洲议会和理事会2006年5月17日指令2006/43/EC，关于年度账目和合并账目的法定审计，修订理事会指令78/660/EEC和83/349/EEC，并废止理事会指令84/253/EEC（《欧盟官方公报》L 157，2006年6月9日，第87页）。

事件分类配套条例英中全文

本节为Commission Delegated Regulation (EU) 2024/1772全文英中对照，包含制定依据、序言、全部正文和脚注。它回答如何分类及是否达到重大性阈值；下节2025/301回答报告内容与时限。中文均为非官方参考译文，解读与原文分开展示。

阅读范围	直达入口
标题、制定依据和18段序言	制定依据 · 序言
第一章：分类标准，第1—7条	客户、交易与影响
第二章：重大事件与阈值，第8—9条	重大事件 · 阈值
第三章：重大网络威胁，第10条	威胁分类
第四章：机关间相关性与共享，第11—12条	跨成员国影响 · 报告共享
第五章及其他原文信息	第13条生效 · 签署 · 脚注

查看法规原文

官方来源：EUR-Lex，CELEX 32024R1772 · 法规版本与生效信息。

**收录范围与版本：**本节完整收录欧盟委员会授权条例（EU）2024/1772的标题、制定依据、18段序言、5章13条正文、结束语、签署信息及9项脚注，依据2024年6月25日《欧盟官方公报》公布文本。该条例于2024年7月15日生效；DORA基础法规的适用日期另行判断。本节不包含DORA基础法规或其他配套法规全文。网页导航、语言选择器及网站页脚不属于法规文本。

**译本效力：**英文保留公布文本的措辞、款项和条件，仅调整空白、分段及脚注链接。中文为本站AI辅助制作的非官方参考译文，未经主管机关或法律专业人员审定，不具有法律效力。实际适用应核对官方文本、后续更正、成员国主管机关要求及基础法规中的定义和豁免。条文中的历史引用按公布版本保留，不表示确认被引用文件截至当前未发生变化。

**来源与使用：**英文来源为EUR-Lex／欧盟官方公报，©欧盟，2024；再利用条件见EUR-Lex法律声明。中文译文、导航、锚点及折叠排版由本站添加，不代表欧盟机构审定或背书。

**术语说明（非原文）：**ICT为信息与通信技术；financial counterparts译为“金融交易对手”；materiality thresholds译为“重大性阈值”。data losses依第5条涵盖数据可用性、真实性、完整性和保密性受损，不限于数据文件被删除。major incidents与significant cyber threats分别译为“重大事件”和“重大网络威胁”，对应不同分类对象。

标题与制定依据 / Title and citations

展开标题与制定依据的英中对照

English

COMMISSION DELEGATED REGULATION (EU) 2024/1772

of 13 March 2024

supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (1), and in particular Article 18(4), third subparagraph, thereof,

Whereas:

中文参考译文

欧盟委员会授权条例（EU）2024/1772

2024年3月13日

补充欧洲议会和理事会条例（EU）2022/2554，就规定ICT相关事件和网络威胁分类标准、设定重大性阈值以及明确重大事件报告详细信息的监管技术标准作出规定

（与欧洲经济区相关的文本）

欧盟委员会，

鉴于《欧洲联盟运行条约》，

鉴于欧洲议会和理事会2022年12月14日关于金融部门数字运营韧性，并修订条例（EC）第1060/2009号、（EU）第648/2012号、（EU）第600/2014号、（EU）第909/2014号和（EU）2016/1011的条例（EU）2022/2554(1)，尤其是其第18条第4款第三分段，

鉴于：

序言 / Recitals

序言（1）：统一分类框架

English

(1) Regulation (EU) 2022/2554 aims to harmonise and streamline reporting requirements for ICT-related incidents and for operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions (‘incidents’). Considering that the reporting requirements cover 20 different types of financial entities, the classification criteria and the materiality thresholds for determining major incidents and significant cyber threats should be specified in a simple, harmonised and consistent way that takes into account the specificities of the services and activities of all relevant financial entities.

中文参考译文

(1) 条例（EU）2022/2554旨在统一并简化ICT相关事件，以及涉及信贷机构、支付机构、账户信息服务提供者和电子货币机构的支付相关运营事件或安全事件（以下统称“事件”）的报告要求。考虑到报告要求涵盖20种不同类型的金融实体，用于确定重大事件和重大网络威胁的分类标准及重大性阈值，应以简明、协调且一致的方式加以规定，并考虑所有相关金融实体的服务和活动的特点。

序言（2）：比例原则与绝对阈值

English

(2) In order to ensure proportionality, the classification criteria and the materiality thresholds should reflect the size and overall risk profile, and the nature, scale and complexity of the services of all financial entities. Moreover, the criteria and materiality thresholds should be designed in such a way that they apply consistently to all financial entities, irrespective of their size and risk profile, and do not pose unproportional reporting burden to smaller financial entities. However, in order to address situations where a significant number of clients are affected by an incident which as such does not exceed the applicable threshold, an absolute threshold mainly targeted at larger financial entities should be set out.

中文参考译文

(2) 为确保符合比例原则，分类标准和重大性阈值应反映所有金融实体的规模及整体风险状况，以及其服务的性质、规模和复杂程度。此外，这些标准和重大性阈值的设计，应使其不论金融实体的规模和风险状况如何，均能一致适用，且不会对较小金融实体造成不成比例的报告负担。但是，为应对大量客户受到某一事件影响、而该事件本身并未超过适用阈值的情况，应设定一个主要针对较大金融实体的绝对阈值。

序言（3）：与既有报告框架衔接

English

(3) In relation to incident reporting frameworks, which have existed prior to the entry into force of Regulation (EU) 2022/2554, continuity for financial entities should be ensured. Therefore, the classification criteria and materiality thresholds should be aligned with and inspired by the EBA Guidelines on major incident reporting under Directive (EU) 2015/2366 of the European Parliament and of the Council (2), the Guidelines on periodic information and notification of material changes to be submitted to ESMA by Trade Repositories, the ECB/SSM Cyber Incident Reporting Framework and other relevant guidance. The classification criteria and thresholds should also be suitable for the financial entities that have not been subject to incident reporting requirements prior to Regulation (EU) 2022/2554.

中文参考译文

(3) 对于条例（EU）2022/2554生效前已经存在的事件报告框架，应确保金融实体适用上的连续性。因此，分类标准和重大性阈值应与欧洲银行管理局依据欧洲议会和理事会指令（EU）2015/2366(2)制定的重大事件报告指南、交易数据库向欧洲证券和市场管理局提交定期信息及重大变更通知的指南、欧洲中央银行／单一监管机制网络事件报告框架，以及其他相关指引相衔接并加以借鉴。分类标准和阈值也应适用于在条例（EU）2022/2554之前不受事件报告要求约束的金融实体。

序言（4）：交易的范围

English

(4) With regard to the classification criterion ‘amount and number of transactions affected’, the notion of transactions is broad and covers different activities and services across the sectorial acts applicable to financial entities. For the purposes of that classification criterion, payment transactions and all forms of exchange of financial instruments, crypto-assets, commodities, or any other assets, also in form of margin, collateral or pledge, both against cash and against any other asset, should be covered. All transactions that involve assets whose value can be expressed in a monetary amount should be considered for classification purposes.

中文参考译文

(4) 就“受影响交易的金额和数量”这一分类标准而言，交易的概念范围广泛，涵盖适用于金融实体的各行业法律文件下的不同活动和服务。为适用该分类标准，应涵盖支付交易，以及以现金或任何其他资产为对价的、所有形式的金融工具、加密资产、商品或任何其他资产的交换，包括以保证金、担保物或质押形式进行的交换。进行分类时，应考虑所有涉及价值能够以货币金额表示的资产的交易。

序言（5）：未授权入侵与数据影响

English

(5) The classification criteria should ensure that all relevant types of major incidents are captured. Cyber attacks related to intrusion into network or information systems may not necessarily be captured by many classification criteria. However, they are important since any intrusion in network and information systems may harm the financial entity. Accordingly, the classification criteria ‘critical services affected’ and ‘data losses’ should be specified in such a way as to capture these types of major incidents, in particular unauthorised intrusions which, even if the impacts are not immediately known, may lead to serious consequences, in particular data breaches and data leakages.

中文参考译文

(5) 分类标准应确保涵盖所有相关类型的重大事件。与侵入网络或信息系统有关的网络攻击，未必能够被许多分类标准识别出来。但是，这类攻击十分重要，因为对网络和信息系统的任何入侵都可能损害金融实体。因此，“关键服务受到影响”和“数据损失”这两项分类标准，应以能够涵盖此类重大事件的方式加以规定；尤其应涵盖未经授权的入侵，因为即使其影响尚不能立即确定，也可能造成严重后果，特别是数据安全破坏和数据泄漏。

序言（6）：经济影响的计算口径

English

(6) Since credit institutions are subject both to the framework for classification of incidents under Article 18 of Regulation (EU) 2022/2554 and to the operational risk framework under Commission Delegated Regulation (EU) 2018/959 (3), the approach for assessing the economic impact of an incident based on the calculation of costs and losses should, to the greatest possible extent, be consistent across both frameworks to avoid introducing incompatible or contradicting requirements.

中文参考译文

(6) 由于信贷机构同时受条例（EU）2022/2554第18条规定的事件分类框架，以及欧盟委员会授权条例（EU）2018/959(3)规定的操作风险框架约束，基于成本和损失计算来评估事件经济影响的方法，应尽可能在两个框架之间保持一致，以避免引入不兼容或相互矛盾的要求。

序言（7）：地域范围关注跨境影响

English

(7) The criterion in relation to the geographical spread of an incident set out in Article 18(1), point (c), of Regulation (EU) 2022/2554 should focus on the cross-border impact of the incident, since the impact of an incident on the activities of a financial entity within a single jurisdiction will be captured by the other criteria set out in that Article.

中文参考译文

(7) 条例（EU）2022/2554第18条第1款(c)项规定的事件地域范围标准，应侧重事件的跨境影响，因为事件对金融实体在单一司法管辖区内活动的影响，将由该条规定的其他标准涵盖。

序言（8）：通过标准组合识别重大事件

English

(8) Given that the classification criteria are interdependent and linked to each other, the approach for identifying major incidents which are to be reported in accordance with Article 19(1) of Regulation (EU) 2022/2554 should be based on a combination of criteria, where some criteria that are closely related to the definitions of an ICT-related incident and a major ICT-related incident set out in Article 3(8) and (10) of Regulation (EU) 2022/2554 should have more prominence in the classification of major incidents than other criteria.

中文参考译文

(8) 鉴于各项分类标准相互依赖并彼此关联，识别应依据条例（EU）2022/2554第19条第1款报告的重大事件的方法，应以标准组合为基础。其中，与该条例第3条第8项和第10项中ICT相关事件及重大ICT相关事件定义密切相关的某些标准，在重大事件分类中应比其他标准发挥更突出的作用。

序言（9）：阈值服务于监管与防止风险传导

English

(9) With a view to ensure that the reports on and notifications of major incidents received by competent authorities under Article 19(1) of Regulation (EU) 2022/2554 serve both for supervisory purposes and for the prevention of contagion across the financial sector, the materiality thresholds should make it possible to capture major incidents, by focusing, inter alia, on the impact on entity specific critical services, the specific absolute and relative thresholds of clients or financial counterparts, transactions that indicate a material impact on the financial entity, and the significance of the impact in other Member States.

中文参考译文

(9) 为确保主管机关依据条例（EU）2022/2554第19条第1款收到的重大事件报告和通知，既服务于监管目的，也有助于防止风险在金融部门内传导，重大性阈值应能够识别重大事件，重点包括对各实体特定关键服务的影响，客户或金融交易对手的具体绝对阈值和相对阈值，表明对金融实体产生重大影响的交易，以及在其他成员国产生影响的重要程度。

序言（10）：关键服务与恶意访问

English

(10) Incidents that affect ICT services or network and information systems that support critical or important functions, or financial services requiring authorisation or malicious unauthorised access to network and information systems that support critical or important functions, should be considered as incidents affecting critical services of the financial entities. Malicious, unauthorised access to network and information systems that support critical or important functions of financial entities poses serious risks to the financial entity and, as they may affect other financial entities, should always be considered as major incidents which are to be reported.

中文参考译文

(10) 影响支持关键或重要功能的ICT服务或网络和信息系统、影响需要许可的金融服务的事件，或者对支持关键或重要功能的网络和信息系统进行恶意、未经授权访问的事件，应被视为影响金融实体关键服务的事件。对支持金融实体关键或重要功能的网络和信息系统进行恶意、未经授权访问，会对该金融实体构成严重风险，并且可能影响其他金融实体，因此始终应被视为需要报告的重大事件。

序言（11）：重复发生的事件

English

(11) Recurring incidents that are linked through a similar apparent root cause, which individually are not major incidents, can indicate significant deficiencies and weaknesses in the financial entity’s incident and risk management procedures. Therefore, recurring incidents should be considered as major collectively where they occur repeatedly over a certain period of time.

中文参考译文

(11) 因类似的表面根本原因而相互关联、单独看来不属于重大事件的重复事件，可能表明金融实体的事件和风险管理程序存在重大缺陷和薄弱环节。因此，在一定期间内重复发生的此类事件，应合并判断其重大性。

序言（12）：重大网络威胁

English

(12) Considering that cyber threats can have a negative impact on the financial entity and sector, the significant cyber threats which financial entities may submit should indicate the probability of materialisation and the criticality of the potential impact. Accordingly, to ensure a clear and consistent assessment of the significance of cyber threats, the classification of a cyber threat as significant should be dependent on the likelihood that the classification criteria for major incidents and their threshold would be met if the threat had materialised, on the type of cyber threat and on the information available to the financial entity.

中文参考译文

(12) 考虑到网络威胁可能对金融实体及金融部门产生负面影响，金融实体可以报送的重大网络威胁，应体现威胁实际发生的概率及潜在影响的严重程度。因此，为确保对网络威胁重大性作出明确且一致的评估，将某一网络威胁分类为重大，应取决于该威胁一旦实际发生便满足重大事件分类标准及其阈值的可能性、网络威胁的类型，以及金融实体可获得的信息。

序言（13）：对其他成员国的相关性

English

(13) Considering that competent authorities in other Member States are to be notified of incidents that impact financial entities and customers in their jurisdiction, the assessment of the impact in another jurisdiction in accordance with Article 19(7) of Regulation (EU) 2022/2554 should be based on the root cause of the incident, on potential contagion through third-party providers and on financial market infrastructures, as well as on the impact of the incident on significant groups of clients or financial counterparts.

中文参考译文

(13) 考虑到影响其他成员国管辖范围内金融实体和客户的事件，应通知这些成员国的主管机关，依据条例（EU）2022/2554第19条第7款评估事件在另一司法管辖区内的影响时，应以事件的根本原因、通过第三方提供者和金融市场基础设施发生风险传导的可能性，以及事件对重要客户群体或金融交易对手群体的影响为基础。

序言（14）：机关间传递的报告信息

English

(14) The reporting and notification processes referred to in Article 19(6) and (7) of Regulation (EU) 2022/2554 should allow the respective recipients to assess the impact of the incidents. Therefore, the transmitted information should cover all details contained in the incident reports submitted by the financial entity to the competent authority.

中文参考译文

(14) 条例（EU）2022/2554第19条第6款和第7款所述报告和通知程序，应使各接收方能够评估事件的影响。因此，所传递的信息应涵盖金融实体向主管机关提交的事件报告中包含的全部详细信息。

序言（15）：个人数据义务并行适用

English

(15) Where an incident constitutes a personal data breach according to Regulation (EU) 2016/679 of the European Parliament and of the Council (4) and Directive 2002/58/EC of the European Parliament and of the Council (5), this Regulation should not affect the recording and notification obligations for personal data breaches set out in those Union laws. The competent authorities should cooperate and exchange information about all relevant matters with the authorities referred to in Regulation (EU) 2016/679 and Directive 2002/58/EC.

中文参考译文

(15) 事件依据欧洲议会和理事会条例（EU）2016/679(4)及欧洲议会和理事会指令2002/58/EC(5)构成个人数据泄露事件的，本条例不应影响这些欧盟法律规定的个人数据泄露事件记录和通知义务。主管机关应就所有相关事项，与条例（EU）2016/679及指令2002/58/EC所述机关开展合作和信息交换。

序言（16）：技术标准草案

English

(16) This Regulation is based on the draft regulatory technical standards submitted to the Commission by the European Supervisory Authorities, in consultation with the European Union Agency for Cybersecurity (ENISA) and the European Central bank (ECB).

中文参考译文

(16) 本条例以欧洲监管当局在与欧盟网络安全局（ENISA）和欧洲中央银行（ECB）磋商后，向欧盟委员会提交的监管技术标准草案为基础。

序言（17）：公开咨询及利益相关方意见

English

(17) The Joint Committee of the European Supervisory Authorities referred to in Article 54 of Regulation (EU) No 1093/2010 of the European Parliament and of the Council (6), in Article 54 of Regulation (EU) No 1094/2010 of the European Parliament and of the Council (7) and in Article 54 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council (8) has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential costs and benefits of the proposed standards and requested advice of the Banking Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1093/2010, the Insurance and Reinsurance Stakeholder Group and the Occupational Pensions Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1094/2010, and the Securities and Markets Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1095/2010,

中文参考译文

(17) 欧洲议会和理事会条例（EU）第1093/2010号(6)第54条、欧洲议会和理事会条例（EU）第1094/2010号(7)第54条，以及欧洲议会和理事会条例（EU）第1095/2010号(8)第54条所述欧洲监管当局联合委员会，已就本条例所依据的监管技术标准草案开展公开咨询，分析拟议标准的潜在成本和收益，并征求了依条例（EU）第1093/2010号第37条设立的银行业利益相关方小组、依条例（EU）第1094/2010号第37条设立的保险和再保险利益相关方小组及职业养老金利益相关方小组，以及依条例（EU）第1095/2010号第37条设立的证券和市场利益相关方小组的意见，

序言（18）：欧洲数据保护监督专员意见

English

(18) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (9) and delivered an opinion on 24 January 2024,

中文参考译文

(18) 已依据欧洲议会和理事会条例（EU）2018/1725(9)第42条第1款征询欧洲数据保护监督专员意见，监督专员于2024年1月24日发表了意见，

English

HAS ADOPTED THIS REGULATION:

中文参考译文

通过本条例：

查看法规原文

第一章 分类标准 / CHAPTER I — CLASSIFICATION CRITERIA

第1条 客户、金融交易对手和交易 / Article 1 — Clients, financial counterparts and transactions

展开第1条英中对照

English

1. The number of clients affected by the incident as referred to in Article 18(1), point (a), of Regulation (EU) 2022/2554, shall reflect the number of all affected clients, whether natural or legal persons, that are or were unable to make use of the service provided by the financial entity during the incident or that were adversely impacted by the incident. That number shall also include third parties explicitly covered by the contractual agreement between the financial entity and the client as beneficiaries of the affected service.

2. The number of financial counterparts affected by the incident as referred to in Article 18(1), point (a), of Regulation (EU) 2022/2554 shall reflect the number of all affected financial counterparts that have concluded a contractual arrangement with the financial entity.

3. In relation to the relevance of clients and financial counterparts affected by the incident as referred to in Article 18(1), point (a), of Regulation (EU) 2022/2554, the financial entity shall take into account the extent to which the impact on a client or a financial counterpart will affect the implementation of the business objectives of the financial entity, as well as the potential impact of the incident on market efficiency.

4. In relation to the amount or number of transactions affected by the incident as referred to in Article 18(1), point (a), of Regulation (EU) 2022/2554, the financial entity shall take into account all affected transactions involving a monetary amount where at least one part of the transaction is carried out in the Union.

5. Where the actual number of clients or financial counterparts affected or the actual number or amount of transactions affected cannot be determined, the financial entity shall estimate those numbers or amounts based on available data from comparable reference periods.

中文参考译文

1. 条例（EU）2022/2554第18条第1款(a)项所述受事件影响的客户数量，应反映在事件期间无法或曾经无法使用金融实体所提供服务，或者受到事件不利影响的全部客户数量，无论其为自然人还是法人。该数量还应包括金融实体与客户之间的合同明确涵盖的、作为受影响服务受益人的第三方。

2. 条例（EU）2022/2554第18条第1款(a)项所述受事件影响的金融交易对手数量，应反映与金融实体订立了合同安排的全部受影响金融交易对手的数量。

3. 就条例（EU）2022/2554第18条第1款(a)项所述受事件影响客户和金融交易对手的重要性而言，金融实体应考虑对客户或金融交易对手的影响将会在何种程度上影响金融实体业务目标的实现，以及事件对市场效率的潜在影响。

4. 就条例（EU）2022/2554第18条第1款(a)项所述受事件影响交易的金额或数量而言，金融实体应考虑所有涉及货币金额、且至少一部分在欧盟境内开展的受影响交易。

5. 无法确定实际受影响的客户或金融交易对手数量，或者实际受影响的交易数量或金额的，金融实体应根据可比参考期间的可用数据，对上述数量或金额作出估计。

第2条 声誉影响 / Article 2 — Reputational impact

展开第2条英中对照

English

1. For the purposes of determining the reputational impact of the incident as referred to in Article 18(1), point (a), of Regulation (EU) 2022/2554, financial entities shall consider that a reputational impact has occurred where at least one of the following criteria is met:

(a) the incident has been reflected in the media;

(b) the incident has resulted in repetitive complaints from different clients or financial counterparts on client-facing services or critical business relationships;

(c) the financial entity will not be able to or is likely not to be able to meet regulatory requirements as a result of the incident;

(d) the financial entity will or is likely to lose clients or financial counterparts with a material impact on its business as a result of the incident.

2. When assessing the reputational impact of the incident, financial entities shall take into account the level of visibility that the incident has gained or is likely to gain in relation to each criterion listed in paragraph 1.

中文参考译文

1. 为确定条例（EU）2022/2554第18条第1款(a)项所述事件的声誉影响，满足下列至少一项标准时，金融实体应认定已经产生声誉影响：

(a) 事件已在媒体中得到反映；

(b) 事件导致不同客户或金融交易对手就面向客户的服务或关键业务关系反复提出投诉；

(c) 金融实体因事件而将无法或可能无法满足监管要求；

(d) 金融实体因事件而将失去或可能失去客户或金融交易对手，并对其业务产生重大影响。

2. 评估事件的声誉影响时，金融实体应就第1款所列每项标准，考虑事件已经或可能获得的公众关注程度。

第3条 持续时间和服务停机时间 / Article 3 — Duration and service downtime

展开第3条英中对照

English

1. Financial entities shall measure the duration of an incident as referred to in Article 18(1), point (b), of Regulation (EU) 2022/2554, from the moment the incident occurs until the moment when it is resolved.

Where financial entities are unable to determine the moment when the incident occurred, they shall measure the duration of the incident from the moment it was detected. Where financial entities become aware that the incident occurred prior to its detection, they shall measure the duration from the moment the incident is recorded in network or system logs or other data sources.

Where financial entities do not yet know when the incident will be resolved or are unable to verify records in logs or other data sources, they shall apply estimates.

2. Financial entities shall measure the service downtime of an incident as referred to in Article 18(1), point (b), of Regulation (EU) 2022/2554, from the moment the service is fully or partially unavailable to clients, financial counterparts or other internal or external users to the moment when regular activities or operations have been restored to the level of service that was provided prior to the incident.

Where the service downtime causes a delay in the provision of service after regular activities or operations have been restored, the downtime shall be measured from the start of the incident to the moment when that delayed service is fully provided.

Where financial entities are unable to determine the moment when the service downtime started, they shall measure the service downtime from the moment it was detected.

中文参考译文

1. 金融实体应自事件发生之时起，至事件解决之时止，计算条例（EU）2022/2554第18条第1款(b)项所述事件的持续时间。

金融实体无法确定事件发生时间的，应自检测到事件之时起计算事件持续时间。金融实体获知事件在被检测到之前已经发生的，应从网络或系统日志或其他数据源所记录的事件发生时间起计算持续时间。

金融实体尚不知道事件何时能够解决，或者无法核实日志或其他数据源中的记录的，应采用估计值。

2. 金融实体应自服务对客户、金融交易对手或其他内部或外部用户完全或部分不可用之时起，至正常活动或运营恢复至事件发生前所提供的服务水平之时止，计算条例（EU）2022/2554第18条第1款(b)项所述事件的服务停机时间。

服务停机导致正常活动或运营恢复后仍存在服务提供延迟的，应从事件开始之时起，至该延迟服务得到完整提供之时止，计算停机时间。

金融实体无法确定服务停机开始时间的，应自检测到服务停机之时起计算服务停机时间。

第4条 地域范围 / Article 4 — Geographical spread

展开第4条英中对照

English

For the purpose of determining the geographical spread with regard to the areas affected by the incident as referred to in Article 18(1), point (c), of Regulation (EU) 2022/2554, financial entities shall assess whether the incident has or had an impact in other Member States, and in particular the significance of the impact in relation to any of the following:

(a) clients and financial counterparts in other Member States;

(b) branches or other financial entities within the group carrying out activities in other Member States;

(c) financial market infrastructures or third-party providers, which may affect financial entities in other Member States to which they provide services, to the extent such information is available.

中文参考译文

为确定条例（EU）2022/2554第18条第1款(c)项所述事件影响区域的地域范围，金融实体应评估事件是否在其他成员国产生或曾经产生影响，尤其应评估对下列任何对象所产生影响的重要程度：

(a) 位于其他成员国的客户和金融交易对手；

(b) 在其他成员国开展活动的分支机构或集团内其他金融实体；

(c) 在能够获得相关信息的范围内，可能影响其在其他成员国所服务金融实体的金融市场基础设施或第三方提供者。

第5条 数据损失 / Article 5 — Data losses

展开第5条英中对照

English

For the purpose of determining the data losses that the incident entails as referred to in Article 18(1), point (d), of Regulation (EU) 2022/2554, financial entities shall take into account the following:

(a) in relation to the availability of data, whether the incident has rendered the data on demand by the financial entity, its clients or its counterparts temporarily or permanently inaccessible or unusable;

(b) in relation to the authenticity of data, whether the incident has compromised the trustworthiness of the source of data;

(c) in relation to the integrity of data, whether the incident has resulted in non-authorised modification of data that has rendered it inaccurate or incomplete;

(d) in relation to the confidentiality of data, whether the incident has resulted in data having been accessed by or disclosed to an unauthorised party or system.

中文参考译文

为确定条例（EU）2022/2554第18条第1款(d)项所述事件导致的数据损失，金融实体应考虑下列事项：

(a) 就数据可用性而言，事件是否导致金融实体、其客户或交易对手需要按需使用的数据暂时或永久无法访问或使用；

(b) 就数据真实性而言，事件是否损害了数据来源的可信性；

(c) 就数据完整性而言，事件是否导致未经授权的数据修改，使数据不准确或不完整；

(d) 就数据保密性而言，事件是否导致数据被未经授权的主体或系统访问，或向其披露。

第6条 受影响服务的关键程度 / Article 6 — Criticality of services affected

展开第6条英中对照

English

For the purpose of determining the criticality of the services affected as referred to in Article 18(1), point (e), of Regulation (EU) 2022/2554, financial entities shall assess whether the incident:

(a) affects or has affected ICT services or network and information systems that support critical or important functions of the financial entity;

(b) affects or has affected financial services provided by the financial entity that require authorisation, registration or that are supervised by competent authorities;

(c) constitutes or has constituted a successful, malicious and unauthorised access to the network and information systems of the financial entity.

中文参考译文

为确定条例（EU）2022/2554第18条第1款(e)项所述受影响服务的关键程度，金融实体应评估事件是否：

(a) 影响或曾经影响支持金融实体关键或重要功能的ICT服务或网络和信息系统；

(b) 影响或曾经影响金融实体提供的、需要许可、登记或者接受主管机关监管的金融服务；

(c) 构成或曾经构成对金融实体网络和信息系统的成功、恶意且未经授权的访问。

第7条 经济影响 / Article 7 — Economic impact

展开第7条英中对照

English

1. For the purpose of determining the economic impact of the incident as referred to in Article 18(1), point (f), of Regulation (EU) 2022/2554, financial entities shall, without accounting for financial recoveries, take into account the following types of direct and indirect costs and losses which they have incurred as a result of the incident:

(a) expropriated funds or financial assets for which they are liable, including assets lost to theft;

(b) costs for replacement or relocation of software, hardware or infrastructure;

(c) staff costs, including costs associated with replacement or relocation of staff, recruitment of extra staff, remuneration of overtime and recovery of lost or impaired skills;

(d) fees due to non-compliance with contractual obligations;

(e) costs for redress and compensation to customers;

(f) losses due to forgone revenues;

(g) costs associated with internal and external communication;

(h) advisory costs, including costs associated with legal counselling, forensic services and remediation services.

2. Costs and losses referred to in paragraph 1 shall not include costs that are necessary for the day-to-day operation of the business, in particular the following:

(a) costs for general maintenance of infrastructure, equipment, hardware and software, and costs for keeping skills of staff up to date;

(b) internal or external costs to enhance the business after the incident, including upgrades, improvements and risk assessment initiatives;

(c) insurance premiums.

3. Financial entities shall calculate the amounts of costs and losses based on data available at the time of reporting. Where the actual amounts of costs and losses cannot be determined, financial entities shall estimate those amounts.

4. When assessing the economic impact of the incident, financial entities shall sum up the costs and losses referred to in paragraph 1.

中文参考译文

1. 为确定条例（EU）2022/2554第18条第1款(f)项所述事件的经济影响，金融实体应在不计入财务追回或补偿款项的情况下，考虑其因事件而发生的下列类型的直接及间接成本和损失：

(a) 被侵占且由其承担责任的资金或金融资产，包括因盗窃而损失的资产；

(b) 替换或迁移软件、硬件或基础设施的成本；

(c) 人员成本，包括替换或调动人员、增聘人员、支付加班报酬，以及恢复丧失或受损技能所涉及的成本；

(d) 因未履行合同义务而发生的费用；

(e) 向客户提供补救和赔偿的成本；

(f) 因未能取得收入而造成的损失；

(g) 与内部和外部沟通有关的成本；

(h) 咨询成本，包括法律咨询、取证服务和补救服务相关成本。

2. 第1款所述成本和损失，不得包括日常业务运营所必需的成本，尤其不得包括下列成本：

(a) 基础设施、设备、硬件和软件的一般维护成本，以及保持员工技能更新的成本；

(b) 事件发生后提升业务的内部或外部成本，包括升级、改进和风险评估举措的成本；

(c) 保险费。

3. 金融实体应根据报告时可获得的数据，计算成本和损失金额。无法确定实际成本和损失金额的，金融实体应对这些金额作出估计。

4. 评估事件的经济影响时，金融实体应合计第1款所述成本和损失。

查看法规原文

第二章 重大事件与重大性阈值 / CHAPTER II — MAJOR INCIDENTS AND MATERIALITY THRESHOLDS

第8条 重大事件 / Article 8 — Major incidents

展开第8条英中对照

English

1. An incident shall be considered a major incident for the purposes of Article 19(1) of Regulation (EU) 2022/2554 where it has affected critical services as referred to in Article 6 and where either of the following conditions is fulfilled:

(a) the materiality threshold referred to in Article 9(5), point (b), is met;

(b) two or more of the other materiality thresholds referred to in Articles 9(1) to (6) are met.

2. Recurring incidents that individually are not considered a major incident in accordance with paragraph 1 shall be considered as one major incident where they meet all of the following conditions:

(a) they have occurred at least twice within 6 months;

(b) they have the same apparent root cause as referred to in Article 20, first subparagraph, point (b) of Regulation (EU) 2022/2554;

(c) they collectively fulfil the criteria for being considered a major incident set out in paragraph 1.

Financial entities shall assess the existence of recurring incidents on a monthly basis.

This paragraph does not apply to microenterprises and to financial entities listed in Article 16(1) of Regulation (EU) 2022/2554.

中文参考译文

1. 事件已经影响第6条所述关键服务，且满足下列任一条件的，为适用条例（EU）2022/2554第19条第1款，应将其视为重大事件：

(a) 达到第9条第5款(b)项所述重大性阈值；

(b) 达到第9条第1款至第6款所述其他重大性阈值中的两项或以上。

2. 按第1款单独判断不属于重大事件的重复事件，同时满足下列全部条件的，应将其视为一个重大事件：

(a) 在6个月内至少发生两次；

(b) 具有条例（EU）2022/2554第20条第一分段(b)项所述的相同表面根本原因；

(c) 合并判断时符合第1款规定的重大事件认定标准。

金融实体应每月评估是否存在重复事件。

本款不适用于微型企业，以及条例（EU）2022/2554第16条第1款所列金融实体。

第9条 确定重大事件的重大性阈值 / Article 9 — Materiality thresholds for determining major incidents

展开第9条英中对照

English

1. The materiality threshold for the criterion ‘clients, financial counterparts and transactions’ is met where any of the following conditions are fulfilled:

(a) the number of affected clients is higher than 10 % of all clients using the affected service;

(b) the number of affected clients using the affected service is higher than 100 000;

(c) the number of affected financial counterparts is higher than 30 % of all financial counterparts carrying out activities related to the provision of the affected service;

(d) the number of affected transactions is higher than 10 % of the daily average number of transactions carried out by the financial entity related to the affected service;

(e) the amount of affected transactions is higher than 10 % of the daily average value of transactions carried out by the financial entity related to the affected service;

(f) clients or financial counterparts which have been identified as relevant in accordance with Article 1(3) have been affected.

Where the actual number of clients or financial counterparts affected or the actual number or amount of transactions affected cannot be determined, the financial entity shall estimate those numbers or amounts based on available data from comparable reference periods.

2. The materiality threshold for the criterion ‘reputational impact’ is met where any of the conditions set out in Article 2, points (a) to (d), are fulfilled.

3. The materiality threshold for the criterion ‘duration and service downtime’ is met where any of the following conditions are fulfilled:

(a) the duration of the incident is longer than 24 hours;

(b) the service downtime is longer than 2 hours for ICT services that support critical or important functions.

4. The materiality threshold for the criterion ‘geographical spread’ is met where the incident has an impact in two or more Member States in accordance with Article 4.

5. The materiality threshold for the criterion ‘data losses’ is met where any of the following conditions are fulfilled:

(a) any impact as referred to in Article 5 on the availability, authenticity, integrity or confidentiality of data has or will have an adverse impact on the implementation of the business objectives of the financial entity or on its ability to meet regulatory requirements;

(b) any successful, malicious and unauthorised access not covered by point (a) occurs to network and information systems, where such access may result in data losses.

6. The materiality threshold for the criterion ‘economic impact’ is met where the costs and losses incurred by the financial entity due to the incident have exceeded or are likely to exceed 100 000 euro.

中文参考译文

1. 满足下列任一条件的，即达到“客户、金融交易对手和交易”这一标准的重大性阈值：

(a) 受影响客户数量超过使用受影响服务的全部客户数量的10%；

(b) 使用受影响服务的受影响客户数量超过100 000；

(c) 受影响金融交易对手数量超过开展与提供受影响服务有关活动的全部金融交易对手数量的30%；

(d) 受影响交易数量超过金融实体开展的、与受影响服务有关的日均交易数量的10%；

(e) 受影响交易金额超过金融实体开展的、与受影响服务有关的日均交易金额的10%；

(f) 根据第1条第3款被认定为重要的客户或金融交易对手受到影响。

无法确定实际受影响的客户或金融交易对手数量，或者实际受影响的交易数量或金额的，金融实体应根据可比参考期间的可用数据，对上述数量或金额作出估计。

2. 满足第2条(a)至(d)项所列任一条件的，即达到“声誉影响”这一标准的重大性阈值。

3. 满足下列任一条件的，即达到“持续时间和服务停机时间”这一标准的重大性阈值：

(a) 事件持续时间超过24小时；

(b) 支持关键或重要功能的ICT服务，其服务停机时间超过2小时。

4. 按第4条判断，事件在两个或以上成员国产生影响的，即达到“地域范围”这一标准的重大性阈值。

5. 满足下列任一条件的，即达到“数据损失”这一标准的重大性阈值：

(a) 第5条所述对数据可用性、真实性、完整性或保密性的任何影响，已经或将会对金融实体业务目标的实现，或者其满足监管要求的能力产生不利影响；

(b) 网络和信息系统发生不属于(a)项范围的任何成功、恶意且未经授权的访问，并且该访问可能导致数据损失。

6. 金融实体因事件发生的成本和损失已经超过或可能超过100 000欧元的，即达到“经济影响”这一标准的重大性阈值。

第三章 重大网络威胁 / CHAPTER III — SIGNIFICANT CYBER THREATS

第10条 确定重大网络威胁的高重大性阈值 / Article 10 — High materiality thresholds for determining significant cyber threats

展开第10条英中对照

English

For the purposes of Article 18(2) of Regulation (EU) 2022/2554, a cyber threat shall be considered significant where all of the following conditions are fulfilled:

(a) the cyber threat, if materialised, could affect or could have affected critical or important functions of the financial entity, or could affect other financial entities, third-party providers, clients or financial counterparts, based on information available to the financial entity;

(b) the cyber threat has a high probability of materialisation at the financial entity or at other financial entities, taking into account at least the following elements:

(i) applicable risks related to the cyber threat referred to in point (a), including potential vulnerabilities of the systems of the financial entity that can be exploited;

(ii) the capabilities and intent of threat actors to the extent known by the financial entity;

(iii) the persistence of the threat and any accrued knowledge about incidents that have impacted the financial entity or its third-party provider, clients or financial counterparts;

(c) the cyber threat could, if materialised, meet any of the following:

(i) the criterion regarding criticality of services set out in Article 18(1), point (e), of Regulation (EU) 2022/2554, as specified in Article 6 of this Regulation;

(ii) the materiality threshold set out in Article 9(1);

(iii) the materiality threshold set out in Article 9(4).

Where, depending on the type of cyber threat and available information, the financial entity concludes that the materiality thresholds set out in Article 9(2), (3), (5) and (6) could be met, those thresholds may also be considered.

中文参考译文

为适用条例（EU）2022/2554第18条第2款，满足下列全部条件的，网络威胁应被视为重大：

(a) 根据金融实体可获得的信息，该网络威胁一旦实际发生，可能影响或可能曾经影响金融实体的关键或重要功能，或者可能影响其他金融实体、第三方提供者、客户或金融交易对手；

(b) 至少考虑下列要素后，该网络威胁在该金融实体或其他金融实体实际发生的概率较高：

(i) 与(a)项所述网络威胁有关的适用风险，包括金融实体系统中可能被利用的潜在漏洞；

(ii) 在金融实体已知范围内，威胁行为者的能力和意图；

(iii) 威胁的持续性，以及对已经影响金融实体或其第三方提供者、客户或金融交易对手的事件所积累的任何认识；

(c) 该网络威胁一旦实际发生，可能满足下列任一标准或阈值：

(i) 条例（EU）2022/2554第18条第1款(e)项规定，并由本条例第6条具体明确的服务关键程度标准；

(ii) 第9条第1款规定的重大性阈值；

(iii) 第9条第4款规定的重大性阈值。

金融实体根据网络威胁类型及可获得的信息，认定可能达到第9条第2、3、5和6款规定的重大性阈值的，也可以考虑这些阈值。

第四章 对其他成员国主管机关的相关性及共享报告信息 / CHAPTER IV

English — Chapter title

RELEVANCE OF MAJOR INCIDENTS TO COMPETENT AUTHORITIES IN OTHER MEMBER STATES AND DETAILS OF REPORTS TO BE SHARED WITH OTHER COMPETENT AUTHORITIES

中文参考译文 — 章名

重大事件与其他成员国主管机关的相关性，以及应与其他主管机关共享的报告详细信息

第11条 重大事件与其他成员国主管机关的相关性 / Article 11 — Relevance of major incidents to competent authorities in other Member States

展开第11条英中对照

English

The assessment of whether the major incident is relevant for competent authorities in other Member States as referred to in Article 19(7) of Regulation (EU) 2022/2554 shall be based on whether the incident has a root cause originating from another Member State or whether the incident has or has had a significant impact in another Member State in relation to any of the following:

(a) clients or financial counterparts;

(b) a branch of the financial entity or another financial entity within the group;

(c) a financial market infrastructure or a third-party provider which may affect financial entities to which they provide services.

中文参考译文

评估条例（EU）2022/2554第19条第7款所述重大事件是否与其他成员国主管机关相关时，应以事件的根本原因是否源自另一成员国，或者事件是否在另一成员国对下列任一对象产生或曾经产生重大影响为基础：

(a) 客户或金融交易对手；

(b) 该金融实体的分支机构或集团内另一金融实体；

(c) 可能影响其所服务金融实体的金融市场基础设施或第三方提供者。

第12条 应与其他主管机关共享的重大事件详细信息 / Article 12 — Details of major incidents to be shared with other competent authorities

展开第12条英中对照

English

The details of major incidents to be submitted by competent authorities to other competent authorities in accordance with Article 19(6) of Regulation (EU) 2022/2554 and the notifications to be submitted by EBA, ESMA or EIOPA and the ECB to the relevant competent authorities in other Member States in accordance with Article 19(7) of that Regulation shall contain the same level of information, without any anonymisation, as the notifications and reports of major incidents received from financial entities in accordance with Article 19(4) of Regulation (EU) 2022/2554.

中文参考译文

主管机关依据条例（EU）2022/2554第19条第6款向其他主管机关提交的重大事件详细信息，以及欧洲银行管理局、欧洲证券和市场管理局或欧洲保险和职业养老金管理局及欧洲中央银行依据该条例第19条第7款向其他成员国相关主管机关提交的通知，应包含与依据条例（EU）2022/2554第19条第4款从金融实体收到的重大事件通知和报告相同详细程度的信息，且不得进行任何匿名化处理。

第五章 最后条款 / CHAPTER V — FINAL PROVISIONS

第13条 生效 / Article 13 — Entry into force

展开第13条英中对照

English

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

中文参考译文

本条例自其在《欧盟官方公报》公布之日后的第二十日生效。

结束语与签署 / Closing formula and signatures

English

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 13 March 2024.

For the Commission

The President

Ursula VON DER LEYEN

中文参考译文

本条例整体具有约束力，并在所有成员国直接适用。

2024年3月13日订于布鲁塞尔。

代表欧盟委员会

主席

乌尔苏拉·冯德莱恩

原文脚注 / Footnotes

以下沿用原法规脚注编号，脚注不构成新增条文。

脚注（1）

English

(1) OJ L 333, 27.12.2022, p. 1, ELI: http://data.europa.eu/eli/reg/2022/2554/oj.

中文参考译文

(1) 《欧盟官方公报》L 333，2022年12月27日，第1页，ELI：http://data.europa.eu/eli/reg/2022/2554/oj。

脚注（2）

English

(2) Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35, ELI: http://data.europa.eu/eli/dir/2015/2366/oj).

中文参考译文

(2) 欧洲议会和理事会2015年11月25日关于内部市场支付服务，修订指令2002/65/EC、2009/110/EC和2013/36/EU及条例（EU）第1093/2010号，并废止指令2007/64/EC的指令（EU）2015/2366（《欧盟官方公报》L 337，2015年12月23日，第35页，ELI：http://data.europa.eu/eli/dir/2015/2366/oj）。

脚注（3）

English

(3) Commission Delegated Regulation (EU) 2018/959 of 14 March 2018 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards of the specification of the assessment methodology under which competent authorities permit institutions to use Advanced Measurement Approaches for operational risk (OJ L 169, 6.7.2018, p. 1, ELI: http://data.europa.eu/eli/reg_del/2018/959/oj).

中文参考译文

(3) 欧盟委员会2018年3月14日授权条例（EU）2018/959，补充欧洲议会和理事会条例（EU）第575/2013号，就明确主管机关允许机构对操作风险使用高级计量法所依据评估方法的监管技术标准作出规定（《欧盟官方公报》L 169，2018年7月6日，第1页，ELI：http://data.europa.eu/eli/reg_del/2018/959/oj）。

脚注（4）

English

(4) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj).

中文参考译文

(4) 欧洲议会和理事会2016年4月27日关于在个人数据处理方面保护自然人及此类数据自由流动，并废止指令95/46/EC的条例（EU）2016/679（通用数据保护条例）（《欧盟官方公报》L 119，2016年5月4日，第1页，ELI：http://data.europa.eu/eli/reg/2016/679/oj）。

脚注（5）

English

(5) Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37, ELI: http://data.europa.eu/eli/dir/2002/58/oj).

中文参考译文

(5) 欧洲议会和理事会2002年7月12日关于电子通信部门个人数据处理和隐私保护的指令2002/58/EC（隐私和电子通信指令）（《欧盟官方公报》L 201，2002年7月31日，第37页，ELI：http://data.europa.eu/eli/dir/2002/58/oj）。

脚注（6）

English

(6) Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12, ELI: http://data.europa.eu/eli/reg/2010/1093/oj).

中文参考译文

(6) 欧洲议会和理事会2010年11月24日设立欧洲监管当局（欧洲银行管理局）、修订决定第716/2009/EC号并废止欧盟委员会决定2009/78/EC的条例（EU）第1093/2010号（《欧盟官方公报》L 331，2010年12月15日，第12页，ELI：http://data.europa.eu/eli/reg/2010/1093/oj）。

脚注（7）

English

(7) Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48, ELI: http://data.europa.eu/eli/reg/2010/1094/oj).

中文参考译文

(7) 欧洲议会和理事会2010年11月24日设立欧洲监管当局（欧洲保险和职业养老金管理局）、修订决定第716/2009/EC号并废止欧盟委员会决定2009/79/EC的条例（EU）第1094/2010号（《欧盟官方公报》L 331，2010年12月15日，第48页，ELI：http://data.europa.eu/eli/reg/2010/1094/oj）。

脚注（8）

English

(8) Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84, ELI: http://data.europa.eu/eli/reg/2010/1095/oj).

中文参考译文

(8) 欧洲议会和理事会2010年11月24日设立欧洲监管当局（欧洲证券和市场管理局）、修订决定第716/2009/EC号并废止欧盟委员会决定2009/77/EC的条例（EU）第1095/2010号（《欧盟官方公报》L 331，2010年12月15日，第84页，ELI：http://data.europa.eu/eli/reg/2010/1095/oj）。

脚注（9）

English

(9) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj).

中文参考译文

(9) 欧洲议会和理事会2018年10月23日关于在欧盟机构、机关、办事处和专门机构处理个人数据方面保护自然人及此类数据自由流动，并废止条例（EC）第45/2001号和决定第1247/2002/EC号的条例（EU）2018/1725（《欧盟官方公报》L 295，2018年11月21日，第39页，ELI：http://data.europa.eu/eli/reg/2018/1725/oj）。

**原刊出版标识：**Official Journal of the European Union, EN, L series, 2024/1772, 25.6.2024；ELI: http://data.europa.eu/eli/reg_del/2024/1772/oj；ISSN 1977-0677 (electronic edition)。

事件报告配套条例英中全文

下方按序言和条文分组折叠，保留英文原文与中文参考译文。这里收录的是Commission Delegated Regulation (EU) 2025/301，规定事件报告内容和时限；事件分类和阈值见上节2024/1772，基础法规见前文2022/2554。未列出的其他配套法规不在本文全文收录范围内。

查看法规原文

官方全文：EUR-Lex，CELEX 32025R0301。

**收录范围：**法规标题、制定依据、序言第1—9段、第1—7条、签署信息及脚注。网页导航、语言选择器和网站页脚不属于法规正文，不收录。本节收录的是2025/301配套法规全文；DORA基础法规2022/2554全文不在本节范围内。

**版本与效力：**依据2025年2月20日《欧盟官方公报》公布文本。中文为AI辅助制作的非官方参考译文，不具有法律效力，也未经主管机关或法律专业人员审定。法律适用应核对官方文本、后续更正及具体主管机关要求。英文仅调整空格、分段和脚注展示方式；原网页出现的“simplication”“ITC-related”“Members States”及第4条标题多出的“Article”予以保留，未擅自改写。

**来源与使用说明：**英文来源为EUR-Lex／欧盟官方公报，© 欧盟，2025；再利用条件见EUR-Lex法律声明。中文译文及折叠、锚点和术语说明由本站添加，不代表欧盟机构审定或背书。

**术语说明（非原文）：**ICT指信息与通信技术；LEI指法律实体识别编码；indicators of compromise译为“失陷指标”；resolution authorities译为“处置当局”，指金融处置语境下的机构，不能理解为普通安全事件响应团队。

标题与制定依据

展开英文原文与中文参考译文

English

COMMISSION DELEGATED REGULATION (EU) 2025/301

of 23 October 2024

supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (1), and in particular Article 20, third subparagraph thereof,

Whereas:

中文参考译文

欧盟委员会授权条例（EU）2025/301

2024年10月23日

补充欧洲议会和理事会条例（EU）2022/2554，就规定重大ICT相关事件初始通知、中间报告和最终报告的内容及期限，以及重大网络威胁自愿通知内容的监管技术标准作出规定

（与欧洲经济区相关的文本）

欧盟委员会，

鉴于《欧洲联盟运行条约》，

鉴于欧洲议会和理事会2022年12月14日关于金融部门数字运营韧性，并修订条例（EC）第1060/2009号、（EU）第648/2012号、（EU）第600/2014号、（EU）第909/2014号和（EU）2016/1011的条例（EU）2022/2554（1），尤其是其第20条第3段，

鉴于：

序言（第1—9段）

展开英文原文与中文参考译文

English — Recital (1)

(1) To ensure the harmonisation and simplication of the notification and reporting requirements for major ICT-related incidents referred to in Article 19(4) of Regulation (EU) 2022/2554, the time limits for reporting major ICT-related incidents should follow a consistent approach for all types of financial entities. For these reasons, the time limits should also, to the greatest extent possible, follow a consistent approach with, and at least be equivalent in effect to, the requirements set out in Directive (EU) 2022/2555 of the European Parliament and of the Council (2).

中文参考译文 — 序言(1)

(1) 为统一并简化条例（EU）2022/2554第19条第4款所述重大ICT相关事件的通知和报告要求，各类金融实体报告重大ICT相关事件的期限应采用一致方法。因此，这些期限还应尽可能与欧洲议会和理事会指令（EU）2022/2555（2）的要求保持一致，并至少在效果上与其相当。

English — Recital (2)

(2) To avoid imposing an undue reporting burden on financial entities at a time when they are handling the ICT-related incident, the content of the initial notification should be limited to the most significant information. To be able to take proper supervisory action, competent authorities need to receive information about major ICT-related incidents as quickly as possible after the financial entity has classified an ICT-related incident as major. Consequently, the time limit for submitting an initial notification as referred to in Article 19(4), point (a), of Regulation (EU) 2022/2554 should be as short as possible after an ICT-related incident has been classified as major, whilst still allowing for flexibility, especially for service business models that are not particularly time-critical, in case financial entities need more time to handle the ICT-related incident after becoming aware of it.

中文参考译文 — 序言(2)

(2) 为避免金融实体在处理ICT相关事件期间承受不当报告负担，初始通知的内容应限于最重要的信息。为采取适当监管行动，主管机关需要在金融实体将ICT相关事件分类为重大事件后尽快收到有关信息。因此，条例（EU）2022/2554第19条第4款(a)项所述初始通知的提交期限，应在ICT相关事件被分类为重大事件之后尽可能短；同时，如果金融实体知悉事件后需要更多时间处置，仍应保留灵活性，尤其应考虑对时间并非特别敏感的服务业务模式。

English — Recital (3)

(3) After having received the initial notification, competent authorities should receive more detailed information about the ICT-related incident in the intermediate report and all relevant information in the final report. The information in those reports should enable competent authorities to further assess the ICT-related incident and evaluate supervisory actions they may want to take.

中文参考译文 — 序言(3)

(3) 收到初始通知后，主管机关应通过中间报告获得更详细的ICT相关事件信息，并通过最终报告获得所有相关信息。这些报告应使主管机关能够进一步评估事件，并判断拟采取的监管行动。

English — Recital (4)

(4) The reporting time limits referred to in Article 20, first paragraph, point (a)(ii), of Regulation (EU) 2022/2554 should therefore balance the need for competent authorities to receive the information quickly, with the need to provide financial entities with sufficient time to obtain complete and accurate information.

中文参考译文 — 序言(4)

(4) 因此，条例（EU）2022/2554第20条第1段(a)(ii)项所述报告期限，应平衡主管机关迅速取得信息的需要，以及给予金融实体充分时间获取完整准确信息的需要。

English — Recital (5)

(5) Taking into account the criteria set out in Article 20, first paragraph, point (a), of Regulation (EU) 2022/2554, the reporting timelines should not pose a disproportionate burden to microenterprises and to other financial entities that are not significant. In addition, to avoid a disproportional burden on financial entities, the reporting time limits should take into account weekends and bank holidays.

中文参考译文 — 序言(5)

(5) 考虑条例（EU）2022/2554第20条第1段(a)项所列标准，报告期限不应对微型企业及其他非重要金融实体造成不成比例的负担。此外，为避免给金融实体造成不成比例的负担，报告期限应考虑周末和银行假日。

English — Recital (6)

(6) Since significant cyber threats are to be notified on a voluntary basis, the content of such notifications should not impose a burden on financial entities and should be more limited than the information requested for major ICT-related incidents.

中文参考译文 — 序言(6)

(6) 重大网络威胁的通知为自愿性质，其内容不应给金融实体造成负担，所需信息范围应小于重大ICT相关事件报告所要求的范围。

English — Recital (7)

(7) This Regulation is based on the draft regulatory technical standards submitted to the Commission by the European Supervisory Authorities.

中文参考译文 — 序言(7)

(7) 本条例以欧洲监管当局向委员会提交的监管技术标准草案为基础。

English — Recital (8)

(8) The European Supervisory Authorities have conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the advice of the Stakeholders Groups established in accordance with Article 37 of Regulations (EU) No 1093/2010 (3), (EU) No 1094/2010 (4) and (EU) No 1095/2010 (5) of the European Parliament and of the Council.

中文参考译文 — 序言(8)

(8) 欧洲监管当局已经就本条例所依据的监管技术标准草案开展公开咨询，分析相关潜在成本和收益，并征求依欧洲议会和理事会条例（EU）第1093/2010号（3）、第1094/2010号（4）和第1095/2010号（5）第37条设立的利益相关方小组的意见。

English — Recital (9)

(9) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (6) and delivered a positive opinion on 22 July 2024. Any processing of personal data within the scope of this Regulation should be performed in accordance with the applicable data protection principles and provisions from Regulation (EU) 2018/1725,

HAS ADOPTED THIS REGULATION:

中文参考译文 — 序言(9)

(9) 已依欧洲议会和理事会条例（EU）2018/1725（6）第42条第1款征询欧洲数据保护监督专员的意见，其于2024年7月22日出具了赞同意见。本条例范围内的任何个人数据处理，均应遵守条例（EU）2018/1725中适用的数据保护原则和规定，

兹通过本条例：

Article 1 / 第1条

展开英文原文与中文参考译文

General information to be provided in initial notifications and intermediate and final reports on major ICT-related incidents

重大ICT相关事件的初始通知、中间报告及最终报告应提供的一般信息

English

Financial entities shall include in the initial notification, the intermediate report, and the final report, as referred to in Article 19(4) of Regulation (EU) 2022/2554, the following general information:

(a) the type of submission (initial notification, intermediate report, or final report);

(b) the name of the financial entity, its LEI code, and the type of financial entity, as referred to in Article 2(1) of Regulation (EU) 2022/2554;

(c) the name and identification code of the entity that submits the initial notification, or intermediate or final report, for the financial entity;

(d) where applicable, the names and LEI codes of all financial entities covered in the aggregated initial notification or intermediate or final report;

(e) the contact details of the persons responsible for communicating with the competent authority on the major ICT-related incident;

(f) where applicable, the identification of the parent undertaking of the group to which the financial entity belongs;

(g) where there is monetary impact, the currency the amounts are based on.

中文参考译文

金融实体应在条例（EU）2022/2554第19条第4款所述初始通知、中间报告及最终报告中包含下列一般信息：

(a) 提交文件的类型，即初始通知、中间报告或最终报告；

(b) 金融实体名称、其法律实体识别编码（LEI），以及条例（EU）2022/2554第2条第1款所述金融实体类型；

(c) 代表金融实体提交初始通知、中间报告或最终报告的实体名称及识别编码；

(d) 适用时，合并提交的初始通知、中间报告或最终报告所覆盖的全部金融实体名称及LEI编码；

(e) 负责就重大ICT相关事件与主管机关沟通的人员的联系方式；

(f) 适用时，金融实体所属集团的母企业识别信息；

(g) 存在货币金额影响时，相关金额使用的币种。

Article 2 / 第2条

展开英文原文与中文参考译文

Specific information to be provided in initial notifications

初始通知应提供的具体信息

English

Initial notifications as referred to in Article 19(4), point (a), of Regulation (EU) 2022/2554 shall contain at least all of the following specific information:

(a) the incident reference code assigned by the financial entity;

(b) the date of detection, time of detection, and classification of the incident pursuant to Article 8 of Commission Delegated Regulation (EU) 2024/1772 (7);

(c) a description of the ICT-related incident;

(d) the criteria, laid down in Articles 1 to 8 of Delegated Regulation (EU) 2024/1772, on the basis of which the financial entity classified the ICT-related incident as major;

(e) the Members States that are impacted by the ICT-related incident;

(f) information on how the ICT-related incident was discovered;

(g) where available, information about the origin of the ICT-related incident;

(h) information about whether the financial entity has activated a business continuity plan;

(i) where applicable, information about the reclassification of the ICT-related incident from major to non-major;

(j) where available, any other relevant information.

中文参考译文

条例（EU）2022/2554第19条第4款(a)项所述初始通知，至少应包含以下全部具体信息：

(a) 金融实体分配的事件参考编码；

(b) 事件发现日期、发现时间，以及依委员会授权条例（EU）2024/1772（7）第8条作出的事件分类；

(c) ICT相关事件的描述；

(d) 金融实体据以将ICT相关事件分类为重大事件的、授权条例（EU）2024/1772第1—8条所列标准；

(e) 受ICT相关事件影响的成员国；

(f) 发现ICT相关事件的方式；

(g) 已知时，ICT相关事件的来源信息；

(h) 金融实体是否已启动业务连续性计划的信息；

(i) 适用时，将ICT相关事件从重大重新分类为非重大的信息；

(j) 已知时，其他相关信息。

Article 3 / 第3条

展开英文原文与中文参考译文

Specific information to be provided in intermediate reports

中间报告应提供的具体信息

English

Intermediate reports as referred to in Article 19(4), point (b), of Regulation (EU) 2022/2554 shall contain at least all of the following specific information:

(a) where applicable, the incident reference code provided by the competent authority;

(b) the date and time of occurrence of the ICT-related incident;

(c) where applicable, the date and time when the financial entity has recovered its regular activities;

(d) information about how the criteria laid down in Articles 1 to 8 of Delegated Regulation (EU) 2024/1772 have been fulfilled, on the basis of which the financial entity classified the ITC-related incident as major;

(e) the type of ICT-related incident;

(f) where applicable, the threats and techniques used by the threat actor;

(g) affected functional areas and business processes;

(h) affected infrastructure components supporting business processes;

(i) impact on the financial interest of clients;

(j) information about reporting about the ICT-related incident to other authorities;

(k) temporary actions or measures taken or planned to be taken by the financial entity to recover from the ICT-related incident;

(l) where applicable, information on indicators of compromise.

中文参考译文

条例（EU）2022/2554第19条第4款(b)项所述中间报告，至少应包含以下全部具体信息：

(a) 适用时，主管机关提供的事件参考编码；

(b) ICT相关事件发生的日期和时间；

(c) 适用时，金融实体恢复正常活动的日期和时间；

(d) 金融实体据以将事件分类为重大的、授权条例（EU）2024/1772第1—8条所列标准具体如何得到满足的信息；

(e) ICT相关事件的类型；

(f) 适用时，威胁行为者使用的威胁和技术；

(g) 受影响的职能领域和业务流程；

(h) 支撑业务流程的受影响基础设施组件；

(i) 对客户财务利益的影响；

(j) 向其他机关报告ICT相关事件的情况；

(k) 金融实体为从ICT相关事件中恢复而已采取或拟采取的临时行动或措施；

(l) 适用时，失陷指标信息。

Article 4 / 第4条

展开英文原文与中文参考译文

Article Specific information to be provided in final reports

最终报告应提供的具体信息

English

Final reports as referred to in Article 19(4), point (c), of Regulation (EU) 2022/2554 shall contain all of the following specific information:

(a) information about the root causes of the ICT-related incident;

(b) dates and times when the ICT-related incident was resolved and the root cause(s) addressed;

(c) information on the resolution of the ICT-related incident;

(d) where applicable, information relevant for resolution authorities;

(e) information about direct and indirect costs and losses stemming from the ICT-related incident and information about financial recoveries;

(f) where applicable, information about recurring ICT-related incidents.

中文参考译文

条例（EU）2022/2554第19条第4款(c)项所述最终报告，应包含以下全部具体信息：

(a) ICT相关事件的根本原因；

(b) ICT相关事件得到解决，以及根本原因得到处理的日期和时间；

(c) ICT相关事件的解决情况；

(d) 适用时，与处置当局有关的信息；

(e) ICT相关事件造成的直接和间接成本及损失，以及资金损失收回的相关信息；

(f) 适用时，重复发生的ICT相关事件的信息。

Article 5 / 第5条

展开英文原文与中文参考译文

Time limits for the initial notification, and for the intermediate and final reports

初始通知、中间报告及最终报告的期限

English — 5(1)

1. Financial entities shall submit the initial notification and the intermediate and final reports as referred to in Article 19(4), points (a), (b) and (c), of Regulation (EU) 2022/2554 within the following time limits:

(a) for the initial report: as early as possible, but in any case, within four hours from the classification of the ICT-related incident as a major ICT-related incident and no later than 24 hours from the moment the financial entity has become aware of the ICT-related incident;

(b) for the intermediate report: at the latest within 72 hours from the submission of the initial notification, even where the status or the handling of the incident have not changed as referred to in Article 19(4), point (b), of Regulation (EU) 2022/2554. Financial entities shall submit an updated intermediate report without undue delay, and in any case when the regular activities have been recovered;

(c) for the final report: no later than one month after either the submission of the intermediate report, or, where applicable, after the latest updated intermediate report.

中文参考译文 — 5(1)

1. 金融实体应在下列期限内提交条例（EU）2022/2554第19条第4款(a)、(b)、(c)项所述初始通知、中间报告和最终报告：

(a) 初始报告：尽早提交；无论如何，应在将ICT相关事件分类为重大ICT相关事件后4小时内，且不晚于金融实体知悉ICT相关事件后24小时提交；

(b) 中间报告：最迟在提交初始通知后72小时内提交，即使未发生条例（EU）2022/2554第19条第4款(b)项所述事件状态或处置情况变化，也应提交。金融实体应在无不当迟延的情况下提交更新的中间报告，并且在正常活动恢复时无论如何都应提交更新报告；

(c) 最终报告：不晚于提交中间报告后一个月，或者在适用时，不晚于提交最新更新的中间报告后一个月。

English — 5(2)

2. Where the financial entity has not classified an ICT-related incident as major within 24 hours from the moment the financial entity has become aware of the ITC-related incident but classifies that ICT-related incident as major at a later stage, the financial entity shall submit the initial notification within four hours from the classification of the ICT-related incident as a major incident.

中文参考译文 — 5(2)

2. 金融实体在知悉ICT相关事件后24小时内未将其分类为重大事件，但在其后阶段将其分类为重大事件的，应在作出重大分类后4小时内提交初始通知。

English — 5(3)

3. Financial entities that are unable to submit the initial notification, intermediate report, or final report within the time limits set out in paragraph 1, shall inform the competent authority thereof without undue delay, but no later than the respective time limits for the submission of the notification or report, and shall explain the reasons for the delay.

中文参考译文 — 5(3)

3. 无法在第1款规定期限内提交初始通知、中间报告或最终报告的金融实体，应在无不当迟延的情况下，且最迟不晚于相应通知或报告的提交期限，告知主管机关，并说明迟延理由。

English — 5(4)

4. Where the time limit for the submission of an initial notification, intermediate report, or a final report falls on a weekend day or a bank holiday in the Member State of the reporting financial entity, the financial entity may submit the initial notification, intermediate or final reports by noon of the next working day.

中文参考译文 — 5(4)

4. 初始通知、中间报告或最终报告的提交期限落在报告金融实体所在成员国的周末或银行假日时，该金融实体可以在下一个工作日中午之前提交相应通知或报告。

English — 5(5)

5. Paragraph 4 shall not apply for the submission of an initial notification or an intermediate report by credit institutions, central counterparties, operators of trading venues, and other financial entities identified as essential or important entities pursuant to Article 3 of Directive (EU) 2022/2555.

中文参考译文 — 5(5)

5. 信贷机构、中央对手方、交易场所运营者，以及依指令（EU）2022/2555第3条被认定为关键实体或重要实体的其他金融实体，提交初始通知或中间报告时不适用第4款。

English — 5(6)

6. Competent authorities may decide that paragraph 4 shall not apply for the submission of an initial notification or an intermediate report by financial entities, other than those referred to in paragraph 5, which are significant or have a systemic character for the financial sector at national or Union level. Competent authorities shall notify their decision to the identified financial entities.

The decision of the competent authority shall only apply in respect of incidents reported after the date of notification of the decision by the competent authority to the identified financial entities.

中文参考译文 — 5(6)

6. 对于第5款所述实体以外、在国家或欧盟层面对金融部门具有重要性或系统性特征的金融实体，主管机关可以决定其提交初始通知或中间报告时不适用第4款。主管机关应将决定通知所确定的金融实体。

主管机关的决定，仅适用于其向所确定的金融实体通知该决定之日后报告的事件。

Article 6 / 第6条

展开英文原文与中文参考译文

Content of the voluntary notification of significant cyber threats

重大网络威胁自愿通知的内容

English

The content of the voluntary notification in relation to significant cyber threats as referred to in Article 19(2) of Regulation (EU) 2022/2554 shall cover all of the following:

(a) general information about the notifying financial entity as set out in Article 1;

(b) the date and time of detection of the significant cyber threat and any other relevant timestamps related to the significant cyber threat;

(c) a description of the significant cyber threat;

(d) information about the potential impact of the significant cyber threat on the financial entity, its clients, or financial counterparts;

(e) the classification criteria that would have triggered a major incident report laid down in Articles 1 to 8 of Delegated Regulation (EU) 2024/1772 if the cyber threat had materialised;

(f) information about the status of the significant cyber threat and any changes in the threat activity;

(g) where applicable, a description of the actions taken by the financial entity to prevent the materialisation of the significant cyber threats;

(h) information about any notification of the significant cyber threat to other financial entities or authorities;

(i) where applicable, information on indicators of compromise;

(j) where available, any other relevant information.

中文参考译文

条例（EU）2022/2554第19条第2款所述重大网络威胁自愿通知，应覆盖以下全部内容：

(a) 第1条所列通知金融实体的一般信息；

(b) 发现重大网络威胁的日期、时间及其他相关时间戳；

(c) 重大网络威胁的描述；

(d) 重大网络威胁对金融实体、客户或金融交易对手可能产生的影响；

(e) 假使该网络威胁转化为实际事件时，本会触发重大事件报告的、授权条例（EU）2024/1772第1—8条所列分类标准；

(f) 重大网络威胁的状态及威胁活动变化的信息；

(g) 适用时，金融实体为防止重大网络威胁实际发生而已采取行动的描述；

(h) 向其他金融实体或机关通知重大网络威胁的情况；

(i) 适用时，失陷指标信息；

(j) 已知时，其他相关信息。

Article 7 / 第7条

展开英文原文与中文参考译文

Entry into force / 生效

English

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

中文参考译文

本条例于其在《欧盟官方公报》公布之日后的第二十日生效。

本条例整体具有约束力，并在所有成员国直接适用。

签署信息

展开英文原文与中文参考译文

English

Done at Brussels, 23 October 2024.

For the Commission

The President

Ursula VON DER LEYEN

中文参考译文

2024年10月23日订于布鲁塞尔。

代表委员会

主席

乌尔苏拉·冯德莱恩

脚注（第1—7项）

展开英文原文与中文参考译文

English — (1)

(1) OJ L 333, 27.12.2022, p. 1, ELI: http://data.europa.eu/eli/reg/2022/2554/oj.

中文参考译文 — (1)

(1) 《欧盟官方公报》L 333，2022年12月27日，第1页。ELI：http://data.europa.eu/eli/reg/2022/2554/oj。

English — (2)

(2) Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (OJ L 333, 27.12.2022, p. 80, ELI: http://data.europa.eu/eli/dir/2022/2555/oj).

中文参考译文 — (2)

(2) 欧洲议会和理事会2022年12月14日关于在欧盟范围实现高水平共同网络安全的措施，并修订条例（EU）第910/2014号和指令（EU）2018/1972、废止指令（EU）2016/1148的指令（EU）2022/2555（NIS 2指令）。《欧盟官方公报》L 333，2022年12月27日，第80页。ELI：http://data.europa.eu/eli/dir/2022/2555/oj。

English — (3)

(3) Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12, ELI: http://data.europa.eu/eli/reg/2010/1093/oj).

中文参考译文 — (3)

(3) 欧洲议会和理事会2010年11月24日关于设立欧洲监管当局（欧洲银行业管理局），修订第716/2009/EC号决定并废止委员会第2009/78/EC号决定的条例（EU）第1093/2010号。《欧盟官方公报》L 331，2010年12月15日，第12页。ELI：http://data.europa.eu/eli/reg/2010/1093/oj。

English — (4)

(4) Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48, ELI: http://data.europa.eu/eli/reg/2010/1094/oj).

中文参考译文 — (4)

(4) 欧洲议会和理事会2010年11月24日关于设立欧洲监管当局（欧洲保险和职业养老金管理局），修订第716/2009/EC号决定并废止委员会第2009/79/EC号决定的条例（EU）第1094/2010号。《欧盟官方公报》L 331，2010年12月15日，第48页。ELI：http://data.europa.eu/eli/reg/2010/1094/oj。

English — (5)

(5) Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84, ELI: http://data.europa.eu/eli/reg/2010/1095/oj).

中文参考译文 — (5)

(5) 欧洲议会和理事会2010年11月24日关于设立欧洲监管当局（欧洲证券和市场管理局），修订第716/2009/EC号决定并废止委员会第2009/77/EC号决定的条例（EU）第1095/2010号。《欧盟官方公报》L 331，2010年12月15日，第84页。ELI：http://data.europa.eu/eli/reg/2010/1095/oj。

English — (6)

(6) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj).

中文参考译文 — (6)

(6) 欧洲议会和理事会2018年10月23日关于欧盟机构、机关、办事处和专门机构处理个人数据时保护自然人以及此类数据自由流动，并废止条例（EC）第45/2001号和第1247/2002/EC号决定的条例（EU）2018/1725。《欧盟官方公报》L 295，2018年11月21日，第39页。ELI：http://data.europa.eu/eli/reg/2018/1725/oj。

English — (7)

(7) Commission Delegated Regulation (EU) 2024/1772 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents (OJ L, 2024/1772, 25.6.2024, ELI: http://data.europa.eu/eli/reg_del/2024/1772/oj).

中文参考译文 — (7)

(7) 委员会2024年3月13日授权条例（EU）2024/1772，补充欧洲议会和理事会条例（EU）2022/2554，就规定ICT相关事件与网络威胁分类标准、重大性阈值及重大事件报告详细信息的监管技术标准作出规定。《欧盟官方公报》L，2024/1772，2024年6月25日。ELI：http://data.europa.eu/eli/reg_del/2024/1772/oj。