Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Article 2Scope

1. Without prejudice to paragraphs 3 and 4, this Regulation applies to the following entities:

(a) credit institutions;

(b) payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366;

(c) account information service providers;

(d) electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC;

(e) investment firms;

(f) crypto-asset service providers as authorised under a Regulation of the European Parliament and of the Council on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (‘the Regulation on markets in crypto-assets’) and issuers of asset-referenced tokens;

(g) central securities depositories;

(h) central counterparties;

(i) trading venues;

(j) trade repositories;

(k) managers of alternative investment funds;

(l) management companies;

(m) data reporting service providers;

(n) insurance and reinsurance undertakings;

(o) insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries;

(p) institutions for occupational retirement provision;

(q) credit rating agencies;

(r) administrators of critical benchmarks;

(s) crowdfunding service providers;

(t) securitisation repositories;

(u) ICT third-party service providers.

2. For the purposes of this Regulation, entities referred to in paragraph 1, points (a) to (t), shall collectively be referred to as ‘financial entities’.

3. This Regulation does not apply to:

(a) managers of alternative investment funds as referred to in Article 3(2) of Directive 2011/61/EU;

(b) insurance and reinsurance undertakings as referred to in Article 4 of Directive 2009/138/EC;

(c) institutions for occupational retirement provision which operate pension schemes which together do not have more than 15 members in total;

(d) natural or legal persons exempted pursuant to Articles 2 and 3 of Directive 2014/65/EU;

(e) insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries which are microenterprises or small or medium-sized enterprises;

(f) post office giro institutions as referred to in Article 2(5), point (3), of Directive 2013/36/EU.

4. Member States may exclude from the scope of this Regulation entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU that are located within their respective territories. Where a Member State makes use of such option, it shall inform the Commission thereof as well as of any subsequent changes thereto. The Commission shall make that information publicly available on its website or other easily accessible means.

DORA, the European Union regulation on digital operational resilience, Article 2

Scope is set by listing, not by a test. Twenty kinds of entity, points (a) to (t), are together “financial entities”: credit institutions, payment and electronic money institutions (including exempted ones), account information service providers, investment firms, crypto-asset service providers and issuers of asset-referenced tokens, central securities depositories, central counterparties, trading venues, trade repositories, fund managers (AIFMs and management companies), data reporting service providers, insurance and reinsurance undertakings and intermediaries, institutions for occupational retirement provision, credit rating agencies, critical benchmark administrators, crowdfunding providers and securitisation repositories. ICT third-party service providers are a twenty-first listed category, in scope but not “financial entities”.

Paragraph 3 removes a short list: small AIFMs under Article 3(2) of the AIFMD, the smaller insurers within Article 4 of Solvency II, pension institutions whose schemes have no more than 15 members in total, firms exempted under Articles 2 and 3 of MiFID II, insurance intermediaries that are micro, small or medium-sized, and post office giro institutions.

Paragraph 4 lets each Member State exclude certain locally exempted institutions under Article 2(5), points (4) to (23), of the Capital Requirements Directive. Whether it did so decides whether those entities are in scope at all and, if they are, that they follow the simplified framework in Article 16. Check national law.

There is no general size threshold, although some exclusions in paragraph 3 turn on size. Otherwise size changes how duties apply, not whether the entity is in scope.

What is in the packs for this

From DORA ICT Risk & Resilience Readiness. Each one helps with this requirement.

Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.