Article 44International cooperation
1. Without prejudice to Article 36, EBA, ESMA and EIOPA may, in accordance with Article 33 of Regulations (EU) No 1093/2010, (EU) No 1095/2010 and (EU) No 1094/2010, respectively, conclude administrative arrangements with third-country regulatory and supervisory authorities to foster international cooperation on ICT third-party risk across different financial sectors, in particular by developing best practices for the review of ICT risk management practices and controls, mitigation measures and incident responses.
2. The ESAs shall, through the Joint Committee, submit every five years a joint confidential report to the European Parliament, to the Council and to the Commission, summarising the findings of relevant discussions held with the third countries’ authorities referred to in paragraph 1, focusing on the evolution of ICT third-party risk and the implications for financial stability, market integrity, investor protection and the functioning of the internal market.
DORA, the European Union regulation on digital operational resilience, Article 44
International cooperation on ICT third-party risk. EBA, ESMA and EIOPA may conclude administrative arrangements with third-country regulatory and supervisory authorities to foster cooperation across financial sectors, in particular by developing best practice for reviewing ICT risk management practices and controls, mitigation measures and incident responses. This is a power, not a duty, and it is without prejudice to Article 36, under which cooperation arrangements are to be concluded to allow inspections in third countries.
Every five years the ESAs, through the Joint Committee, submit a joint confidential report to the Parliament, the Council and the Commission summarising the findings of discussions with those authorities, focusing on developments in ICT third-party risk and the implications for financial stability, market integrity, investor protection and the functioning of the internal market.
The article places no obligation on financial entities. It concerns how the Union’s supervisors work with their counterparts in third countries.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.