Article 59Amendments to Regulation (EC) No 1060/2009
Regulation (EC) No 1060/2009 is amended as follows:
(1) in Annex I, Section A, point 4, the first subparagraph is replaced by the following:
‘A credit rating agency shall have sound administrative and accounting procedures, internal control mechanisms, effective procedures for risk assessment, and effective control and safeguard arrangements for managing ICT systems in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council (*).
(*) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).’;
(2) in Annex III, point 12 is replaced by the following:
‘12. The credit rating agency infringes Article 6(2), in conjunction with point 4 of Section A of Annex I, by not having sound administrative or accounting procedures, internal control mechanisms, effective procedures for risk assessment, or effective control or safeguard arrangements for managing ICT systems in accordance with Regulation (EU) 2022/2554; or by not implementing or maintaining decision-making procedures or organisational structures as required by that point.’.
DORA, the European Union regulation on digital operational resilience, Article 59
An amendment to the Credit Rating Agencies Regulation, and the first of five amending articles. Annex I, Section A, point 4, first subparagraph, is replaced so that a credit rating agency must have sound administrative and accounting procedures, internal control mechanisms, effective risk assessment procedures, and effective control and safeguard arrangements for managing ICT systems in line with DORA. Point 12 of Annex III is also replaced, so that failing to have those arrangements is a listed infringement by reference to DORA.
The same technique runs through Articles 59 to 63: each amends a sectoral regulation so that it refers to DORA for ICT matters. Several of the amendments also delete or narrow provisions, such as technical-standard mandates, so that they leave out ICT matters that DORA now covers. This article touches only the Credit Rating Agencies Regulation.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.