1.   Where the investment firm does not meet the conditions for qualifying as a small and non-interconnected investment firm as set out in Article 12(1) of Regulation (EU) 2019/2033, competent authorities shall, having regard to the business model, the legal form, the business and risk strategy, and the scale and complexity of the activities of the investment firm, during their supervisory review and evaluation process set out in Article 36 of Directive (EU) 2019/2034, measure any material risk or material element of risk deriving from any of the investment firm’s ongoing activities, other than those referred to in Article 2 of this Regulation and not already covered by the own funds requirements of that firm set out in Parts Three and Four of Regulation (EU) 2019/2033, by determining on a risk-by-risk basis the additional capital considered adequate to cover material risks or elements of risks.

2.   The measurement referred to in paragraph 1 shall comprise the identification, assessment and, where appropriate, the quantification of the following risk areas:

(a)	the risks posed to the security of the investment firm’s network and information systems to ensure confidentiality, integrity and availability of their processes, data, and assets;

(b)	the interest rate risk and credit risk arising from non-trading book activities.

For investment firms subject to an initial capital requirement lower than the requirement laid down in Article 9(1) of Directive (EU) 2019/2034, where competent authorities deem a more granular quantification not feasible or overly burdensome, the measurement shall be performed on an aggregate level.

3.   When performing the measurement referred to in paragraphs 1 and 2, competent authorities shall use the relevant indicative qualitative metrics referred to in Article 6(5) and combine them with static and historical trend analysis, delivering their expert judgement as appropriate.