Updated 01/07/2025
Coming into force on 08/07/2025

Initial Legal Act
Amendments
Search within this legal act
DORA ToolDelegated Regulation 2025/1190
Article 2

Article 2 - Delegated Regulation 2025/1190

Article 2

Identification of financial entities required to perform TLPT

1.   TLPT authorities shall assess whether any financial entity is required to perform TLPT, taking into account the impact of those financial entities, their systemic character and their ICT risk profile, on the basis of all of the following criteria:

(a)

impact-related and systemic character related factors:

(i)

the size of the financial entity, determined on the basis of whether the financial entity provides financial services in one or more Member States and by comparing the activities of the financial entity to those of other financial entities providing similar services;

(ii)

the extent and nature of the interconnectedness of the financial entity with other financial entities in the financial sector in one or more Member States;

(iii)

the criticality or importance of the services that the financial entity provides to the financial sector;

(iv)

the substitutability of the services that the financial entity provides;

(v)

the complexity of the business model of the financial entity and the related services and processes;

(vi)

whether the financial entity is part of a group of systemic character at Union or national level in the financial sector and sharing ICT systems;

(b)

ICT risk-related factors:

(i)

the risk profile of the financial entity;

(ii)

the threat landscape of the financial entity;

(iii)

the degree of dependence of critical or important functions or their supporting functions of the financial entity on ICT systems and processes;

(iv)

the complexity of the ICT architecture of the financial entity;

(v)

the ICT services and functions supported by ICT third-party service providers, and the quantity and type of contractual arrangements with ICT third-party service providers or ICT intra-group service providers;

(vi)

the outcomes of any supervisory reviews relevant for the assessment of the ICT maturity of the financial entity;

(vii)

the maturity of ICT business continuity plans and ICT response and recovery plans;

(viii)

the maturity of the operational ICT security detection and mitigation measures, including the ability to:

(1)

monitor the financial entity’s ICT infrastructure on a permanent basis;

(2)

detect ICT-related events in real time;

(3)

analyse the events referred to in point (2);

(4)

respond to the events referred to in point (2) in a timely and effective manner;

(ix)

whether the financial entity is part of a group active in the financial sector at Union or national level that shares ICT systems.

For the purposes of point (a)(i), the TLPT authority shall, where possible, consider:

(a)

the market share position of the financial entity at Union and national level;

(b)

the range of activities offered by the financial entity;

(c)

the market share of the services provided by the financial entity or of the activities undertaken at Union and national level.

For the purposes of point (a)(v), the TLPT authority shall, where possible, consider:

(a)

whether the financial entity operates more than one business model;

(b)

the interconnectedness of different business processes and the related services.

2.   TLPT authorities shall require all of the following financial entities to perform TLPT, unless the assessment referred to in paragraph 1 in respect of a financial entity indicates that its impact, the financial stability concerns relating to that financial entity, or its ICT risk profile, does not justify the performance of a TLPT:

(a)

credit institutions that meet any of the following conditions:

(i)

they have been identified as global systemically important institutions (G-SIIs) in accordance with Article 131 of Directive 2013/36/EU of the European Parliament and of the Council (7);

(ii)

they have been identified as other systemically important institutions (O-SIIs) in accordance with Article 131 of Directive 2013/36/EU;

(iii)

they are part of a G-SIIs or O-SIIs;

(b)

payment institutions that exceeded in each of the 2 calendar years preceding the assessment by the TLPT authority EUR 150 billion of total value of payment transactions as defined in Article 4, point (5), of Directive (EU) 2015/2366 of the European Parliament and of the Council (8);

(c)

electronic money institutions that exceeded in each of the 2 calendar years preceding the assessment by the TLPT authority either EUR 150 billion of total value of payment transactions as defined in Article 4, point (5), of Directive (EU) 2015/2366 or EUR 40 billion of total value of the amount of outstanding electronic money;

(d)

central securities depositories;

(e)

central counterparties;

(f)

trading venues with an electronic trading system that meet any of the following criteria:

(i)

the trading venue has the highest market share in terms of turnover at national level in each of the 2 calendar years preceding the assessment by the TLPT authority in any of the following:

(1)

transferable securities as defined in Article 4(1), point (44)(a), of Directive 2014/65/EU of the European Parliament and of the Council (9);

(2)

transferable securities as defined in Article 4(1), point (44)(b), of Directive 2014/65/EU;

(3)

derivatives as defined in Article 2(1), point (29), of Regulation (EU) No 600/2014 of the European Parliament and of the Council (10);

(4)

structured finance products as defined in Article 2(1), point (28), of Regulation (EU) No 600/2014;

(5)

emission allowances as referred to in Section C, point (11), of Annex I to Directive 2014/65/EU;

(ii)

the trading venue has a market share in terms of turnover at Union level that exceeds 5 % in each of the 2 calendar years preceding the assessment by the TLPT authority in any of the following:

(1)

shares in companies and other securities equivalent to shares in companies, partnerships or other entities, and depositary receipts in respect of shares;

(2)

bonds or other forms of securitised debt, including depositary receipts in respect of such securities;

(3)

derivatives as defined in Article 2(1), point (29), of Regulation (EU) No 600/2014,

(4)

structured finance products as defined in Article 2(1), point (28), of Regulation (EU) No 600/2014;

(5)

emission allowances as referred to in Section C, point (11), of Annex I to Directive 2014/65/EU;

(g)

insurance and reinsurance undertakings that meet all the following criteria:

(i)

they have a gross written premium (GWP) that exceeds EUR 1 500 000 000;

(ii)

they have technical provisions that exceed EUR 10 000 000 000;

(iii)

insurance undertakings that pursue only life activities or that pursue both life and non-life activities and that have total assets that exceed 3,5 % of the sum of the total assets valuated in accordance with Article 75 of Directive 2009/138/EC of the European Parliament and of the Council (11) of the insurance and reinsurance undertakings established in the Member State.

For the purposes of (f)(ii), where the trading venue is part of a group sharing ICT systems or the same ICT intra-group service provider, the turnover of the securities and derivatives contracts on all trading venues pertaining to the same group and established in the Union shall be considered.

For the purposes of point (g), TLPT authorities shall identify a subset of all insurance and reinsurance undertakings by applying the criteria laid down in points (g)(i), (ii), and (iii). Insurance and reinsurance undertakings included in that subset shall be required to perform TLPT where they also meet any of the following criteria:

(a)

gross written premium (GWP) that exceeds EUR 3 000 000 000;

(b)

technical provisions that exceed EUR 30 000 000 000;

(c)

total assets that exceed 10 % of the sum of the total assets valuated in accordance with Article 75 of Directive 2009/138/EC of the insurance and reinsurance undertakings established in the Member State.

3.   Where more than one financial entity belonging to the same group and sharing ICT systems, or where more than one financial entity using the same ICT intra-group service provider, meet the criteria set out in paragraph 2, the TLPT authorities of those financial entities shall, in accordance with Article 16(2), decide whether the requirement to perform TLPT on an individual basis is relevant for those financial entities.

Where the TLPT authority of the parent undertaking of a group of financial entities referred to in the first subparagraph is different from the TLPT authorities of the financial entities of the group, that authority shall be consulted by the TLPT authorities of the financial entities belonging to that group on whether it is appropriate to perform TLPT on an individual basis.

(7)  Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338, ELI: http://data.europa.eu/eli/dir/2013/36/oj).

(8)  Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35, ELI: http://data.europa.eu/eli/dir/2015/2366/oj).

(9)  Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349, ELI: http://data.europa.eu/eli/dir/2014/65/oj).

(10)  Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Regulation (EU) No 648/2012 (OJ L 173, 12.6.2014, p. 84, ELI: http://data.europa.eu/eli/reg/2014/600/oj).

(11)  Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (OJ L 335, 17.12.2009, p. 1, ELI: http://data.europa.eu/eli/dir/2009/138/oj).