art_26__para_8

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (Text with EEA relevance) · European Union

8. Financial entities shall contract testers for the purposes of undertaking TLPT in accordance with Article 27. When financial entities use internal testers for the purposes of undertaking TLPT, they shall contract external testers every three tests. Credit institutions that are classified as significant in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall only use external testers in accordance with Article 27(1), points (a) to (e). Competent authorities shall identify financial entities that are required to perform TLPT taking into account the criteria set out in Article 4(2), based on an assessment of the following: impact-related factors, in particular the extent to which the services provided and activities undertaken by the financial entity impact the financial sector; possible financial stability concerns, including the systemic character of the financial entity at Union or national level, as applicable; specific ICT risk profile, level of ICT maturity of the financial entity or technology features involved.

← art_26__para_7__para · All articles · art_26__para_8__para →

Source: EUR-Lex (Cellar) · retrieved 2026-10-12 · Text as adopted (Official Journal); later amendments are not incorporated in this text.