art_28__para_4

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (Text with EEA relevance) · European Union

4. Before entering into a contractual arrangement on the use of ICT services, financial entities shall: assess whether the contractual arrangement covers the use of ICT services supporting a critical or important function; assess if supervisory conditions for contracting are met; identify and assess all relevant risks in relation to the contractual arrangement, including the possibility that such contractual arrangement may contribute to reinforcing ICT concentration risk as referred to in Article 29; undertake all due diligence on prospective ICT third-party service providers and ensure throughout the selection and assessment processes that the ICT third-party service provider is suitable; identify and assess conflicts of interest that the contractual arrangement may cause.

← art_28__para_3__para__4 · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-12 · Text as adopted (Official Journal); later amendments are not incorporated in this text.