art_29__para_1

1. When performing the identification and assessment of risks referred to in Article 28(4), point (c), financial entities shall also take into account whether the envisaged conclusion of a contractual arrangement in relation to ICT services supporting critical or important functions would lead to any of the following: contracting an ICT third-party service provider that is not easily substitutable; or having in place multiple contractual arrangements in relation to the provision of ICT services supporting critical or important functions with the same ICT third-party service provider or with closely connected ICT third-party service providers. Financial entities shall weigh the benefits and costs of alternative solutions, such as the use of different ICT third-party service providers, taking into account if and how envisaged solutions match the business needs and objectives set out in their digital resilience strategy.

← Article 29 · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-12 · Text as adopted (Official Journal); later amendments are not incorporated in this text.