EBA欧洲银行-EBA-GL-2017-05-CT-GLs-on-ICT-Risk-Assessment-under-the-Supervisory-Review_5页_217kb

EBA Guidelines Compliance Table Summary

Core Content

This document is the EBA/GL/2017/05 Appendix 1, titled "Guidelines on ICT Risk Assessment under the Supervisory Review and Evaluation process (SREP)". It provides an overview of the compliance status of competent authorities across EU Member States, EEA-EFTA States, and European Territories under Article 355(3) TFEU with the EBA's guidelines on ICT risk assessment as part of the SREP process. The guidelines were issued on 11 May 2017 and became applicable from 01 January 2018, with an update on 19 February 2018.

Main Points

• The EBA has issued guidelines on ICT risk assessment to be integrated into the SREP framework.
• These guidelines are intended to enhance the supervision of financial institutions by incorporating ICT risk into the overall risk assessment process.
• The compliance status of each competent authority is reported, indicating whether they comply, intend to comply, or do not comply with the guidelines.

Compliance Status Overview

EU Member States

EEA-EFTA States

European Territories under Article 355(3) TFEU

Key Information

• Application Date: The guidelines became applicable from 01 January 2018.
• Compliance Criteria: Competent authorities must inform the EBA whether they comply or intend to comply with the guidelines. If they continue to intend to comply after the application date, they are considered non-compliant unless specific conditions (A or B) are met.
• National Implementation: Some competent authorities are already compliant, while others are in the process of implementing the guidelines or plan to do so in 2018.
• SREP Integration: The guidelines are to be integrated into the SREP process, focusing on ICT risk assessment as part of operational risk.
• Transparency Note: The EBA aims to maintain transparency but cannot be held responsible for the accuracy of the provided information, which is sourced from the competent authorities themselves.

Notes

• The EBA's Regulations (Article 16(3)) require competent authorities to report their compliance status with each guideline or recommendation.
• Competent authorities may choose not to comply if the guidelines do not apply to their jurisdiction or if legislative changes are not yet in place.
• For detailed information on any competent authority's position, direct contact with the authority is recommended.