Global Trustee and Fiduciary Services Bite-Sized Issue 2 2024

Global Trustee and Fiduciary Services Bite-Sized | Issue 2 | 2024 8 QUICK LINKS AIFMD ANTI-MONEY LAUNDERING CBDC CRYPTOASSETS CYBERSECURITY FINTECH FSB IOSCO MIFID II/MIFIR OPERATIONAL RESILIENCE SUSTAINABLE FINANCE/ESG ASIA EUROPE LUXEMBOURG NETHERLANDS NORTH AMERICA UNITED KINGDOM The CSA will cover the following aspects: • Implementation of PTCs, including their calibration methodology and the use of hard and soft blocks in the design of PTCs; • Establishment of credit and risk limits and their interaction with PTCs; • Monitoring and governance framework related to PTCs; and • Implementation andmonitoring of PTCs in case of outsourcing of trading activity to third countries. This initiative and the related sharing of practices across NCAs aimat ensuring consistent application of EU rules, helping to promote stable and orderly markets in line with ESMA’s objectives. The rules governing the use of PTCs are set out inMiFID II andmore specifically in CDR 2017/589 (RTS 6) which specifies the organisational requirements of investment firms engaged in algorithmic trading. ESMA and NCAs will carry out the CSA in the course of 2024. Link to Announcement here OPERATIONAL RESILIENCE ESAs Publish First Set of Rules Under DORA for ICT and Third-party Risk Management and Incident Classification On 17 January 2024 the three European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) published the first set of final draft technical standards under the DORA aimed at enhancing the digital operational resilience of the EU financial sector by strengthening financial entities’ Information and Communication Technology (ICT) and third-party riskmanagement and incident reporting frameworks. The joint final draft technical standards cover: Regulatory Technical Standards (RTS) on ICT risk management framework and on simplified ICT risk management framework The draft RTS on ICT risk management framework identify further elements related to ICT risk management with a view to harmonise tools, methods, processes and policies. These elements are complementary to those identified in DORA. The RTS identify the key elements that financial entities subject to the simplified regime and of lower scale, risk, size and complexity would need to have in place, setting out a simplified ICT risk management framework. The RTS ensure the ICT risk management requirements are harmonised among the different financial sectors. RTS on criteria for the classification of ICT-related incidents These RTS specify the criteria for the classification of major ICT-related incidents, the approach for the classification of major incidents, the materiality thresholds of each classification criterion, the criteria and materiality thresholds for determining significant cyber threats, the criteria for competent authorities to assess the relevance of incidents to competent authorities in other Member States and the details of the incidents to be shared in this regard. The RTS ensure a harmonised and simple process of classifying incident reports throughout the financial sector. RTS on ICT TPP policy These RTS specify parts of the governance arrangements, risk management and internal control framework that financial entities should have in place regarding the use of ICT third-party service providers. They aim to ensure financial entities remain in control of their operational risks, information security and business continuity throughout the life cycle of contractual arrangements with such ICT third-party service providers. ITS on the register of information Finally, the ITS set out the templates to be maintained and updated by financial entities in relation to their contractual arrangements with ICT third-party service providers. The register of information will play a crucial role in the ICT third-party risk management framework of the financial entities and will be used by competent authorities and ESAs in the context of supervising financial entities’ compliance with DORA and to designate critical ICT third-party service providers that will be subject to the DORA oversight regime.