Article 6, Paragraph 5. · Commission Delegated Regulation (EU) 2023/1668

Contents

5.For the purposes of Article 3, the indicative qualitative metrics shall be the following:

(a)any indication of significant financial risks not addressed by the own funds requirements set out in Article 11 of Regulation (EU) 2019/2033, in particular:

(i)the average of total operational risk losses over gross income over the preceding 5 years;

(ii)any significant operational events and associated financial losses over the preceding 5 years;

(iii)the share of the investment firm’s net income coming from services or activities that are not listed in Section A of Annex I to Directive 2014/65/EU of the European Parliament and of the Council^note;

(b)any indication of significant information and communication technology (ICT) risk, in particular:

(i)the overall complexity of ICT architecture, including the share of outsourced ICT services;

(ii)the number of material changes within the ICT environment over the preceding 5 years;

(iii)any losses due to disruption caused by incidents affecting critical ICT services over the preceding 5 years;

(iv)the number of cyberattacks and related losses over the preceding 5 years;

(c)any indication of significant interest rate risk arising from non-trading book activities, in particular:

(i)the volume of transactions based on interest rates or otherwise depending on interest rates, outside of the trading book of the investment firm;

(ii)the investment firm’s hedging policy and potential misalignments between the position and the hedge, outside of the trading book of the investment firm.