Article 5, Paragraph 2. · Commission Delegated Regulation (EU) 2025/1125

Contents

2.The application for authorisation shall contain a description of the arrangements and assigned ICT and human resources to ensure that the applicant issuer complies with Regulation (EU) 2022/2554, including all of the following information in relation to the applicant issuer’s ICT systems, protocols and tools:

(a)a detailed technical documentation including a description of the ICT risk management framework in accordance with Article 6(1) of Regulation (EU) 2022/2554, demonstrating the applicant issuer’s ability to address ICT risk rapidly, efficiently and comprehensively and to ensure a high level of digital operational resilience;

(b)details showing that the applicant issuer maintains updated ICT systems, protocols and tools that are appropriate, reliable, equipped with sufficient capacity to accurately process the data necessary for the performance of activities and the timely provision of services, and technologically resilient in accordance with Article 7 of Regulation (EU) 2022/2254;

(c)a detailed description of the security policy demonstrating that the applicant issuer’s systems and procedures are capable to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers in accordance with Article 9(4) of Regulation (EU) 2022/2554;

(d)a comprehensive description of the ICT process and systems showing the ability to provide the applicant issuer with reliable information and data to support data reporting requirements.