The joint final draft technical standards include:

• Regulatory Technical Standards (RTS) on ICT risk management framework and on simplified ICT risk management framework;
• RTS on criteria for the classification of ICT-related incidents;
• RTS to specify the policy on ICT services supporting critical or important functions provided by ICT third-party service providers; and
• Implementing Technical Standards to establish the templates for the register of information.

The package includes four draft regulatory technical standards (RTS), one set of draft implementing technical standards (ITS) and two sets of guidelines (GL). 

These policy instruments aim to ensure a "consistent and harmonised legal framework in the areas of major ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management and oversight over critical ICT third-party providers."

Comments on this consultation can be sent to the ESAs via the consultation pages:

• Consultation on Joint draft technical standards on major incident reporting
• Consultation on Joint draft Guidelines on estimation of aggregated annual costs and losses caused by major ICT-related incidents
• Consultation on Joint draft RTS on subcontracting ICT services supporting critical or important functions
• Consultation on Joint draft RTS on the harmonisation of conditions enabling the conduct of the oversight activities
• Consultation on Joint draft guidelines on the oversight cooperation and information exchange between the ESAs and the competent authorities
• Consultation on Joint draft RTS specifying elements related to threat led penetration tests 

The consultation runs until 4 March 2024.

These ‘travel rule’ Guidelines specify the steps that Payment Service Providers (PSPs), Intermediary PSPs (IPSPs), cryptoasset service providers (CASPs) and Intermediary CASPs (ICASPs) should take to detect missing or incomplete information that accompanies a transfer of funds or cryptoassets.

They also detail the procedures these providers should put in place to manage a transfer of funds or a transfer of cryptoassets that lacks the required information.

Deadline for comments is 26 February 2024.

The consultations published today are on:

Draft regulatory technical standards on liquidity requirements and on draft Guidelines on liquidity stress testing of relevant issuers of tokens 

Draft technical standards on own funds requirements and stress testing of issuers 

Draft Guidelines on recovery plans for issuers of asset-referenced tokens and e-money tokens 

Reporting of transactions with asset-referenced tokens and e-money tokens denominated in a non-EU currency 

Draft technical standards on supervisory colleges 

Deadline for comments on all consultations is 8 February 2024.

According to the press release, the EBA will focus on:

i) implementing the EU banking package (Capital Requirements Regulation - CRR III / Capital Requirements Directive - CRD VI); 

ii) monitoring financial stability and sustainability; 

iii) providing a data infrastructure at the service of stakeholders;

iv) developing oversight and supervisory capacity for the Digital Operational Resilience Act (DORA) and the Markets in Crypto Assets Regulation (MiCA); and

v) increasing attention on innovation and consumers (including access to financial services) while preparing the transition to the new anti-money laundering and countering the financing of terrorism (AML/CFT) framework. 

The Opinion is issued against the background of a changed risk landscape, which has an impact on institutions’ AML/CFT compliance and competent authorities’ approaches to supervision. Examples include geopolitical events such as Russia’s invasion of Ukraine and legislative developments like  the publication of a comprehensive ‘AML Package’ and the Markets in Crypto-Assets Regulation (MiCA). They also include emerging risks such as corruption, and the laundering of proceeds from both environmental crime and cybercrime.

The draft RTS proposed in the consultation set out definitions of complaints and complainants, requirements related to the complaints management policy and function, provision of information to holders of ARTs and on templates and recording.

They then proceed with requirements about the procedure to investigate complaints and to communicate the outcome of the investigations to complainants and specific provisions for complaints handling involving third-party entities.