The package includes four draft regulatory technical standards (RTS), one set of draft implementing technical standards (ITS) and two sets of guidelines (GL). 

These policy instruments aim to ensure a "consistent and harmonised legal framework in the areas of major ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management and oversight over critical ICT third-party providers."

Comments on this consultation can be sent to the ESAs via the consultation pages:

• Consultation on Joint draft technical standards on major incident reporting
• Consultation on Joint draft Guidelines on estimation of aggregated annual costs and losses caused by major ICT-related incidents
• Consultation on Joint draft RTS on subcontracting ICT services supporting critical or important functions
• Consultation on Joint draft RTS on the harmonisation of conditions enabling the conduct of the oversight activities
• Consultation on Joint draft guidelines on the oversight cooperation and information exchange between the ESAs and the competent authorities
• Consultation on Joint draft RTS specifying elements related to threat led penetration tests 

The consultation runs until 4 March 2024.

The Joint Committee of the ESAs advises national competent authorities, financial institutions and market participants to take a number of policy actions including:

1. Supervisors should continue to monitor risks to retail investors some of whom buy assets, in particular cryptoassets and related products, without fully realising the high risks involved. 

"Some retail investors may not be fully aware of the long-term effects of rising inflation on their assets and purchasing power. In the context of growing retail participation and significant volatility in cryptoassets and related products, retail investors should be aware of the risks stemming from these. The recent events and subsequent selloff of cryptoassets raises concerns on the appropriate assessment of the risks and the developments of this market segment going forward and requires particular attention of financial institutions and supervisors. Where disclosures are ineffective, these risks are compounded.

2. Financial institutions and supervisors should continue to carefully manage environmental related risks and cyber risks. 

"They should ensure that appropriate technologies and adequate control frameworks are in place to address threats to information security and business continuity, including risks stemming from increasingly sophisticated cyber-attacks."

The EBA's priorities are:

• monitoring the regulatory perimeter, including assessing current authorisation and licencing approaches to FinTech firms, and analysing regulatory sandboxes and innovation hubs to identify a set of best practices to enhance consistency and facilitate supervisory co-ordination;
• monitoring emerging trends and analysing the impact on incumbent institutions' business models and the prudential risks and opportunities arising from the use of FinTech;
• promoting best supervisory practices on assessing cybersecurity and promoting a common cyber threat testing framework;
• addressing consumer issues arising from FinTech, in particular in the areas of unclear regulatory status of FinTech firms and related disclosure to consumers, potential national barriers preventing FinTech firms from scaling up services to consumers across the single market, and the appropriateness of the current regulatory framework for virtual currencies; and
• identifying and assessing money laundering/terrorist financing risks associated with regulated FinTech firms, technology providers and FinTech solutions. 

As mandated by the European Commission's 2018 FinTech action plan, the EBA and the other European Supervisory Authorities (ESAs) (namely, the European Securities and Markets Authority and the European Insurance and Occupational Pensions Authority) will carry out specific tasks relating to FinTech.

Some areas of focus include authorisations issues, regulatory sandboxes and innovation hubs, knowledge sharing among FinTech firms, supervisors and regulators, and virtual currencies.

In respect of virtual currencies, the ESAs will work on the regulatory mapping of the current requirements on virtual currencies in order to assess whether the current framework is appropriate with a view of publishing an EBA report and/or opinion addressed to EU legislators.

The Roadmap also announces the creation of a FinTech Knowledge Hub to enhance knowledge sharing and foster technological neutrality in regulatory and supervisory approaches.

Andrea Enria, the EBA's Chairperson, said:

"The EBA's Knowledge Hub will ensure that EU supervisors share best practices and adopt a technologically neutral approach to the application of new technologies in the financial sector. This will help facilitate innovation and scalability across the single market."