The package includes four draft regulatory technical standards (RTS), one set of draft implementing technical standards (ITS) and two sets of guidelines (GL). 

These policy instruments aim to ensure a "consistent and harmonised legal framework in the areas of major ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management and oversight over critical ICT third-party providers."

Comments on this consultation can be sent to the ESAs via the consultation pages:

• Consultation on Joint draft technical standards on major incident reporting
• Consultation on Joint draft Guidelines on estimation of aggregated annual costs and losses caused by major ICT-related incidents
• Consultation on Joint draft RTS on subcontracting ICT services supporting critical or important functions
• Consultation on Joint draft RTS on the harmonisation of conditions enabling the conduct of the oversight activities
• Consultation on Joint draft guidelines on the oversight cooperation and information exchange between the ESAs and the competent authorities
• Consultation on Joint draft RTS specifying elements related to threat led penetration tests 

The consultation runs until 4 March 2024.

The Joint Committee of the ESAs advises national competent authorities, financial institutions and market participants to take a number of policy actions including:

1. Supervisors should continue to monitor risks to retail investors some of whom buy assets, in particular cryptoassets and related products, without fully realising the high risks involved. 

"Some retail investors may not be fully aware of the long-term effects of rising inflation on their assets and purchasing power. In the context of growing retail participation and significant volatility in cryptoassets and related products, retail investors should be aware of the risks stemming from these. The recent events and subsequent selloff of cryptoassets raises concerns on the appropriate assessment of the risks and the developments of this market segment going forward and requires particular attention of financial institutions and supervisors. Where disclosures are ineffective, these risks are compounded.

2. Financial institutions and supervisors should continue to carefully manage environmental related risks and cyber risks. 

"They should ensure that appropriate technologies and adequate control frameworks are in place to address threats to information security and business continuity, including risks stemming from increasingly sophisticated cyber-attacks."

The proposals aim at maintaining a "high level of consumer protection" and addressing risks arising from the transformation of "value chains, platformisation and the emergence of new ‘mixed-activity groups’, i.e groups combining financial and non-financial activities."

The ESAs note that the use of innovative technologies in the EU financial sector is "facilitating changes to value chains, that dependencies on digital platforms are increasing rapidly, and that new mixed-activity groups are emerging. These trends open up a range of opportunities for both EU consumers and financial institutions, but also pose new risks."

The ESAs recommend action to ensure the EU’s financial services regulatory and supervisory framework remains fit-for-purpose in the digital age.