The number of websites blacked out since July 2019 has thus risen to 720.
Bank of Italy has released six new Occasional Papers (nn. 692-697):
In light of the cross-border scope of market data management, Regulation (EU) 2019/2175 transferred authorisation and supervisory powers to ESMA with regard to the activities of data communications service providers in the Union.
This Regulation specifies the fees that ESMA may charge for the application, authorisation and supervision of DRSPs.
Fees charged to DRSPs are aimed at full recovery of costs made by ESMA related to authorisation and supervision of DRSPs.
Supervisory activities include:
  • the assessment of suitability of the management body;
  • supervision of compliance by DRSPs with organisational requirements;
  • the exercise of powers to require information, conduct investigations and perform on-site inspections; and
  • the imposing of supervisory measures.
The Regulation also provides transitional rules for the years 2022 and 2023 and bases the calculations for the determination of the supervisory fees on the principle of proportionality, determining the relevance of DRSPs on the number of transactions carried out.
EIOPA has published two consultation papers on:

  • the supervisory statement on exclusions related to systemic events such as pandemic, natural catastrophes or large cyber-attacks: the aim of the supervisory statement is to promote supervisory convergence in how national competent authorities assess the treatment of exclusions in insurance contracts that arise from risks following systemic events. This should ultimately support that that insurers follow a customer-oriented approach in such events.
    EIOPA in its supervisory statement recommends national competent authorities to take into consideration the following:
    1. Insurance product manufacturers should assess whether the applicable exclusions from coverage are clear, and there is contract clarity for policyholders;
    2. If the risk arising from a systemic event becomes uninsurable or there is lack of clarity as to whether the risk is covered or not, insurance manufacturers are expected to make an assessment of the terms and conditions and of the scope of coverage by considering the needs, objectives and characteristics of the identified target market;
    3. More broadly, when new products are developed, the target market’s needs, objectives and characteristics need to be taken into account vis-à-vis exclusions.
  • the supervisory statement on the management of non-affirmative cyber exposures: in this consultation paper, EIOPA recommends national competent authorities to dedicate higher attention to insurance undertakings’ assessment of the terms and conditions of their existing insurance products.
    The consultation paper focuses on supervisory expectations and emphasises:
    1. the need for a top-down strategy and risk appetite definition for (re)insurance undertakings to underwrite cyber risk;
    2. the need to identify and measure risks exposure with the purpose of implementing sound cyber underwriting practices, with particular regard to the management of non-affirmative cyber exposures;
    3. the importance of cyber underwriting risk management and risk mitigation, including the reinsurance strategy.