Bank of Italy has published the new legal research paper N. 98 entitled: “Pandectae. Digest of the case-law on the Banking Union”.

(Only in Italian)

Published in the Official Journal No. 12 of 16 January 2024, the notice of the Ministry of Economy and Finance indicating the applicable default interest rate for the creditor in the event of late payment of commercial transactions.
In particular, for the first half of 2024, 1 January – 30 June 2024, the reference rate has been set at 4.5%.

The three European Supervisory Authorities (ESMA, EBA and EIOPA – the ESAs) has published the first set of final draft technical standards under the DORA aimed at enhancing the digital operational resilience of the EU financial sector by strengthening financial entities’ Information and Communication Technology (ICT) and third-party risk management and incident reporting frameworks.

• Regulatory Technical Standards (RTS) on ICT risk management framework and on simplified ICT risk management framework: the draft RTS on ICT risk management framework identify further elements related to ICT risk management with a view to harmonise tools, methods, processes and policies. These elements are complementary to those identified in DORA. The RTS identify the key elements that financial entities subject to the simplified regime and of lower scale, risk, size and complexity would need to have in place, setting out a simplified ICT risk management framework. The RTS ensure the ICT risk management requirements are harmonised among the different financial sectors.
• RTS on criteria for the classification of ICT-related incidents: these RTS specify the criteria for the classification of major ICT-related incidents, the approach for the classification of major incidents, the materiality thresholds of each classification criterion, the criteria and materiality thresholds for determining significant cyber threats, the criteria for competent authorities to assess the relevance of incidents to competent authorities in other Member States and the details of the incidents to be shared in this regard. The RTS ensure a harmonised and simple process of classifying incident reports throughout the financial sector.
• RTS to specify the policy on ICT services supporting critical or important functions provided by ICT third-party service providers (TPPs): these RTS specify parts of the governance arrangements, risk management and internal control framework that financial entities should have in place regarding the use of ICT third-party service providers. They aim to ensure financial entities remain in control of their operational risks, information security and business continuity throughout the life cycle of contractual arrangements with such ICT third-party service providers.
• Implementing Technical Standards (ITS) to establish the templates for the register of information: the ITS set out the templates to be maintained and updated by financial entities in relation to their contractual arrangements with ICT third-party service providers. The register of information will play a crucial role in the ICT third-party risk management framework of the financial entities and will be used by competent authorities and ESAs in the context of supervising financial entities’ compliance with DORA and to designate critical ICT third-party service providers that will be subject to the DORA oversight regime.