EBA Final Guidelines On ICT Risk Assessment Under Supervisory Review And Evaluation Process

Authored by Amy Roper

On May 11, 2017, the EBA published a report (EBA/GL/2017/05) containing its final guidelines on information and communication technology ("ICT") risk assessment under the supervisory review and evaluation process ("SREP") required under the CRD IV Directive (2013/36/EU).

The guidelines are addressed to competent authorities and aim at promoting common procedures and methodologies for the assessment of ICT risk. They should be read in conjunction with the EBA SREP Guidelines, which continue to remain applicable as appropriate.

The guidelines are contained in section 3 of the report and are structured around three main parts:

1. the general provisions for applying the guidelines (Title 1);