EBA amendment of its Guidelines on ICT and security risk management measures under DORA, 11 February 2025

On the 11^th of February 2025, the European Banking Authority amended its Guidelines on ICT and security risk management in light of the application of harmonised ICT risk management requirements under Regulation 2022/2554/EU (DORA). In particular, the EBA narrowed down the entity scope of the Guidelines to only those which are covered by DORA (credit institutions, payment institutions, account information service providers, exempted payment institutions and exempted e-money institutions), as well as the scope of the Guidelines to the requirements on relationship management of the payment service users in relation to the provision of payment services. Security and operational risk management requirements under Directive 2015/2366/EU (PSD2) continue to apply to other types of payment service providers not covered by DORA, such as post-office giro institutions and credit unions.

The Guidelines will be translated into the EU official languages and published on the EBA website together with a consolidated version. Competent authorities must report whether they comply with the guidelines within two months from the date of publication of the translations.