The European Supervisory Authorities have published a joint report on the feasibility of further centralization of the reporting of major ICT-related incidents by financial entities to competent authorities. The ESAs' joint report explores the potential for further centralization through the establishment of a single EU hub assessing the feasibility of three different models: (i) the baseline model; (ii) a model with enhanced data sharing arrangements; and (iii) a fully centralized model (i.e., an EU hub). The report considers the potential burden and cost reductions, as well as the efficiency and effectiveness gains that each model would bring for cross-sector supervisory practices.
The report concludes that all three models are feasible, noting that the baseline scenario must be implemented this year. For the other two models, their implementation is considered feasible within three years for the data-sharing solution, given this could be implemented progressively from the baseline solution, and from five years onwards for the fully centralized hub. In terms of costs, the analysis shows that there is no significant difference among the three scenarios assessed and from overall cost perspective all three solutions are in a similar range. The report also discusses the local solutions that have already been or are in the process of being built at national level to enable reporting by January 17, 2025. Therefore, while there are some envisaged advantages and cost reductions in absolute terms for the fully centralized scenario, it inevitably becomes less attractive with limited advantage and incentives for changing the existing reporting channels. The ESAs stress that is thus important that co-legislators continue to assess and consider further centralization into a single EU hub, having regard to the different elements and aspects highlighted in this report, especially minimizing costs of a transition to a fully centralized EU hub solution.
[View source.]
