2025/381

6.3.2025

COUNCIL DECISION (EU) 2025/381

of 18 February 2025

on the position to be adopted, on behalf of the European Union, within the EEA Joint Committee concerning an amendment to Annex IX (Financial services) to the EEA Agreement

(Text with EEA relevance)

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 53(1) and Article 114 in conjunction with Article 218(9) thereof,

Having regard to Council Regulation (EC) No 2894/94 of 28 November 1994 concerning arrangements for implementing the Agreement on the European Economic Area (1), and in particular Article 1(3) thereof,

Having regard to the proposal from the European Commission,

Whereas:

(1) The Agreement on the European Economic Area (2) (‘the EEA Agreement’) entered into force on 1 January 1994.

(2) Pursuant to Article 98 of the EEA Agreement, the EEA Joint Committee may decide to amend, inter alia, Annex IX (Financial services) to the EEA Agreement.

(3) Regulation (EU) 2022/2554 of the European Parliament and of the Council (3) and Directive (EU) 2022/2556 of the European Parliament and of the Council (4) should be incorporated into the EEA Agreement.

(4) Annex IX (Financial services) to the EEA Agreement should therefore be amended accordingly.

(5) The position of the Union within the EEA Joint Committee should therefore be based on the attached draft Decision,

HAS ADOPTED THIS DECISION:

Article 1

The position to be adopted, on the Union’s behalf, within the EEA Joint Committee on the proposed amendment of Annex IX (Financial services) to the EEA Agreement, shall be based on the draft decision of the EEA Joint Committee attached to this Decision.

Article 2

This Decision shall enter into force on the date of its adoption.

Done at Brussels, 18 February 2025.

For the Council

The President

A. DOMAŃSKI

(1)

OJ L 305, 30.11.1994, p. 6

, ELI: http://data.europa.eu/eli/reg/1994/2894/oj.

(2)

OJ L 1, 3.1.1994, p. 3

, ELI: http://data.europa.eu/eli/agree_internation/1994/1/oj.

(3) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (

OJ L 333, 27.12.2022, p. 1

, ELI: http://data.europa.eu/eli/reg/2022/2554/oj).

(4) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital operational resilience for the financial sector (

OJ L 333, 27.12.2022, p. 153

, ELI: http://data.europa.eu/eli/dir/2022/2556/oj).

DRAFT

DECISION OF THE EEA JOINT COMMITTEE NO …

of …

amending Annex IX (Financial services) to the EEA Agreement

THE EEA JOINT COMMITTEE,

Having regard to the Agreement on the European Economic Area (‘the EEA Agreement’), and in particular Article 98 thereof,

Whereas:

(1) Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (1) is to be incorporated into the EEA Agreement.

(2) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital operational resilience for the financial sector (2) is to be incorporated into the EEA Agreement.

(3) Annex IX to the EEA Agreement should therefore be amended accordingly,

HAS ADOPTED THIS DECISION:

Article 1

Annex IX to the EEA Agreement shall be amended as follows:

The following indent is added in point 1 (Directive 2009/138/EC of the European Parliament and of the Council), point 14 (Directive 2013/36/EU of the European Parliament and of the Council), point 19b (Directive 2014/59/EU of the European Parliament and of the Council), point 30 (Directive 2009/65/EC of the European Parliament and of the Council), point 31ba (Directive 2014/65/EU of the European Parliament and of the Council) and point 31bb (Directive 2011/61/EU of the European Parliament and of the Council):

‘—

32022 L 2556

: Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 (

OJ L 333, 27.12.2022, p. 153

).’

The following is added in point 16e (Directive (EU) 2015/2366 of the European Parliament and of the Council) and point 31d (Directive (EU) 2016/2341 of the European Parliament and of the Council):

‘, as amended by:

— 32022 L 2556

: Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 (

OJ L 333, 27.12.2022, p. 153

).’

The following is inserted after point 31pc (Commission Delegated Regulation (EU) 2023/2486):

‘31q.

32022 R 2554

: Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (

OJ L 333, 27.12.2022, p. 1

The provisions of the Regulation shall, for the purposes of this Agreement, be read with the following adaptations:

(a) Notwithstanding the provisions of Protocol 1 to this Agreement, and unless otherwise provided for in this Agreement, the terms Member State(s) and competent authorities shall be understood to include, in addition to their meaning in the Regulation, the EFTA States and their competent authorities, respectively.

(b) Unless otherwise provided for in this Agreement, the European Supervisory Authorities (ESAs) and the EFTA Surveillance Authority shall cooperate, exchange information and consult each other for the purposes of the Regulation, in particular prior to taking any action.

(c) Decisions, requests, recommendations, opinions, plans and other measures of the EFTA Surveillance Authority under Articles 31, 33, 35-39, 42 and 43 shall, without undue delay, be adopted on the basis of drafts prepared by the competent ESA pursuant to Article 31(1) at its own initiative or at the request of the EFTA Surveillance Authority.

(d) When the Regulation refers to the national central banks, it shall, as regards Liechtenstein, refer to the Ministry of Finance in Liechtenstein.

(e) In point (61) of Article 3, the words “or the EFTA Surveillance Authority, as the case may be” shall be inserted after the words “European Supervisory Authority”.

(f) In point (30) of Article 3 and Article 55(3), the words “Union or national law” shall be replaced with “provisions of the EEA Agreement or national law”.

(g) In Articles 6(10) and 19(5), the words “Union and national sectoral law” shall be replaced with “the EEA Agreement and national sectoral law”.

(h) In Article 19(7), the words “and the national central banks of the EFTA States” shall be inserted after the words “members of the European System of Central Banks”.

(i) In Article 31(1):

(i) the words “, or the EFTA Surveillance Authority, as regards ICT third-party service providers established in an EFTA State or ICT third-party service providers established in a third country but with a subsidiary in an EFTA State,” shall be inserted after the word “Joint Committee”;

(ii) the words “or, as the case may be, the EFTA Surveillance Authority,” shall be inserted after the word “the ESA that is responsible”;

(iii) the following shall be added to point (b):

“The EFTA Surveillance Authority shall be the Lead Overseer for each critical ICT third-party service providers established in an EFTA State, or ICT third-party service providers established in a third country but with a subsidiary in an EFTA State. The ESAs shall, through the Joint Committee, appoint the relevant ESA that is to assist the EFTA Surveillance Authority in fulfilling its role under the Regulation, including preparing the drafts referred to in adaptation (c)”.

(j) In Article 31(5), the words “, or the EFTA Surveillance Authority, as the case may be” shall be inserted after the word “Joint Committee”.

(k) In Article 31(8) (ii), the words “or, as regards the EFTA States, frameworks for the purposes of supporting the same tasks as referred to in Article 127(2) of the Treaty on the Functioning of the European Union” shall be inserted after the words “Treaty on the Functioning of the European Union”.

(l) In Article 31(11), the words “, or the EFTA Surveillance Authority, as the case may be” shall be inserted after the words “Joint Committee”.

(m) In Article 32(4), the following subparagraphs shall be added:

“The competent authorities of the EFTA States shall have the same rights and obligations as the competent authorities of the EU Member States in the work of the Oversight Forum.

The EFTA Surveillance Authority shall have the right to appoint two representatives to the Oversight Forum, one of which shall be a high-level representative, with the same rights and obligations as the representatives of the ESAs.”.

(n) In Article 32(8), the words “Union rules” shall be replaced by the words “provisions of the EEA Agreement”.

(o) In Article 34(1), the following sentence shall be added:

“The EFTA Surveillance Authority, in its role as a Lead Overseer, shall participate in JON.”.

(p) In Article 35(3), the following subparagraph shall be added:

“Before preparing a draft recommendation under paragraph 1, point (d) for the EFTA Surveillance Authority, the responsible ESA shall give the ICT third-party service provider the opportunity to provide, within 30 calendar days, relevant information evidencing the expected impact on costumers that are entities falling outside of the scope of this Regulation and, where appropriate, formulating solutions to mitigate risks.”.

(q) In Article 35(9), the following sentence shall be added:

“The Standing Committee of the EFTA States shall determine the allocation of the amounts of periodic penalty payments collected by the EFTA Surveillance Authority, in its role as a Lead Overseer.”.

(r) In Article 35(11), the following subparagraph shall be inserted after the first subparagraph:

“Before preparing a draft decision on periodic penalty payments under paragraph 6 for the EFTA Surveillance Authority, the responsible ESA shall give the representatives of the critical ICT third-party service provider subject to the proceedings the opportunity to be heard on the findings and shall base its decisions only on findings on which the critical ICT third-party service provider subject to the proceedings has had an opportunity to comment.”.

(s) In Article 36(2), the words “or the EFTA Surveillance Authority” shall be inserted after the words “EBA, ESMA or EIOPA”.

(t) In Article 37(3), as regards the EFTA States, point (f) shall read as follows:

“indicate the right to have the decision reviewed by the EFTA Court in accordance with Article 36 of the Agreement between the EFTA States on the Establishment of a Surveillance Authority and a Court of Justice.”.

(u) In Article 40(2):

(i) the words “and the EFTA Surveillance Authority” shall be added after the words “the ESAs”;

(ii) the following subparagraph shall be added:

“The participation of the EFTA Surveillance Authority in the joint examination team shall, in cases where the oversight activities do not involve ICT third-party service provider or a subsidiary established in an EFTA State, be on a voluntary basis.”.

(v) In Article 49(1), the words “and the EFTA Surveillance Authority” shall be inserted after the word “ESAs”.

(w) In Articles 49(2) and 56(1), the words “, the EFTA Surveillance Authority” shall be inserted after the word “ESAs”.

(x) In Article 64, as regards the EFTA States, the words “17 January 2025” shall read “a date designated under national law no later than 12 months after the date of entry into force of Decision of the EEA Joint Committee No [nn/yyyy] of month/year] (This decision).”.’

The following indent is added in points 31baa (Regulation (EU) No 600/2014 of the European Parliament and of the Council), 31bc (Regulation (EU) No 648/2012 of the European Parliament and of the Council), 31bf (Regulation (EU) No 909/2014 of the European Parliament and of the Council), 31eb (Regulation (EC) No 1060/2009 of the European Parliament and of the Council) and 31l (Regulation (EU) 2016/1011 of the European Parliament and of the Council):

‘—

32022 R 2554

: Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 (

OJ L 333, 27.12.2022, p. 1

).’.

Article 2

The texts of Regulation (EU) 2022/2554 and Directive (EU) 2022/2556 in the Icelandic and Norwegian languages, to be published in the EEA Supplement to the

Official Journal of the European Union

, shall be authentic.

Article 3

This Decision shall enter into force on , provided that all the notifications under Article 103(1) of the EEA Agreement have been made

(

)

Article 4

This Decision shall be published in the EEA Section of, and in the EEA Supplement to, the

Official Journal of the European Union

Done at Brussels, …

For the EEA Joint Committee

The President

The Secretaries

To the EEA Joint Committee

(1)

OJ L 333, 27.12.2022, p. 1

(2)

OJ L 333, 27.12.2022, p. 153

(

)

[No constitutional requirements indicated.] [Constitutional requirements indicated.]

ELI: http://data.europa.eu/eli/dec/2025/381/oj

ISSN 1977-0677 (electronic edition)