The joint final draft technical standards include:

• Regulatory Technical Standards (RTS) on ICT risk management framework and on simplified ICT risk management framework;
• RTS on criteria for the classification of ICT-related incidents;
• RTS to specify the policy on ICT services supporting critical or important functions provided by ICT third-party service providers; and
• Implementing Technical Standards to establish the templates for the register of information.

The package includes four draft regulatory technical standards (RTS), one set of draft implementing technical standards (ITS) and two sets of guidelines (GL). 

These policy instruments aim to ensure a "consistent and harmonised legal framework in the areas of major ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management and oversight over critical ICT third-party providers."

Comments on this consultation can be sent to the ESAs via the consultation pages:

• Consultation on Joint draft technical standards on major incident reporting
• Consultation on Joint draft Guidelines on estimation of aggregated annual costs and losses caused by major ICT-related incidents
• Consultation on Joint draft RTS on subcontracting ICT services supporting critical or important functions
• Consultation on Joint draft RTS on the harmonisation of conditions enabling the conduct of the oversight activities
• Consultation on Joint draft guidelines on the oversight cooperation and information exchange between the ESAs and the competent authorities
• Consultation on Joint draft RTS specifying elements related to threat led penetration tests 

The consultation runs until 4 March 2024.

The report identifies 12 good practices that national competent authorities and other public entities can follow when designing and implementing their financial education initiatives.

The Joint Committee of the ESAs advises national competent authorities, financial institutions and market participants to take a number of policy actions including:

1. Supervisors should continue to monitor risks to retail investors some of whom buy assets, in particular cryptoassets and related products, without fully realising the high risks involved. 

"Some retail investors may not be fully aware of the long-term effects of rising inflation on their assets and purchasing power. In the context of growing retail participation and significant volatility in cryptoassets and related products, retail investors should be aware of the risks stemming from these. The recent events and subsequent selloff of cryptoassets raises concerns on the appropriate assessment of the risks and the developments of this market segment going forward and requires particular attention of financial institutions and supervisors. Where disclosures are ineffective, these risks are compounded.

2. Financial institutions and supervisors should continue to carefully manage environmental related risks and cyber risks. 

"They should ensure that appropriate technologies and adequate control frameworks are in place to address threats to information security and business continuity, including risks stemming from increasingly sophisticated cyber-attacks."

The report identifies areas of improvement for the framework relating to applicable sectoral legislation or where additional analysis is needed (for example, interaction between resolution and the AML and CTF regimes). It also sets out criteria for the notion of serious breach of AML/CTF rules.

The ESAs suggest introducing a specific legal ground to revoke authorisation for serious breaches of AML and CTF rules and that competent authorities ensure that adequacy of AML and CTF arrangements and processes is a condition for granting authorisation or registration.

The report highlights the need for the proposed Markets in Cryptoassets (MiCA) Regulation to appropriately integrate AML and CTF issues in the prudential supervision of entities that will be regulated under that regime.

Key workstreams include:

• Digital finance – extensive technical discussions on topics such as cryptoassets and digital operational resilience;
• Sustainability – the development of the regulatory and supervisory framework for sustainability-related disclosures, including the delivery of two sets of draft Regulatory Technical Standards (RTS) under the Sustainable Finance Disclosure Regulation (SFDR);
• Consumer protection – work to prepare the response to the Call for Evidence from the European Commission in the context of the review of the PRIIPs Regulation, following the submission of the draft RTS in January 2021; and
• Securitisation – the delivery of a report on the implementation and functioning of the Securitisation Regulation as well as an Opinion on its jurisdictional scope.