Application of Directive 2013/36/EU and of Regulations (EU) No 575/2013, (EC) No 1060/2009, (EU) 2015/534, and (EU) 2017/2402 to credit and financial services institutions

(1) For institutions that are not
1. CRR credit institutions,
2. credit institutions that hold only a licence under Article 16(1) of Regulation (EU) No 909/2014 to carry out the activity of a central securities depository under Section A, or under Sections A and B, of the Annex to Regulation (EU) No 909/2014, or
3. housing enterprises with a savings facility, subject to section 2(7) to (9f), the requirements of Directive 2013/36/EU, as amended on 27 November 2024, the requirements of Regulation (EU) No 575/2013 and of Chapter 2 of Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation and creating a specific framework for simple, transparent, and standardised securitisation, and amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, and Regulations (EC) No 1060/2009 and (EU) No 648/2012 (OJ L 347, 28.12.2017, p. 35), the requirements of the legal acts issued on the basis of Directive 2013/36/EU, as amended on 27 November 2024, Regulation (EU) No 575/2013, and Chapter 2 of Regulation (EU) 2017/2402, the provisions of this Act that refer to requirements of Regulation (EU) No 575/2013 or of Chapter 2 of Regulation (EU) 2017/2402, and the statutory instruments issued to supplement Regulation (EU) No 575/2013 under section 10(1), first sentence, and section 13(1), apply as if these institutions were CRR credit institutions.
(2) For entities named specifically in Article 2(5), point 5, of Directive 2013/36/EU, the requirements of Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014, and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1), and the requirements of the legal acts issued on the basis of Regulation (EU) 2022/2554, and the provisions of this Act that refer to requirements of Regulation (EU) 2022/2554, apply as if these entities were CRR credit institutions.
(2a) For institutions that do not fall within the scope of Regulation (EU) 2022/2554 under Article 2 of that Regulation, the requirements of Regulation (EU) 2022/2554 and the requirements of the legal acts issued on the basis of Regulation (EU) 2022/2554, and the provisions of this Act that refer to requirements of Regulation (EU) 2022/2554, apply as if these institutions were CRR credit institutions. By way of derogation from the first sentence,
1. the requirements of the simplified information and communication technology risk management framework under Article 16 of Regulation (EU) 2022/2554 apply in place of the requirements of Articles 5 to 15 of Regulation (EU) 2022/2554,
2. the requirements for conducting threat-led penetration testing under Articles 26 and 27 of Regulation (EU) 2022/2554 do not apply,
3. the requirements for information and communication technology third-party risk management under Articles 28 to 30 of Regulation (EU) 2022/2554 do not apply to micro-enterprises within the meaning of Article 3, point 60, of Regulation (EU) 2022/2554.
(3) For credit institutions and financial services institutions that are neither CRR credit institutions nor housing enterprises with a savings facility, the requirements of Article 4(1), first subparagraph, and Article 5a(1), and Articles 8b to 8d, of Regulation (EC) No 1060/2009 of the European Parliament and of the Council of 16 September 2009 on credit rating agencies (OJ L 302, 17.11.2009, p. 1; L 350, 29.12.2009, p. 59; L 145, 31.5.2011, p. 57; L 267, 6.9.2014, p. 30), as last amended by Regulation (EU) 2017/2402 (OJ L 347, 28.12.2017, p. 35), and the legal acts issued on its basis, apply as if these credit institutions and financial services institutions were CRR credit institutions.
(4) For credit institutions that hold a licence to conduct banking business within the meaning of section 1(1), second sentence, points 1 and 2, but that are neither CRR credit institutions nor branches within the meaning of section 53(1), first sentence, the reporting requirements of Regulation (EU) 2015/534 of the European Central Bank of 17 March 2015 on reporting of supervisory financial information (ECB/2015/13) (OJ L 86, 31.3.2015, p. 13; L 65, 8.3.2018, p. 48), as last amended by Regulation (EU) 2020/605 (OJ L 145, 7.5.2020, p. 1), apply as if these credit institutions were CRR credit institutions. The classification as a significant or less significant credit institution required for determining the scope of reporting is made on the basis of the size criterion "total value of assets" under Article 50 of Regulation (EU) No 468/2014 of the European Central Bank of 16 April 2014 establishing the framework for cooperation within the Single Supervisory Mechanism between the European Central Bank and national competent authorities and with national designated authorities (SSM Framework Regulation) (ECB/2014/17) (OJ L 141, 14.5.2014, p. 1; L 113, 29.4.2017, p. 64; L 65, 8.3.2018, p. 49). Reports are to be submitted electronically to the Deutsche Bundesbank.