Decision (EU) 2022/911 of the European Central Bank of 19 April 2022 concerning the terms and conditions of TARGET-ECB and repealing Decision ECB/2007/7 (ECB/2022/22)

Where segregation of duties cannot be implemented due to documented objective reasons, compensatory controls shall be implemented following a formal risk analysis. Controls shall be established to prevent and detect the introduction of malicious code for systems in the Payment Transaction Chain. Controls shall be also established (including user awareness) to prevent, detect and remove malicious code. Mobile code shall be used only from trusted sources (e.g. signed Microsoft COM components and Java Applets). The configuration of the browser (e.g. the use of extensions and plugins) shall be strictly controlled.

Data backup and recovery policies shall be implemented by the management; those recovery policies shall include a plan of the restoration process which is tested at regular intervals at least annually.

Systems that are critical for the security of payments shall be monitored and events relevant to information security shall be recorded. Operator logs shall be used to ensure that information system problems are identified. Operator logs shall be regularly reviewed on a sample basis, based on the criticality of the operations. System monitoring shall be used to check the effectiveness of controls which are identified as critical for the security of payments and to verify conformity to an access policy model.

Exchanges of information between organisations shall be based on a formal exchange policy, carried out in line with exchange agreements among the involved parties and shall be compliant with any relevant legislation. Third party software components employed in the exchange of information with TARGET (e.g. software received from a Service Bureau) must be used under a formal agreement with the third party.

Requirement 1.9: Access control

Access to information assets shall be justified on the basis of business requirements (need-to-know ([^E0022])) and according to the established framework of corporate policies (including the information security policy). Clear access control rules shall be defined based on the principle of least privilege ([^E0023]) to reflect closely the needs of the corresponding business and IT processes. Where relevant, (e.g. for backup management) logical access control should be consistent with physical access control unless there are adequate compensatory controls in place (e.g. encryption, personal data anonymisation).

Formal and documented procedures shall be in place to control the allocation of access rights to information systems and services that fall within the scope of the Payment Transaction Chain. The procedures shall cover all stages in the lifecycle of user access, from the initial registration of new users to the final deregistration of users that no longer require access.

Special attention shall be given, where appropriate, to the allocation of access rights of such criticality that the abuse of those access rights could lead to a severe adverse impact on the operations of the participant (e.g. access rights allowing system administration, override of system controls, direct access to business data). Appropriate controls shall be put in place to identify, authenticate and authorise users at specific points in the organisation’s network, e.g. for local and remote access to systems in the Payment Transaction Chain. Personal accounts shall not be shared in order to ensure accountability.

For passwords, rules shall be established and enforced by specific controls to ensure that passwords cannot be easily guessed, e.g. complexity rules and limited-time validity. A safe password recovery and/or reset protocol shall be established.

A policy shall be developed and implemented on the use of cryptographic controls to protect the confidentiality, authenticity and integrity of information. A key management policy shall be established to support the use of cryptographic controls.

There shall be policy for viewing confidential information on screen or in print (e.g. a clear screen, a clear desk policy) to reduce the risk of unauthorised access.

When working remotely, the risks of working in an unprotected environment shall be considered and appropriate technical and organisational controls shall be applied.

Requirement 1.10: Information systems acquisition, development and maintenance

Security requirements shall be identified and agreed prior to the development and/or implementation of information systems.

Appropriate controls shall be built into applications, including user-developed applications, to ensure correct processing. These controls shall include the validation of input data, internal processing and output data. Additional controls may be required for systems that process, or have an impact on, sensitive, valuable or critical information. Such controls shall be determined on the basis of security requirements and risk assessment according to the established policies (e.g. information security policy, cryptographic control policy).

The operational requirements of new systems shall be established, documented and tested prior to their acceptance and use. As regards network security, appropriate controls, including segmentation and secure management, should be implemented based on the criticality of data flows and the level of risk of the network zones in the organisation. There shall be specific controls to protect sensitive information passing over public networks.

Access to system files and program source code shall be controlled and IT projects and support activities conducted in a secure manner. Care shall be taken to avoid exposure of sensitive data in test environments. Project and support environments shall be strictly controlled. Deployment of changes in production shall be strictly controlled. A risk assessment of the major changes to be deployed in production shall be conducted.

Regular security testing activities of systems in production shall also be conducted according to a predefined plan based on the outcome of a risk-assessment, and security testing shall include, at least, vulnerability assessments. All of the shortcomings highlighted during the security testing activities shall be assessed and action plans to close any identified gap shall be prepared and followed-up in a timely fashion.

Requirement 1.11: Information security in supplier

([^E0024]) relationships

To ensure protection of the participant’s internal information systems that are accessible by suppliers, information security requirements for mitigating the risks associated with supplier’s access shall be documented and formally agreed upon with the supplier.

Requirement 1.12: Management of information security incidents and improvements

To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses, roles, responsibilities and procedures, at business and technical level, shall be established and tested to ensure a quick, effective and orderly and safely recover from information security incidents including scenarios related to a cyberrelated cause (e.g. a fraud pursued by an external attacker or by an insider). Personnel involved in these procedures shall be adequately trained.

Requirement 1.13: Technical compliance review

A participant’s internal information systems (e.g. back office systems, internal networks and external network connectivity) shall be regularly assessed for compliance with the organisation’s established framework of policies (e.g. information security policy, cryptographic control policy).

Requirement 1.14: Virtualisation

Guest virtual machines shall comply with all the security controls that are set for physical hardware and systems (e.g. hardening, logging). Controls relating to hypervisors must include: hardening of the hypervisor and the hosting operating system, regular patching, strict separation of different environments (e.g. production and development). Centralised management, logging and monitoring as well as managing of access rights, in particular for high privileged accounts, shall be implemented based on a risk assessment. Guest virtual machines managed by the same hypervisor shall have a similar risk profile.

Requirement 1.15: Cloud computing

The usage of public and/or hybrid cloud solutions in the Payment Transaction Chain must be based on a formal risk assessment, taking into account the technical controls and the contractual clauses related to the cloud solution.

If hybrid cloud solutions are used, it is understood that the criticality level of the overall system is the highest one of the connected systems. All on-premises components of the hybrid solutions must be segregated from the other on-premises systems.

The following requirements relate to business continuity management. Each TARGET participant designated by the Eurosystem as being critical for the smooth functioning of the TARGET system shall have a business continuity strategy in place that complies with the following requirements.

Requirement 2.1:

Business continuity plans shall be developed and procedures for maintaining them are in place.

Requirement 2.2:

An alternate operational site shall be available.

Requirement 2.3:

The risk profile of the alternate site shall be different from that of the primary site, in order to avoid that both sites are affected by the same event at the same time. For example, the alternate site shall be on a different power grid and central telecommunication circuit from those of the primary business location.

Requirement 2.4:

In the event of a major operational disruption rendering the primary site inaccessible and/or critical staff unavailable, the critical participant shall be able to resume normal operations from the alternate site, where it shall be possible to properly close the business day and open the following business day(s).

Requirement 2.5:

Procedures shall be in place to ensure that the processing of transactions is resumed from the alternate site within a reasonable timeframe after the initial disruption of service and commensurate to the criticality of the business that was disrupted.

Requirement 2.6:

The ability to cope with operational disruptions shall be tested at least once a year and critical staff shall be aptly trained. The maximum period between tests shall not exceed one year.

ANNEX II

TARGET GOVERNANCE ARRANGEMENTS

ANNEX III

DEFINITIONS

• (1) ‘account monitoring group’ means a group of two or more MCAs and/or DCAs in respect of which one participant, the leader party, has a view over the balance on each of the TARGET accounts in the group;

• (2) ‘addressable BIC holder’ means an entity which: (a) holds a Business Identifier Code (BIC); and (b) is a correspondent or customer of a RTGS DCA holder or a branch of a RTGS DCA holder, and is able to submit payment orders to and receive payments from a TARGET component system via that RTGS DCA holder;

• (3) ‘ancillary system’ (AS) means a system operated by an entity established in the Union or the EEA that is subject to supervision and/or oversight by a competent authority and complies with the oversight requirements for the location of infrastructures offering services in euro, as amended from time to time and published on the ECB's website, in which payments and/or financial instruments are exchanged and/or cleared or recorded with (a) the monetary obligations resulting in cash transfer orders which are settled in TARGET and/or (b) funds held in TARGET, in accordance with Guideline ECB/2022/8;

• (4) ‘ancillary system guarantee funds account’ (AS guarantee funds account) means a technical account used for the purpose of holding guarantee funds to support RTGS AS settlement procedures A and B;

• (5) ‘ancillary system settlement procedure’ (AS settlement procedure) means any TIPS AS settlement procedure or RTGS AS settlement procedure;

• (6) ‘ancillary system transfer order’ (AS transfer order) means any cash transfer order that is initiated by an ancillary system for the purpose of an RTGS ancillary system settlement procedure;

• (7) ‘auto-collateralisation’ means intraday credit granted by a euro area national central bank (NCB) in central bank money triggered when a T2S DCA holder has insufficient funds to settle securities transactions, whereby such intraday credit is collateralised either with the securities being purchased (collateral on flow), or with securities held by the T2S DCA holder in favour of the euro area NCB (collateral on stock). An auto collateralisation transaction consists of two distinct transactions, one for the granting of auto-collateralisation and one for its reimbursement. It may also include a third transaction for any eventual relocation of collateral. For the purposes of Annex I, Part I, Article 17 all three transactions are deemed to have been entered into the system and deemed to be irrevocable at the same time as the transaction for the granting of the auto-collateralisation;

• (8) ‘automated liquidity transfer order’ means a liquidity transfer order generated automatically to transfer funds from a designated RTGS DCA to the participant’s MCA in the event there are insufficient funds on that MCA for the settlement of central bank operations;

• (9) ‘available liquidity’ means a credit balance on a participant's account and, if applicable, any intraday credit line granted on the MCA by the relevant euro area NCB in relation to such account but not yet drawn upon, or if applicable, decreased by the amount of any processed reservations of liquidity or blocking of funds on MCAs or DCAs;

• (10) ‘banking group’ means:
• a) a composition of credit institutions included in the consolidated financial statements of a parent company where the parent company is obliged to present consolidated financial statements under International Accounting Standard 27 (IAS 27), adopted pursuant to Commission Regulation (EC) No 1126/2008 ([^E0025]) and consisting of either: (i) a parent company and one or more subsidiaries; or (ii) two or more subsidiaries of a parent company; or
• b) a composition of credit institutions as referred to in subparagraph (a)(i) or (ii), where a parent company does not present consolidated financial statements in accordance with IAS 27, but may be able to satisfy the criteria defined in IAS 27 for inclusion in consolidated financial statements, subject to the verification of the CB of the participant;
• c) a bilateral or multilateral network of credit institutions that is: (i) organised through a statutory framework determining the affiliation of credit institutions to such a network; or (ii) characterised by self-organised mechanisms of cooperation (promoting, supporting and representing the business interests of its members) and/or economic solidarity going beyond the ordinary cooperation usual between credit institutions whereby such cooperation and solidarity are permitted by credit institutions’ by-laws or articles of incorporation or established by virtue of separate agreements and in each cases referred to in points (c)(i) and (c)(ii) the ECB’s Governing Council has approved an application to be considered as constituting a banking group;

• (11) ‘branch’ means a branch within the meaning of point (17) of Article 4(1) of Regulation (EU) No 575/2013 of the European Parleament and of the Council ([^E0026]) or point (30) of Article 4(1) of Directive 2014/65/EU of the European Parleament and of the Council ([^E0027]);

• (12) ‘broadcast message’ means information made simultaneously available to all or a selected group of participants;

• (13) ‘business day’ or ‘TARGET business day’ means any day on which MCAs, RTGS DCAs, or T2S DCAs are available for the settlement of cash transfer orders;

• (14) ‘Business Identifier Code’ (BIC) means a code as defined by ISO Standard No 9362;

• (15) ‘capacity opinion’ means a participant-specific opinion that contains an assessment of a participant’s legal capacity to enter into and carry out its obligations;

• (16) ‘cash transfer order’ means any instruction by a participant or a party acting on its behalf to place at the disposal of a recipient an amount of money from one account by means of a book entry onto another account and which is an ancillary system transfer order, a liquidity transfer order, an instant payment order, a positive recall answer or a payment order;

• (17) ‘central bank’ (CB) means a Eurosystem CB and/or a connected NCB;

• (18) ‘central bank operation’ means any payment order or liquidity transfer order initiated by a CB on an MCA opened in any TARGET component system;

• (19) ‘connected NCB’ means an NCB, other than a euro area NCB, which is connected to TARGET pursuant to a specific agreement;

• (20) ‘Contingency Solution’ means the functionality that allows CBs and participants to process cash transfer orders in the event that the normal operation of MCAs and/or RTGS DCAs and/or RTGS AS technical accounts is not possible;

• (21) ‘credit institution’ means either: (a) a credit institution within the meaning of point (1) of Article 4(1) of Regulation (EU) No 575/2013 (and Article 2(5) of Directive 2013/36/EU of the European Parliament and of the Council ([^E0028]) as applicable to the credit institution) that is subject to supervision by a competent authority; or (b) another credit institution within the meaning of Article 123(2) of the Treaty that is subject to scrutiny of a standard comparable to supervision by a competent authority;

• (22) ‘credit memorandum balance’ (CMB) means a limit set by the TIPS DCA holder for the use of liquidity on the TIPS DCA by a specific reachable party;

• (23) ‘cross-system settlement’ means the settlement of AS transfer orders debiting the RTGS AS technical account or a sub-account of a settlement bank of one AS using AS settlement procedure C or D and crediting the RTGS AS technical account or a sub-account of a settlement bank of another AS using AS settlement procedure C or D;

• (24) ‘dedicated cash account’ (DCA) means an RTGS DCA, a T2S DCA or a TIPS DCA;

• (25) ‘deposit facility rate’ means ‘deposit facility rate’ as defined in point (22) of Article 2 of Guideline (EU) 2015/510 (ECB/2014/60);

• (26) ‘deposit facility’ means ‘deposit facility’ as defined in point (21) of Article 2 of Guideline (EU) 2015/510 (ECB/2014/60);

• (27) ‘euro area NCB’ means the national central bank (NCB) of a Member State whose currency is the euro;

• (28) ‘European Payments Council’s SEPA Instant Credit Transfer (SCT Inst) scheme’ or ‘SCT Inst scheme’ means an automated, open standards scheme providing a set of interbank rules to be complied with by SCT Inst scheme participants, allowing payment services providers in the Single Euro Payments Area (SEPA) to offer an automated SEPA-wide euro instant credit transfer product;

• (29) ‘Eurosystem CB’ means the ECB or a euro area NCB;

• (30) ‘event of default’ means any impending or existing event, the occurrence of which may threaten the performance by a participant of its obligations under the Conditions contained in Annex I, Part I or any other rules applying to the relationship between that participant and the participant’s CB or any other CB, including:
• (a) where the participant no longer meets the access criteria laid down in the national implementation of Part I, Annex I, Article 4 or the requirements laid down in Part I, Annex I, Article 5(1), point (a);
• (b) the opening of insolvency proceedings in relation to the participant;
• (c) the submission of an application relating to the proceedings referred to in point (b);
• (d) the issue by the participant of a written declaration of its inability to pay all or any part of its debts or to meet its obligations arising in relation to intraday credit;
• (e) the entry of the participant into a voluntary general agreement or arrangement with its creditors;
• (f) where the participant is, or is deemed by its CB to be, insolvent or unable to pay its debts;
• (g) where the participant's credit balance on any of its TARGET accounts, or all or a substantial part of the participant's assets are subject to a freezing order, attachment, seizure or any other procedure that is intended to protect the public interest or the rights of the participant's creditors;
• (h) where participation of the participant in another TARGET component system and/or in an AS has been suspended or terminated;
• (i) where any material representation or pre-contractual statement made by the participant or which is implied to have been made by the participant under the applicable law is incorrect or untrue;
• (j) the assignment of all or a substantial part of the participant's assets;

• (31) ‘guarantee funds’ means funds provided by participants of an AS, to be used in the event of the failure, for whatever reason, of one or more participants to meet their payment obligations in the AS;

• (32) ‘insolvency proceedings’ means insolvency proceedings within the meaning of Article 2(j) of Directive 98/26/EC;

• (33) ‘instant payment order’ means, in line with the European Payments Council’s SEPA Instant Credit Transfer (SCT Inst) scheme, a cash transfer order which can be executed 24 hours a day any calendar day of the year, with immediate or close to immediate settlement and notification to the payer, and which includes: (i) TIPS DCA to TIPS DCA instant payment orders; (ii) TIPS DCA to TIPS AS technical account instant payment orders; (iii) TIPS AS technical account to TIPS DCA instant payment orders; and (iv) TIPS AS technical account to TIPS AS technical account instant payment orders;

• (34) ‘instructing party’ means an entity which has been designated as such by a TIPS DCA holder or the holder of a TIPS AS technical account, and which is allowed to send instant payment orders or liquidity transfer orders and/or receive instant payment orders or liquidity transfer orders on behalf of that account holder or a reachable party of that account holder;

• (35) ‘intraday credit’ means credit extended for a period of less than one business day;

• (36) ‘investment firm’ means an investment firm within the meaning of Article 4(1)(1) of Directive 2014/65/EU, excluding the institutions specified in Article 2(1) of Directive 2014/65/EU as applicable to the investment firm, provided that the investment firm in question is:
• a) authorised and supervised by a recognised competent authority, which has been designated as such under Directive 2014/65/EU; and
• b) entitled to carry out the activities referred to under items 2, 3, 6 and 7 of Section A of Annex I to Directive 2014/65/EU as applicable to the investment firm;

• (37) ‘Level 3 NCBs’ means the Deutsche Bundesbank, the Banque de France, the Banca d’Italia and the Banco de España in their capacity as the CBs developing and operating TARGET for the Eurosystem’s benefit;

• (38) ‘liquidity transfer order’ means a cash transfer order to transfer a specified amount of funds for the purpose of liquidity management;

• (39) ‘marginal lending facility rate’ means ‘marginal lending facility rate’ as defined in point (57) of Article 2 of Guideline (EU) 2015/510 (ECB/2014/60);

• (40) ‘marginal lending facility’ means ‘marginal lending facility’ as defined in point (56) of Article 2 of Guideline (EU) 2015/510 (ECB/2014/60);

• (41) ‘mobile proxy look-up (MPL) service’ means a service which enables TIPS DCA holders, AS using TIPS AS technical accounts and reachable parties, who receive from their customers a request to execute an instant payment order in favour of a beneficiary identified with a proxy (e.g. a mobile number), to retrieve from the central MPL repository the corresponding beneficiary IBAN and the BIC to be used to credit the relevant TARGET Instant Payment Settlement (TIPS) account;

• (42) ‘near instant payment’ means a transfer of cash order which complies with the European Payments Council’s SEPA Credit Transfer Additional Optional Services (SCT AOS) NL Standard for instant processing of SEPA credit transfers;

• (43) ‘network service provider’ (NSP) means an undertaking that has been awarded a concession with the Eurosystem to provide connectivity services via the Eurosystem Single Market Infrastructure Gateway to the TARGET services;

• (44) ‘non-settled cash transfer order’ means a cash transfer order that is not settled on the business day on which it is accepted;

• (45) ‘participant’ means; a) an entity that holds at least one MCA and may additionally hold one or more DCAs in TARGET; or b) an AS;

• (46) ‘payee’ means, except where used in Article 29, Part I of Annex I, a participant whose MCA or DCA, will be credited as a result of a cash transfer order being settled;

• (47) ‘payer’ means, except where used in Article 29, Part I of Annex I, a participant whose MCA or DCA, will be debited as a result of a cash transfer order being settled;

• (48) ‘payment order’ means any instruction by a participant or a party acting on its behalf to place at the disposal of a recipient an amount of money from one account by means of a book entry onto another account and which is not an AS transfer order, a liquidity transfer order, an instant payment order or a positive recall answer;

• (49) ‘positive recall answer’ means, in line with the European Payments Council’s SEPA Instant Credit Transfer (SCT Inst) scheme, a cash transfer order initiated by the receiver of a recall request, in response to a recall request, for the benefit of the sender of that recall request;

• (50) ‘public sector body’ means an entity within the ‘public sector’, the latter term as defined in Article 3 of Council Regulation (EC) No 3603/93 ([^E0029]);

• (51) ‘reachable party’ means an entity which: (a) holds a Business Identifier Code (BIC); (b) is designated as such by a TIPS DCA holder or by an ancillary system holding a TIPS AS technical account; (c) is a correspondent, customer, or branch of a TIPS DCA holder or a participant of an ancillary system; or is a correspondent, customer, or branch of a participant of an ancillary system holding a TIPS AS technical account and (d) is addressable through TIPS and is able to submit cash transfer orders and receive cash transfer orders either via the TIPS DCA holder or by an ancillary system holding a TIPS AS technical account, or directly if so authorised by the TIPS DCA holder or by an ancillary system holding a TIPS AS technical account;

• (52) ‘Real-time gross settlement ancillary system settlement procedure’ (RTGS AS settlement procedure) means one of the range of special, predefined services for the submission and settlement of AS transfer orders related to settlement of AS on RTGS DCAs, sub-accounts and RTGS AS technical accounts;

• (53) ‘Real-time gross settlement ancillary system technical account’ (RTGS AS technical account) means an account held by an AS or by the CB in its TARGET component system on behalf of the AS and used in the context of an RTGS AS settlement procedure;

• (54) ‘recall request’ means a message from an RTGS DCA holder, a TIPS DCA holder or a TIPS AS technical account holder requesting reimbursement of a settled payment order or instant payment order respectively;

• (55) ‘rule-based liquidity transfer order’ means a liquidity transfer order that is triggered as a result of: (a) the balance on an MCA, or RTGS DCA or TIPS DCA breaching a pre-defined floor or ceiling; or (b) insufficient funds being available to cover queued urgent payment orders, AS transfer orders or high priority payment orders on an RTGS DCA;

• (56) ‘settlement bank account group’ means a list of RTGS DCAs and/or sub accounts set in the context of the settlement of an ancillary system using RTGS AS settlement procedures;

• (57) ‘settlement bank’ means an RTGS DCA holder whose RTGS DCA or sub-account is used to settle AS transfer orders submitted by an AS using the RTGS AS settlement procedures;

• (58) ‘suspension’ means the temporary freezing of the rights and obligations of a participant for a period of time to be determined by the participant’s CB;

• (59) ‘TARGET account’ means any account opened in a TARGET component system;

• (60) ‘TARGET component system’ means any of the CBs’ systems that form part of TARGET;

• (61) ‘TARGET coordinator’ means a person appointed by the ECB to ensure the daily operational management of TARGET, to manage and coordinate activity in the event of an abnormal situation occurring and to coordinate the dissemination of information to participants;

• (62) ‘TARGET Instant Payment Settlement (TIPS) ancillary system settlement procedure’ (TIPS AS settlement procedure) means the predefined service for the submission and settlement of liquidity transfer orders and instant payment orders related to settlement of AS on TIPS DCAs and TIPS AS technical accounts;

• (63) ‘TARGET Instant Payment Settlement (TIPS) ancillary system technical account’ (TIPS AS technical account) means an account held by an AS or by the CB in its TARGET component system on behalf of the AS for use by the AS for the purpose of settling instant payments or near instant payments in its own books;

• (64) ‘TARGET settlement manager’ means a person appointed by a Eurosystem CB to monitor the operation of its TARGET component system;

• (65) ‘TARGET2-Securities’ (T2S) means the set of hardware, software and other technical infrastructure components through which the Eurosystem provides the services to CSDs and Eurosystem CBs that allow core, neutral and borderless settlement of securities transactions on a delivery-versus-payment basis in central bank money;

• (66) ‘technical malfunction of TARGET’ means any defect or failure in the technical infrastructure and/or the computer systems used by the relevant TARGET component system, or any other event that makes it impossible to execute and complete the processing of cash transfer orders according to the relevant parts of this Guideline in the relevant TARGET component system.

[^E0001]: Regulation (EU) 2021/378 of the European Central Bank of 22 January 2021 on the application of minimum reserve requirements (ECB/2021/1) (OJ L 73, 3.3.2021, p. 1).

[^E0002]: Directive 98/26/EC of the European Parliament and of the Council of 19 May 1998 on settlement finality in payment and securities settlement systems (OJ L 166, 11.6.1998, p. 45).

[^E0003]: Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190).

[^E0004]: Decision (EU) 2024/1209 of the European Central Bank of 16 April 2024 on the remuneration of non-monetary policy deposits held with national central banks and the European Central Bank (ECB/2024/11) (OJ L, 2024/1209, 3.5.2024, ELI: http://data.europa.eu/eli/dec/2024/1209/oj).

[^E0006]: Not yet published in the Official Journal.

[^E0007]: Not yet published in the Official Journal.

[^E0008]: According to the calendar applicable at the seat of the ECB.

[^E0009]: According to the calendar applicable at the seat of the ECB.

[^E0010]: According to the calendar applicable at the seat of the ECB.

[^E0011]: According to the calendar applicable at the seat of the ECB.

[^E0012]: Also applies to RTGS AS technical accounts, sub-accounts and AS guarantee fund accounts.

[^E0013]: Also applies to TIPS AS technical accounts.

[^E0018]: Regardless of whether it is a RTGS DCA, an RTGS AS technical account or an AS guarantee funds account.

[^E0020]: Regardless of whether it is a RTGS DCA, an RTGS AS technical account or an AS guarantee funds Account.

[^E0022]: The need-to-know principle refers to the identification of the set of information that an individual needs access to in order to carry out her/his duties.

[^E0023]: The principle of least privilege refers to the tailoring a subject’s access profile to an IT system to match the corresponding business role.

[^E0024]: A supplier in the context of this exercise should be understood as any third party (and its personnel) which is under contract (agreement), with the institution, to provide a service and under the service agreement the third party (and its personnel) is granted access, either remotely or on site, to information and/or information systems and/or information processing facilities of the institution in scope or associated to the scope covered under the exercise of the TARGET self-certification.

[^E0025]: Commission Regulation (EC) No 1126/2008 of 3 November 2008 adopting certain international accounting standards in accordance with Regulation (EC) No 1606/2002 of the European Parliament and of the Council (OJ L 320, 29.11.2008, p. 1).

[^E0026]: Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1).

[^E0027]: Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).

[^E0028]: Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).

[^E0029]: Council Regulation (EC) No 3603/93 of 13 December 1993 specifying definitions for the application of the prohibitions referred to in Articles 104 and 104b (1) of the Treaty (OJ L 332, 31.12.1993, p. 1).