FRANCE Trends and Developments Contributed by: Martine Samuelian, Olivier Lyon Lynch and Hugues Vaysset, Jeantet
portionality regime and has sent a questionnaire to insurance and reinsurance undertakings to gather their initial impressions. In line with this: • The ACPR plans to specify the practical details of this new regime in 2026 in order to provide clarity for undertakings and offer them the opportunity to submit blank applications in the last quarter of the year to facilitate authorisations as of 2027. • It has provided an email address to deal with ques- tions related to this new regime and to support European Regulation 2022/2554 of 14 December 2022 on the digital operational resilience of the financial sector (DORA) came into force on 17 January 2025. As a reminder, the requirements of this regulation apply, with some exceptions, to all entities in the finan- cial sector and concern: • IT risk management: Including appropriate govern- ance, an appropriate risk management framework and harmonised technical resilience measures. • Incident reporting: A requirement to report major incidents, encouraging all entities to implement an effective incident detection process, enabling greater responsiveness by the authorities in the event of a critical incident. undertakings in its implementation. DORA: Digital Operational Resilience Entry into force and key obligations • Resilience testing: A proportionate testing pro- gramme with, for the most important entities, monitoring by the competent authority of threat- based intrusion tests. • Third-party risk management by IT service provid- ers: A new framework for monitoring critical ICT service providers which, by ensuring greater resil- ience of these third parties, should also increase the resilience of financial sector entities. At European level, all Level 2 texts have been adopt- ed, with a review clause on 17 January 2028. At the French level, the adoption of the “Resilience law” ( loi de résilience ) (transposing Directive (EU) 2022/2556) and its transposition into regulations is expected by
the end of the year. Regardless of the enactment of this law, the DORA Regulation applies, as it stands, to the entities referred to in Article 2 of that Regulation
since 17 January 2025. Support from the ACPR
The ACPR has issued numerous communications, documents and instructions to help stakeholders comply with the new regulatory framework. Key ele- ments include: • In January 2025, the ACPR published an initial set of frequently asked questions (FAQs) on DORA, as well as an outsourcing declaration form for report- ing major ICT incidents. • On 25 March 2025, the ACPR updated these FAQs to clarify, in particular: (a) The procedures for submitting the information register (register of ICT service providers/exter- nal suppliers), with a summary table specify- ing the scope of submission (single entity or consolidation, scope of subsidiaries, etc). (b) Resilience tests, in particular threat-led pen- etration testing (TLPT): The ACPR specifies that the list of entities subject to TLPT will not be published — the competent authorities will contact each entity concerned directly by mail after the delegated regulation on TLPT comes into force. • The ACPR has updated its guidance note on “Dis- closure of information to the supervisory author- ity and information for the public (RSR/SFCR) for insurance undertakings and groups subject to the Solvency II Directive”. • In practical terms, for entities supervised in France, the first transmission of the information register of their ICT service providers was due to take place no later than 15 April 2025. Situation nine months after DORA came into force The Fintech Forum held on 9 October 2025 by the ACPR and the Financial Markets Authority (AMF) dis- cussed the implementation of the DORA regulation. In this context, the ACPR and AMF noted in particular:
Regarding incident reporting (a) Profile of reporting entities
172 CHAMBERS.COM
Powered by FlippingBook