Critical Entities Resilience Directive (CER)

(21) Union financial services law establishes comprehensive requirements on financial entities to manage all risks they face, including operational risks, and to ensure business continuity. Such law includes European Market Infrastructure Regulation (EMIR) , (EU) No 575/2013 and (EU) No 600/2014 of the European Parliament and of the Council and Capital Requirements Directive (CRD IV) and 2014/65/EU of the European Parliament and of the Council. That legal framework is complemented by Digital Operational Resilience Act (DORA) of the European Parliament and of the Council , which lays down requirements applicable to financial entities to manage Information and Communication Technology (ICT) risks, including concerning the protection of physical ICT infrastructure. Since the resilience of those entities is therefore comprehensively covered, Article 11 and Chapters III, IV and VI of this Directive should not apply to those entities in order to avoid duplication and unnecessary administrative burden. However, considering the importance of the services provided by entities in the financial sector to critical entities belonging to all other sectors, Member States should identify, based on the criteria and using the procedure provided for in this Directive, entities in the financial sector as critical entities. Consequently, the strategies, the Member State risk assessments and the support measures set out in Chapter II of this Directive should apply. Member States should be able to adopt or maintain provisions of national law to achieve a higher level of resilience for those critical entities provided that those provisions are consistent with applicable Union law.