Glossary
Compliance terms, briefly explained.
Definitions for regulatory terms that actually appear in EU frameworks. Each entry gives a short answer, a source-grounded explanation and cross-links to the relevant framework page.
DORA
DORA Art. 28 — ICT third-party register
The ICT third-party register under Art. 28 of DORA (Regulation (EU) 2022/2554) is a mandatory inventory of every ICT service provider that each in-scope financial institution must maintain and submit to the competent authority annually by 31 March. It documents, per provider, at minimum: identification, service type, criticality assessment, contract date, sub-outsourcing chain and data-processing location.
ReadRegister of Information (DORA)
The Register of Information is the inventory that financial entities must maintain under DORA (Regulation (EU) 2022/2554, Art. 28(3)) of all contractual arrangements for the use of ICT services provided by ICT third-party service providers — kept at entity, sub-consolidated and consolidated level. The reporting templates are set out in Implementing Regulation (EU) 2024/2956; a first supervisory collection of the registers took place in spring 2025.
ReadTLPT — Threat-Led Penetration Testing (DORA)
TLPT is the advanced, threat-led penetration-testing duty under DORA (Regulation (EU) 2022/2554, Arts. 26–27): financial entities identified by their supervisor must, at least every three years, have a realistic attack test run against their critical live systems. The method is based on the TIBER-EU framework; the detailed rules sit in Delegated Regulation (EU) 2025/1190.
Read
Sustainability / CSRD
Double Materiality
Double materiality is the core principle of CSRD reporting: a sustainability matter must be reported if it is material from the impact perspective (the company's effects on people and the environment, inside-out) or from the financial perspective (how the matter affects the company's position and performance, outside-in) — either view suffices. Its legal basis is the CSRD (Directive (EU) 2022/2464), operationalised in ESRS 1.
ReadESRS — European Sustainability Reporting Standards
The ESRS are the standards companies use to report on sustainability under the CSRD. The first set was enacted as Delegated Regulation (EU) 2023/2772 (adopted 31 July 2023) and contains twelve standards: two cross-cutting (ESRS 1, ESRS 2), five environmental (E1–E5), four social (S1–S4) and one governance standard (G1). They build on double materiality. After the Omnibus package a slimmed-down, revised set is being developed — still in draft as of 2 June 2026.
Read
Banking / Prudential
ICAAP — Internal Capital Adequacy Assessment Process
The ICAAP is a bank’s own internal process for determining, on an ongoing basis, that its internal capital is adequate to cover all the material risks to which it is, or might be, exposed. Its legal basis is Art. 73 of the Capital Requirements Directive (CRD, Directive 2013/36/EU). The ECB expects two perspectives — a normative (multi-year, regulatory) and an economic one — and the ICAAP feeds directly into the SREP and thereby into the setting of P2R and P2G.
ReadOutput Floor (CRR III / Basel III)
The output floor is the centrepiece of the EU's implementation of the Basel III finalisation. It caps the capital benefit of internal models by lifting a bank's risk-weighted assets to at least 72.5% of the figure produced by the standardised approaches. Its legal basis is CRR III (Regulation (EU) 2024/1623); the floor phases in from 1 January 2025 (starting at 50%) and reaches the full 72.5% in 2030.
ReadP2R & P2G — Pillar 2 Requirement and Guidance
P2R and P2G are the capital-related outcomes of the supervisory SREP for banks. The Pillar 2 Requirement (P2R) is a binding, institution-specific own-funds add-on above the Pillar 1 minimums (Art. 104a CRD). The Pillar 2 Guidance (P2G) is a non-binding supervisory expectation of an additional buffer above the binding requirements (Art. 104b CRD). Breaching P2R can trigger distribution restrictions (MDA) via the combined buffer requirement; falling below P2G does not do so automatically.
ReadSREP — Supervisory Review and Evaluation Process
The SREP is the process by which banking supervisors regularly assess each bank’s business model, governance, capital and liquidity, and decide whether to impose additional own funds or other measures. Its legal basis is Arts. 97 and 104 of the Capital Requirements Directive (CRD, Directive 2013/36/EU); the methodology is harmonised by the EBA Guidelines EBA/GL/2022/03. Its key outputs are the Pillar 2 Requirement (P2R, binding) and Pillar 2 Guidance (P2G, non-binding).
Read
Payment services / PSD2
SCA — Strong Customer Authentication
Strong Customer Authentication (SCA) is the multi-factor authentication that PSD2 (Article 97 of Directive (EU) 2015/2366) requires for electronic payments and online access to payment accounts. It relies on at least two of three independent elements — knowledge (something only the user knows), possession (something only the user has) and inherence (something the user is). The technical detail — dynamic linking, exemptions and secure communication with third-party providers — sits in the SCA-RTS (Commission Delegated Regulation (EU) 2018/389), applicable since 14 September 2019.
ReadOpen Banking / XS2A
Open banking is the regulated third-party access to payment accounts created by PSD2 (Directive (EU) 2015/2366) — “access to the account” (XS2A). With the customer's consent, account-servicing banks (ASPSPs) must grant access to authorised payment-initiation services (PISPs, Art. 66) and account-information services (AISPs, Art. 67). The secure interface (a dedicated API plus a fallback) and strong customer authentication are governed by the SCA-RTS (Commission Delegated Regulation (EU) 2018/389). The proposed PSD3/PSR would improve API access; the proposed FIDA Regulation would extend the principle beyond payment accounts to “open finance” — neither is yet law.
Read