(1)

The way that information in an application for registration as an external reviewer is provided should enable the European Securities and Markets Authority (ESMA) to assess whether the conditions referred to in Article 23(2) of Regulation (EU) 2023/2631 are fulfilled, including the conditions laid down in Commission Delegated Regulation (EU) 2025/2180 (2).

(2)

To safeguard security and enhance data management and usability, the standard forms, templates, and procedures that applicants should use when they apply for registration as an external reviewer should allow for digital means of registration. Any information that applicants submit to ESMA in an application for registration should therefore be machine-readable and be provided in a durable medium.

(3)

To assist ESMA in identifying the documents that an applicant has submitted as part of the application for registration, a unique reference number should be provided to correspond to each document.

(4)

For assurance and accountability purposes, applicants that submit an application for registration to ESMA should complement that application with a letter signed by a member of its senior management, attesting that the submitted information is accurate and complete to the best of that member’s knowledge.

(5)

This Regulation is based on the draft implementing technical standard submitted to the Commission by ESMA.

(6)

This Regulation respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union, and notably the right to protection of personal data. The processing of personal data for the purposes of this Regulation should be carried out in accordance with Union law on the protection of personal data. In that regard, any processing of personal data performed by ESMA in application of this Regulation should be carried out in accordance with Regulation (EU) 2018/1725 of the European Parliament and of the Council (3). Any processing of personal data performed by entities applying for external reviewer within application of this Regulation should be carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (4) and national requirements on the protection of natural persons with regard to the processing of personal data.

(7)

To enable ESMA to conduct the assessment for the purposes of the initial registration, while ensuring appropriate safeguards, personal data relating to applicants for registration as an external reviewer should be kept by external reviewers and ESMA for no longer than five years after that applicant has ceased to perform its function where the applicant has been registered as an external reviewer. Where ESMA has refused to register an applicant external reviewer or where the applicant withdraws its application, personal data relating to that applicant should be kept by ESMA no longer than five years after the refusal of the registration of the applicant or after the withdrawal of the application.

(8)

The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered formal comments on 7 July 2025.

(9)

ESMA has conducted an open public consultation on the draft implementing technical standard on which this Regulation is based. It has analysed the potential related costs and benefits and requested the advice of the Securities and Markets Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council (5),