(1)

Article 36 of Regulation (EU) 2017/2402 requires the competent authorities referred to in Article 29 of Regulation (EU) 2017/2402 (the competent authorities) and the three European Supervisory Authorities (ESAs), namely the European Securities and Markets Authority (ESMA), the European Banking Authority (EBA) and the European Insurance and Occupational Pensions Authority (EIOPA), to cooperate closely with each other and exchange information in order to carry out their duties under Articles 30 to 34 of that Regulation. It also requires competent authorities who find that an entity has or may have infringed certain requirements of that Regulation to notify the entity’s competent authority of their findings, and, where the infringement concerns an incorrect or misleading notification pursuant to Article 27(1) of that Regulation, to notify the competent authority of the entity that has been designated as the first contact point to inform, in turn, the ESAs.

(2)

The scope and nature of the cooperation, the exchange of information and the notifications required to take place under Article 36 of Regulation (EU) 2017/2402 should be sufficient to allow the competent authorities and the ESAs to discharge their supervisory, investigatory and sanctioning duties effectively. To this end, this Regulation sets out the minimum information which the competent authorities and the ESAs should exchange, including, where relevant, reports of their supervisory and enforcement activities.

(3)

It is essential that, subject to national and Union law governing the protection of confidentiality of information and the processing of personal data, competent authorities and the ESAs are able to cooperate and exchange information throughout the entire process of their activities.

(4)

In order to ensure that the cooperation and exchange of information under Article 36(1) of Regulation (EU) 2017/2402 takes place in an efficient and timely manner, it is appropriate to establish common procedures and forms to be used for the purposes of requesting cooperation or information and responding to such requests.

(5)

A common procedure and form should also be used by competent authorities and the ESAs to transmit information on a voluntary basis when they consider that information in their possession may be of use to another competent authority or an ESA. For example, that could include information held by the competent authority of an institutional investor or third party authorised to assess whether a securitisation complies with the simple, transparent and standardised (STS) requirements, where that information may be of use to the competent authority of the originator, sponsor, securitisation special purpose entity or original lender.

(6)

The common procedure and form to be used for voluntary exchanges of information should also be used for notifying findings of an infringement or suspected infringement under Article 36(4) and (5) of Regulation (EU) 2017/2402. This is in order to ensure the smooth and timely performance of the infringement notification duties under that Article.

(7)

The competent authorities and the ESAs should be required to ensure the confidentiality of any request for cooperation or information, any information actually exchanged or notified, and any notification made, and to ensure compliance with the rules on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

(8)

This Regulation is based on the draft regulatory technical standards submitted by ESMA to the Commission.

(9)

ESMA did not conduct open public consultations on the draft regulatory standards on which this Regulation is based, nor did it analyse the potential costs and benefits, as this would have been highly disproportionate to the scope and impact of those standards, taking into account the fact that they principally concern competent authorities and the ESAs.

(10)

ESMA has requested the opinion of the Securities and Markets Stakeholder Group established by Article 37 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council (2),

(a)

information on the arrangements, processes and mechanisms referred to in Article 30(2) of that Regulation;

(b)

information on the risk management policies and procedures referred to in Article 30(3) of that Regulation;

(c)

information on the specific effects and material risks referred to in Article 30(4) of that Regulation;

(d)

information and, to the extent available, reports or extracts of reports on any investigation or proceedings commenced with respect to the situations listed in Article 32(1) of that Regulation;

(e)

information and, to the extent available, reports or extracts of reports on any criminal sanction, administrative sanction or remedial measure imposed or taken pursuant to Article 32 or 34 of that Regulation.