(1)

Rules should be laid down specifying the information to be provided to the European Securities and Markets Authority (ESMA) as part of an application for registration or extension of registration as a trade repository.

(2)

Establishing a comprehensive and sound framework for registration and extension of registration of trade repositories is essential for the achievement of the objectives of Regulation (EU) 2015/2365 and for the efficient provision of repository functions.

(3)

The rules and standards for the registration and the extension of registration of trade repositories for the purposes of Regulation (EU) No 2365/2015 should build on pre-existing infrastructures, operational processes and formats which were introduced with regard to reporting derivative contracts to trade repositories, in order to minimise additional operational costs for market participants.

(4)

Experience in applying the provisions of Commission Delegated Regulation (EU) No 150/2013 (2) supplementing Regulation (EU) No 648/2012 of the European Parliament and of the Council on OTC derivatives, central counterparties and trade repositories with regard to regulatory technical standards specifying the details of the application for registration as a trade repository has proved that the provisions for registration of trade repositories under Regulation (EU) No 648/2012 constitute a sound basis to build the framework for registration of trade repositories under Regulation (EU) 2015/2365. In order to further strengthen that framework, this Regulation should reflect the evolving nature of the industry.

(5)

Any application for registration as a trade repository should contain information on the structure of its internal controls and the independence of its governing bodies, in order to enable ESMA to assess whether the corporate governance structure ensures the independence of the trade repository and whether that structure and its reporting routines are sufficient to ensure compliance with the requirements for trade repositories set out in Regulation (EU) 2015/2365. Detailed information on the relevant internal control mechanisms and structures, the internal audit function as well as the audit work plan should be included in the application for registration in order to enable ESMA to assess the way in which those factors contribute to the efficient functioning of the trade repository.

(6)

Although trade repositories which operate through branches are not considered separate legal persons, separate information on branches should be provided in order to enable ESMA to clearly identify the position of the branches in the organisational structure of the trade repository, assess the fitness for duty and appropriateness of the senior management of the branches, and evaluate whether the control mechanisms, compliance and other functions in place are robust enough to identify, evaluate and manage the branches' risks in an effective manner.

(7)

For the purpose of enabling ESMA to assess the good repute, experience and skills of the prospective trade repository's board members and senior management, an applicant trade repository should provide relevant information on those persons such as the curricula vitae, details regarding any criminal convictions, self-declarations of good repute and declarations of any potential conflicts of interests.

(8)

Any application for registration should contain information which demonstrates that the applicant has the necessary financial resources at its disposal for the performance of its functions as a trade repository on an on-going basis and effective business continuity arrangements.

(9)

Article 5(2) of Regulation (EU) 2015/2365 requires trade repositories to verify the completeness and correctness of data reported under Article 4 thereof. In order to be registered or be granted an extension of registration under Regulation (EU) 2015/2365, trade repositories should demonstrate that they have established systems and procedures which ensure their ability to verify the completeness and correctness of the details of the securities financing transactions (SFTs).

(10)

The use of common resources within a trade repository between SFT reporting services on the one hand and ancillary services or derivative reporting services on the other may lead to contagion of operational risks across services. Whereas the validation, reconciliation, processing and recordkeeping of data may require an effective operational separation to avoid such contagion of risks, practices such as a common front-end of systems, a common access point to data for authorities or the use of the same staff working in sales, compliance, or a client services helpdesk may be less prone to contagion and hence do not necessarily require operational separation. Trade repositories should therefore establish an appropriate level of operational separation between the resources, systems or procedures used in different business lines, including where those business lines comprise the provision of services subject to other Union or third country legislation, and ensure that detailed and clear information on the ancillary services, or other business lines that the trade repository offers outside its core activity of repository services under Regulation (EU) 2015/2365, is provided to ESMA in the application for registration or extension of registration.

(11)

The soundness, resilience and protection of the information technology systems of trade repositories are essential to ensure compliance with the objectives of Regulation (EU) 2015/2365. Accordingly, trade repositories should provide comprehensive and detailed information on those systems to allow ESMA to assess the soundness and resilience of their information technology systems. Where the provision of repository functions is outsourced to third parties, either at the level of the group or outside the group, the trade repository should provide detailed information on the relevant outsourcing arrangements to allow the assessment of compliance with the conditions for registration, including information on any service level agreements, on metrics and on how those metrics are effectively monitored. Finally, information should be provided by trade repositories on the mechanisms and controls that they put in place to effectively manage potential cyber-risks and to protect the data they maintain from cyber-attacks.

(12)

Different types of users can report, access or modify the data maintained by the trade repository. The characteristics, as well as the rights and obligations of the different types of users should be clearly defined by the trade repository and should be provided as part of the application for registration. The information provided by the trade repositories should also clearly identify the different categories of access available. To ensure the confidentiality of data, but also its availability to third parties, a trade repository should provide information about how it ensures that only the data for which the relevant counterparties have provided their explicit, revocable and discretionary consent is made available to third parties. Finally, the trade repository should provide information in its application on the channels and mechanisms used to publicly disclose information on its access rules in order to ensure an informed decision by its service users.

(13)

The fees associated with the services provided by trade repositories are essential information for enabling market participants to make an informed choice and should therefore form part of the application for registration as a trade repository.

(14)

Given that market participants and authorities rely on the data maintained by trade repositories, strict and effective operational and record-keeping arrangements should be clearly described in a trade repository's application for registration. To demonstrate how the confidentiality and protection of data maintained by the trade repository is preserved as well as to allow for its traceability, a specific reference regarding the set-up of a reporting log needs to be included in the application for registration.

(15)

To achieve the objectives of Regulation (EU) 2015/2365 regarding the transparency of SFTs, trade repositories should demonstrate that they apply the procedure for terms and conditions of access in accordance with Commission Delegated Regulation (EU) 2019/357 (3), that the integrity of the data provided to authorities is ensured and that they are in a position to provide access to the data in accordance with the relevant requirements included in Commission Delegated Regulation (EU) 2019/358 (4).

(16)

The effective payment of the registration fees by trade repositories at the time of application is essential to cover ESMA's necessary expenditure relating to the registration or extension of registration of a trade repository.

(17)

A simplified application procedure for the extension of registration should be established to allow those trade repositories already registered under Regulation (EU) No 648/2012 to have that registration extended under Regulation (EU) 2015/2365. To avoid any duplicate requirements, the information to be provided by the trade repository as part of an extension of registration should include detailed information on the adaptations necessary to ensure it complies with the requirements under Regulation (EU) 2015/2365.

(18)

This Regulation is based on the draft regulatory technical standards submitted by the European Securities and Markets Authority to the European Commission pursuant to the procedure in Article 10 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority) (5).

(19)

ESMA has conducted open public consultations on these draft regulatory technical standards, analysed the potential related costs and benefits and requested the opinion of the Securities and Markets Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1095/2010,

(a)

an indication that the Board approves the policies, that the senior management approves the procedures and that the senior management is responsible for the implementation and maintenance of the policies and procedures;

(b)

a description of how the communication of policies and procedures within the applicant is organised, how compliance with the policies is ensured and monitored on a day to day basis, and the person or persons responsible for compliance in that regard;

(c)

any records indicating that employed and dedicated staff are aware of the policies and procedures;

(d)

a description of the measures to adopt in the event of a breach of policies and procedures;

(e)

an indication of the procedure for reporting to ESMA any material breach of policies or procedures which may result in a breach of the conditions for initial registration.

(a)

a description of the roles of the persons responsible for compliance and of any other staff involved in the compliance assessments, including how the independence of the compliance function from the rest of the business will be ensured;

(b)

the internal policies and procedures designed to ensure that the applicant, including its managers and employees, comply with all the provisions of Regulation (EU) 2015/2365, including a description of the role of the board and senior management;

(c)

where available, the most recent internal report prepared by the persons responsible for compliance or any other staff involved in compliance assessments within the applicant.

(a)

a copy of the curriculum vitae;

(b)

detailed information on the knowledge and experience in IT management, operations and development;

(c)

details regarding any criminal convictions in connection with the provision of financial or data services or in relation to acts of fraud or embezzlement, in particular in the form of an official certificate if available within the relevant Member State;

(d)

a self-declaration of good repute in relation to the provision of a financial or data service, where each member of the senior management and the Board states whether they:

(e)

a declaration of any potential conflicts of interests that the senior management and the members of the board may have in performing their duties and how these conflicts are managed.

(a)

a copy of the remuneration policy for the senior management, board members and the staff employed in risk and control functions of the applicant;

(b)

a description of the measures put in place by the applicant to mitigate the risk of over-reliance on any individual employees.

(a)

a general list of the staff directly employed by the trade repository, including their role and qualifications per role;

(b)

a specific description of the information technology staff directly employed to provide trade repository services, together with the role and the qualifications of each individual;

(c)

a description of the roles and qualifications of each individual who is responsible for internal audit, internal controls, compliance and risk assessment;

(d)

the identity of the dedicated staff members and those members of the staff that are operating under an outsourcing arrangement;

(e)

details of the training on the applicant's policies and procedures as well as the trade repository business, including any examination or other type of formal assessment required for staff regarding the conduct of trade repository activities.

(a)

policies and procedures with respect to the identification, management and disclosure of conflicts of interest and a description of the process used to ensure that the relevant persons are aware of the policies and procedures;

(b)

any other measures and controls put in place to ensure the requirements referred to in point (a) on conflicts of interest management are met.

(a)

a detailed description of the information technology system including the relevant business requirements, functional and technical specifications, system architectural and technical design, data model and data flows, and operations and administrative procedures and manuals;

(b)

user facilities developed by the applicant in order to provide services to the relevant users, including a copy of any user manual and internal procedures;

(c)

the investment and renewal policies on information technology resources of the applicant;

(d)

the outsourcing arrangements entered into by the applicant, including:

(a)

a description of the ancillary services that the applicant, or the undertaking within its group, performs and a description of any agreement that the trade repository may have with companies offering trading, post- trading, or other related services, as well as copies of such agreements;

(b)

the procedures and policies that ensure the necessary degree of operational separation in terms of resources, systems and procedures, between the applicant's trade repository services under Regulation (EU) 2015/2365 and other business lines, including those business lines that comprise the provision of services under Union or third country legislation, irrespective of whether that separate business line is run by the trade repository, a company belonging to its holding company, or any other company within which it has an agreement in the context of the trading or post-trading chain or business line.

(a)

procedures for the authentication of the identity of the users accessing the trade repository in accordance with Article 1 of Delegated Regulation (EU) 2019/358;

(b)

procedures for the verification of the use of an XML template complying with the ISO 20022 methodology in accordance with Article 1 of Delegated Regulation (EU) 2019/358;

(c)

procedures for the verification of the authorisation and IT permission of the entity reporting on behalf of the reporting counterparty in accordance with Article 1 of Delegated Regulation (EU) 2019/358;

(d)

procedures for verification that the logical sequence of the reported SFT details is maintained at all times in accordance with Article 1 of Delegated Regulation (EU) 2019/358;

(e)

procedures for the verification of the completeness and correctness of the reported SFT details in accordance with Article 1 of Delegated Regulation (EU) 2019/358;

(f)

procedures for the reconciliation of data between trade repositories where counterparties report to different trade repositories in accordance with Article 2 of Delegated Regulation (EU) 2019/358;

(g)

procedures for the provision of feedback to the counterparties to the SFTs or the third parties reporting on their behalf, on the verifications performed under points (a) to (e) and the outcomes of the reconciliation process under point (f) in accordance with Article 3 of Delegated Regulation (EU) 2019/358.

(a)

pricing policy, including any existing discounts and rebates and conditions to benefit from such reductions;

(b)

fee structure for providing any trade repository and ancillary services including the estimated cost of the trade repository services and ancillary services, along with the details of the methods used to account the separate cost that the applicant may incur when providing trade repository services and ancillary services;

(c)

methods used to make the information publicly available to all types of users, including a copy of the fee structure in which trade repository services and ancillary services are unbundled.

(a)

a procedure to calculate the aggregate positions in accordance with Article 6 of Delegated Regulation (EU) 2019/358 and a description of the resources, methods and channels that the trade repository will employ in order to facilitate access to the data contained therein to the public in accordance with Article 12(1) of Regulation (EU) 2015/2365, and a description of the frequency of updates, along with a copy of any specific manuals and internal policies;

(b)

a description of the resources, methods and facilities that the trade repository employs in order to facilitate the access to its information to the relevant authorities in accordance with Article 12(2) of Regulation (EU) 2015/2365, the frequency of the update and the controls and verifications that the trade repository may establish for the access filtering process, along with a copy of any specific manuals and internal procedures;

(c)

a procedure and a description of the resources, methods and channels that the trade repository employs in order to facilitate the timely structured and comprehensive collection of data from counterparties, the access to its information to counterparties to SFTs in accordance with Article 4(6) of Regulation (EU) 2015/2365 and Article 80(5) of Regulation (EU) No 648/2012, along with a copy of the specific manuals and internal policies.

(a)

the terms and conditions under which the authorities referred to in Article 12(2) of Regulation (EU) 2015/2365 are given direct and immediate access to the details of SFTs maintained at the trade repository in accordance with Delegated Regulation (EU) 2019/357;

(b)

the procedure under which the authorities referred to in point (a) are given direct and immediate access to the details of SFTs maintained at the trade repository in accordance with Articles 4 and 5 of Delegated Regulation (EU) 2019/358;

(c)

the procedure to ensure the integrity of the data accessed by those authorities.

(a)

Article 1, except point (k) of paragraph 1;

(b)

Article 2;

(c)

Article 5;

(d)

Article 7, except point (d) of paragraph 2;

(e)

Article 8(b);

(f)

Article 9(1)(b) and 9(1)(e);

(g)

Article 11;

(h)

Article 12(2);

(i)

Article 13;

(j)

Article 14(2);

(k)

Article 15;

(l)

Article 16, except point (c);

(m)

Article 17;

(n)

Article 18;

(o)

Article 19;

(p)

Article 20;

(q)

Article 21;

(r)

Article 22;

(s)

Article 23;

(t)

Article 24;

(u)

Article 25;

(v)

Article 27.