28.8.2014

EN

Official Journal of the European Union

L 257/1

---

REGULATION (EU) No 909/2014 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 23 July 2014

on improving securities settlement in the European Union and on central securities depositories and amending Directives 98/26/EC and 2014/65/EU and Regulation (EU) No 236/2012

(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Central Bank (1),

Having regard to the opinion of the European Economic and Social Committee (2),

Acting in accordance with the ordinary legislative procedure (3),

Whereas:

(1)

Central securities depositories (CSDs), together with central counterparties (CCPs) contribute to a large degree in maintaining post-trade infrastructures that safeguard financial markets and give market participants confidence that securities transactions are executed properly and in a timely manner, including during periods of extreme stress.

(2)

Due to their key position in the settlement process, the securities settlement systems operated by CSDs are of a systemic importance for the functioning of securities markets. Playing an important role in the securities holding systems through which their participants report the securities holdings of investors, the securities settlement systems operated by CSDs also serve as an essential tool to control the integrity of an issue, hindering the undue creation or reduction of issued securities, and thereby play an important role in maintaining investor confidence. Moreover, securities settlement systems operated by CSDs are closely involved in securing collateral for monetary policy operations as well as in securing collateral between credit institutions and are, therefore, important actors in the collateralisation process.

(3)

While Directive 98/26/EC of the European Parliament and of the Council (4) reduced the disruption to a securities settlement system caused by insolvency proceedings against a participant in that system, it is necessary to address other risks that securities settlement systems are facing, as well as the risk of insolvency or disruption in the functioning of the CSDs that operate securities settlement systems. A number of CSDs are subject to credit and liquidity risks deriving from the provision of banking services ancillary to settlement.

(4)

The increasing number of cross-border settlements as a consequence of the development of link agreements between CSDs calls into question the resilience, in the absence of common prudential rules, of CSDs when importing the risks encountered by CSDs from other Member States. Moreover, despite the increase in cross-border settlements, market-driven changes towards a more integrated market for CSD services have proven to be very slow. An open internal market in securities settlement should allow any investor in the Union to invest in all Union securities with the same ease as in, and using the same processes as for, domestic securities. However, the settlement markets in the Union remain fragmented across national borders and cross-border settlement remains more costly, due to different national rules regulating settlement and the activities of CSDs and limited competition between CSDs. That fragmentation hinders and creates additional risks and costs for cross-border settlement. Given the systemic relevance of CSDs, competition between them should be promoted so as to enable market participants a choice of provider and reduce reliance on any one infrastructure provider. In the absence of identical obligations for market operators and common prudential standards for CSDs, divergent measures likely to be taken at national level will have a direct negative impact on the safety, efficiency and competition in the settlement markets in the Union. It is necessary to remove those significant obstacles in the functioning of the internal market and avoid distortions of competition and to prevent such obstacles and distortions from arising in the future. The creation of an integrated market for securities settlement with no distinction between national and cross-border securities transactions is needed for the proper functioning of the internal market. Consequently, the appropriate legal basis for this Regulation should be Article 114 of the Treaty on the Functioning of the European Union (TFEU), as interpreted in accordance with the consistent case law of the Court of Justice of the European Union.

(5)

It is necessary to lay down in a regulation a number of uniform obligations to be imposed on market participants regarding certain aspects of the settlement cycle and discipline and to provide a set of common requirements for CSDs operating securities settlement systems. The directly applicable rules of a regulation should ensure that all market operators and CSDs are subject to identical directly applicable obligations, standards and rules. A regulation should increase the safety and efficiency of settlement in the Union by preventing any diverging national rules as a result of the transposition of a directive. A regulation should reduce the regulatory complexity for market operators and CSDs resulting from different national rules and should allow CSDs to provide their services on a cross-border basis without having to comply with different sets of national requirements such as those concerning the authorisation, supervision, organisation or risks of CSDs. A regulation imposing identical requirements on CSDs should also contribute to eliminating competitive distortions.

(6)

On 20 October 2010, the Financial Stability Board called for more robust core market infrastructures and asked for the revision and enhancement of the existing standards. In April 2012, the Committee on Payments and Settlement Systems (CPSS) of the Bank of International Settlements (BIS) and the International Organisation of Securities Commissions (IOSCO) adopted global standards for financial market infrastructures. Those standards have replaced the BIS recommendations of 2001, which were adapted through non-binding guidelines at European level in 2009 by the European System of Central Banks (ESCB) and the Committee of European Securities Regulators. Taking into account the global nature of financial markets and the systemic importance of CSDs, it is necessary to ensure international convergence of the prudential requirements to which they are subject. This Regulation should follow the existing principles for financial market infrastructures developed by CPSS-IOSCO. The Commission and the European Supervisory Authority (European Securities and Markets Authority) (‘ESMA’), established by Regulation (EU) No 1095/2010 of the European Parliament and of the Council (5), in close cooperation with the members of the ESCB, should ensure consistency with the existing standards and their future developments when drawing up or proposing to revise the regulatory technical standards and the implementing technical standards as well as the guidelines and recommendations referred to in this Regulation.

(7)	The Council, in its conclusions of 2 December 2008, emphasised the need to strengthen the safety and soundness of the securities settlement systems, and to address legal barriers to post-trading in the Union.

(8)

One of the basic tasks of the ESCB is to promote the smooth operation of payment systems. In this respect, the members of the ESCB execute oversight by ensuring efficient and sound clearing and payment systems. The members of the ESCB often act as settlement agents for the cash leg of securities transactions. They are also significant clients of CSDs, which often manage the collateralisation of monetary policy operations. The members of the ESCB should be closely involved, by being consulted, in the authorisation and supervision of CSDs, the recognition of third-country CSDs and the approval of certain CSD links. To prevent the emergence of parallel sets of rules, they should also be closely involved by being consulted in the setting of regulatory and implementing technical standards as well as of guidelines and recommendations although primary responsibility for the setting of such technical standards, guidelines and recommendations should rest with the Commission and ESMA, as laid down in this Regulation. This Regulation should be without prejudice to the responsibilities of the European Central Bank (ECB) and the national central banks to ensure efficient and sound clearing and payment systems within the Union and other countries. This Regulation should not prevent the members of the ESCB from accessing the information relevant for the performance of their duties, including the oversight of CSDs and other financial market infrastructures.

(9)

The members of the ESCB, any other bodies performing similar functions in certain Member States or other public bodies charged with or intervening in the management of the public debt in the Union may themselves provide a number of services, such as operating a securities settlement system, which would qualify them as a CSD. Such entities, when acting as CSDs without establishing a separate entity, should be exempt from the authorisation and supervision requirements, certain organisational requirements and capital and investment policy requirements, but should remain subject to the remaining prudential requirements for CSDs. Where such Member State entities act as CSDs, they should not provide their services in other Member States. Since the members of the ESCB act as settlement agents for the purpose of settlement, they should also be exempt from the requirements set out in Title IV of this Regulation.

(10)

This Regulation should apply to the settlement of transactions in all financial instruments and activities of CSDs unless specified otherwise. This Regulation should also be without prejudice to other legislation of the Union concerning specific financial instruments such as Directive 2003/87/EC of the European Parliament and of the Council (6) and measures adopted in accordance with that Directive.

(11)

The recording of securities in book-entry form is an important step towards increasing the efficiency of settlement and ensuring the integrity of a securities issue, especially in a context of increasing complexity of holding and transfer methods. For reasons of safety, this Regulation provides for the recording in book-entry form of all transferable securities admitted to trading or traded on the trading venues regulated by Directive 2014/65/EU of the European Parliament and of the Council (7) and by Regulation (EU) No 600/2014 of the European Parliament and of the Council (8). This Regulation should not impose one particular method for the initial book-entry recording, which should be able to take the form of immobilisation or of immediate dematerialisation. This Regulation should not impose the type of institution that is to record securities in book-entry form upon issuance but, rather, should permit different actors, including registrars, to perform that function. However, once transactions in such securities are executed on trading venues regulated by Directive 2014/65/EU and Regulation (EU) No 600/2014 or provided as collateral under the conditions laid down in Directive 2002/47/EC of the European Parliament and of the Council (9), such securities should be recorded in a CSD book-entry system in order to ensure, inter alia, that all such securities can be settled in a securities settlement system. Immobilisation and dematerialisation should not imply any loss of rights for the holders of securities and should be achieved in a way that ensures that holders of securities can verify their rights.

(12)

In order to ensure the safety of settlement, any participant in a securities settlement system buying or selling certain financial instruments, namely transferable securities, money-market instruments, units in collective investment undertakings and emission allowances, should settle its obligation on the intended settlement date.

(13)

Longer settlement periods for transactions in transferable securities cause uncertainty and increased risk for securities settlement systems participants. Different durations of settlement periods across Member States hamper reconciliation and are sources of errors for issuers, investors and intermediaries. It is therefore necessary to provide a common settlement period which would facilitate the identification of the intended settlement date and facilitate the implementation of settlement discipline measures. The intended settlement date of transactions in transferable securities which are executed on trading venues regulated by Directive 2014/65/EU and Regulation (EU) No 600/2014 should be no later than on the second business day after the trading takes place. For complex operations composed of several transactions such as securities repurchase or lending agreements, that requirement should apply to the first transaction involving a transfer of securities. Given their non-standardised character, that requirement should not apply to transactions that are negotiated privately by the relevant parties, but executed on the trading venues regulated by Directive 2014/65/EU and Regulation (EU) No 600/2014 or to transactions that are executed bilaterally, but reported to a trading venue regulated by Directive 2014/65/EU and Regulation (EU) No 600/2014. Moreover, that requirement should not apply to the first transaction where the transferable securities concerned are subject to initial recording in book-entry form.

(14)

CSDs and other market infrastructures should take measures to prevent and address settlement fails. It is essential that such rules be uniformly and directly applied in the Union. In particular, CSDs and other market infrastructures should be required to put in place procedures enabling them to take appropriate measures to suspend any participant that systematically causes settlement fails and to disclose its identity to the public, provided that that participant has the opportunity to submit observations before such a decision is taken.

(15)

One of the most efficient ways to address settlement fails is to require failing participants to be subject to a compulsory enforcement of the original agreement. This Regulation should provide for uniform rules concerning penalties and certain aspects of the buy-in transaction for all transferable securities, money-market instruments, units in collective investment undertakings and emission allowances, such as timing and pricing. Those rules should be adapted to the specificities of different securities markets, certain trading venues such as SME growth markets as defined in Directive 2014/65/EU and certain complex operations such as very short-term securities repurchase or lending agreements, in order to avoid adversely impacting on the liquidity and efficiency of securities markets. The rules on settlement discipline should be applied in a manner that provides an incentive for the settlement of transactions in all relevant financial instruments by their intended settlement date.

(16)

The procedures and penalties relating to settlement fails should be commensurate with the scale and seriousness of such fails whilst being scaled in such a way that maintains and protects the liquidity of the relevant financial instruments. In particular, market-making activities play a crucial role in providing liquidity to markets within the Union, particularly to less liquid securities. Measures to prevent and address settlement fails should be balanced against the need to maintain and protect liquidity in those securities. Cash penalties imposed on failing participants should, where possible, be credited to the non-failing clients as compensation and should not, in any event, become a source of revenue for the CSD concerned. CSDs should consult the market infrastructures in respect of which they provide CSD services on the implementation of settlement discipline measures laid down in this Regulation.

(17)

In most cases a buy-in process should be initiated where the financial instruments are not delivered within four business days of the intended settlement date. However, for illiquid financial instruments it is appropriate that the period before initiating the buy-in process should be increased to a maximum of seven business days. The basis for determining when financial instruments are deemed to be illiquid should be established through regulatory technical standards, taking account of the assessments already made in Regulation (EU) No 600/2014. Where such a determination is made the extension of the deadline for initiating the buy-in process should be up to seven business days.

(18)

It is appropriate to allow SME growth markets the flexibility not to apply the buy-in process until up to 15 days after the trade has taken place so as to take into account the liquidity of such markets and to allow, in particular, for activity by market-makers in those less liquid markets. The settlement discipline measures specific to SME growth markets should apply only to transactions executed on such markets. As identified in the Commission Staff Working Paper of 7 December 2011 accompanying the Commission communication entitled, ‘An action plan to improve access to finance for SMEs’, access to capital markets should be developed as an alternative to bank lending to SMEs and it is therefore appropriate to tailor the rules to better serve the needs of those SME growth markets.

(19)

CSDs should be allowed to monitor the execution of a buy-in with respect to multiple settlement instructions on the same financial instruments and with the same date of expiry of the extension period with the aim of minimising the number of buy-ins to the extent compatible with the requirements of this Regulation.

(20)

As the main purpose of this Regulation is to introduce a number of legal obligations imposed directly on market operators consisting, inter alia, of the recording in book-entry form in CSDs of all transferable securities once such securities are traded on trading venues regulated by Directive 2014/65/EU and Regulation (EU) No 600/2014 or provided as collateral under the conditions of Directive 2002/47/EC and in the settling of their obligations no later than on the second business day after trading takes place and as CSDs are responsible for the operation of securities settlement systems and the application of measures to provide timely settlement in the Union, it is essential to ensure that all CSDs are safe and sound and comply at all times with stringent organisational, conduct of business and prudential requirements laid down in this Regulation, including by taking all reasonable steps to mitigate fraud and negligence. Uniform and directly applicable rules regarding the authorisation and ongoing supervision of CSDs are therefore an essential corollary of and are interrelated with the legal obligations imposed on market participants by this Regulation. It is, therefore, necessary to include rules regarding the authorisation and supervision of CSDs in the same act as the legal obligations imposed on market participants.

(21)

Taking into account that CSDs should be subject to common requirements and in order to dismantle the existing barriers to cross-border settlement, any authorised CSDs should enjoy the freedom to provide services within the territory of the Union, including through setting up a branch. In order to ensure an appropriate level of safety in the provision of services by CSDs in another Member State, such CSDs should be subject to a specific procedure laid down in this Regulation where they intend to provide certain core services as provided for in this Regulation or set up a branch in a host Member State.

(22)

Within a borderless Union settlement market, it is necessary to establish the competences of the different authorities involved in the application of this Regulation. Member States should specifically designate the competent authorities responsible for the application of this Regulation, which should be afforded the supervisory and investigatory powers necessary for the exercise of their functions. A CSD should be subject to authorisation and supervision by the competent authority of its home Member State, which is well placed and should be empowered to examine how CSDs operate on a daily basis, to carry out regular reviews and to take appropriate action when necessary. The competent authority concerned should however consult at the earliest stage and cooperate with other relevant authorities, which include the authorities responsible for the oversight of each securities settlement system operated by the CSD, the central banks that issue the most relevant settlement currencies, where applicable, the relevant central banks that act as settlement agent for each securities settlement system, and, also, where applicable, the competent authorities of other group entities. Such cooperation also implies exchanges of information between the authorities concerned and the immediate notification of those authorities in the case of an emergency situation affecting the liquidity and stability of the financial system in any of the Member States where the CSD or any of its participants is established.

(23)

Where a CSD provides its services in another Member State, the competent authority of the host Member State should be able to request from the competent authority of the home Member State all information concerning the activities of the CSD that is of relevance to the requesting authority. In order to enable effective coordination of supervision, that information could concern in particular the services provided to CSD users established in the host Member State or the instruments or currencies processed and may include information on adverse developments, results of risk assessments and remedial measures. The competent authority of the home Member State should also have access to any information periodically reported by the CSD to the competent authority of the host Member State.

(24)

Where a CSD provides its services in a Member State other than the Member State where it is established, including through setting up a branch, the competent authority of its home Member State is mainly responsible for the supervision of that CSD. When the activities of a CSD in a host Member State have become of substantial importance for the functioning of the securities markets and the protection of the investors in that host Member State, the competent authorities and relevant authorities of the home Member State and of the host Member State should establish cooperation arrangements for the supervision of the activities of that CSD in the host Member State. The competent authority of the home Member State should also be able to decide that those cooperation arrangements envisage multilateral cooperation, including cooperation of a collegial nature, between the competent authority of the home Member State and the competent authorities and relevant authorities of the host Member States concerned. Such cooperation arrangements, however, should not be considered to be colleges of supervisors as referred to in Regulation (EU) No 1095/2010. No Member State or group of Member States should be discriminated against directly or indirectly, as a location for CSD and settlement services. While performing its duties under this Regulation no authority should directly or indirectly discriminate against any undertaking from another Member State. Subject to this Regulation, a CSD from one Member State should not be restricted in or prevented from settling financial instruments in the currency of another Member State or in the currency of a third country.

(25)

This Regulation should not prevent Member States from requiring in their national law a specific legal framework for day-to-day cooperation at national level between the competent authority of the CSD and relevant authorities. Such a national legal framework should be consistent with the guidelines concerning supervisory practices and cooperation between authorities that ESMA may issue under this Regulation.

(26)

Any legal person falling within the scope of the definition of a CSD needs to be authorised by the competent national authorities before starting its activities. Taking into account different business models, a CSD should be defined by reference to certain core services, which consist of settlement, implying the operation of a securities settlement system, notary and central securities accounts maintenance services. A CSD should at least operate a securities settlement system and provide one other core service. This combination is essential for CSDs to play their role in securities settlement and in ensuring the integrity of a securities issue. Entities that do not operate securities settlement systems such as registrars, transfer agents, public authorities, bodies in charge of a registry system established under Directive 2003/87/EC, or CCPs that are regulated by Regulation (EU) No 648/2012 of the European Parliament and of the Council (10) do not fall within the scope of the definition of a CSD.

(27)

CSDs should have in place recovery plans to ensure continuity of their critical operations. Without prejudice to Directive 2014/59/EU of the European Parliament and of the Council (11), the competent authorities should ensure that an adequate resolution plan is established and maintained for each CSD in accordance with the relevant national law.

(28)

In order to provide reliable data on the scale of securities settlement outside securities settlement systems and to ensure that the risks arising can be monitored and addressed, any institutions other than CSDs that settle securities transactions outside a securities settlement system should report their settlement activities to the competent authorities concerned. The recipient competent authorities should subsequently transmit that information to ESMA and should inform ESMA of any potential risk resulting from such settlement activities. Furthermore, ESMA should monitor such settlement activities and take into account the potential risks that they might create.

(29)

In order to avoid any risk-taking by CSDs in activities other than those subject to authorisation under this Regulation, the activities of authorised CSDs should be limited to the provision of services covered by their authorisation or notified under this Regulation and they should not hold any participation, as defined in this Regulation by reference to the Directive 2013/34/EU of the European Parliament and of the Council (12), or any ownership, direct or indirect, of 20 % or more of the voting rights or capital in any institutions other than those providing similar services unless such a participation is approved by CSDs’ competent authorities on the basis that it does not significantly increase the CSDs’ risk profile.

(30)	In order to ensure the safe functioning of the securities settlement systems, they should be operated only by the CSDs or by central banks acting as CSDs, subject to this Regulation.

(31)

Without prejudice to specific requirements of Member State tax law, CSDs should be authorised to provide services ancillary to their core services that contribute to enhancing the safety, efficiency and transparency of the securities markets and that do not create undue risks to their core services. A non-exhaustive list of those services is set out in this Regulation in order to enable CSDs to respond to future market developments. Where the provision of such services relates to withholding and reporting obligations to the tax authorities, it will continue to be carried out in accordance with the law of the Member States concerned. In accordance with Article 114(2) TFEU, the power to adopt measures under Article 114(1) does not apply to fiscal provisions. In its judgement of 29 April 2004 in Case C-338/01 Commission v Council  (13), the Court of Justice of the European Union held that the words ‘fiscal provisions’ are to be interpreted as ‘covering not only the provisions determining taxable persons, taxable transactions, the basis of imposition, and rates of and exemptions from direct and indirect taxes, but also those relating to arrangements for the collection of such taxes.’ This Regulation does not therefore cover arrangements for the collection of taxes for which a different legal basis would need to be used.

(32)

A CSD intending to outsource a core service to a third party or to provide a new core service or an ancillary service not listed in this Regulation, to operate another securities settlement system, to use another settlement agent or to set up any CSD links that involve significant risks should apply for authorisation following the same procedure as that required for initial authorisation, save that the competent authority should inform the applicant CSD within three months whether authorisation has been granted or refused. However, CSD links not involving significant risks or interoperable links of CSDs that outsource their services relating to those interoperable links to public entities, such as the members of the ESCB, should not be subject to prior authorisation, but should be notified by the relevant CSDs to their competent authorities.

(33)	Where a CSD intends to extend its services to non-banking type ancillary services explicitly listed in this Regulation which do not entail an increase in its risk profile, it should be able to do so following notification to the competent authority of its home Member State.

(34)

CSDs established in third countries should be able to offer their services in the Union, including through the setting-up of a branch. In order to ensure an appropriate level of safety in the provision of CSD services by third-country CSDs, such CSDs should be subject to recognition by ESMA where they intend to provide certain services listed in this Regulation or to set up a branch in the Union. Third-country CSDs should be able to set up links with CSDs established in the Union in the absence of such recognition provided that the relevant competent authority does not object. In view of the global nature of financial markets, ESMA is best placed to recognise third-country CSDs. ESMA should be able to recognise third-country CSDs only if the Commission concludes that they are subject to a legal and supervisory framework effectively equivalent to the one provided in this Regulation, if they are effectively authorised, supervised and subject to oversight in their country of establishment and cooperation arrangements have been established between ESMA, the competent authorities and relevant authorities of CSDs. Recognition by ESMA should be subject to an effective equivalent recognition of the prudential framework applicable to CSDs established in the Union and authorised under this Regulation.

(35)

Taking into account the complexity as well as the systemic nature of the CSDs and of the services they provide, transparent governance rules should ensure that senior management, members of the management body, shareholders and participants, who are in a position to exercise control, as defined by reference to the Directive 2013/34/EU, over the operation of the CSD are suitable to ensure the sound and prudent management of the CSD.

(36)

Different governance structures are used across Member States. In most cases a unitary or a dual board structure is used. The definitions used in this Regulation are intended to embrace all existing structures without advocating any particular structure. They are purely functional for the purpose of setting out rules aiming to achieve a particular outcome irrespective of the national company law applicable to an institution in each Member State. The definitions should therefore not interfere with the general allocation of competences in accordance with national company law.

(37)

Transparent governance rules should ensure that the interests of the shareholders, the management and staff of the CSD, on the one hand, and the interests of their users whom CSDs are ultimately serving, on the other, are taken into account. Those governance rules should apply without prejudice to the ownership model adopted by the CSD. User committees should be established for each securities settlement system operated by the CSD to give users the opportunity to advise the management body of the CSD on the key issues that impact them and should be given the tools to perform their role. The interests of different users of CSDs, including those of holders of different types of securities, should be represented in the user committee.

(38)

CSDs should be able to outsource the operation of their services provided that the risks arising from such outsourcing arrangements are managed. Taking into account the significance of the tasks entrusted to CSDs, this Regulation should provide that CSDs do not transfer their responsibilities to third parties through the outsourcing by contract of their activities to third parties. Outsourcing of such activities should be subject to strict conditions that maintain the responsibility of CSDs for their activities and ensure that the supervision and oversight of the CSDs are not impaired. It should be possible to exempt outsourcing by a CSD of its activities to a public entity from those requirements under certain conditions.

(39)

This Regulation should not prevent Member States allowing direct securities holding systems from providing in their national law that parties other than CSDs shall or may perform certain functions, which in some other types of securities holding systems are typically performed by CSDs and specifying how those functions should be exercised. In particular, in some Member States account operators or participants in the securities settlement systems operated by CSDs record entries into securities accounts maintained by CSDs without necessarily being account providers themselves. In view of the need for legal certainty on the entries made into accounts at the CSD level, the specific role played by such other parties should be recognised by this Regulation. It should therefore be possible, under specific circumstances and subject to strict rules laid down by law, to share the responsibility between a CSD and the relevant other party or to provide for exclusive responsibility by that other party for certain aspects related to maintaining of securities accounts at the top tier level provided that such other party is subject to appropriate regulation and supervision. There should be no restrictions on the extent to which responsibility is shared.

(40)

Conduct of business rules should provide transparency in the relations between CSDs and their users. In particular, CSDs should have publicly disclosed, transparent, objective and non-discriminatory criteria for participation in the securities settlement system, which would allow restriction of access by participants only on the basis of the risks involved. A quick and appropriate remedy should be made available to competent authorities to address any unjustified refusal of CSDs to provide their services to participants. CSDs should publicly disclose prices and fees for their services. In order to provide open and non-discriminatory access to their services and in view of the significant market power that CSDs still enjoy in the territory of their respective Member States, CSDs should not be able to diverge from their published pricing policy for their core services and should maintain separate accounts for the costs and revenues associated with each of their core services and with their ancillary services. Those participation provisions complement and reinforce the right of market participants to use a settlement system in another Member State provided for in Directive 2014/65/EU.

(41)

In order to facilitate efficient recording, settlement and payment, CSDs should accommodate in their communication procedures with participants and with the market infrastructures they interface with, the relevant international open communication procedures and standards for messaging and reference data.

(42)

Taking into account the central role of securities settlement systems in the financial markets, CSDs should, when providing their services, make best efforts to ensure the timely settlement of securities transactions and the integrity of the securities issue. This Regulation should not interfere with the national law of the Member States regulating the holdings of securities and the arrangements maintaining the integrity of securities issues. However, in order to enhance the protection of the assets of their participants and those of their clients, this Regulation should require CSDs to segregate the securities accounts maintained for each participant and offer, upon request, further segregation of the accounts of the participants’ clients which in some cases might be available only at a higher cost to be borne by the participants’ clients requesting further segregation. CSDs and their participants should be required to provide for both omnibus client segregation and individual client segregation so clients can choose the level of segregation they believe is appropriate to their needs. The only exclusion from this should be where due to other public policy requirements, in particular in relation to efficient and transparent collection of taxation, a CSD and its participants are required to provide individual client segregation for citizens and residents of and legal persons established in a Member State where, at the date of entry into force of this Regulation, such individual client segregation is required under the national law of the Member State under which the securities are constituted and only for citizens, residents of and legal persons established in that Member State. CSDs should ensure that those requirements apply separately to each securities settlement system operated by them. Without prejudice to the provision of ancillary services, CSDs should not use on their own account any securities that belong to a participant unless explicitly authorised by that participant and should not otherwise use on their own account the securities that do not belong to them. In addition the CSD should require the participants to obtain any necessary prior consent from their clients.

(43)

Directive 98/26/EC provides that transfer orders entered into securities settlement systems in accordance with the rules of those systems should be legally enforceable and binding on third parties. However, since Directive 98/26/EC does not specifically refer to CSDs that operate securities settlement systems, for clarity, this Regulation should require CSDs to define the moment or moments when transfer orders are entered into their systems and become irrevocable in accordance with the rules of that Directive. In addition, in order to increase legal certainty, CSDs should disclose to their participants the moment when the transfer of securities and cash in a securities settlement system is legally enforceable and binding on third parties in accordance, as the case may be, with national law. CSDs should also take all reasonable steps to ensure that transfers of securities and cash are legally enforceable and binding on third parties no later than at the end of the business day of the actual settlement date.

(44)

In order to avoid settlement risks due to the insolvency of the settlement agent, a CSD should settle, whenever practical and available, the cash leg of the securities transaction through accounts opened with a central bank. If this option is not practical and available, a CSD should be able to settle through accounts opened with a credit institution established under the conditions provided in Directive 2013/36/EU of the European Parliament and of the Council (14) and subject to a specific authorisation procedure and prudential requirements provided in Title IV of this Regulation.

(45)	Banking services ancillary to settlement involving credit and liquidity risks should only be undertaken by CSDs or outsourced to entities authorised to provide the banking services ancillary to the CSD activities as laid down in this Regulation.

(46)

In order to secure efficiencies resulting from the provision of both CSD and banking services within the same group of undertakings, the requirements of this Regulation should not prevent credit institutions from belonging to the same group of undertakings as the CSD. It is appropriate to provide for arrangements under which CSDs could be authorised to provide to their participants and to other entities ancillary services from within the same legal entity or from within a separate legal entity which may be part of the same group of undertakings ultimately controlled by the same parent undertaking or not. Where a credit institution other than a central bank acts as a settlement agent, the credit institution should be able to provide to the CSD participants the services set out in this Regulation, which are covered by the authorisation, but should not provide other banking services from the same legal entity in order to limit the settlement system’s exposure to the risks resulting from the failure of the credit institution.

(47)

Since Directive 2013/36/EU does not specifically address intra-day credit and liquidity risks resulting from the provision of banking services ancillary to settlement, credit institutions and CSDs providing such services should also be subject to specific enhanced credit and liquidity risk mitigation requirements, including a risk-based capital surcharge which reflects the relevant risks. Such enhanced credit and liquidity risk mitigation requirements should follow the global standards for financial market infrastructures and the principles for ‘Monitoring tools for intra-day liquidity management’ published in April 2013 by the Basel Committee on Banking Supervision.

(48)

Some CSDs also operating as credit institutions are subject to own funds and reporting requirements relevant for credit institutions and laid down in Regulation (EU) No 575/2013 of the European Parliament and of the Council (15) and in Directive 2013/36/EU. Given the systemic importance of such CSDs it is appropriate that the strictest requirements provided in Union law apply in order to avoid the cumulative application of various Union rules, for example in relation to the reporting of own funds requirements. In any areas where potential duplication of requirements is identified, the European Supervisory Authority (European Banking Authority) (‘EBA’) established by Regulation (EU) No 1093/2010 of the European Parliament and of the Council (16) and ESMA should provide an opinion on the appropriate application of the Union acts in accordance with Article 34 of Regulation (EU) No 1093/2010 and of Regulation (EU) No 1095/2010.

(49)

In addition to the own funds requirements provided for in Regulation (EU) No 575/2013 and in Directive 2013/36/EU, credit institutions and CSDs should be subject to a capital surcharge that reflects the risks, such as credit and liquidity risks, resulting from the provision of intra-day credit, inter alia, to the participants in a securities settlement system or other users of CSD services.

(50)

In order to ensure full compliance with specific measures aimed at mitigating credit and liquidity risks, the competent authorities should be able to require CSDs to designate more than one credit institution whenever they can demonstrate, based on the available evidence, that the exposures of one credit institution to the concentration of credit and liquidity risks is not fully mitigated. CSDs should also be able to designate more than one credit institution.

(51)

Supervision of the compliance of designated credit institutions or CSDs authorised to provide banking services ancillary to settlement with the requirements of Regulation (EU) No 575/2013 and of Directive 2013/36/EU and the specific relevant prudential requirements of this Regulation should be entrusted to the competent authorities referred to in Regulation (EU) No 575/2013. In order to ensure consistent application of supervisory standards, it is desirable that the banking services of CSDs which are of a scale and nature to pose a significant risk to the financial stability of the Union are directly supervised by the ECB under the conditions provided for in Council Regulation (EU) No 1024/2013 (17) concerning policies relating to the prudential supervision of credit institutions. This Regulation should be without prejudice to Regulation (EU) No 1024/2013.

(52)

A credit institution or a CSD authorised to provide banking services ancillary to settlement should comply with any present or future Union legislation applicable to credit institutions. This Regulation should be without prejudice to Directive 2014/59/EU and any future Union legislative act regarding the framework for the recovery and resolution of credit institutions, investment firms and other financial institutions.

(53)	In order to provide a sufficient degree of safety and continuity of services provided by CSDs, CSDs should be subject to specific uniform and directly applicable prudential and capital requirements which mitigate their legal, operational and investment risks.

(54)

The safety of the link arrangements set up between CSDs should be subject to specific requirements to enable the access of their respective participants to other securities settlement systems. The provision of banking-type ancillary services from within a separate legal entity should not prevent CSDs from receiving such services, in particular when they are participants in a securities settlement system operated by another CSD. It is particularly important that any potential risks resulting from the link arrangements such as credit, liquidity, organisational or any other relevant risks for CSDs are fully mitigated. For interoperable links, it is important that linked securities settlement systems have identical moments of entry of transfer orders into the system and irrevocability of such transfer orders and use equivalent rules concerning the moment of finality of transfers of securities and cash. The same principles should apply to CSDs that use a common settlement information technology (IT) infrastructure.

(55)

In order to allow competent authorities to supervise the activities of CSDs effectively, CSDs should be subject to strict record-keeping requirements. CSDs should maintain for at least 10 years all the records and data on all the services that they may provide, including transaction data on collateral management services that involve the processing of securities repurchase or lending agreements. CSDs might need to specify a common format in which their clients provide transaction data so as to allow this record-keeping requirement to be met, in conformity with any relevant regulatory and implementing technical standards adopted under this Regulation.

(56)

In many Member States issuers are required by national law to issue certain types of securities, notably shares, within their national CSDs. In order to remove this barrier to the smooth functioning of the Union post-trading market and to allow issuers to opt for the most efficient way of managing their securities, issuers should have the right to choose any CSD established in the Union for recording their securities and receiving any relevant CSD services. Since harmonisation of national corporate law is beyond the scope of this Regulation, such national corporate or similar law under which the securities are constituted should continue to apply and arrangements be made to ensure that the requirements of such national corporate or similar law can be met where the right of choice of CSD is exercised. Such national corporate and similar law under which the securities are constituted govern the relationship between their issuer and holders or any third parties, and their respective rights and duties attached to the securities such as voting rights, dividends and corporate actions. A refusal to provide services to an issuer should be permissible only based on a comprehensive risk assessment or if that CSD does not provide any issuance services in relation to securities constituted under the corporate or similar law of the relevant Member State. A quick and appropriate remedy should be made available to competent authorities to address any unjustified refusal of CSDs to provide their services to issuers.

(57)

In view of the increasing cross-border holdings and transfers of securities enhanced by this Regulation, it is of the utmost urgency and importance to establish clear rules on the law applicable to proprietary aspects in relation to the securities held in the accounts maintained by CSDs. Nevertheless, this is a horizontal issue which goes beyond the scope of this Regulation and could be dealt with in future Union legislative acts.

(58)

The European Code of Conduct for Clearing and Settlement of 7 November 2006 created a voluntary framework to enable access between CSDs and other market infrastructures. However, the post-trade sector remains fragmented along national lines, making cross-border trade unnecessarily costly. It is necessary to lay down uniform conditions for links between CSDs and of access between CSDs and other market infrastructures. In order to enable CSDs to offer their participants access to other markets, they should have a right to become a participant in another CSD or request another CSD to develop special functions for having access to the latter. Such access should be granted on fair, reasonable and non-discriminatory terms and should be refused only where it threatens the smooth and orderly functioning of the financial markets or causes systemic risk. A quick and appropriate remedy should be made available to competent authorities to address any unjustified refusal of a CSD to grant access to another CSD. Where CSD links introduce significant risks for settlement, they should be subject to authorisation and increased supervision by the relevant competent authorities.

(59)

CSDs should also have access to transaction feeds from a CCP or a trading venue and those market infrastructures should have access to the securities settlement systems operated by CSDs. Such access may be refused only where it threatens the smooth and orderly functioning of the financial markets or causes systemic risk and may not be denied on the grounds of loss of market share.

(60)

A quick and appropriate remedy should be made available to competent authorities to address any unjustified refusal of CSDs or market infrastructures to provide access to their services. This Regulation completes the access arrangements between trading venues, CCPs, and CSDs as laid down in Regulation (EU) No 648/2012 and in Regulation (EU) No 600/2014 necessary to establish a competitive internal market in post-trade services. ESMA and the Commission should continue to monitor closely the evolution of post-trade infrastructure and the Commission should, where necessary, intervene in order to prevent competitive distortions from occurring in the internal market.

(61)

A sound prudential and conduct of business framework for the financial sector should rest on strong supervisory and sanctioning regimes. To that end, supervisory authorities should be equipped with sufficient powers to act and should be able to rely on deterrent sanctioning regimes to be used against any unlawful conduct. A review of existing sanctioning powers and their practical application aiming to promote convergence of sanctions across the range of supervisory activities has been carried out in the Commission Communication of 8 December 2010 entitled ‘Reinforcing sanctioning regimes in the financial services sector’.

(62)

Therefore, in order to ensure effective compliance by CSDs, credit institutions designated as settlement agents, the members of their management bodies and any other persons who effectively control their business or any other persons with the requirements of this Regulation, competent authorities should be able to apply administrative sanctions and other measures which are effective, proportionate and dissuasive.

(63)

In order to provide deterrence and consistent application of the sanctions across Member States, this Regulation should provide a list of key administrative sanctions and other measures that need to be available to the competent authorities, for the power to impose those sanctions and other measures on all persons, whether legal or natural, responsible for an infringement, for a list of key criteria when determining the level and type of those sanctions and other measures and for levels of administrative pecuniary sanctions. Administrative fines should take into account factors such as any identified financial benefit resulting from the infringement, the gravity and duration of the infringement, any aggravating or mitigating factors, the need for administrative fines to have a deterrent effect and, where appropriate, include a discount for cooperation with the competent authority. The adoption and publication of sanctions should respect fundamental rights as laid down in the Charter of Fundamental Rights of the European Union (‘the Charter’), in particular the rights to respect for private and family life (Article 7), the right to the protection of personal data (Article 8) and the right to an effective remedy and to a fair trial (Article 47).

(64)

In order to detect potential infringements, effective mechanisms to encourage reporting of potential or actual infringements of this Regulation to the competent authorities should be put in place. Those mechanisms should include adequate safeguards for the persons who report potential or actual infringements of this Regulation and the persons accused of such infringements. Appropriate procedures should be established to comply with the accused person’s right to protection of personal data, with the right of defence and to be heard before the adoption of a final decision affecting that person as well as with the right to seek effective remedy before a tribunal against any decision or measure affecting that person.

(65)	This Regulation should be without prejudice to any provisions in the law of Member States relating to criminal sanctions.

(66)

Directive 95/46/EC of the European Parliament and of the Council (18) governs the processing of personal data carried out in the Member States pursuant to this Regulation. Any exchange or transmission of personal data by competent authorities of the Member States should be undertaken in accordance with the rules on the transfer of personal data as laid down in Directive 95/46/EC. Regulation (EC) No 45/2001 of the European Parliament and of the Council (19) governs the processing of personal data carried out by ESMA pursuant to this Regulation. Any exchange or transmission of personal data carried out by ESMA should be in accordance with the rules on the transfer of personal data as laid down in Regulation (EC) No 45/2001.

(67)

This Regulation complies with the fundamental rights and observes the principles recognised in particular by the Charter, notably the rights to respect for private and family life, the right to the protection of personal data, the right to an effective remedy and to a fair trial, the right not to be tried or punished twice for the same offence, and the freedom to conduct a business, and has to be applied in accordance with those rights and principles.

(68)	ESMA should play a central role in the application of this Regulation by ensuring consistent application of Union rules by national competent authorities and by settling disagreements between them.

(69)

ESMA should submit annual reports to the Commission assessing the trends and potential risks in the markets covered by this Regulation. Those reports should include at least an assessment of settlement efficiency, internalised settlement, cross-border provision of services, the reasons for the rejection of access rights and any other substantive barriers to competition in post-trade financial services including any barriers arising from the inappropriate use of licensing arrangements, appropriateness of penalties for settlement fails, in particular the need for additional flexibility in relation to penalties for settlement fails in relation to illiquid financial instruments, the application of Member States’ rules on civil liability to losses attributable to CSDs, the conditions relating to the provision of banking-type ancillary services, requirements regarding the protection of securities of participants and those of their clients, and the sanctions regime and may contain, where necessary, recommendations of preventative or remedial actions. ESMA should also conduct peer reviews covering the activities of the competent authorities under this Regulation within an appropriate time-frame and in accordance with Regulation (EU) No 1095/2010. Given the systemic importance of CSDs and the fact that they are being regulated for the first time at Union level, it is appropriate to require that such peer reviews should initially occur every three years at least in relation to the supervision of CSDs which make use of the freedom to provide services or participate in an interoperable link.

(70)

As a body with highly specialised expertise regarding securities and securities markets, it is efficient and appropriate to entrust ESMA with the development of draft regulatory and implementing technical standards which do not involve policy choices, for submission to the Commission. Where specified, ESMA should also closely cooperate with the members of the ESCB and EBA.

(71)

The Commission should be empowered to adopt regulatory technical standards in accordance with Article 290 TFEU and with Articles 10 to 14 of Regulation (EU) No 1093/2010 and of Regulation (EU) No 1095/2010 with regard to the detailed elements of the settlement discipline measures; the reporting of internalised settlement; information and other elements to be included by a CSD in its application for authorisation; conditions under which the competent authorities of CSDs may approve their participations in the capital of certain legal entities, the information that different authorities shall supply each other when supervising CSDs; the information that the applicant CSD shall provide ESMA in its application for recognition; the elements of the governance arrangements for CSDs; the details of the records to be kept by CSDs; the risks to be taken into account by CSDs when carrying out a comprehensive risk assessment, and competent authorities assessing the reasons for refusal of requests for access; the elements of the procedure for access of participants and issuers to CSDs, access between CSDs and between CSDs and other market infrastructures; the details of the measures to be taken by CSDs so that the integrity of the issue is maintained; the mitigation of the operational and investment risks and of the risks derived from the CSD links; the details of the capital requirements for CSDs; the details of the application for authorisation to provide banking-type ancillary services; the capital surcharge and the prudential requirements on credit and liquidity risks for CSDs and designated credit institutions that are authorised to provide banking-type ancillary services.

(72)

The Commission should also be empowered to adopt implementing technical standards by means of implementing acts pursuant to Article 291 TFEU and in accordance with Article 15 of Regulation (EU) No 1095/2010 with regard to standard forms and templates for reporting on internalised settlement; for the application for authorisation by CSDs; for the provision of information between different competent authorities for the purposes of supervision of CSDs; for the relevant cooperation arrangements between authorities of home and host Member States; for formats of records to be kept by CSDs; for the procedures in cases where a participant or an issuer is denied access to a CSD, CSDs are denied access between themselves or between CSDs and other market infrastructures; and for the consultation of different authorities prior to granting authorisation to a settlement agent.

(73)

In order to attain the objectives set out in this Regulation, the power to adopt acts in accordance with Article 290 of the TFEU should be delegated to the Commission in respect of specific details concerning some definitions, parameters for the calculation of cash penalties for the participants that cause settlement fails, the criteria under which the operations of a CSD in a host Member State should be considered to be of substantial importance for that Member State. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level. The Commission, when preparing and drawing up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and to the Council.

(74)

In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission to take decisions on the assessment of rules from third countries for the purposes of recognition of third-country CSDs. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council (20).

(75)

When assessing the relevant rules of third countries, a proportionate, outcomes-based approach should be taken, focusing on compliance with applicable Union rules and, where relevant, international standards. Conditional or interim recognition may also be granted where there are no areas of substantive difference that would have foreseeable detrimental effects on Union markets.

(76)

Since the objectives of this Regulation, namely to lay down uniform requirements for settlement as well as for CSDs, cannot be sufficiently achieved by the Member States and can therefore, by reason of the scale of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives.

(77)	It is necessary to amend Directive 98/26/EC to bring it in line with the Directive 2010/78/EU of the European Parliament and of the Council (21), whereby designated securities settlement systems are no longer notified to the Commission but to ESMA.

(78)

Taking into account the fact that this Regulation harmonises at Union level the measures to prevent and address settlement fails and has a wider scope of application for such measures than Regulation (EU) No 236/2012 of the European Parliament and of the Council (22), it is necessary to repeal Article 15 of that Regulation.

(79)

CSDs should be exempt from the application of Directive 2014/65/EU and Regulation (EU) No 600/2014 where they provide services that are explicitly listed in this Regulation. However, in order to ensure that any entities providing investment services and activities are subject to Directive 2014/65/EU and Regulation (EU) No 600/2014 and to avoid competitive distortions between different types of providers of such services, it is necessary to require CSDs that provide investment services and activities in the course of their ancillary services to be subject to the requirements of Directive 2014/65/EU and Regulation (EU) No 600/2014.

(80)

The application of the authorisation and recognition requirements of this Regulation should be deferred in order to provide CSDs established in the Union or in third countries with sufficient time to apply for authorisation and recognition of their activities provided for in this Regulation. Until a decision is made under this Regulation on the authorisation or recognition of CSDs and of their activities, including CSD links, the respective national rules on authorisation and recognition of CSDs should continue to apply.

(81)

It is also necessary to defer the application of the requirements concerning settlement discipline and requirements concerning reporting obligation of settlement internalisers until all the necessary delegated or implementing acts further specifying such requirements are in place, and of the requirements for recording certain transferable securities in book-entry form and settling obligations in securities settlement systems no later than on the second business day after the trading in order to provide market participants, holding securities in paper form or using longer settlement periods, with sufficient time to comply with those requirements,

HAVE ADOPTED THIS REGULATION:

TITLE I

SUBJECT MATTER, SCOPE AND DEFINITIONS

Article 1

Subject matter and scope

1.   This Regulation lays down uniform requirements for the settlement of financial instruments in the Union and rules on the organisation and conduct of central securities depositories (CSDs) to promote safe, efficient and smooth settlement.

2.   This Regulation applies to the settlement of all financial instruments and activities of CSDs unless otherwise specified in this Regulation.

3.   This Regulation is without prejudice to provisions of Union law concerning specific financial instruments, in particular Directive 2003/87/EC.

4.   Articles 10 to 20, 22 to 24 and 27, Article 28(6), Article 30(4) and Articles 46 and 47, the provisions of Title IV and the requirements to report to competent authorities or relevant authorities or to comply with their orders under this Regulation, do not apply to the members of the ESCB, other Member States’ national bodies performing similar functions, or to other public bodies charged with or intervening in the management of public debt in the Union in relation to any CSD which the aforementioned bodies directly manage under the responsibility of the same management body, which has access to the funds of those bodies and which is not a separate entity.

Article 2

Definitions

1.   For the purposes of this Regulation, the following definitions apply:

(1)	‘central securities depository’ or ‘CSD’ means a legal person that operates a securities settlement system referred to in point (3) of Section A of the Annex and provides at least one other core service listed in Section A of the Annex;

(2)	‘third-country CSD’ means any legal entity established in a third country that provides a similar service to the core service referred to in point (3) of Section A of the Annex and performs at least one other core service listed in Section A of the Annex;

(3)	‘immobilisation’ means the act of concentrating the location of physical securities in a CSD in a way that enables subsequent transfers to be made by book entry;

(4)	‘dematerialised form’ means the fact that financial instruments exist only as book entry records;

(5)	‘receiving CSD’ means the CSD which receives the request of another CSD to have access to its services through a CSD link;

(6)	‘requesting CSD’ means the CSD which requests access to the services of another CSD through a CSD link;

(7)	‘settlement’ means the completion of a securities transaction where it is concluded with the aim of discharging the obligations of the parties to that transaction through the transfer of cash or securities, or both;

(8)	‘financial instruments’ or ‘securities’ means financial instruments as defined in point (15) of Article 4(1) of Directive 2014/65/EU;

(9)	‘transfer order’ means transfer order as defined in the second indent of point (i) of Article 2 of Directive 98/26/EC;

(10)	‘securities settlement system’ means a system under the first, second and third indents of point (a) of Article 2 of Directive 98/26/EC that is not operated by a central counterparty whose activity consists of the execution of transfer orders;

(11)	‘settlement internaliser’ means any institution, including one authorised in accordance with Directive 2013/36/EU or with Directive 2014/65/EU, which executes transfer orders on behalf of clients or on its own account other than through a securities settlement system;

(12)	‘intended settlement date’ means the date that is entered into the securities settlement system as the settlement date and on which the parties to a securities transaction agree that settlement is to take place;

(13)	‘settlement period’ means the time period between the trade date and the intended settlement date;

(14)	‘business day’ means business day as defined in point (n) of Article 2 of Directive 98/26/EC;

(15)	‘settlement fail’ means the non-occurrence of settlement, or partial settlement of a securities transaction on the intended settlement date, due to a lack of securities or cash and regardless of the underlying cause;

(16)	‘central counterparty’ or ‘CCP’ means a CCP as defined in point (1) of Article 2 of Regulation (EU) No 648/2012;

(17)	‘competent authority’ means the authority designated by each Member State in accordance with Article 11, unless otherwise specified in this Regulation;

(18)	‘relevant authority’ means any authority referred to in Article 12;

(19)	‘participant’ means any participant, as defined in point (f) of Article 2 of Directive 98/26/EC in a securities settlement system;

(20)	‘participation’ means participation within the meaning of the first sentence of point (2) of Article 2 of Directive 2013/34/EU, or the ownership, direct or indirect, of 20 % or more of the voting rights or capital of an undertaking;

(21)	‘control’ means the relationship between two undertakings as described in Article 22 of Directive 2013/34/EU;

(22)	‘subsidiary’ means a subsidiary undertaking within the meaning of Article 2(10) and Article 22 of Directive 2013/34/EU;

(23)	‘home Member State’ means the Member State in which a CSD is established;

(24)	‘host Member State’ means the Member State, other than the home Member State, in which a CSD has a branch or provides CSD services;

(25)	‘branch’ means a place of business other than the head office which is a part of a CSD, which has no legal personality and which provides CSD services for which the CSD has been authorised;

(26)	‘default’, in relation to a participant, means a situation where insolvency proceedings, as defined in point (j) of Article 2 of Directive 98/26/EC, are opened against a participant;

(27)	‘delivery versus payment’ or ‘DVP’ means a securities settlement mechanism which links a transfer of securities with a transfer of cash in a way that the delivery of securities occurs if and only if the corresponding transfer of cash occurs and vice versa;

(28)	‘securities account’ means an account on which securities may be credited or debited;

(29)

‘CSD link’ means an arrangement between CSDs whereby one CSD becomes a participant in the securities settlement system of another CSD in order to facilitate the transfer of securities from the participants of the latter CSD to the participants of the former CSD or an arrangement whereby a CSD accesses another CSD indirectly via an intermediary. CSD links include standard links, customised links, indirect links, and interoperable links;

(30)	‘standard link’ means a CSD link whereby a CSD becomes a participant in the securities settlement system of another CSD under the same terms and conditions as applicable to any other participant in the securities settlement system operated by the latter;

(31)	‘customised link’ means a CSD link whereby a CSD that becomes a participant in the securities settlement system of another CSD is provided with additional specific services to the services normally provided by that CSD to participants in the securities settlement system;

(32)	‘indirect link’ means an arrangement between a CSD and a third party other than a CSD, that is a participant in the securities settlement system of another CSD. Such link is set up by a CSD in order to facilitate the transfer of securities to its participants from the participants of another CSD;

(33)	‘interoperable link’ means a CSD link whereby CSDs agree to establish mutual technical solutions for settlement in the securities settlement systems that they operate;

(34)	‘international open communication procedures and standards’ means internationally accepted standards for communication procedures, such as standardised messaging formats and data representation, which are available on a fair, open and non-discriminatory basis to any interested party;

(35)	‘transferable securities’ means transferable securities as defined in point (44) of Article 4(1) of Directive 2014/65/EU;

(36)	‘shares’ means securities specified in point (44)(a) of Article 4(1) of Directive 2014/65/EU;

(37)	‘money-market instruments’ means money-market instruments as defined in point (17) of Article 4(1) of Directive 2014/65/EU;

(38)	‘units in collective investment undertakings’ means units in collective investment undertakings as referred to in point (3) of Section C of Annex I to Directive 2014/65/EU;

(39)	‘emission allowance’ means emission allowance as described in point (11) of Section C of Annex I to Directive 2014/65/EU, excluding derivatives in emission allowances;

(40)	‘regulated market’ means regulated market as defined in point (21) of Article 4(1) of Directive 2014/65/EU;

(41)	‘multilateral trading facility’ or ‘MTF’ means multilateral trading facility as defined in point (22) of Article 4(1) of Directive 2014/65/EU;

(42)	‘trading venue’ means a trading venue as defined in point (24) of Article 4(1) of Directive 2014/65/EU;

(43)	‘settlement agent’ means settlement agent as defined in point (d) of Article 2 of Directive 98/26/EC;

(44)	‘SME growth market’ means an SME growth market as defined in point (12) of Article 4(1) of Directive 2014/65/EU;

(45)

‘management body’ means the body or bodies of a CSD, appointed in accordance with national law, which is empowered to set the CSD’s strategy, objectives and overall direction, and which oversees and monitors management decision-making and includes persons who effectively direct the business of the CSD. Where, according to national law, a management body comprises different bodies with specific functions, the requirements of this Regulation shall apply only to members of the management body to whom the applicable national law assigns the respective responsibility;

(46)	‘senior management’ means those natural persons who exercise executive functions within a CSD and who are responsible and accountable to the management body for the day-to-day management of that CSD.

2.   The Commission shall be empowered to adopt delegated acts in accordance with Article 67 concerning measures to further specify the non-banking-type ancillary services set out in points (1) to (4) of Section B of the Annex and the banking-type ancillary services set out in Section C of the Annex.

TITLE II

SECURITIES SETTLEMENT

CHAPTER I

Book-entry form

Article 3

Book-entry form

1.   Without prejudice to paragraph 2, any issuer established in the Union that issues or has issued transferable securities which are admitted to trading or traded on trading venues, shall arrange for such securities to be represented in book-entry form as immobilisation or subsequent to a direct issuance in dematerialised form.

2.   Where a transaction in transferable securities takes place on a trading venue the relevant securities shall be recorded in book-entry form in a CSD on or before the intended settlement date, unless they have already been so recorded.

Where transferable securities are transferred following a financial collateral arrangement as defined in point (a) of Article 2(1) of Directive 2002/47/EC, those securities shall be recorded in book-entry form in a CSD on or before the intended settlement date, unless they have already been so recorded.

Article 4

Enforcement

1.   The authorities of the Member State where the issuer that issues securities is established shall ensure that Article 3(1) is applied.

2.   The authorities competent for the supervision of the trading venues, including the competent authorities designated in accordance with Article 21(1) of Directive 2003/71/EC of the European Parliament and of the Council (23), shall ensure that the first subparagraph of Article 3(2) of this Regulation is applied where the securities referred to in Article 3(1) of this Regulation are traded on trading venues.

3.   Member States’ authorities responsible for the application of Directive 2002/47/EC shall ensure that the second subparagraph of Article 3(2) of this Regulation is applied where the securities referred to in Article 3(1) of this Regulation are transferred following a financial collateral arrangement as defined in point (a) of Article 2(1) of Directive 2002/47/EC.

CHAPTER II

Settlement periods

Article 5

Intended settlement date

1.   Any participant in a securities settlement system that settles in that system on its own account or on behalf of a third party transactions in transferable securities, money-market instruments, units in collective investment undertakings and emission allowances shall settle such transactions on the intended settlement date.

2.   As regards transactions in transferable securities referred to in paragraph 1 which are executed on trading venues, the intended settlement date shall be no later than on the second business day after the trading takes place. That requirement shall not apply to transactions which are negotiated privately but executed on a trading venue, to transactions which are executed bilaterally but reported to a trading venue or to the first transaction where the transferable securities concerned are subject to initial recording in book-entry form pursuant to Article 3(2).

3.   The competent authorities shall ensure that paragraph 1 is applied.

The authorities competent for the supervision of trading venues shall ensure that paragraph 2 is applied.

CHAPTER III

Settlement discipline

Article 6

Measures to prevent settlement fails

1.   Trading venues shall establish procedures that enable the confirmation of relevant details of transactions in financial instruments referred to in Article 5(1) on the date when the transaction has been executed.

2.   Notwithstanding the requirement laid down in paragraph 1, investment firms authorised pursuant to Article 5 of Directive 2014/65/EU shall, where applicable, take measures to limit the number of settlement fails.

Such measures shall at least consist of arrangements between the investment firm and its professional clients as referred to in Annex II to Directive 2014/65/EU to ensure the prompt communication of an allocation of securities to the transaction, confirmation of that allocation and confirmation of the acceptance or rejection of terms in good time before the intended settlement date.

ESMA shall, in close cooperation with the members of the ESCB, issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 on the standardised procedures and messaging protocols to be used for complying with the second subparagraph of this paragraph.

3.   For each securities settlement system it operates, a CSD shall establish procedures that facilitate the settlement of transactions in financial instruments referred to in Article 5(1) on the intended settlement date with a minimum exposure of its participants to counterparty and liquidity risks and a low rate of settlement fails. It shall promote early settlement on the intended settlement date through appropriate mechanisms.

4.   For each securities settlement system it operates, a CSD shall put in place measures to encourage and incentivise the timely settlement of transactions by its participants. CSDs shall require participants to settle their transactions on the intended settlement date.

5.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the measures to be taken by investment firms in accordance with the first subparagraph of paragraph 2, the details of the procedures facilitating settlement referred to in paragraph 3 and the details of the measures to encourage and incentivise the timely settlement of transactions referred to in paragraph 4.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

Article 7

Measures to address settlement fails

1.   For each securities settlement system it operates, a CSD shall establish a system that monitors settlement fails of transactions in financial instruments referred to in Article 5(1). It shall provide regular reports to the competent authority and relevant authorities, as to the number and details of settlement fails and any other relevant information, including the measures envisaged by CSDs and their participants to improve settlement efficiency. Those reports shall be made public by CSDs in an aggregated and anonymised form on an annual basis. The competent authorities shall share with ESMA any relevant information on settlement fails.

2.   For each securities settlement system it operates, a CSD shall establish procedures that facilitate settlement of transactions in financial instruments referred to in Article 5(1) that are not settled on the intended settlement date. These procedures shall provide for a penalty mechanism which will serve as an effective deterrent for participants that cause settlement fails.

Before establishing the procedures referred to in the first subparagraph, a CSD shall consult the relevant trading venues and CCPs in respect of which it provides settlement services.

The penalty mechanism referred to in the first subparagraph shall include cash penalties for participants that cause settlement fails (‘failing participants’). Cash penalties shall be calculated on a daily basis for each business day that a transaction fails to be settled after its intended settlement date until the end of a buy-in process referred to in paragraph 3, but no longer than the actual settlement day. The cash penalties shall not be configured as a revenue source for the CSD.

3.   Without prejudice to the penalty mechanism referred to in paragraph 2 and the right to bilaterally cancel the transaction, where a failing participant does not deliver the financial instruments referred to in Article 5(1) to the receiving participant within 4 business days after the intended settlement date (‘extension period’) a buy-in process shall be initiated whereby those instruments shall be available for settlement and delivered to the receiving participant within an appropriate time-frame.

Where the transaction relates to a financial instrument traded on an SME growth market the extension period shall be 15 days unless the SME growth market decides to apply a shorter period.

4.   The following exemptions from the requirement referred to in paragraph 3 shall apply:

(a)	based on asset type and liquidity of the financial instruments concerned, the extension period may be increased from four business days up to a maximum of seven business days where a shorter extension period would affect the smooth and orderly functioning of the financial markets concerned;

(b)	for operations composed of several transactions including securities repurchase or lending agreements, the buy-in process referred to in paragraph 3 shall not apply where the timeframe of those operations is sufficiently short and renders the buy-in process ineffective.

5.   Without prejudice to paragraph 7, the exemptions referred to in paragraph 4 shall not apply in relation to transactions for shares where those transactions are cleared by a CCP.

6.   Without prejudice to the penalty mechanism referred to in paragraph 2, where the price of the shares agreed at the time of the trade is higher than the price paid for the execution of the buy-in, the corresponding difference shall be paid to the receiving participant by the failing participant no later than on the second business day after the financial instruments have been delivered following the buy-in.

7.   If the buy-in fails or is not possible, the receiving participant can choose to be paid cash compensation or to defer the execution of the buy-in to an appropriate later date (‘deferral period’). If the relevant financial instruments are not delivered to the receiving participant at the end of the deferral period, cash compensation shall be paid.

Cash compensation shall be paid to the receiving participant no later than on the second business day after the end of either the buy-in process referred to in paragraph 3 or the deferral period, where the deferral period was chosen.

8.   The failing participant shall reimburse the entity that executes the buy-in for all amounts paid in accordance with paragraphs 3, 4 and 5, including any execution fees resulting from the buy-in. Such fees shall be clearly disclosed to the participants.

9.   CSDs, CCPs and trading venues shall establish procedures that enable them to suspend in consultation with their respective competent authorities, any participant that fails consistently and systematically to deliver the financial instruments referred to in Article 5(1) on the intended settlement date and to disclose to the public its identity only after giving that participant the opportunity to submit its observations and provided that the competent authorities of the CSDs, CCPs and trading venues, and of that participant have been duly informed. In addition to consulting before any suspension, CSDs, CCPs and trading venues shall notify, without delay, the respective competent authorities of the suspension of a participant. The competent authority shall immediately inform the relevant authorities of the suspension of a participant.

Public disclosure of suspensions shall not contain personal data within the meaning of point (a) of Article 2 of Directive 95/46/EC.

10.   Paragraphs 2 to 9 shall apply to all transactions of the financial instruments referred to in Article 5(1) which are admitted to trading or traded on a trading venue or cleared by a CCP as follows:

(a)	for transactions cleared by a CCP, the CCP shall be the entity that executes the buy-in according to paragraphs 3 to 8;

(b)	for transactions not cleared by a CCP but executed on a trading venue, the trading venue shall include in its internal rules an obligation for its members and its participants to apply the measures referred to in paragraphs 3 to 8;

(c)	for all transactions other than those referred to in points (a) and (b) of this subparagraph, CSDs shall include in their internal rules an obligation for their participants to be subject to the measures referred to in paragraphs 3 to 8.

A CSD shall provide the necessary settlement information to CCPs and trading venues to enable them to fulfil their obligations under this paragraph.

Without prejudice to points (a), (b) and (c) of the first subparagraph, CSDs may monitor the execution of buy-ins referred to in those points with respect to multiple settlement instructions, on the same financial instruments and with the same date of expiry of the execution period, with the aim of minimising the number of buy-ins to be executed and thus the impact on the prices of the relevant financial instruments.

11.   Paragraphs 2 to 9 shall not apply to failing participants which are CCPs.

12.   Paragraphs 2 to 9 shall not apply if insolvency proceedings are opened against the failing participant.

13.   This Article shall not apply where the principal venue for the trading of shares is located in a third country. The location of the principal venue for the trading of shares shall be determined in accordance with Article 16 of Regulation (EU) No 236/2012.

14.   The Commission shall be empowered to adopt delegated acts in accordance with Article 67 to specify parameters for the calculation of a deterrent and proportionate level of the cash penalties referred to in the third subparagraph of paragraph 2 based on asset type and liquidity of the financial instrument and type of transaction that shall ensure a high degree of settlement discipline and the smooth and orderly functioning of the financial markets concerned.

15.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify:

(a)	the details of the system monitoring settlement fails and the reports on settlement fails referred to in paragraph 1;

(b)	the processes for collection and redistribution of cash penalties and any other possible proceeds from such penalties in accordance with paragraph 2;

(c)

the details of operation of the appropriate buy-in process referred to in paragraphs 3 to 8, including appropriate time-frames to deliver the financial instrument following the buy-in process referred to in paragraph 3. Such time-frames shall be calibrated taking into account the asset type and liquidity of the financial instruments;

(d)

the circumstances under which the extension period could be prolonged according to asset type and liquidity of the financial instruments, in accordance with the conditions referred to in point (a) of paragraph 4 taking into account the criteria for assessing liquidity under point (17) of Article 2(1) of Regulation (EU) No 600/2014;

(e)	type of operations and their specific time-frames referred to in point (b) of paragraph 4 that renders buy-in ineffective;

(f)	a methodology for the calculation of the cash compensation referred to in paragraph 7;

(g)	the conditions under which a participant is deemed consistently and systematically to fail to deliver the financial instruments as referred to in paragraph 9; and

(h)	the necessary settlement information referred to in the second subparagraph of paragraph 10.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

Article 8

Enforcement

1.   The competent authority of the CSD that operates the securities settlement system, the relevant authority responsible for the oversight of the securities settlement system concerned as well as the competent authorities for the supervision of trading venues, investment firms and CCPs shall be competent for ensuring that Articles 6 and 7 are applied by the institutions subject to their supervision and for monitoring the penalties imposed. Where necessary, the respective competent authorities shall cooperate closely. Member States shall inform ESMA about the designated competent authorities that are part of the supervision structure at the national level.

2.   In order to ensure consistent, efficient and effective supervisory practices within the Union in relation to Articles 6 and 7 of this Regulation, ESMA may, in close cooperation with the members of the ESCB, issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010.

3.   An infringement of the rules under this Title shall not affect the validity of a private contract on financial instruments or the possibility for the parties to enforce the provisions of a private contract on financial instruments.

CHAPTER IV

Internalised settlement

Article 9

Settlement internalisers

1.   Settlement internalisers shall report to the competent authorities of their place of establishment on a quarterly basis the aggregated volume and value of all securities transactions that they settle outside securities settlement systems.

Competent authorities shall without delay transmit the information received under the first subparagraph to ESMA and shall inform ESMA of any potential risk resulting from that settlement activity.

2.   ESMA may, in close cooperation with the members of the ESCB, develop draft regulatory technical standards further specifying the content of such reporting.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

3.   ESMA shall develop draft implementing technical standards to establish standard forms, templates and procedures for the reporting and transmission of information referred to in paragraph 1.

ESMA shall submit those draft implementing technical standards to the Commission by 18 June 2015.

Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1095/2010.

TITLE III

CENTRAL SECURITIES DEPOSITORIES

CHAPTER I

Authorisation and supervision of CSDs

Section 1

Authorities responsible for authorisation and supervision of CSDs

Article 10

Competent authority

Without prejudice to the oversight by the members of the ESCB referred to in Article 12(1), a CSD shall be authorised and supervised by the competent authority of its home Member State.

Article 11

Designation of the competent authority

1.   Each Member State shall designate the competent authority responsible for carrying out the duties under this Regulation for the authorisation and supervision of CSDs established in its territory and shall inform ESMA thereof.

Where a Member State designates more than one competent authority, it shall determine their respective roles and shall designate a single authority to be responsible for cooperation with other Member States’ competent authorities, the relevant authorities, ESMA, and EBA, where specifically referred to in this Regulation.

2.   ESMA shall publish on its website a list of the competent authorities designated in accordance with paragraph 1.

3.   The competent authorities shall have the supervisory and investigatory powers necessary for the exercise of their functions.

Article 12

Relevant authorities

1.   The following authorities shall be involved in the authorisation and supervision of CSDs where specifically referred to in this Regulation:

(a)	the authority responsible for the oversight of the securities settlement system operated by the CSD in the Member State whose law applies to that securities settlement system;

(b)	the central banks in the Union issuing the most relevant currencies in which settlement takes place;

(c)	where relevant, the central bank in the Union in whose books the cash leg of a securities settlement system operated by the CSD is settled.

2.   ESMA shall publish on its website the list of the relevant authorities referred to in paragraph 1.

3.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards specifying the conditions under which the Union currencies referred to in point (b) of paragraph 1 are considered to be the most relevant, and efficient practical arrangements for the consultation of the relevant authorities referred to in points (b) and (c) of that paragraph.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

Article 13

Exchange of information

1.   Competent authorities, relevant authorities and ESMA shall, on request and without undue delay, provide one another with the information required for the purposes of carrying out their duties under this Regulation.

2.   Competent authorities, relevant authorities, ESMA and other bodies or natural and legal persons receiving confidential information in the exercise of their duties under this Regulation shall use it only in the course of their duties.

Article 14

Cooperation between authorities

1.   Competent authorities, relevant authorities and ESMA shall cooperate closely, including by exchanging all relevant information for the application of this Regulation. Where appropriate and relevant, such cooperation shall include other public authorities and bodies, in particular those established or appointed under Directive 2003/87/EC.

In order to ensure consistent, efficient and effective supervisory practices within the Union, including cooperation between competent authorities and relevant authorities in the different assessments necessary for the application of this Regulation, ESMA may, in close cooperation with the members of the ESCB, issue guidelines addressed to competent authorities in accordance with Article 16 of Regulation (EU) No 1095/2010.

2.   The competent authorities shall, in the exercise of their general duties, duly consider the potential impact of their decisions on the stability of the financial system in all other Member States concerned, in particular in the emergency situations referred to in Article 15, based on the available information.

Article 15

Emergency situations

Without prejudice to the notification procedure provided for in Article 6(3) of Directive 98/26/EC, competent authorities and relevant authorities shall immediately inform ESMA, the European Systemic Risk Board established by Regulation (EU) No 1092/2010 of the European Parliament and of the Council (24) and each other of any emergency situation relating to a CSD, including of any developments in financial markets, which may have an adverse effect on market liquidity, the stability of a currency in which settlement takes place, the integrity of monetary policy or on the stability of the financial system in any of the Member States where the CSD or one of its participants are established.

Section 2

Conditions and procedures for authorisation of CSDs

Article 16

Authorisation of a CSD

1.   Any legal person that falls within the definition of CSD shall obtain an authorisation from the competent authority of the Member State where it is established before commencing its activities.

2.   The authorisation shall specify the core services listed in Section A of the Annex and non-banking-type ancillary services permitted under Section B of the Annex, which the CSD is authorised to provide.

3.   A CSD shall comply at all times with the conditions necessary for authorisation.

4.   A CSD as well as its independent auditors, shall, without undue delay, inform the competent authority of any substantive changes affecting the compliance with the conditions for authorisation.

Article 17

Procedure for granting authorisation

1.   The applicant CSD shall submit an application for authorisation to its competent authority.

2.   The application for authorisation shall be accompanied by all information necessary to enable the competent authority to satisfy itself that the applicant CSD has established, at the time of the authorisation, all the necessary arrangements to meet its obligations as laid down in this Regulation. The application for authorisation shall include a programme of operations setting out the types of business envisaged and the structural organisation of the CSD.

3.   Within 30 working days from the receipt of the application, the competent authority shall assess whether the application is complete. If the application is not complete, the competent authority shall set a time limit by which the applicant CSD has to provide additional information. The competent authority shall inform the applicant CSD when the application is considered to be complete.

4.   From the moment when the application is considered to be complete, the competent authority shall transmit all information included in the application to the relevant authorities and consult those authorities concerning the features of the securities settlement system operated by the applicant CSD. Each relevant authority may inform the competent authority of its views within 3 months of the receipt of the information by the relevant authority.

5.   Where the applicant CSD intends to provide services referred to in point (2) of Article 4(1) of Directive 2014/65/EU in addition to the provision of non-banking-type ancillary services explicitly listed in Section B of the Annex, the competent authority shall transmit all information included in the application to the authority referred to in Article 67 of Directive 2014/65/EU and consult that authority on the ability of the applicant CSD to comply with the requirements of Directive 2014/65/EU and of Regulation (EU) No 600/2014.

6.   The competent authority shall, before granting authorisation to the applicant CSD, consult the competent authorities of the other Member State involved in the following cases:

(a)	the CSD is a subsidiary of a CSD authorised in another Member State;

(b)	the CSD is a subsidiary of the parent undertaking of a CSD authorised in another Member State;

(c)	the CSD is controlled by the same natural or legal persons who control a different CSD authorised in another Member State.

7.   The consultation referred to in paragraph 6 shall cover the following:

(a)

the suitability of the shareholders and persons referred to in Article 27(6) and the reputation and experience of the persons who effectively direct the business of the CSD referred to in Article 27(1) and (4), where those shareholders and persons are common to the CSD and to a CSD authorised in another Member State;

(b)	whether the relations referred to in points (a), (b) and (c) of paragraph 6 between the CSD authorised in another Member State and the applicant CSD do not affect the ability of the latter to comply with the requirements of this Regulation.

8.   Within six months from the submission of a complete application, the competent authority shall inform the applicant CSD in writing with a fully reasoned decision whether the authorisation has been granted or refused.

9.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the information that the applicant CSD is to provide to the competent authority in the application for authorisation.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

10.   ESMA shall, in close cooperation with the members of the ESCB, develop draft implementing technical standards to establish standard forms, templates and procedures for the application for authorisation.

ESMA shall submit those draft implementing technical standards to the Commission by 18 June 2015.

Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1095/2010.

Article 18

Effects of the authorisation

1.   The activities of the authorised CSD shall be limited to the provision of services covered by its authorisation or by notification in accordance with Article 19(8).

2.   Securities settlement systems may be operated only by authorised CSDs, including central banks acting as CSDs.

3.   An authorised CSD may have a participation only in a legal person whose activities are limited to the provision of services listed in Sections A and B of the Annex, unless such a participation is approved by its competent authority on the basis that it does not significantly increase the risk profile of the CSD.

4.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the criteria to be taken into account by the competent authorities to approve the participation of CSDs in legal persons other than those providing the services listed in Sections A and B of the Annex. Such criteria may include whether the services provided by that legal person are complementary to the services provided by a CSD, and the extent of the CSD’s exposure to liabilities arising from such participation.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

Article 19

Extension and outsourcing of activities and services

1.   An authorised CSD shall submit an application for authorisation to the competent authority of its home Member State where it wishes to outsource a core service to a third party under Article 30 or extend its activities to one or more of the following:

(a)	additional core services listed in Section A of the Annex, not covered by the initial authorisation;

(b)	ancillary services permitted under, but not explicitly listed in Section B of the Annex, not covered by the initial authorisation;

(c)	the operation of another securities settlement system;

(d)	the settlement of all or part of the cash leg of its securities settlement system in the books of another settlement agent;

(e)	setting up an interoperable link, including those with third-country CSDs.

2.   The granting of authorisation under paragraph 1 shall follow the procedure laid down in Article 17.

The competent authority shall inform the applicant CSD whether the authorisation has been granted or refused within three months of the submission of a complete application.

3.   CSDs established in the Union that intend to establish an interoperable link shall submit an application for authorisation as required under point (e) of paragraph 1, to their respective competent authorities. Those authorities shall consult each other regarding the approval of the CSD link. In the event of divergent decisions and if agreed by both competent authorities the matter may be referred to ESMA, which may act in accordance with the powers conferred on it under Article 19 of Regulation (EU) No 1095/2010.

4.   The authorities referred to in paragraph 3 shall refuse to authorise a link only where such a CSD link would threaten the smooth and orderly functioning of the financial markets or cause systemic risk.

5.   Interoperable links of CSDs that outsource some of their services related to those interoperable links to a public entity in accordance with Article 30(5) and CSD links that are not referred to in point (e) of paragraph 1 shall not be subject to authorisation under that point but shall be notified to the CSDs’ competent and relevant authorities prior to their implementation by providing all relevant information that allows such authorities to assess compliance with the requirements provided in Article 48.

6.   A CSD established and authorised in the Union may maintain or establish a link with a third-country CSD in accordance with the conditions and procedures provided in this Article. Where links are established with a third-country CSD the information provided by the requesting CSD shall allow the competent authority to evaluate whether such links fulfil the requirements provided in Article 48 or the requirements that are equivalent to those provided in Article 48.

7.   The competent authority of the requesting CSD shall require that CSD to discontinue a CSD link that has been notified when such link does not fulfil the requirements provided for in Article 48 and thereby would threaten the smooth and orderly functioning of the financial markets or cause systemic risk. Where a competent authority requires the CSD to discontinue a CSD link, it shall follow the procedure laid down in Article 20(2) and (3).

8.   The additional ancillary services explicitly listed in Section B of the Annex shall not be subject to authorisation, but shall be notified to the competent authority prior to their provision.

Article 20

Withdrawal of authorisation

1.   Without prejudice to any remedial actions or measures under Title V, the competent authority of the home Member State shall withdraw the authorisation in any of the following circumstances, where the CSD:

(a)	has not made use of the authorisation during 12 months, expressly renounces the authorisation or has provided no services or performed no activity during the preceding six months;

(b)	has obtained the authorisation by making false statements or by any other unlawful means;

(c)	no longer complies with the conditions under which authorisation was granted and has not taken the remedial actions requested by the competent authority within a set time-frame;

(d)	has seriously or systematically infringed the requirements laid down in this Regulation or, where applicable, in Directive 2014/65/EU or Regulation (EU) No 600/2014.

2.   From the moment when it becomes aware of one of the circumstances referred to in paragraph 1, the competent authority shall immediately consult the relevant authorities and, where applicable, the authority referred to in Article 67 of Directive 2014/65/EU on the necessity to withdraw the authorisation.

3.   ESMA and any relevant authority and, where applicable, the authority referred to in Article 67 of Directive 2014/65/EU may, at any time, request that the competent authority of the home Member State examines whether the CSD still complies with the conditions under which the authorisation was granted.

4.   The competent authority may limit the withdrawal of authorisation to a particular service, activity, or financial instrument.

5.   A CSD shall establish, implement and maintain adequate procedures ensuring the timely and orderly settlement and transfer of the assets of clients and participants to another CSD in the event of a withdrawal of authorisation referred to in paragraph 1.

Article 21

CSD register

1.   Decisions taken by competent authorities under Articles 16, 19 and 20 shall be immediately communicated to ESMA.

2.   Central banks shall without undue delay inform ESMA of any securities settlement system that they operate.

3.   The name of each CSD operating in compliance with this Regulation and to which authorisation or recognition has been granted pursuant to Article 16, 19 or 25 shall be entered in a register specifying the services and, where applicable, classes of financial instruments for which the CSD has been authorised. The register shall include branches operated by the CSD in other Member States, CSD links and the information required under Article 31 where Member States have made use of the possibility provided for in that Article. ESMA shall make the register available on its dedicated website and keep it up to date.

Section 3

Supervision of CSDs

Article 22

Review and evaluation

1.   The competent authority shall, at least on an annual basis, review the arrangements, strategies, processes and mechanisms implemented by a CSD with respect to compliance with this Regulation and evaluate the risks to which the CSD is, or might be, exposed or which it creates for the smooth functioning of securities markets.

2.   The competent authority shall require the CSD to submit to the competent authority an adequate recovery plan to ensure continuity of its critical operations.

3.   The competent authority shall ensure that an adequate resolution plan is established and maintained for each CSD so as to ensure continuity of at least its core functions, having regard to the size, systemic importance, nature, scale and complexity of the activities of the CSD concerned and any relevant resolution plan established in accordance with Directive 2014/59/EU.

4.   The competent authority shall establish the frequency and depth of the review and evaluation referred to in paragraph 1 having regard to the size, systemic importance, nature, scale and complexity of the activities of the CSD concerned. The review and evaluation shall be updated at least on an annual basis.

5.   The competent authority shall subject the CSD to on-site inspections.

6.   When performing the review and evaluation referred to in paragraph 1, the competent authority shall, at an early stage, consult the relevant authorities, in particular concerning the functioning of the securities settlement systems operated by the CSD and, where applicable, the authority referred to in Article 67 of Directive 2014/65/EU.

7.   The competent authority shall regularly, and at least once a year, inform the relevant authorities and, where applicable, the authority referred to in Article 67 of Directive 2014/65/EU of the results, including any remedial actions or penalties, of the review and evaluation referred to in paragraph 1.

8.   When performing the review and evaluation referred to in paragraph 1, the competent authorities responsible for supervising CSDs which maintain the types of relations referred to in points (a), (b) and (c) of Article 17(6) shall supply one another with all relevant information that is likely to facilitate their tasks.

9.   The competent authority shall require a CSD that does not meet the requirements of this Regulation to take at an early stage the necessary actions or steps to address the situation.

10.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the following:

(a)	the information that the CSD is to provide to the competent authority for the purposes of the review and evaluation referred to in paragraph 1;

(b)	the information that the competent authority is to supply to the relevant authorities, as set out in paragraph 7;

(c)	the information that the competent authorities referred to in paragraph 8 are to supply one another.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with in Articles 10 to 14 of Regulation (EU) No 1095/2010.

11.   ESMA shall, in close cooperation with the members of the ESCB, develop draft implementing technical standards to determine standard forms, templates and procedures for the provision of information referred to in the first subparagraph of paragraph 10.

ESMA shall submit those draft implementing technical standards to the Commission by 18 June 2015.

Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1095/2010.

Section 4

Provision of services in another member state

Article 23

Freedom to provide services in another Member State

1.   An authorised CSD may provide services referred to in the Annex within the territory of the Union, including through setting up a branch, provided that those services are covered by the authorisation.

2.   An authorised CSD that intends to provide the core services referred to in points 1 and 2 of Section A of the Annex in relation to financial instruments constituted under the law of another Member State referred to in Article 49(1) or to set up a branch in another Member State shall be subject to the procedure referred to in paragraphs 3 to 7.

3.   Any CSD wishing to provide the services referred to in paragraph 2 within the territory of another Member State for the first time, or to change the range of those services provided shall communicate the following information to the competent authority of the home Member State:

(a)	the Member State in which the CSD intends to operate;

(b)	a programme of operations stating in particular the services which the CSD intends to provide;

(c)	the currency or currencies that the CSD intends to process;

(d)	where there is a branch, the organisational structure of the branch and the names of those responsible for the management of the branch;

(e)	where relevant, an assessment of the measures the CSD intends to take to allow its users to comply with the national law referred to in Article 49(1).

4.   Within three months from the receipt of the information referred to in paragraph 3, the competent authority of the home Member State shall communicate that information to the competent authority of the host Member State unless, by taking into account the provision of services envisaged, it has reasons to doubt the adequacy of the administrative structure or the financial situation of the CSD wishing to provide its services in the host Member State.

The competent authority of the host Member State shall without delay inform the relevant authorities of that Member State of any communication received under the first subparagraph.

5.   Where the competent authority of the home Member State decides in accordance with paragraph 4 not to communicate all the information referred to in paragraph 3 to the competent authority of the host Member State it shall give reasons for its refusal to the CSD concerned within three months of receiving all the information and inform the competent authority of the host Member State of its decision in relation to point (a) of paragraph 6. Where information is shared in response to such a request the competent authority of the host Member State shall not issue the communication referred to in point (a) of paragraph 6.

6.   The CSD may start providing the services referred to in paragraph 2 in the host Member State under the following conditions:

(a)	on receipt of a communication from the competent authority in the host Member State acknowledging receipt by the latter of the communication referred to in paragraph 4 and, where relevant, approving the assessment referred to in point (e) of paragraph 3;

(b)	in the absence of any receipt of a communication, after three months from the date of transmission of the communication referred to in paragraph 4.

7.   In the event of a change in any of the information communicated in accordance with paragraph 3, a CSD shall give written notice of that change to the competent authority of the home Member State at least one month before implementing the change. The competent authority of the host Member State shall also be informed of that change without delay by the competent authority of the home Member State.

Article 24

Cooperation between authorities of the home Member State and of the host Member State and peer review

1.   Where a CSD authorised in one Member State has set up a branch in another Member State, the competent authority of the home Member State and the competent authority of the host Member State shall cooperate closely in the performance of their duties provided for in this Regulation, in particular when carrying out on-site inspections in that branch. The competent authority of the home Member State and of the host Member State may, in the exercise of their responsibilities, carry out on-site inspections in that branch after informing the competent authority of the host Member State or of the home Member State respectively.

2.   The competent authority of the home Member State or of the host Member State may require CSDs which provide services in accordance with Article 23 to report to them periodically on their activities in that host Member State, including for the purpose of collecting statistics. The competent authority of the host Member State shall, on request from the competent authority of the home Member State, provide those periodic reports to the competent authority of the home Member State.

3.   The competent authority of the home Member State of the CSD shall, on the request of the competent authority of the host Member State and without delay, communicate the identity of the issuers and participants in the securities settlement systems operated by the CSD which provides services in that host Member State and any other relevant information concerning the activities of that CSD in the host Member State.

4.   Where, taking into account the situation of the securities markets in the host Member State, the activities of a CSD have become of substantial importance for the functioning of the securities markets and the protection of the investors in that host Member State, the competent authority of the home Member State and of the host Member State and the relevant authorities of the home Member State and of the host Member State shall establish cooperation arrangements for the supervision of the activities of that CSD in the host Member State.

Where a CSD has become of substantial importance for the functioning of the securities markets and the protection of the investors in more than one host Member State, the home Member State may decide that such cooperation arrangements are to include colleges of supervisors.

5.   Where the competent authority of the host Member State has clear and demonstrable grounds for believing that a CSD providing services within its territory in accordance with Article 23 is in breach of the obligations arising from the provisions of this Regulation, it shall refer those findings to the competent authority of the home Member State and to ESMA.

Where, despite measures taken by the competent authority of the home Member State or because such measures prove inadequate, the CSD persists in acting in infringement of the obligations arising from the provisions of this Regulation, after informing the competent authority of the home Member State, the competent authority of the host Member State shall take all the appropriate measures needed in order to ensure compliance with the provisions of this Regulation within the territory of the host Member State. ESMA shall be informed of such measures without delay.

The competent authority of the host Member State and of the home Member State may refer the matter to ESMA, which may act in accordance with the powers conferred on it under Article 19 of Regulation (EU) No 1095/2010.

6.   Without prejudice to Article 30 of Regulation (EU) No 1095/2010, ESMA shall, after consulting the members of the ESCB, organise and conduct, at least every three years, a peer review of the supervision of CSDs which make use of the freedom to provide services in another Member State in accordance with Article 23 or to participate in an interoperable link.

In the context of the peer review referred to in the first subparagraph ESMA shall, where appropriate, also request opinions or advice from the Securities and Markets Stakeholder Group referred to in Article 37 of Regulation (EU) No 1095/2010.

7.   The Commission shall be empowered to adopt delegated acts in accordance with Article 67 concerning measures for establishing the criteria under which the operations of a CSD in a host Member State could be considered to be of substantial importance for the functioning of the securities markets and the protection of the investors in that host Member State.

8.   ESMA shall, in close cooperation with the members of the ESCB, develop draft implementing technical standards to establish standard forms, templates and procedures for the cooperation referred to in paragraphs 1, 3 and 5.

ESMA shall submit those draft implementing technical standards to the Commission by 18 June 2015.

Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1095/2010.

Section 5

Relations with third countries

Article 25

Third countries

1.   Third-country CSDs may provide services referred to in the Annex within the territory of the Union, including through setting up a branch.

2.   Notwithstanding paragraph 1, a third-country CSD that intends to provide the core services referred to in points (1) and (2) of Section A of the Annex in relation to financial instruments constituted under the law of a Member State referred to in the second subparagraph of Article 49(1) or to set up a branch in a Member State shall be subject to the procedure referred to in paragraphs 4 to 11 of this Article.

3.   A CSD established and authorised in the Union may maintain or establish a link with a third-country CSD in accordance with Article 48.

4.   After consulting the authorities referred to in paragraph 5, ESMA may recognise a third-country CSD that has applied for recognition to provide the services referred to in paragraph 2, where the following conditions are met:

(a)	the Commission has adopted a decision in accordance with paragraph 9;

(b)	the third-country CSD is subject to effective authorisation, supervision and oversight or, if the securities settlement system is operated by a central bank, oversight, ensuring full compliance with the prudential requirements applicable in that third country;

(c)	cooperation arrangements between ESMA and the responsible authorities in that third country (‘responsible third-country authorities’) have been established pursuant to paragraph 10;

(d)

where relevant, the third-country CSD takes the necessary measures to allow its users to comply with the relevant national law of the Member State in which the third-country CSD intends to provide CSD services, including the law referred to in the second subparagraph of Article 49(1), and the adequacy of those measures has been confirmed by the competent authorities of the Member State in which the third-country CSD intends to provide CSD services.

5.   When assessing whether the conditions referred to in paragraph 4 are met, ESMA shall consult:

(a)	the competent authorities of the Member States in which the third-country CSD intends to provide CSD services, in particular, on how the third-country CSD intends to comply with the requirement referred to in point (d) of paragraph 4;

(b)	the relevant authorities;

(c)	the responsible third-country authorities entrusted with the authorisation, supervision and oversight of CSDs.

6.   The third-country CSD referred to in paragraph 2 shall submit its application for recognition to ESMA.

The applicant CSD shall provide ESMA with all information deemed to be necessary for its recognition. Within 30 working days from the receipt of the application, ESMA shall assess whether the application is complete. If the application is not complete, ESMA shall set a time limit by which the applicant CSD has to provide additional information.

The competent authorities of the Member States in which the third-country CSD intends to provide CSD services shall assess the compliance of the third-country CSD with the law referred to in point (d) of paragraph 4 and inform ESMA with a fully reasoned decision whether the compliance is met or not within three months from the receipt of all the necessary information from ESMA.

The recognition decision shall be based on the criteria laid down in paragraph 4.

Within six months from the submission of a complete application, ESMA shall inform the applicant CSD in writing with a fully reasoned decision whether the recognition has been granted or refused.

7.   The competent authorities of the Member States in which the third-country CSD, duly recognised under paragraph 4, provides CSD services, in close cooperation with ESMA, may request the responsible third-country authorities to:

(a)	report periodically on the third-country CSD’s activities in those host Member States, including for the purpose of collecting statistics;

(b)

communicate, within an appropriate time-frame, the identity of the issuers and participants in the securities settlement systems operated by the third-country CSD which provides services in that host Member State and any other relevant information concerning the activities of that third-country CSD in the host Member State.

8.   ESMA shall, after consulting the authorities referred to in paragraph 5, review the recognition of the third-country CSD in the event of extensions by that CSD in the Union of its services under the procedure laid down in paragraphs 4, 5 and 6.

ESMA shall withdraw the recognition of that CSD where the conditions laid down in paragraph 4 are no longer met, or in the circumstances referred to in Article 20.

9.   The Commission may adopt implementing acts to determine that the legal and supervisory arrangements of a third country ensure that CSDs authorised in that third country comply with legally binding requirements which are in effect equivalent to the requirements laid down in this Regulation, that those CSDs are subject to effective supervision, oversight and enforcement in that third country on an ongoing basis and that the legal framework of that third country provides for an effective equivalent system for the recognition of CSDs authorised under third-country legal regimes. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 68(2).

In making the determination referred to in the first subparagraph, the Commission may also consider whether the legal and supervisory arrangements of a third country reflect the internationally agreed CPSS-IOSCO standards, in so far as the latter do not conflict with the requirements laid down in this Regulation.

10.   In accordance with Article 33(1) of Regulation (EU) No 1095/2010, ESMA shall establish cooperation arrangements with the responsible third-country authorities whose legal and supervisory frameworks have been recognised as equivalent to this Regulation in accordance with paragraph 9. Such arrangements shall specify at least:

(a)

the mechanism for the exchange of information between ESMA, the competent authorities of the host Member State and the third-country responsible authorities, including access to all information regarding the CSDs authorised in third countries that is requested by ESMA and in particular access to information in the cases referred to in paragraph 7;

(b)	the mechanism for prompt notification of ESMA where a third-country responsible authority deems a CSD that it is supervising to infringe the conditions of its authorisation or of other applicable law;

(c)	the procedures concerning the coordination of supervisory activities including, where appropriate, on-site inspections.

Where a cooperation agreement provides for transfers of personal data by a Member State, such transfers shall comply with the provisions of Directive 95/46/EC and where a cooperation agreement provides for transfers of personal data by ESMA, such transfers shall comply with the provisions of Regulation (EU) No 45/2001.

11.   Where a third-country CSD has been recognised, in accordance with paragraphs 4 to 8, it may provide services referred to in the Annex within the territory of the Union, including by setting up a branch.

12.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the information that the applicant CSD is to provide to ESMA in its application for recognition under paragraph 6.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

CHAPTER II

Requirements for CSDs

Section 1

Organisational requirements

Article 26

General provisions

1.   A CSD shall have robust governance arrangements, which include a clear organisational structure with well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks to which it is or might be exposed, and adequate remuneration policies and internal control mechanisms, including sound administrative and accounting procedures.

2.   A CSD shall adopt policies and procedures which are sufficiently effective so as to ensure compliance with this Regulation, including compliance of its managers and employees with all the provisions of this Regulation.

3.   A CSD shall maintain and operate effective written organisational and administrative arrangements to identify and manage any potential conflicts of interest between itself, including its managers, employees, members of the management body or any person directly or indirectly linked to them, and its participants or their clients. It shall maintain and implement adequate resolution procedures where possible conflicts of interest occur.

4.   A CSD shall make its governance arrangements and the rules governing its activity available to the public.

5.   A CSD shall have appropriate procedures for its employees to report internally potential infringements of this Regulation through a specific channel.

6.   A CSD shall be subject to regular and independent audits. The results of these audits shall be communicated to the management body and made available to the competent authority and, where appropriate taking into account potential conflicts of interest between the members of the user committee and the CSD, to the user committee.

7.   Where a CSD is part of a group of undertakings including other CSDs or credit institutions referred to in Title IV, it shall adopt detailed policies and procedures specifying how the requirements laid down in this Article apply to the group and to the different entities in the group.

8.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards specifying at the CSD level and at the group level as referred to in paragraph 7:

(a)	the monitoring tools for the risks of the CSDs referred to in paragraph 1;

(b)	the responsibilities of the key personnel in respect of the risks of the CSDs referred to in paragraph 1;

(c)	the potential conflicts of interest referred to in paragraph 3;

(d)	the audit methods referred to in paragraph 6; and

(e)	the circumstances in which it would be appropriate, taking into account potential conflicts of interest between the members of the user committee and the CSD, to share audit findings with the user committee in accordance with paragraph 6.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

Article 27

Senior management, management body and shareholders

1.   The senior management of a CSD shall be of sufficiently good repute and experience so as to ensure the sound and prudent management of the CSD.

2.   A CSD shall have a management body of which at least one third, but no less than two, of its members are independent.

3.   The remuneration of the independent and other non-executive members of the management body shall not be linked to the business performance of the CSD.

4.   The management body shall be composed of suitable members of sufficiently good repute with an appropriate mix of skills, experience and knowledge of the entity and of the market. The non-executive members of the management body shall decide on a target for the representation of the under-represented gender in the management body and prepare a policy on how to increase the number of the under-represented gender in order to meet that target. The target, policy and its implementation shall be made public.

5.   A CSD shall clearly determine the role and responsibilities of the management body in accordance with the relevant national law. A CSD shall make the minutes of the meetings of the management body available to the competent authority and the auditor upon request.

6.   The CSD’s shareholders and persons who are in a position to exercise, directly or indirectly, control over the management of the CSD shall be suitable to ensure the sound and prudent management of the CSD.

7.   A CSD shall:

(a)	provide the competent authority with, and make public, information regarding the ownership of the CSD, and in particular, the identity and scale of interests of any parties in a position to exercise control over the operation of the CSD;

(b)

inform and seek approval from its competent authority of any decision to transfer ownership rights which give rise to a change in the identity of the persons exercising control over the operation of the CSD. After receiving approval from its competent authority, the CSD shall make public the transfer of ownership rights.

Any natural or legal person shall inform without undue delay the CSD and its competent authority of a decision to acquire or dispose of its ownership rights that give rise to a change in the identity of the persons exercising control over the operation of the CSD.

8.   Within 60 working days from the receipt of the information referred to in paragraph 7, the competent authority shall take a decision on the proposed changes in the control of the CSD. The competent authority shall refuse to approve proposed changes in the control of the CSD where there are objective and demonstrable grounds for believing that they would pose a threat to the sound and prudent management of the CSD or to the ability of the CSD to comply with this Regulation.

Article 28

User committee

1.   A CSD shall establish user committees for each securities settlement system it operates, which shall be composed of representatives of issuers and of participants in such securities settlement systems. The advice of the user committee shall be independent from any direct influence by the management of the CSD.

2.   A CSD shall define in a non-discriminatory way the mandate for each established user committee, the governance arrangements necessary to ensure its independence and its operational procedures, as well as the admission criteria and the election mechanism for user committee members. The governance arrangements shall be publicly available and shall ensure that the user committee reports directly to the management body and holds regular meetings.

3.   User committees shall advise the management body on key arrangements that impact on their members, including the criteria for accepting issuers or participants in their respective securities settlement systems and on service level.

4.   User committees may submit a non-binding opinion to the management body containing detailed reasons regarding the pricing structures of the CSD.

5.   Without prejudice to the right of competent authorities to be duly informed, the members of the user committees shall be bound by confidentiality. Where the chairman of a user committee determines that a member has an actual or a potential conflict of interest in relation to a particular matter, that member shall not be allowed to vote on that matter.

6.   A CSD shall promptly inform the competent authority and the user committee of any decision in which the management body decides not to follow the advice of the user committee. The user committee may inform the competent authority of any areas in which it considers that the advice of the user committee has not been followed.

Article 29

Record keeping

1.   A CSD shall maintain, for a period of at least 10 years, all its records on the services and activities, including on the ancillary services referred to in Sections B and C of the Annex, so as to enable the competent authority to monitor the compliance with the requirements under this Regulation.

2.   A CSD shall make the records referred to in paragraph 1 available upon request to the competent authority and the relevant authorities and any other public authority which under Union law or national law of its home Member State has a power to require access to such records for the purpose of fulfilling their mandate.

3.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the details of the records referred to in paragraph 1 to be retained for the purpose of monitoring the compliance of CSDs with the provisions of this Regulation.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

4.   ESMA shall, in close cooperation with the members of the ESCB, develop draft implementing technical standards to establish the format of the records referred to in paragraph 1 to be retained for the purpose of monitoring the compliance of CSDs with the provisions of this Regulation.

ESMA shall submit those draft implementing technical standards to the Commission by 18 June 2015.

Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1095/2010.

Article 30

Outsourcing

1.   Where a CSD outsources services or activities to a third party, it shall remain fully responsible for discharging all of its obligations under this Regulation and shall comply at all times with the following conditions:

(a)	outsourcing does not result in the delegation of its responsibility;

(b)	the relationship and obligations of the CSD towards its participants or issuers are not altered;

(c)	the conditions for the authorisation of the CSD do not effectively change;

(d)	outsourcing does not prevent the exercise of supervisory and oversight functions, including on-site access to acquire any relevant information needed to fulfil those functions;

(e)	outsourcing does not result in depriving the CSD of the systems and controls necessary to manage the risks it faces;

(f)

the CSD retains the expertise and resources necessary for evaluating the quality of the services provided, the organisational and capital adequacy of the service provider, for supervising the outsourced services effectively and for managing the risks associated with the outsourcing on an ongoing basis;

(g)	the CSD has direct access to the relevant information of the outsourced services;

(h)	the service provider cooperates with the competent authority and the relevant authorities in connection with the outsourced activities;

(i)

the CSD ensures that the service provider meets the standards set down by the relevant data protection law which would apply if the service providers were established in the Union. The CSD is responsible for ensuring that those standards are set out in a contract between the parties and that those standards are maintained.

2.   The CSD shall define in a written agreement its rights and obligations and those of the service provider. The outsourcing agreement shall allow the CSD to terminate the agreement.

3.   A CSD and a service provider shall make available upon request to the competent authority and the relevant authorities all information necessary to enable them to assess the compliance of the outsourced activities with the requirements of this Regulation.

4.   The outsourcing of a core service shall be subject to authorisation under Article 19 by the competent authority.

5.   Paragraphs 1 to 4 shall not apply where a CSD outsources some of its services or activities to a public entity and where that outsourcing is governed by a dedicated legal, regulatory and operational framework which has been jointly agreed and formalised by the public entity and the relevant CSD and agreed by the competent authorities on the basis of the requirements established in this Regulation.

Article 31

Services provided by parties other than CSDs

1.   Notwithstanding Article 30 and where required by national law, a person other than CSD may be responsible for recording book entries into securities accounts maintained by CSDs.

2.   Member States that allow parties other than CSDs to provide certain core services referred to in Section A of the Annex in accordance with paragraph 1 shall specify in their national law the requirements that will apply in such a case. Those requirements shall include the provisions of this Regulation which shall apply both to the CSD and, where relevant, to the other party concerned.

3.   Member States that allow parties other than CSDs to provide certain core services referred to in Section A of the Annex in accordance with paragraph 1 shall communicate to ESMA all the relevant information concerning the provision of such services, including their relevant national law.

ESMA shall include such information in the CSD register referred to in Article 21.

Section 2

Conduct of business rules

Article 32

General provisions

1.   A CSD shall have clearly defined goals and objectives that are achievable, such as in the areas of minimum service levels, risk-management expectations and business priorities.

2.   A CSD shall have transparent rules for the handling of complaints.

Article 33

Requirements for participation

1.   For each securities settlement system it operates a CSD shall have publicly disclosed criteria for participation which allow fair and open access for all legal persons that intend to become participants. Such criteria shall be transparent, objective, and non-discriminatory so as to ensure fair and open access to the CSD with due regard to risks to financial stability and the orderliness of markets. Criteria that restrict access shall be permitted only to the extent that their objective is to justifiably control a specified risk for the CSD.

2.   A CSD shall treat requests for access promptly by providing a response to such requests within one month at the latest and shall make the procedures for treating access requests publicly available.

3.   A CSD shall deny access to a participant meeting the criteria referred to in paragraph 1 only where duly justified in writing and based on a comprehensive risk assessment.

In the event of a refusal, the requesting participant has the right to complain to the competent authority of the CSD that has refused access.

That competent authority shall duly examine the complaint by assessing the reasons for refusal and shall provide the requesting participant with a reasoned reply.

That competent authority shall consult the competent authority of the place of establishment of the requesting participant on its assessment of the complaint. Where the authority of the requesting participant disagrees with the assessment provided, any one of the two competent authorities may refer the matter to ESMA, which may act in accordance with the powers conferred on it under Article 19 of Regulation (EU) No 1095/2010.

Where the refusal by the CSD to grant access to the requesting participant is deemed to be unjustified, the competent authority of the CSD that has refused access shall issue an order requiring that CSD to grant access to the requesting participant.

4.   A CSD shall have objective and transparent procedures for the suspension and orderly exit of participants that no longer meet the criteria for participation referred to in paragraph 1.

5.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the risks to be taken into account by CSDs when carrying out a comprehensive risk assessment, and by competent authorities when assessing the reasons for refusal in accordance with paragraph 3 and the elements of the procedure referred to in paragraph 3.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

6.   ESMA shall, in close cooperation with the members of the ESCB, develop draft implementing technical standards to establish standard forms and templates for the procedure referred to in paragraph 3.

ESMA shall submit those draft implementing technical standards to the Commission by 18 June 2015.

Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1095/2010.

Article 34

Transparency

1.   For each securities settlement system it operates, as well as for each of the other core services it performs, a CSD shall publicly disclose the prices and fees associated with the core services listed in Section A of the Annex that they provide. It shall disclose the prices and fees of each service and function provided separately, including discounts and rebates and the conditions to benefit from those reductions. It shall allow its clients separate access to the specific services provided.

2.   A CSD shall publish its price list so as to facilitate the comparison of offers and to allow clients to anticipate the price they shall have to pay for the use of services.

3.   A CSD shall be bound by its published pricing policy for its core services.

4.   A CSD shall provide its clients with information that allows reconciling invoices with the published price lists.

5.   A CSD shall disclose to all clients information that allows them to assess the risks associated with the services provided.

6.   A CSD shall account separately for costs and revenues of the core services provided and shall disclose that information to the competent authority.

7.   A CSD shall account for the cost and revenue of the ancillary services provided as a whole and shall disclose that information to the competent authority.

8.   In order to ensure effective application of Union competition rules and enable the identification, inter alia, of cross-subsidisation of ancillary services by core services, a CSD shall maintain analytical accounting for its activities. Such analytical accounts shall at least separate the costs and revenues associated with each of its core services from those associated with ancillary services.

Article 35

Communication procedures with participants and other market infrastructures

CSDs shall use in their communication procedures with participants of the securities settlement systems they operate, and with the market infrastructures they interface with international open communication procedures and standards for messaging and reference data in order to facilitate efficient recording, payment and settlement.

Section 3

Requirements for CSD services

Article 36

General provisions

For each securities settlement system it operates a CSD shall have appropriate rules and procedures, including robust accounting practices and controls, to help ensure the integrity of securities issues, and reduce and manage the risks associated with the safekeeping and settlement of transactions in securities.

Article 37

Integrity of the issue

1.   A CSD shall take appropriate reconciliation measures to verify that the number of securities making up a securities issue or part of a securities issue submitted to the CSD is equal to the sum of securities recorded on the securities accounts of the participants of the securities settlement system operated by the CSD and, where relevant, on owner accounts maintained by the CSD. Such reconciliation measures shall be conducted at least daily.

2.   Where appropriate and if other entities are involved in the reconciliation process for a certain securities issue, such as the issuer, registrars, issuance agents, transfer agents, common depositories, other CSDs or other entities, the CSD and any such entities shall organise adequate cooperation and information exchange measures with each other so that the integrity of the issue is maintained.

3.   Securities overdrafts, debit balances or securities creation shall not be allowed in a securities settlement system operated by a CSD.

4.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the reconciliation measures a CSD is to take under paragraphs 1, 2 and 3.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

Article 38

Protection of securities of participants and those of their clients

1.   For each securities settlement system it operates, a CSD shall keep records and accounts that shall enable it, at any time and without delay, to segregate in the accounts with the CSD, the securities of a participant from those of any other participant and, if applicable, from the CSD’s own assets.

2.   A CSD shall keep records and accounts that enable any participant to segregate the securities of the participant from those of the participant’s clients.

3.   A CSD shall keep records and accounts that enable any participant to hold in one securities account the securities that belong to different clients of that participant (‘omnibus client segregation’)

4.   A CSD shall keep records and accounts that enable a participant to segregate the securities of any of the participant’s clients, if and as required by the participant (‘individual client segregation’).

5.   A participant shall offer its clients at least the choice between omnibus client segregation and individual client segregation and inform them of the costs and risks associated with each option.

However, a CSD and its participants shall provide individual clients segregation for citizens and residents of, and legal persons established in, a Member State where required under the national law of the Member State under which the securities are constituted as it stands at 17 September 2014. That obligation shall apply as long as the national law is not amended or repealed and its objectives are still valid.

6.   CSDs and their participants shall publicly disclose the levels of protection and the costs associated with the different levels of segregation that they provide and shall offer those services on reasonable commercial terms. Details of the different levels of segregation shall include a description of the main legal implications of the respective levels of segregation offered, including information on the insolvency law applicable in the relevant jurisdictions.

7.   A CSD shall not use for any purpose securities that do not belong to it. A CSD may however use securities of a participant where it has obtained that participant’s prior express consent. The CSD shall require its participants to obtain any necessary prior consent from their clients.

Article 39

Settlement finality

1.   A CSD shall ensure that the securities settlement system it operates offers adequate protection to participants. Member States shall designate and notify the securities settlement systems operated by CSDs according to the procedures referred to in point (a) of Article 2 of Directive 98/26/EC.

2.   A CSD shall ensure that each securities settlement system that it operates defines the moments of entry and of irrevocability of transfer orders in that securities settlement system in accordance with Articles 3 and 5 of Directive 98/26/EC.

3.   A CSD shall disclose the rules governing the finality of transfers of securities and cash in a securities settlement system.

4.   Paragraphs 2 and 3 shall apply without prejudice to the provisions applicable to CSD links, and without prejudice to paragraph 8 of Article 48.

5.   A CSD shall take all reasonable steps to ensure that, in accordance with the rules referred to in paragraph 3, finality of transfers of securities and cash referred to in paragraph 3 is achieved either in real time or intra-day and in any case no later than by the end of the business day of the actual settlement date.

6.   Where the CSD offers the services referred to in Article 40(2), it shall ensure that the cash proceeds of securities settlements shall be available for recipients to use no later than by the end of the business day of the intended settlement date.

7.   All securities transactions against cash between direct participants in a securities settlement system operated by a CSD and settled in that securities settlement system shall be settled on a DVP basis.

Article 40

Cash settlement

1.   For transactions denominated in the currency of the country where the settlement takes place, a CSD shall settle the cash payments of its securities settlement system through accounts opened with a central bank of issue of the relevant currency where practical and available.

2.   Where it is not practical and available to settle in central bank accounts as provided in paragraph 1, a CSD may offer to settle the cash payments for all or part of its securities settlement systems through accounts opened with a credit institution or through its own accounts. If a CSD offers to settle in accounts opened with a credit institution or through its own accounts, it shall do so in accordance with the provisions of Title IV.

3.   A CSD shall ensure that any information provided to market participants about the risks and costs associated with settlement in the accounts of credit institutions or through its own accounts is clear, fair and not misleading. A CSD shall make available sufficient information to clients or potential clients to allow them to identify and evaluate the risks and costs associated with settlement in the accounts of credit institutions or through its own accounts and shall provide such information on request.

Article 41

Participant default rules and procedures

1.   For each securities settlement system it operates, a CSD shall have effective and clearly defined rules and procedures to manage the default of one or more of its participants ensuring that the CSD can take timely action to contain losses and liquidity pressures and continue to meet its obligations.

2.   A CSD shall make its default rules and relevant procedures available to the public.

3.   A CSD shall undertake with its participants and other relevant stakeholders periodic testing and review of its default procedures to ensure that they are practical and effective.

4.   In order to ensure consistent application of this Article, ESMA may, in close cooperation with the members of the ESCB, issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010.

Section 4

Prudential requirements

Article 42

General requirements

A CSD shall adopt a sound risk-management framework for comprehensively managing legal, business, operational and other direct or indirect risks, including measures to mitigate fraud and negligence.

Article 43

Legal risks

1.   For the purpose of its authorisation and supervision, as well as for the information of its clients, a CSD shall have rules, procedures, and contracts that are clear and understandable for all the securities settlement systems that it operates and all other services that it provides.

2.   A CSD shall design its rules, procedures and contracts so that they are enforceable in all relevant jurisdictions, including in the case of the default of a participant.

3.   A CSD conducting business in different jurisdictions shall take all reasonable steps to identify and mitigate the risks arising from potential conflicts of law across jurisdictions.

Article 44

General business risk

A CSD shall have robust management and control systems as well as IT tools in order to identify, monitor and manage general business risks, including losses from poor execution of business strategy, cash flows and operating expenses.

Article 45

Operational risks

1.   A CSD shall identify sources of operational risk, both internal and external, and minimise their impact through the deployment of appropriate IT tools, controls and procedures, including for all the securities settlement systems it operates.

2.   A CSD shall maintain appropriate IT tools that ensure a high degree of security and operational reliability, and have adequate capacity. IT tools shall adequately deal with the complexity, variety and type of services and activities performed so as to ensure high standards of security, and the integrity and confidentiality of the information maintained.

3.   For services that it provides as well as for each securities settlement system that it operates, a CSD shall establish, implement and maintain an adequate business continuity policy and disaster recovery plan to ensure the preservation of its services, the timely recovery of operations and the fulfilment of the CSD’s obligations in the case of events that pose a significant risk of disrupting operations.

4.   The plan referred to in paragraph 3 shall provide for the recovery of all transactions and participants’ positions at the time of disruption to allow the participants of a CSD to continue to operate with certainty and to complete settlement on the scheduled date, including by ensuring that critical IT systems can promptly resume operations from the time of disruption. It shall include the setting-up of a second processing site with sufficient resources, capabilities and functionalities and appropriate staffing arrangements.

5.   The CSD shall plan and carry out a programme of tests of the arrangements referred to in paragraphs 1 to 4.

6.   A CSD shall identify, monitor and manage the risks that key participants in the securities settlement systems it operates, as well as service and utility providers, and other CSDs or other market infrastructures might pose to its operations. It shall, upon request, provide competent and relevant authorities with information on any such risk identified.

It shall also inform the competent authority and relevant authorities without delay of any operational incidents resulting from such risks.

7.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the operational risks referred to in paragraphs 1 and 6 and the methods to test, to address or to minimise those risks, including the business continuity policies and disaster recovery plans referred to in paragraphs 3 and 4 and the methods of assessment thereof.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

Article 46

Investment policy

1.   A CSD shall hold its financial assets at central banks, authorised credit institutions or authorised CSDs.

2.   A CSD shall have prompt access to its assets, where required.

3.   A CSD shall invest its financial resources only in cash or in highly liquid financial instruments with minimal market and credit risk. Those investments shall be capable of being liquidated rapidly with minimal adverse price effect.

4.   The amount of capital, including retained earnings and reserves of a CSD which are not invested in accordance with paragraph 3 shall not be taken into account for the purposes of Article 47(1).

5.   A CSD shall ensure that its overall risk exposure to any individual authorised credit institution or authorised CSD with which it holds its financial assets remains within acceptable concentration limits.

6.   ESMA shall, in close cooperation with EBA and the members of the ESCB, develop draft regulatory technical standards specifying the financial instruments that can be considered to be highly liquid with minimal market and credit risk as referred to in paragraph 3, the appropriate timeframe for access to assets referred to in paragraph 2 and the concentration limits as referred to in paragraph 5. Such draft regulatory technical standards shall, where appropriate, be aligned to the regulatory technical standards adopted in accordance with Article 47(8) of Regulation (EU) No 648/2012.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

Article 47

Capital requirements

1.   Capital, together with retained earnings and reserves of a CSD, shall be proportional to the risks stemming from the activities of the CSD. It shall be at all times sufficient to:

(a)	ensure that the CSD is adequately protected against operational, legal, custody, investment and business risks so that the CSD can continue to provide services as a going concern;

(b)	ensure an orderly winding-down or restructuring of the CSD’s activities over an appropriate time span of at least six months under a range of stress scenarios.

2.   A CSD shall maintain a plan for the following:

(a)	the raising of additional capital should its equity capital approach or fall below the requirements laid down in paragraph 1;

(b)	ensuring the orderly winding-down or restructuring of its operations and services where the CSD is unable to raise new capital.

The plan shall be approved by the management body or an appropriate committee of the management body and updated regularly. Each update of the plan shall be provided to the competent authority. The competent authority may require the CSD to take additional measures or to make any alternative provision where the competent authority considers that the CSD’s plan is insufficient.

3.   EBA shall, in close cooperation with ESMA and the members of the ESCB, develop draft regulatory technical standards specifying requirements regarding the capital, retained earnings and reserves of a CSD referred to in paragraph 1.

EBA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Section 5

Requirements for CSD links

Article 48

CSD links

1.   Before establishing a CSD link and on an ongoing basis once the CSD link is established, all CSDs concerned shall identify, assess, monitor and manage all potential sources of risk for themselves and for their participants arising from the CSD link and take appropriate measures to mitigate them.

2.   CSDs that intend to establish links shall submit an application for authorisation to the competent authority of the requesting CSD as required under point (e) of Article 19(1) or notify the competent and relevant authorities of the requesting CSD as required under Article 19(5).

3.   A link shall provide adequate protection to the linked CSDs and their participants, in particular as regards possible credits taken by CSDs and the concentration and liquidity risks as a result of the link arrangement.

A link shall be supported by an appropriate contractual arrangement that sets out the respective rights and obligations of the linked CSDs and, where necessary, of the CSDs’ participants. A contractual arrangement with cross-jurisdictional implications shall provide for an unambiguous choice of law that govern each aspect of the link’s operations.

4.   In the event of a provisional transfer of securities between linked CSDs, retransfer of securities prior to the first transfer becoming final shall be prohibited.

5.   A CSD that uses an indirect link or an intermediary to operate a CSD link with another CSD shall measure, monitor, and manage the additional risks arising from the use of that indirect link or intermediary and take appropriate measures to mitigate them.

6.   Linked CSDs shall have robust reconciliation procedures to ensure that their respective records are accurate.

7.   Links between CSDs shall permit DVP settlement of transactions between participants in linked CSDs, where practical and feasible. Detailed reasons for any CSD link not allowing for DVP settlement shall be notified to the relevant and competent authorities.

8.   Interoperable securities settlement systems and CSDs, which use a common settlement infrastructure shall establish identical moments of:

(a)	entry of transfer orders into the system;

(b)	irrevocability of transfer orders.

The securities settlement systems and CSDs referred to in the first subparagraph shall use equivalent rules concerning the moment of finality of transfers of securities and cash.

9.   By 18 September 2019 all interoperable links between CSDs operating in Member States shall be, where applicable, DVP-settlement supporting links.

10.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the conditions provided for in paragraph 3 under which each type of link arrangement provides for adequate protection of the linked CSDs and of their participants, in particular where a CSD intends to participate in the securities settlement system operated by another CSD, the monitoring and managing of additional risks referred to in paragraph 5 arising from the use of intermediaries, the reconciliation methods referred to in paragraph 6, the cases where DVP settlement through CSD links is practical and feasible as provided for in paragraph 7 and the methods of assessment thereof.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Powers is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

CHAPTER III

Access to CSDs

Section 1

Access of issuers to CSDs

Article 49

Freedom to issue in a CSD authorised in the Union

1.   An issuer shall have the right to arrange for its securities admitted to trading on regulated markets or MTFs or traded on trading venues to be recorded in any CSD established in any Member State, subject to compliance by that CSD with conditions referred to in Article 23.

Without prejudice to the issuer’s right referred to in the first subparagraph, the corporate or similar law of the Member State under which the securities are constituted shall continue to apply.

Member States shall ensure that a list of key relevant provisions of their law, as referred to in the second subparagraph, is compiled. Competent authorities shall communicate that list to ESMA by 18 December 2014. ESMA shall publish the list by 18 January 2015.

The CSD may charge a reasonable commercial fee for the provision of its services to issuers on a cost-plus basis, unless otherwise agreed by both parties.

2.   Where an issuer submits a request for recording its securities in a CSD, the latter shall treat such request promptly and in a non-discriminatory manner and provide a response to the requesting issuer within three months.

3.   A CSD may refuse to provide services to an issuer. Such a refusal shall be based only on a comprehensive risk assessment or if that CSD does not provide the services referred to in point (1) of Section A of the Annex in relation to securities constituted under the corporate or similar law of the relevant Member State.

4.   Without prejudice to Directive 2005/60/EC of the European Parliament and of the Council (25) and Commission Directive 2006/70/EC (26), where a CSD refuses to provide services to an issuer, it shall provide the requesting issuer with full written reasons for its refusal.

In the case of a refusal, the requesting issuer shall have the right to complain to the competent authority of the CSD that refuses to provide its services.

The competent authority of that CSD shall duly examine the complaint by assessing the reasons for refusal provided by the CSD and shall provide the issuer with a reasoned reply.

The competent authority of the CSD shall consult the competent authority of the place of establishment of the requesting issuer on its assessment of the complaint. Where the competent authority of the place of establishment of the requesting issuer disagrees with that assessment, any one of the two competent authorities may refer the matter to ESMA, which may act in accordance with the powers conferred on it under Article 19 of Regulation (EU) No 1095/2010.

Where the refusal by the CSD to provide its services to an issuer is deemed to be unjustified, the responsible competent authority shall issue an order requiring the CSD to provide its services to the requesting issuer.

5.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the risks to be taken into account by CSDs when carrying out a comprehensive risk assessment, and competent authorities assessing the reasons for refusal in accordance with paragraphs 3 and 4, and the elements of the procedure referred to in paragraph 4.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

6.   ESMA shall, in close cooperation with the members of the ESCB, develop draft implementing technical standards to establish standard forms and templates for the procedure referred to in paragraph 4.

ESMA shall submit those draft implementing technical standards to the Commission by 18 June 2015.

Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1095/2010.

Section 2

Access between CSDs

Article 50

Standard link access

A CSD shall have the right to become a participant of another CSD and set up a standard link with that CSD in accordance with Article 33 and subject to the prior notification of the CSD link provided under Article 19(5).

Article 51

Customised link access

1.   Where a CSD requests another CSD to establish a customised link for having access to the latter, the receiving CSD shall reject such a request only on the basis of risk considerations. It shall not deny a request on the grounds of loss of market share.

2.   The receiving CSD may charge a reasonable commercial fee on a cost-plus basis to the requesting CSD for making customised link access available, unless otherwise agreed by both parties.

Article 52

Procedure for CSD links

1.   When a CSD submits a request for access to another CSD pursuant to Articles 50 and 51, the latter shall treat such request promptly and shall provide a response to the requesting CSD within three months.

2.   A CSD shall deny access to a requesting CSD only where such access would threaten the smooth and orderly functioning of the financial markets or cause systemic risk. Such a refusal shall be based only on a comprehensive risk assessment.

Where a CSD refuses access, it shall provide the requesting CSD with full reasons for its refusal.

In the case of a refusal, the requesting CSD has the right to complain to the competent authority of the CSD that has refused access.

The competent authority of the receiving CSD shall duly examine the complaint by assessing the reasons for refusal and shall provide the requesting CSD with a reasoned reply.

The competent authority of the receiving CSD shall consult the competent authority of the requesting CSD and the relevant authority of the requesting CSD referred to in point (a) of Article 12(1) on its assessment of the complaint. Where any of the authorities of the requesting CSD disagrees with the assessment provided, any one of the authorities may refer the matter to ESMA, which may act in accordance with the powers conferred on it under Article 19 of Regulation (EU) No 1095/2010.

Where the refusal by the CSD to grant access to the requesting CSD is deemed to be unjustified, the competent authority of the receiving CSD shall issue an order requiring that CSD to grant access to the requesting CSD.

3.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the risks to be taken into account by CSDs when carrying out a comprehensive risk assessment, and by competent authorities when assessing the reasons for refusal in accordance with paragraph 2, and the elements of the procedure referred to in paragraph 2.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

4.   ESMA shall, in close cooperation with the members of the ESCB, develop draft implementing technical standards to establish standard forms and templates for the procedures referred to in paragraphs 1 and 2.

ESMA shall submit those draft implementing technical standards to the Commission by 18 June 2015.

Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1095/2010.

Section 3

Access between a CSD and another market infrastructure

Article 53

Access between a CSD and another market infrastructure

1.   A CCP and a trading venue shall provide transaction feeds on a non-discriminatory and transparent basis to a CSD upon request by the CSD and may charge a reasonable commercial fee for such transaction feeds to the requesting CSD on a cost-plus basis, unless otherwise agreed by both parties.

A CSD shall provide access to its securities settlement systems on a non-discriminatory and transparent basis to a CCP or a trading venue and may charge a reasonable commercial fee for such access on a cost-plus basis, unless otherwise agreed by both parties.

2.   When a party submits a request for access to another party in accordance with paragraph 1, such request shall be treated promptly and a response to the requesting party shall be provided within three months.

3.   The receiving party shall deny access only where such access would affect the smooth and orderly functioning of the financial markets or cause systemic risk. It shall not deny a request on the grounds of loss of market share.

A party that refuses access shall provide the requesting party with full written reasons for such refusal based on a comprehensive risk assessment. In the case of a refusal, the requesting party has the right to complain to the competent authority of the party that has refused access.

The competent authority of the receiving party and the relevant authority referred to in point (a) of Article 12(1) shall duly examine the complaint by assessing the reasons for refusal and shall provide the requesting party with a reasoned reply.

The competent authority of the receiving party shall consult the competent authority of the requesting party and the relevant authority referred to in point (a) of Article 12(1) on its assessment of the complaint. Where any of the authorities of the requesting party disagrees with the assessment provided, any of them may refer the matter to ESMA, which may act in accordance with the powers conferred on it under Article 19 of Regulation (EU) No 1095/2010.

Where the refusal by a party to grant access is deemed to be unjustified, the responsible competent authority shall issue an order requiring that party to grant access to its services within three months.

4.   ESMA shall, in close cooperation with the members of the ESCB, develop draft regulatory technical standards to specify the risks to be taken into account by CSDs when carrying out a comprehensive risk assessment, and by competent authorities when assessing the reasons for refusal in accordance with paragraph 3, and the elements of the procedure referred to in paragraph 3.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

5.   ESMA shall, in close cooperation with the members of the ESCB, develop draft implementing technical standards to establish standard forms and templates for the procedure referred to in paragraphs 2 and 3.

ESMA shall submit those draft implementing technical standards to the Commission by 18 June 2015.

Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1095/2010.

TITLE IV

PROVISION OF BANKING-TYPE ANCILLARY SERVICES FOR CSD PARTICIPANTS

Article 54

Authorisation and designation to provide banking-type ancillary services

1.   A CSD shall not itself provide any banking-type ancillary services set out in Section C of the Annex unless it has obtained an additional authorisation to provide such services in accordance with this Article.

2.   A CSD that intends to settle the cash leg of all or part of its securities settlement system in accordance with Article 40(2) or otherwise wishes to provide any banking-type ancillary services referred to in paragraph 1 shall be authorised either:

(a)	to offer such services itself under the conditions specified in this Article; or

(b)	to designate for that purpose one or more credit institutions authorised in accordance with Article 8 of Directive 2013/36/EU.

3.   Where a CSD seeks to provide any banking-type ancillary services from within the same legal entity as the legal entity operating the securities settlement system the authorisation referred to in paragraph 2 shall be granted only where the following conditions are met:

(a)	the CSD is authorised as a credit institution as provided for in Article 8 of Directive 2013/36/EU;

(b)	the CSD meets the prudential requirements laid down in Article 59(1), (3) and (4) and the supervisory requirements laid down in Article 60;

(c)	the authorisation referred to in point (a) of this subparagraph is used only to provide the banking-type ancillary services referred to in Section C of the Annex and not to carry out any other activities;

(d)	the CSD is subject to an additional capital surcharge that reflects the risks, including credit and liquidity risks, resulting from the provision of intra-day credit, inter alia, to the participants in a securities settlement system or other users of CSD services;

(e)	the CSD reports at least monthly to the competent authority and annually as a part of its public disclosure as required under Part Eight of Regulation (EU) No 575/2013 on the extent and management of intra-day liquidity risk in accordance with point (j) of Article 59(4) of this Regulation;

(f)	the CSD has submitted to the competent authority an adequate recovery plan to ensure continuity of its critical operations, including in situations where liquidity or credit risk crystallises as a result of the provision of banking-type ancillary services.

In the case of conflicting provisions laid down in this Regulation, in Regulation (EU) No 575/2013 and in Directive 2013/36/EU, the CSD referred to in point (a) of the first subparagraph shall comply with the stricter requirements on prudential supervision. The regulatory technical standards referred to in Articles 47 and 59 of this Regulation shall clarify the cases of conflicting provisions.

4.   Where a CSD seeks to designate a credit institution to provide any banking-type ancillary services from within a separate legal entity which may be part of the same group of undertakings ultimately controlled by the same parent undertaking or not, the authorisation referred to in paragraph 2 shall be granted only where the following conditions are met:

(a)	the separate legal entity is authorised as a credit institution as provided for in Article 8 of Directive 2013/36/EU;

(b)	the separate legal entity meets the prudential requirements laid down in Article 59(1), (3) and (4) and supervisory requirements laid down in Article 60;

(c)	the separate legal entity does not itself carry out any of the core services referred to in Section A of the Annex;

(d)	the authorisation referred to in point (a) is used only to provide the banking-type ancillary services referred to in Section C of the Annex and not to carry out any other activities;

(e)	the separate legal entity is subject to an additional capital surcharge that reflects the risks, including credit and liquidity risks, resulting from the provision of intra-day credit, inter alia, to the participants in a securities settlement system or other users of CSD services;

(f)

the separate legal entity reports at least monthly to the competent authority and annually as a part of its public disclosure as required under Part Eight of Regulation (EU) No 575/2013 on the extent and management of intra-day liquidity risk in accordance with point (j) of Article 59(4) of this Regulation; and

(g)

the separate legal entity has submitted to the competent authority an adequate recovery plan to ensure continuity of its critical operations, including in situations where liquidity or credit risk crystallises as a result of the provision of banking-type ancillary services from within a separate legal entity.

5.   Paragraph 4 shall not apply to credit institutions referred to in point (b) of paragraph 2 that offer to settle the cash payments for part of the CSD’s securities settlement system, if the total value of such cash settlement through accounts opened with those credit institutions, calculated over a one-year period, is less than one per cent of the total value of all securities transactions against cash settled in the books of the CSD and does not exceed a maximum of EUR 2,5 billion per year.

The competent authority shall monitor at least once per year that the threshold defined in the first subparagraph is respected and report its findings to ESMA. Where the competent authority determines that the threshold has been exceeded, it shall require the CSD concerned to seek authorisation in accordance with paragraph 4. The CSD concerned shall submit its application for authorisation within six months.

6.   The competent authority may require a CSD to designate more than one credit institution, or to designate a credit institution in addition to providing services itself in accordance with point (a) of paragraph 2 of this Article where it considers that the exposure of one credit institution to the concentration of risks under Article 59(3) and (4) is not sufficiently mitigated. The designated credit institutions shall be considered to be settlement agents.

7.   A CSD authorised to provide any banking-type ancillary services and a credit institution designated in accordance with point (b) of paragraph 2 shall comply at all times with the conditions necessary for authorisation under this Regulation and shall, without delay, notify the competent authorities of any substantive changes affecting the conditions for authorisation.

8.   EBA shall, in close cooperation with ESMA and the members of the ESCB, develop draft regulatory technical standards to determine the additional risk based capital surcharge referred to in point (d) of paragraph 3 and point (e) of paragraph 4.

EBA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

Article 55

Procedure for granting and refusing authorisation to provide banking-type ancillary services

1.   The CSD shall submit its application for authorisation to designate a credit institution or to provide any banking-type ancillary service, as required under Article 54, to the competent authority of its home Member State.

2.   The application shall contain all the information that is necessary to enable the competent authority to satisfy itself that the CSD and where applicable the designated credit institution have established, at the time of the authorisation, all the necessary arrangements to meet their obligations as laid down in this Regulation. It shall contain a programme of operations setting out the banking-type ancillary services envisaged, the structural organisation of the relations between the CSD and the designated credit institutions where applicable and how that CSD or where applicable the designated credit institution intends to meet the prudential requirements laid down in Article 59(1), (3) and (4) and the other conditions laid down in Article 54.

3.   The competent authority shall apply the procedure under Article 17(3) and (8).

4.   From the moment when the application is considered to be complete, the competent authority shall transmit all information included in the application to the following authorities:

(a)	the relevant authorities;

(b)	the competent authority referred to in point (40) of Article 4(1) of Regulation (EU) No 575/2013;

(c)	the competent authorities in the Member States where the CSD has established interoperable links with another CSD except where the CSD has established interoperable links referred to in Article 19(5);

(d)	the competent authorities in the host Member State where the activities of the CSD are of substantial importance for the functioning of the securities markets and the protection of investors within the meaning of Article 24(4);

(e)	the competent authorities responsible for the supervision of the participants of the CSD that are established in the three Member States with the largest settlement values in the CSD’s securities settlement system on an aggregate basis over a one-year period;

(f)

ESMA; and

(g)

EBA.

5.   The authorities referred to in points (a) to (e) of paragraph 4 shall issue a reasoned opinion on the authorisation within 30 days of receipt of the information referred to in paragraph 4. Where an authority does not provide an opinion within that deadline it shall be deemed to have a positive opinion.

Where at least one of the authorities referred to in points (a) to (e) of paragraph 4 issues a negative reasoned opinion, the competent authority wishing to grant the authorisation shall within 30 days provide the authorities referred to in points (a) to (e) of paragraph 4 with a reasoned decision addressing the negative opinion.

Where 30 days after that decision has been presented any of the authorities referred to in points (a) to (e) of paragraph 4 issues a negative opinion and the competent authority still wishes to grant the authorisation any of the authorities that issued a negative opinion may refer the matter to ESMA for assistance under point (c) of Article 31 of Regulation (EU) No 1095/2010.

Where 30 days after referral to ESMA the issue is not settled, the competent authority wishing to grant the authorisation shall take the final decision and provide a detailed explanation of its decision in writing to the authorities referred to in points (a) to (e) of paragraph 4.

Where the competent authority wishes to refuse authorisation, the matter shall not be referred to ESMA.

Negative opinions shall state in writing the full and detailed reasons why the requirements laid down in this Regulation or other parts of Union law are not met.

6.   Where ESMA considers that the competent authority referred to in paragraph 1 has granted an authorisation which may not be in conformity with Union law it shall act in accordance with Article 17 of Regulation (EU) No 1095/2010.

7.   ESMA shall, in close cooperation with the members of the ESCB and EBA, develop draft regulatory technical standards to specify the information that the CSD is to provide to the competent authority for the purpose of obtaining the relevant authorisations to provide the banking-type services ancillary to settlement.

ESMA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.

8.   ESMA shall, in close cooperation with the members of the ESCB and EBA, develop draft implementing technical standards to establish standard forms, templates and procedures for the consultation of the authorities referred to in paragraph 4 prior to granting authorisation.

ESMA shall submit those draft implementing technical standards to the Commission by 18 June 2015.

Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1095/2010.

Article 56

Extension of the banking-type ancillary services

1.   A CSD that intends to extend the banking-type ancillary services for which it designates a credit institution or that it provides itself in accordance with Article 54, shall submit a request for extension to the competent authority of its home Member State.

2.   The request for extension shall be subject to the procedure under Article 55.

Article 57

Withdrawal of authorisation

1.   Without prejudice to any remedial actions or measures under Title V, the competent authority of the CSD’s home Member State shall withdraw the authorisations referred to in Article 54 in any of the following circumstances:

(a)	where the CSD has not made use of the authorisation within 12 months, expressly renounces the authorisation or where the designated credit institution has provided no services or performed no activity for the preceding six months;

(b)	where the CSD has obtained the authorisation by making false statements or by any other unlawful means;

(c)	where the CSD or the designated credit institution is no longer in compliance with the conditions under which authorisation was granted and has not taken the remedial actions requested by the competent authority within a set time-frame;

(d)	where the CSD or the designated credit institution has seriously and systematically infringed the requirements laid down in this Regulation.

2.   From the moment when it becomes aware of one of the circumstances referred to in paragraph 1, the competent authority shall immediately consult the authorities referred to in Article 55(4) on the necessity of withdrawing the authorisation.

3.   ESMA, any relevant authority under point (a) of Article 12(1) and any authority referred to in Article 60(1) or, respectively, the authorities referred to in Article 55(4) may, at any time, request that the competent authority of the CSD’s home Member State examine whether the CSD and where applicable the designated credit institution is still in compliance with the conditions under which the authorisation is granted.

4.   The competent authority may limit the withdrawal to a particular service, activity, or financial instrument.

5.   A CSD and the designated credit institution shall establish, implement and maintain an adequate procedure ensuring the timely and orderly settlement and transfer of the assets of clients and participants to another settlement agent in the event of a withdrawal of authorisation referred to in paragraph 1.

Article 58

CSD register

1.   Decisions taken by competent authorities under Articles 54, 56 and 57 shall be notified to ESMA.

2.   ESMA shall introduce in the register, that it is required to make available on its dedicated website in accordance with Article 21(3), the following information:

(a)	the name of each CSD which was subject to a decision under Articles 54, 56 and 57;

(b)	the name of each designated credit institution;

(c)	the list of banking-type ancillary services that a designated credit institution or a CSD authorised under Article 54 is authorised to provide for the CSD’s participants.

3.   The competent authorities shall notify to ESMA those entities that provide banking-type ancillary services according to requirements of national law by 16 December 2014.

Article 59

Prudential requirements applicable to credit institutions or CSDs authorised to provide banking-type ancillary services

1.   A credit institution designated under point (b) of Article 54(2) or a CSD authorised under point (a) of Article 54(2) to provide banking-type ancillary services shall provide only the services set out in Section C of the Annex that are covered by the authorisation.

2.   A credit institution designated under point (b) of Article 54(2) or a CSD authorised under point (a) of Article 54(2) to provide banking-type ancillary services shall comply with any present or future legislation applicable to credit institutions.

3.   A credit institution designated under point (b) of Article 54(2) or a CSD authorised under point (a) of Article 54(2) to provide banking-type ancillary services shall comply with the following specific prudential requirements for the credit risks related to those services in respect of each securities settlement system:

(a)	it shall establish a robust framework to manage the corresponding credit risks;

(b)	it shall identify the sources of such credit risks, frequently and regularly, measure and monitor corresponding credit exposures and use appropriate risk-management tools to control those risks;

(c)	it shall fully cover corresponding credit exposures to individual borrowing participants using collateral and other equivalent financial resources;

(d)	if collateral is used to manage its corresponding credit risk, it shall accept highly liquid collateral with minimal credit and market risk; it may use other types of collateral in specific situations if an appropriate haircut is applied;

(e)

it shall establish and apply appropriately conservative haircuts and concentration limits on collateral values constituted to cover the credit exposures referred to in point (c), taking into account the objective of ensuring that collateral can be liquidated promptly without significant adverse price effects;

(f)	it shall set limits on its corresponding credit exposures;

(g)	it shall analyse and plan for how to address any potential residual credit exposures, and adopt rules and procedures to implement such plans;

(h)	it shall provide credit only to participants that have cash accounts with it;

(i)	it shall provide for effective reimbursement procedures of intra-day credit and discourage overnight credit through the application of sanctioning rates which act as an effective deterrent.

4.   A credit institution designated under point (b) of Article 54(2) or a CSD authorised under point (a) of Article 54(2) to provide banking-type ancillary services shall comply with the following specific prudential requirements for the liquidity risks relating to those services in respect of each securities settlement system:

(a)	it shall have a robust framework and tools to measure, monitor, and manage its liquidity risks, including intra-day liquidity risks, for each currency of the security settlement system for which it acts as settlement agent;

(b)	it shall measure and monitor on an ongoing and timely basis, and at least daily, its liquidity needs and the level of liquid assets it holds; in doing so, it shall determine the value of its available liquid assets taking into account appropriate haircuts on those assets;

(c)

it shall have sufficient liquid resources in all relevant currencies for a timely provision of settlement services under a wide range of potential stress scenarios including, but not limited to the liquidity risk generated by the default of at least one participant, including its parent undertakings and subsidiaries, to which it has the largest exposures;

(d)

it shall mitigate the corresponding liquidity risks with qualifying liquid resources in each currency such as cash at the central bank of issue and at other creditworthy financial institutions, committed lines of credit or similar arrangements and highly liquid collateral or investments that are readily available and convertible into cash with prearranged and highly reliable funding arrangements, even in extreme but plausible market conditions and it shall identify, measure and monitor its liquidity risk stemming from the various financial institutions used for the management of its liquidity risks;

(e)	where prearranged funding arrangements are used, it shall select only creditworthy financial institutions as liquidity providers; it shall establish and apply appropriate concentration limits for each of the corresponding liquidity providers including its parent undertaking and subsidiaries;

(f)	it shall determine and test the sufficiency of the corresponding resources by regular and rigorous stress testing;

(g)	it shall analyse and plan for how to address any unforeseen and potentially uncovered liquidity shortfalls, and adopt rules and procedures to implement such plans;

(h)

where practical and available, without prejudice to the eligibility rules of the central bank, it shall have access to central bank accounts and other central bank services to enhance its management of liquidity risks and Union credit institutions shall deposit the corresponding cash balances on dedicated accounts with Union central banks of issue;

(i)	it shall have prearranged and highly reliable arrangements to ensure that it can liquidate in a timely fashion the collateral provided to it by a defaulting client;

(j)	it shall report regularly to the authorities referred to in Article 60(1), and disclose to the public, as to how it measures, monitors and manages its liquidity risks, including intra-day liquidity risks.

5.   EBA shall, in close cooperation with ESMA and the members of the ESCB, develop draft regulatory technical standards to further specify details of the frameworks and tools for the monitoring, the measuring, the management, the reporting and the public disclosure of the credit and liquidity risks, including those which occur intra-day, referred to in paragraphs 3 and 4. Such draft regulatory technical standards shall, where appropriate, be aligned to the regulatory technical standards adopted in accordance with Article 46(3) of Regulation (EU) No 648/2012.

EBA shall submit those draft regulatory technical standards to the Commission by 18 June 2015.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Article 60

Supervision of designated credit institutions and CSDs authorised to provide banking-type ancillary services

1.   Without prejudice to Articles 17 and 22 of this Regulation, the competent authorities referred to in point (40) of Article 4(1) of Regulation (EU) No 575/2013 are responsible for the authorisation as credit institutions and supervision as credit institutions under the conditions provided in Regulation (EU) No 575/2013 and in Directive 2013/36/EU of the designated credit institutions and CSDs authorised under this Regulation to provide banking-type ancillary services.

The competent authorities referred to in the first subparagraph shall also be responsible for the supervision of designated credit institutions and CSDs referred to in that subparagraph as regards their compliance with the prudential requirements referred to in Article 59 of this Regulation.

The competent authorities referred to in the first subparagraph shall regularly, and at least once a year, assess whether the designated credit institution or CSD authorised to provide banking-type ancillary services complies with Article 59 and shall inform the competent authority of the CSD which shall then inform the authorities referred to in Article 55(4), of the results, including any remedial actions or penalties, of its supervision under this paragraph.

2.   The competent authority of the CSD shall, after consulting competent authorities referred to paragraph 1, review and evaluate at least on an annual basis the following:

(a)	in the case referred to in point (b) of Article 54(2), whether all the necessary arrangements between the designated credit institutions and the CSD allow them to meet their obligations as laid down in this Regulation;

(b)	in the case referred to in point (a) of Article 54(2), whether the arrangements relating to the authorisation to provide banking-type ancillary services allow the CSD to meet its obligations as laid down in this Regulation.

The competent authority of the CSD shall regularly, and at least once a year, inform the authorities referred to in Article 55(4) of the results, including any remedial actions or penalties, of its review and evaluation under this paragraph.

Where a CSD designates an authorised credit institution in accordance with Article 54, in view of the protection of the participants in the securities settlement systems it operates, a CSD shall ensure that it has access from the credit institution it designates to all necessary information for the purpose of this Regulation and it shall report any infringements thereof to the competent authority of the CSD and to competent authorities referred to in paragraph 1.

3.   In order to ensure consistent, efficient and effective supervision within the Union of credit institutions and CSDs authorised to provide banking-type ancillary services, EBA may, in close cooperation with ESMA and the members of the ESCB, issue guidelines addressed to competent authorities in accordance with Article 16 of Regulation (EU) No 1093/2010.

TITLE V

SANCTIONS

Article 61

Administrative sanctions and other measures

1.   Without prejudice to the right of Member States to provide for and impose criminal sanctions, Member States shall lay down rules on and ensure that their competent authorities may impose the administrative sanctions and other measures applicable in the circumstances defined in Article 63 to the persons responsible for infringements of the provisions of this Regulation and shall take all measures necessary to ensure that they are implemented. Such sanctions and other measures shall be effective, proportionate and dissuasive.

Member States may decide not to lay down rules for administrative sanctions as referred to in the first subparagraph where the infringements referred to in that subparagraph are already subject to criminal sanctions in their national law by 18 September 2016. Where they so decide, Member States shall notify, in detail, to the Commission and to ESMA, the relevant parts of their criminal law.

By 18 September 2016, the Member States shall notify the rules referred to in the first subparagraph to the Commission and ESMA. Member States shall notify the Commission and ESMA without undue delay of any subsequent amendments thereto.

2.   The competent authorities shall be able to apply administrative sanctions and other measures, to CSDs, designated credit institutions, and, subject to the conditions laid down in national law in areas not harmonised by this Regulation, the members of their management bodies and any other persons who effectively control their business as well as to any other legal or natural person who under national law is held responsible for an infringement.

3.   In the exercise of their sanctioning powers in the circumstances defined in Article 63 competent authorities shall cooperate closely to ensure that the administrative sanctions and other measures produce the results pursued by this Regulation and coordinate their actions in order to avoid any duplication or overlap when applying administrative sanctions and other measures to cross border cases in accordance with Article 14.

4.   Where Member States have chosen, in accordance with paragraph 1 to lay down criminal sanctions for the infringements of the provisions referred to in Article 63, they shall ensure that appropriate measures are in place so that competent authorities have all the necessary powers to liaise with judicial authorities within their jurisdiction to receive specific information related to criminal investigations or proceedings commenced for possible infringements of this Regulation and provide the same to other competent authorities and ESMA to fulfil their obligation to cooperate with each other and ESMA for the purposes of this Regulation.

5.   Competent authorities may also cooperate with competent authorities of other Member States with respect to facilitating the recovery of pecuniary sanctions.

6.   Member States shall provide ESMA annually with aggregated information regarding all sanctions and other measures imposed in accordance with paragraph 1. ESMA shall publish that information in an annual report.

Where Member States have chosen, in accordance with paragraph 1, to lay down criminal sanctions for the infringements of the provisions referred to in Article 63 their competent authorities shall provide ESMA annually with anonymised and aggregated data regarding all criminal investigations undertaken and criminal penalties imposed. ESMA shall publish data on criminal sanctions imposed in an annual report.

7.   Where the competent authority has disclosed an administrative sanction or an administrative measure or a criminal sanction to the public, it shall, at the same time, report that fact to ESMA.

8.   Competent authorities shall exercise their functions and powers in accordance with their national frameworks:

(a)

directly;

(b)	in collaboration with other authorities;

(c)	under their responsibility by delegation to entities to which tasks have been delegated according to this Regulation; or

(d)	by application to the competent judicial authorities.

Article 62

Publication of decisions

1.   Member States shall ensure that the competent authorities publish on their official websites any decision imposing an administrative sanction or other measure for an infringement of this Regulation without undue delay after the person sanctioned is informed of that decision. The publication shall include at least information on the type and nature of the infringement and the identity of a natural or legal person on whom the sanction has been imposed.

Where the decision to impose a sanction or other measure is subject to an appeal before the relevant judicial or other relevant authorities, competent authorities shall, without undue delay, also publish on their official websites information on the appeal status and outcome thereof. Moreover, any decision annulling a previous decision to impose a sanction or a measure shall also be published.

Where the publication of the identity of the legal persons or of the personal data of the natural persons is considered by the competent authority to be disproportionate following a case-by-case assessment conducted on the proportionality of the publication of such data, or where publication jeopardises the stability of financial markets or an ongoing investigation, Member States shall ensure that competent authorities do one of the following:

(a)	delay the publication of the decision to impose the sanction or other measure until the moment when the reasons for non-publication cease to exist;

(b)	publish the decision to impose the sanction or other measure on an anonymous basis in a manner which is in conformity with national law, if such anonymous publication ensures effective protection of the personal data;

(c)

not publish the decision to impose a sanction or other measure at all in the event that the options set out in points (a) and (b) above are considered to be insufficient to ensure: (i) that the stability of financial markets would not be put in jeopardy; (ii) the proportionality of the publication of such decisions with regard to measures which are deemed to be of a minor nature.

In the case of a decision to publish a sanction or other measure on an anonymous basis, the publication of the relevant data may be postponed for a reasonable period if it is envisaged that within that period the reasons for anonymous publication will cease to exist.

Competent authorities shall inform ESMA of all administrative sanctions imposed but not published in accordance with point (c) of the third subparagraph including any appeal in relation thereto and the outcome thereof. Member States shall ensure that competent authorities receive information and the final judgement in relation to any criminal sanction imposed and submit it to ESMA. ESMA shall maintain a central database of sanctions communicated to it solely for the purposes of exchanging information between competent authorities. That database shall be accessible only to competent authorities and it shall be updated on the basis of the information provided by the competent authorities.

2.   Competent authorities shall ensure that any publication, in accordance with this Article, shall remain on their official website for a period of at least five years after its publication. Personal data contained in the publication shall be kept on the official website of the competent authority only for the period necessary under the applicable data protection rules.

Article 63

Sanctions for infringements

1.   This Article shall apply to the following provisions of this Regulation:

(a)	provision of services set out in Sections A, B and C of the Annex in infringement of Articles 16, 25 and 54;

(b)	obtaining the authorisations required under Articles 16 and 54 by making false statements or by any other unlawful means as provided for in point (b) of Article 20(1) and point (b) of Article 57(1);

(c)	failure of CSDs to hold the required capital, thus infringing Article 47(1);

(d)	failure of CSDs to comply with the organisational requirements, thus infringing Articles 26 to 30;

(e)	failure of CSDs to comply with the conduct of business rules, thus infringing Articles 32 to 35;

(f)	failure of CSDs to comply with the requirements for CSD services, thus infringing Articles 37 to 41;

(g)	failure of CSDs to comply with the prudential requirements, thus infringing Articles 43 to 47;

(h)	failure of CSDs to comply with the requirements for CSD links, thus infringing Article 48;

(i)	abusive refusals by CSDs to grant different types of access, thus infringing Articles 49 to 53;

(j)	failure of designated credit institutions to comply with the specific prudential requirements related to credit risks, thus infringing Article 59(3);

(k)	failure of designated credit institutions to comply with specific prudential requirements related to liquidity risks, thus infringing Article 59(4).

2.   Without prejudice to the supervisory powers of competent authorities, at least in the event of an infringement referred to in this Article, the competent authorities shall, in conformity with national law, have the power to impose at least the following administrative sanctions and other measures:

(a)	a public statement which indicates the person responsible for the infringement and the nature of the infringement in accordance with Article 62;

(b)	an order requiring the person responsible for the infringement to cease the conduct and to desist from a repetition of that conduct;

(c)	withdrawal of the authorisations granted under Article 16 or 54, in accordance with Article 20 or 57;

(d)	a temporary or, for repeated serious infringements, a permanent ban against any member of the institution’s management body or any other natural person, who is held responsible, from exercising management functions in the institution;

(e)	maximum administrative pecuniary sanctions of at least twice the amounts of the profit gained as a result of an infringement where those amounts can be determined;

(f)	in respect of a natural person, maximum administrative pecuniary sanctions of at least EUR 5 million or in the Member States whose currency is not the euro, the corresponding value in the national currency on the date of adoption of this Regulation;

(g)

in the case of a legal person, maximum administrative pecuniary sanctions of at least EUR 20 million or up to 10 % of the total annual turnover of the legal person according to the last available accounts approved by the management body; where the legal person is a parent undertaking or a subsidiary of the parent undertaking which has to prepare consolidated financial accounts according to Directive 2013/34/EU, the relevant total annual turnover shall be the total annual turnover or the corresponding type of income according to the relevant Accounting Directives according to the last available consolidated accounts approved by the management body of the ultimate parent undertaking.

3.   Competent authorities may have other sanctioning powers in addition to those referred in paragraph 2 and may provide for higher levels of administrative pecuniary sanctions than those established in that paragraph.

Article 64

Effective application of sanctions

Member States shall ensure that, when determining the type and level of administrative sanctions or other measures, the competent authorities take into account all relevant circumstances, including, where appropriate:

(a)	the gravity and the duration of the infringement;

(b)	the degree of responsibility of the person responsible for the infringement;

(c)	the financial strength of the person responsible for the infringement, for example as indicated by the total turnover of the responsible legal person or the annual income of the responsible natural person;

(d)	the importance of the profits gained, losses avoided by the person responsible for the infringement or the losses for third parties derived from the infringement, insofar as they can be determined;

(e)	the level of cooperation of the person responsible for the infringement with the competent authority, without prejudice to the need to ensure disgorgement of profits gained or losses avoided by that person;

(f)	previous infringements by the person responsible for the infringement.

Article 65

Reporting of infringements

1.   Member States shall ensure that competent authorities establish effective mechanisms to encourage reporting of potential or actual infringements of this Regulation to competent authorities.

2.   The mechanisms referred to in paragraph 1 shall include at least:

(a)	specific procedures for the receipt and investigation of reports on potential or actual infringements and their follow-up, including the establishment of secure communication channels for such reports;

(b)	appropriate protection for employees of institutions who report potential or actual infringements committed within the institution against retaliation, discrimination or other types of unfair treatment at a minimum;

(c)	protection of personal data concerning both the person who reports the potential or actual infringements and the natural person who is allegedly responsible for an infringement in compliance with the principles laid down in Directive 95/46/EC;

(d)

protection of the identity of both the person who reports the infringements and the natural person who is allegedly responsible for an infringement, at all stages of the procedures unless such disclosure is required by national law in the context of further investigation or subsequent administrative or judicial proceedings.

3.   Member States shall require institutions to have in place appropriate procedures for their employees to report actual or potential infringements internally through a specific, independent and autonomous channel.

Such a channel may also be provided through arrangements provided for by social partners. The same protection as is referred to in points (b), (c) and (d) of paragraph 2 shall apply.

Article 66

Right of appeal

Member States shall ensure that decisions and measures taken in pursuance of this Regulation are properly reasoned and subject to a right of appeal before a tribunal. The right of appeal before a tribunal shall apply where no decision is taken, within six months of its submission, in respect of an application for authorisation which contains all the information required under the provisions in force.

TITLE VI

DELEGATION OF POWER, IMPLEMENTING POWERS, TRANSITIONAL, AMENDING AND FINAL PROVISIONS

Article 67

Exercise of the delegation

1.   The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

2.   The power to adopt delegated acts referred to in Article 2(2), Article 7(14) and Article 24(7) shall be conferred on the Commission for an indeterminate period of time from 17 September 2014.

3.   The delegation of power referred to in Article 2(2), Article 7(14) and Article 24(7) may be revoked at any time by the European Parliament or by the Council. A decision of revocation shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

4.   As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

5.   A delegated act adopted pursuant to Article 2(2), Article 7(14) and Article 24(7) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of three months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by three months at the initiative of the European Parliament or of the Council.

Article 68

Committee procedure

1.   The Commission shall be assisted by the European Securities Committee established by Commission Decision 2001/528/EC (27). That Committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

2.   Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.

Article 69

Transitional provisions

1.   The competent authorities shall communicate to ESMA those institutions that operate as CSDs by 16 December 2014.

2.   CSDs shall apply for all authorisations that are necessary for the purposes of this Regulation and shall notify the relevant CSD links within six months from the date of entry into force of all the regulatory technical standards adopted under Articles 17, 26, 45, 47, 48, and, where relevant, Articles 55 and 59.

3.   Within six months from the later of the date of entry into force of the regulatory technical standards adopted under Articles 12, 17, 25, 26, 45, 47, 48, and, where relevant, Articles 55 and 59 or the implementing decision referred to in Article 25(9), a third-country CSD shall apply for recognition from ESMA where it intends to provide its services on the basis of Article 25.

4.   Until the decision is made under this Regulation on the authorisation or recognition of CSDs and of their activities, including CSD links, the respective national rules on authorisation and recognition of CSDs shall continue to apply.

5.   CSDs operated by the entities referred to in Article 1(4) shall comply with the requirements of this Regulation at the latest within one year from the date of entry into force of the regulatory technical standards referred to in paragraph 2.

Article 70

Amendments to Directive 98/26/EC

Directive 98/26/EC is amended as follows:

(1)

the third indent of the first subparagraph of point (a) of Article 2 is replaced by the following: ‘— designated, without prejudice to other more stringent conditions of general application laid down by national law, as a system and notified to the European Securities and Markets Authority by the Member State whose law is applicable, after that Member State is satisfied as to the adequacy of the rules of the system.’;

(2)	in Article 11, the following paragraph is added: ‘3.   By 18 March 2015, Member States shall adopt and publish and communicate to the Commission measures necessary to comply with the third indent of the first subparagraph of point (a) of Article 2.’.

Article 71

Amendments to Directive 2014/65/EU

Directive 2014/65/EU is amended as follows:

(1)

in Article 2(1), point (o) is replaced by the following: ‘(o) CSDs except as provided for in Article 73 of Regulation (EU) No 909/2014 of the European Parliament and of the Council (28). (28)  Regulation (EU) No 909/2014 of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives 98/26/EC and 2014/65/EU and Regulation (EU) No 236/2012 (OJ L 257, 28.8.2014, p. 1).’;"

(2)	in Article 4(1), the following point is added: ‘(64) ‘central securities depository’ or ‘CSD’ means a central securities depository as defined in point (1) of Article 2(1) of Regulation (EU) No 909/2014.’;

(3)

in Section B of Annex I, point (1) is replaced by the following: ‘(1) Safekeeping and administration of financial instruments for the account of clients, including custodianship and related services such as cash/collateral management and excluding providing and maintaining securities accounts at the top tier level (‘central maintenance service’) referred to in point (2) of Section A of the Annex to the Regulation (EU) No 909/2014.’.

Article 72

Amendment to Regulation (EU) No 236/2012

Article 15 of Regulation (EU) No 236/2012 is deleted.

Article 73

Application of Directive 2014/65/EU and Regulation (EU) No 600/2014

CSDs authorised in accordance with Article 16 of this Regulation shall not require authorisation under Directive 2014/65/EU in order to provide the services explicitly listed in Sections A and B of the Annex to this Regulation.

Where a CSD authorised in accordance with Article 16 of this Regulation provides one or more investment services or carries out one or more investment activities in addition to providing the services explicitly listed in Sections A and B of the Annex to this Regulation, Directive 2014/65/EU with the exception of Articles 5 to 8, Article 9(1) to (2) and (4) to (6) and Articles 10 to 13, and Regulation (EU) No 600/2014 shall apply.

Article 74

Reports

1.   ESMA shall, in cooperation with EBA and the competent authorities and the relevant authorities, submit annual reports to the Commission providing assessments of trends, potential risks and vulnerabilities, and, where necessary, recommendations of preventative or remedial action in the markets for services covered by this Regulation. Those reports shall include at least an assessment of the following:

(a)	settlement efficiency for domestic and cross-border operations for each Member State based on the number and volume of settlement fails, amount of penalties referred to in Article 7(2), number and volumes of buy-in transactions referred to in Article 7(3) and (4) and any other relevant criteria;

(b)	the appropriateness of penalties for settlement fails, in particular the need for additional flexibility in relation to penalties for settlement fails in relation to illiquid financial instruments referred to in Article 7(4);

(c)	measuring settlement which does not take place in the securities settlement systems operated by CSDs based on the number and volume of transactions based on the information received under Article 9 and any other relevant criteria;

(d)

the cross-border provision of services covered by this Regulation based on the number and types of CSD links, number of foreign participants in the securities settlement systems operated by CSDs, number and volume of transactions involving such participants, number of foreign issuers recording their securities in a CSD in accordance with Article 49 and any other relevant criteria;

(e)

the handling of access requests in Articles 49, 52 and 53 to identify the reasons for rejection of access requests by CSDs, CCPs and trading venues any trends in such rejections and ways in which the risks identified could be mitigated in future so as to allow for access to be granted, and any other substantive barriers to competition in post-trade financial services;

(f)	the handling of applications submitted in accordance with the procedures referred to in Article 23(3) to (7) and Article 25(4) to (10);

(g)	where applicable, the findings of the peer review process for cross-border supervision in Article 24(6) and whether the frequency of such reviews could be reduced in the future, including an indication of whether such findings indicate the need for more formal colleges of supervisors;

(h)	the application of civil liability rules of Member States relating to the losses attributable to CSDs;

(i)

the procedures and conditions under which CSDs have been authorised to designate credit institutions or themselves to provide banking-type ancillary services in accordance with Articles 54 and 55, including an assessment of the effects that such provision may have on financial stability and competition for settlement and banking-types ancillary services in the Union;

(j)	the application of the rules referred to in Article 38 on protection of securities of participants and those of their clients, in particular those in Article 38(5);

(k)	the application of the sanctions and in particular the need to further harmonise the administrative sanctions for the infringement of the requirements laid down in this Regulation.

2.   The reports referred to in paragraph 1 covering a calendar year shall be communicated to the Commission by 30 April of the following calendar year.

Article 75

Review

By 18 September 2019, the Commission shall review and prepare a general report on this Regulation. That report shall, in particular, assess the matters referred to in points (a) to (k) of Article 74(1), whether there are other substantive barriers to competition in relation to the services subject to this Regulation which are insufficiently addressed and the potential need for further measures to limit the impact on taxpayers of the failure of CSDs. The Commission shall submit the report to the European Parliament and to the Council, together with any appropriate proposals.

Article 76

Entry into force and application

1.   This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

2.   Article 3(1) shall apply from 1 January 2023 to transferable securities issued after that date and from 1 January 2025 to all transferable securities.

3.   Article 5(2) shall apply from 1 January 2015.

By way of derogation from the first subparagraph of this paragraph, in the case of a trading venue that has access to a CSD referred to in Article 30(5), Article 5(2) shall apply at least six months before such a CSD outsources its activities to the relevant public entity, and in any event from 1 January 2016.

4.   The settlement discipline measures referred to in Article 6(1) to (4) shall apply from the date of entry into force of the delegated act adopted by the Commission pursuant to Article 6(5).

5.   The settlement discipline measures referred to in Article 7(1) to (13) and the amendment laid down in Article 72 shall apply from the date of entry into force of the delegated act adopted by the Commission pursuant to Article 7(15).

An MTF that complies with the criteria laid down in Article 33(3) of Directive 2014/65/EU shall be subject to the second subparagraph of Article 7(3) of this Regulation:

(a)	until the final determination of its application for registration under Article 33 of Directive 2014/65/EU; or

(b)	where an MTF has not applied for registration under Article 33 of Directive 2014/65/EU, until 13 June 2017.

6.   The reporting measures referred to in Article 9(1) shall apply from the date of entry into force of the implementing act adopted by the Commission pursuant to Article 9(3).

7.   References in this Regulation to Directive 2014/65/EU and Regulation (EU) No 600/2014 shall, before 3 January 2017, be read as references to Directive 2004/39/EC in accordance with the correlation table set out in Annex IV to Directive 2014/65/EU in so far as that correlation table contains provisions referring to Directive 2004/39/EC.

---

(1)  OJ C 310, 13.10.2012, p. 12.

(2)  OJ C 299, 4.10.2012, p. 76.

(3)  Position of the European Parliament of 15 April 2014 (not yet published in the Official Journal) and decision of the Council of 23 July 2014.

(4)  Directive 98/26/EC of the European Parliament and of the Council of 19 May 1998 on settlement finality in payment and securities settlement systems (OJ L 166, 11.6.1998, p. 45).

(5)  Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84).

(6)  Directive 2003/87/EC of the European Parliament and of the Council of 13 October 2003 establishing a scheme for greenhouse gas emission allowance trading within the Community and amending Council Directive 96/61/EC (OJ L 275, 25.10.2003, p. 32).

(7)  Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).

(8)  Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Regulation (EU) No 648/2012 (OJ L 173, 12.6.2014, p. 84).

(9)  Directive 2002/47/EC of the European Parliament and of the Council of 6 June 2002 on financial collateral arrangements (OJ L 168, 27.6.2002, p. 43).

(10)  Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories (OJ L 201, 27.7.2012, p. 1).

(11)  Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190).

(12)  Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC (OJ L 182, 29.6.2013, p. 19).

(13)  [2004] ECR I-4829.

(14)  Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).

(15)  Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1).

(16)  Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).

(17)  Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63).

(18)  Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

(19)  Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

(20)  Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

(21)  Directive 2010/78/EU of the European Parliament and of the Council of 24 November 2010 amending Directives 98/26/EC, 2002/87/EC, 2003/6/EC, 2003/41/EC, 2003/71/EC, 2004/39/EC, 2004/109/EC, 2005/60/EC, 2006/48/EC, 2006/49/EC and 2009/65/EC in respect of the powers of the European Supervisory Authority (European Banking Authority), the European Supervisory Authority (European Insurance and Occupational Pensions Authority) and the European Supervisory Authority (European Securities and Markets Authority) (OJ L 331, 15.12.2010, p. 120).

(22)  Regulation (EU) No 236/2012 of the European Parliament and of the Council of 14 March 2012 on short selling and certain aspects of credit default swaps (OJ L 86, 24.3.2012, p. 1).

(23)  Directive 2003/71/EC of the European Parliament and of the Council of 4 November 2003 on the prospectus to be published when securities are offered to the public or admitted to trading and amending Directive 2001/34/EC (OJ L 345, 31.12.2003, p. 64).

(24)  Regulation (EU) No 1092/2010 of the European Parliament and of the Council of 24 November 2010 on European Union macro-prudential oversight of the financial system and establishing a European Systemic Risk Board (OJ L 331, 15.12.2010, p. 1).

(25)  Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing (OJ L 309, 25.11.2005, p. 15).

(26)  Commission Directive 2006/70/EC of 1 August 2006 laying down implementing measures for Directive 2005/60/EC of the European Parliament and of the Council as regards the definition of politically exposed person and the technical criteria for simplified customer due diligence procedures and for exemption on grounds of a financial activity conducted on an occasional or very limited basis (OJ L 214, 4.8.2006, p. 29).

(27)  Commission Decision 2001/528/EC of 6 June 2001 establishing the European Securities Committee (OJ L 191, 13.7.2001, p. 45).

---

---

28.8.2014

EN

Official Journal of the European Union

L 257/73

---

REGULATION (EU) No 910/2014 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 23 July 2014

on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Economic and Social Committee (1),

Acting in accordance with the ordinary legislative procedure (2),

Whereas:

(1)	Building trust in the online environment is key to economic and social development. Lack of trust, in particular because of a perceived lack of legal certainty, makes consumers, businesses and public authorities hesitate to carry out transactions electronically and to adopt new services.

(2)

This Regulation seeks to enhance trust in electronic transactions in the internal market by providing a common foundation for secure electronic interaction between citizens, businesses and public authorities, thereby increasing the effectiveness of public and private online services, electronic business and electronic commerce in the Union.

(3)

Directive 1999/93/EC of the European Parliament and of the Council (3), dealt with electronic signatures without delivering a comprehensive cross-border and cross-sector framework for secure, trustworthy and easy-to-use electronic transactions. This Regulation enhances and expands the acquis of that Directive.

(4)

The Commission communication of 26 August 2010 entitled ‘A Digital Agenda for Europe’ identified the fragmentation of the digital market, the lack of interoperability and the rise in cybercrime as major obstacles to the virtuous cycle of the digital economy. In its EU Citizenship Report 2010, entitled ‘Dismantling the obstacles to EU citizens’ rights’, the Commission further highlighted the need to solve the main problems that prevent Union citizens from enjoying the benefits of a digital single market and cross-border digital services.

(5)

In its conclusions of 4 February 2011 and of 23 October 2011, the European Council invited the Commission to create a digital single market by 2015, to make rapid progress in key areas of the digital economy and to promote a fully integrated digital single market by facilitating the cross-border use of online services, with particular attention to facilitating secure electronic identification and authentication.

(6)

In its conclusions of 27 May 2011, the Council invited the Commission to contribute to the digital single market by creating appropriate conditions for the mutual recognition of key enablers across borders, such as electronic identification, electronic documents, electronic signatures and electronic delivery services, and for interoperable e-government services across the European Union.

(7)

The European Parliament, in its resolution of 21 September 2010 on completing the internal market for e-commerce (4), stressed the importance of the security of electronic services, especially of electronic signatures, and of the need to create a public key infrastructure at pan-European level, and called on the Commission to set up a European validation authorities gateway to ensure the cross-border interoperability of electronic signatures and to increase the security of transactions carried out using the internet.

(8)

Directive 2006/123/EC of the European Parliament and of the Council (5) requires Member States to establish ‘points of single contact’ (PSCs) to ensure that all procedures and formalities relating to access to a service activity and to the exercise thereof can be easily completed, at a distance and by electronic means, through the appropriate PSC with the appropriate authorities. Many online services accessible through PSCs require electronic identification, authentication and signature.

(9)

In most cases, citizens cannot use their electronic identification to authenticate themselves in another Member State because the national electronic identification schemes in their country are not recognised in other Member States. That electronic barrier excludes service providers from enjoying the full benefits of the internal market. Mutually recognised electronic identification means will facilitate cross-border provision of numerous services in the internal market and enable businesses to operate on a cross-border basis without facing many obstacles in interactions with public authorities.

(10)

Directive 2011/24/EU of the European Parliament and of the Council (6) set up a network of national authorities responsible for e-health. To enhance the safety and the continuity of cross-border healthcare, the network is required to produce guidelines on cross-border access to electronic health data and services, including by supporting ‘common identification and authentication measures to facilitate transferability of data in cross-border healthcare’. Mutual recognition of electronic identification and authentication is key to making cross-border healthcare for European citizens a reality. When people travel for treatment, their medical data need to be accessible in the country of treatment. That requires a solid, safe and trusted electronic identification framework.

(11)

This Regulation should be applied in full compliance with the principles relating to the protection of personal data provided for in Directive 95/46/EC of the European Parliament and of the Council (7). In this respect, having regard to the principle of mutual recognition established by this Regulation, authentication for an online service should concern processing of only those identification data that are adequate, relevant and not excessive to grant access to that service online. Furthermore, requirements under Directive 95/46/EC concerning confidentiality and security of processing should be respected by trust service providers and supervisory bodies.

(12)

One of the objectives of this Regulation is to remove existing barriers to the cross-border use of electronic identification means used in the Member States to authenticate, for at least public services. This Regulation does not aim to intervene with regard to electronic identity management systems and related infrastructures established in Member States. The aim of this Regulation is to ensure that for access to cross-border online services offered by Member States, secure electronic identification and authentication is possible.

(13)

Member States should remain free to use or to introduce means for the purposes of electronic identification for accessing online services. They should also be able to decide whether to involve the private sector in the provision of those means. Member States should not be obliged to notify their electronic identification schemes to the Commission. The choice to notify the Commission of all, some or none of the electronic identification schemes used at national level to access at least public online services or specific services is up to Member States.

(14)

Some conditions need to be set out in this Regulation with regard to which electronic identification means have to be recognised and how the electronic identification schemes should be notified. Those conditions should help Member States to build the necessary trust in each other’s electronic identification schemes and to mutually recognise electronic identification means falling under their notified schemes. The principle of mutual recognition should apply if the notifying Member State’s electronic identification scheme meets the conditions of notification and the notification was published in the Official Journal of the European Union. However, the principle of mutual recognition should only relate to authentication for an online service. The access to those online services and their final delivery to the applicant should be closely linked to the right to receive such services under the conditions set out in national legislation.

(15)

The obligation to recognise electronic identification means should relate only to those means the identity assurance level of which corresponds to the level equal to or higher than the level required for the online service in question. In addition, that obligation should only apply when the public sector body in question uses the assurance level ‘substantial’ or ‘high’ in relation to accessing that service online. Member States should remain free, in accordance with Union law, to recognise electronic identification means having lower identity assurance levels.

(16)

Assurance levels should characterise the degree of confidence in electronic identification means in establishing the identity of a person, thus providing assurance that the person claiming a particular identity is in fact the person to which that identity was assigned. The assurance level depends on the degree of confidence that electronic identification means provides in claimed or asserted identity of a person taking into account processes (for example, identity proofing and verification, and authentication), management activities (for example, the entity issuing electronic identification means and the procedure to issue such means) and technical controls implemented. Various technical definitions and descriptions of assurance levels exist as the result of Union-funded Large-Scale Pilots, standardisation and international activities. In particular, the Large-Scale Pilot STORK and ISO 29115 refer, inter alia, to levels 2, 3 and 4, which should be taken into utmost account in establishing minimum technical requirements, standards and procedures for the assurances levels low, substantial and high within the meaning of this Regulation, while ensuring consistent application of this Regulation in particular with regard to assurance level high related to identity proofing for issuing qualified certificates. The requirements established should be technology-neutral. It should be possible to achieve the necessary security requirements through different technologies.

(17)

Member States should encourage the private sector to voluntarily use electronic identification means under a notified scheme for identification purposes when needed for online services or electronic transactions. The possibility to use such electronic identification means would enable the private sector to rely on electronic identification and authentication already largely used in many Member States at least for public services and to make it easier for businesses and citizens to access their online services across borders. In order to facilitate the use of such electronic identification means across borders by the private sector, the authentication possibility provided by any Member State should be available to private sector relying parties established outside of the territory of that Member State under the same conditions as applied to private sector relying parties established within that Member State. Consequently, with regard to private sector relying parties, the notifying Member State may define terms of access to the authentication means. Such terms of access may inform whether the authentication means related to the notified scheme is presently available to private sector relying parties.

(18)

This Regulation should provide for the liability of the notifying Member State, the party issuing the electronic identification means and the party operating the authentication procedure for failure to comply with the relevant obligations under this Regulation. However, this Regulation should be applied in accordance with national rules on liability. Therefore, it does not affect those national rules on, for example, definition of damages or relevant applicable procedural rules, including the burden of proof.

(19)

The security of electronic identification schemes is key to trustworthy cross-border mutual recognition of electronic identification means. In this context, Member States should cooperate with regard to the security and interoperability of the electronic identification schemes at Union level. Whenever electronic identification schemes require specific hardware or software to be used by relying parties at the national level, cross-border interoperability calls for those Member States not to impose such requirements and related costs on relying parties established outside of their territory. In that case appropriate solutions should be discussed and developed within the scope of the interoperability framework. Nevertheless technical requirements stemming from the inherent specifications of national electronic identification means and likely to affect the holders of such electronic means (e.g. smartcards), are unavoidable.

(20)

Cooperation by Member States should facilitate the technical interoperability of the notified electronic identification schemes with a view to fostering a high level of trust and security appropriate to the degree of risk. The exchange of information and the sharing of best practices between Member States with a view to their mutual recognition should help such cooperation.

(21)

This Regulation should also establish a general legal framework for the use of trust services. However, it should not create a general obligation to use them or to install an access point for all existing trust services. In particular, it should not cover the provision of services used exclusively within closed systems between a defined set of participants, which have no effect on third parties. For example, systems set up in businesses or public administrations to manage internal procedures making use of trust services should not be subject to the requirements of this Regulation. Only trust services provided to the public having effects on third parties should meet the requirements laid down in the Regulation. Neither should this Regulation cover aspects related to the conclusion and validity of contracts or other legal obligations where there are requirements as regards form laid down by national or Union law. In addition, it should not affect national form requirements pertaining to public registers, in particular commercial and land registers.

(22)	In order to contribute to their general cross-border use, it should be possible to use trust services as evidence in legal proceedings in all Member States. It is for the national law to define the legal effect of trust services, except if otherwise provided in this Regulation.

(23)

To the extent that this Regulation creates an obligation to recognise a trust service, such a trust service may only be rejected if the addressee of the obligation is unable to read or verify it due to technical reasons lying outside the immediate control of the addressee. However, that obligation should not in itself require a public body to obtain the hardware and software necessary for the technical readability of all existing trust services.

(24)	Member States may maintain or introduce national provisions, in conformity with Union law, relating to trust services as far as those services are not fully harmonised by this Regulation. However, trust services that comply with this Regulation should circulate freely in the internal market.

(25)	Member States should remain free to define other types of trust services in addition to those making part of the closed list of trust services provided for in this Regulation, for the purpose of recognition at national level as qualified trust services.

(26)	Because of the pace of technological change, this Regulation should adopt an approach which is open to innovation.

(27)	This Regulation should be technology-neutral. The legal effects it grants should be achievable by any technical means provided that the requirements of this Regulation are met.

(28)

To enhance in particular the trust of small and medium-sized enterprises (SMEs) and consumers in the internal market and to promote the use of trust services and products, the notions of qualified trust services and qualified trust service provider should be introduced with a view to indicating requirements and obligations that ensure high-level security of whatever qualified trust services and products are used or provided.

(29)

In line with the obligations under the United Nations Convention on the Rights of Persons with Disabilities, approved by Council Decision 2010/48/EC (8), in particular Article 9 of the Convention, persons with disabilities should be able to use trust services and end-user products used in the provision of those services on an equal basis with other consumers. Therefore, where feasible, trust services provided and end-user products used in the provision of those services should be made accessible for persons with disabilities. The feasibility assessment should include, inter alia, technical and economic considerations.

(30)

Member States should designate a supervisory body or supervisory bodies to carry out the supervisory activities under this Regulation. Member States should also be able to decide, upon a mutual agreement with another Member State, to designate a supervisory body in the territory of that other Member State.

(31)

Supervisory bodies should cooperate with data protection authorities, for example, by informing them about the results of audits of qualified trust service providers, where personal data protection rules appear to have been breached. The provision of information should in particular cover security incidents and personal data breaches.

(32)	It should be incumbent on all trust service providers to apply good security practice appropriate to the risks related to their activities so as to boost users’ trust in the single market.

(33)	Provisions on the use of pseudonyms in certificates should not prevent Member States from requiring identification of persons pursuant to Union or national law.

(34)

All Member States should follow common essential supervision requirements to ensure a comparable security level of qualified trust services. To ease the consistent application of those requirements across the Union, Member States should adopt comparable procedures and should exchange information on their supervision activities and best practices in the field.

(35)

All trust service providers should be subject to the requirements of this Regulation, in particular those on security and liability to ensure due diligence, transparency and accountability of their operations and services. However, taking into account the type of services provided by trust service providers, it is appropriate to distinguish as far as those requirements are concerned between qualified and non-qualified trust service providers.

(36)

Establishing a supervisory regime for all trust service providers should ensure a level playing field for the security and accountability of their operations and services, thus contributing to the protection of users and to the functioning of the internal market. Non-qualified trust service providers should be subject to a light touch and reactive ex post supervisory activities justified by the nature of their services and operations. The supervisory body should therefore have no general obligation to supervise non-qualified service providers. The supervisory body should only take action when it is informed (for example, by the non-qualified trust service provider itself, by another supervisory body, by a notification from a user or a business partner or on the basis of its own investigation) that a non-qualified trust service provider does not comply with the requirements of this Regulation.

(37)

This Regulation should provide for the liability of all trust service providers. In particular, it establishes the liability regime under which all trust service providers should be liable for damage caused to any natural or legal person due to failure to comply with the obligations under this Regulation. In order to facilitate the assessment of financial risk that trust service providers might have to bear or that they should cover by insurance policies, this Regulation allows trust service providers to set limitations, under certain conditions, on the use of the services they provide and not to be liable for damages arising from the use of services exceeding such limitations. Customers should be duly informed about the limitations in advance. Those limitations should be recognisable by a third party, for example by including information about the limitations in the terms and conditions of the service provided or through other recognisable means. For the purposes of giving effect to those principles, this Regulation should be applied in accordance with national rules on liability. Therefore, this Regulation does not affect those national rules on, for example, definition of damages, intention, negligence, or relevant applicable procedural rules.

(38)	Notification of security breaches and security risk assessments is essential with a view to providing adequate information to concerned parties in the event of a breach of security or loss of integrity.

(39)

To enable the Commission and the Member States to assess the effectiveness of the breach notification mechanism introduced by this Regulation, supervisory bodies should be requested to provide summary information to the Commission and to European Union Agency for Network and Information Security (ENISA).

(40)

To enable the Commission and the Member States to assess the effectiveness of the enhanced supervision mechanism introduced by this Regulation, supervisory bodies should be requested to report on their activities. This would be instrumental in facilitating the exchange of good practice between supervisory bodies and would ensure the verification of the consistent and efficient implementation of the essential supervision requirements in all Member States.

(41)

To ensure sustainability and durability of qualified trust services and to boost users’ confidence in the continuity of qualified trust services, supervisory bodies should verify the existence and the correct application of provisions on termination plans in cases where qualified trust service providers cease their activities.

(42)

To facilitate the supervision of qualified trust service providers, for example, when a provider is providing its services in the territory of another Member State and is not subject to supervision there, or when the computers of a provider are located in the territory of a Member State other than the one where it is established, a mutual assistance system between supervisory bodies in the Member States should be established.

(43)

In order to ensure the compliance of qualified trust service providers and the services they provide with the requirements set out in this Regulation, a conformity assessment should be carried out by a conformity assessment body and the resulting conformity assessment reports should be submitted by the qualified trust service providers to the supervisory body. Whenever the supervisory body requires a qualified trust service provider to submit an ad hoc conformity assessment report, the supervisory body should respect, in particular, the principles of good administration, including the obligation to give reasons for its decisions, as well as the principle of proportionality. Therefore, the supervisory body should duly justify its decision to require an ad hoc conformity assessment.

(44)

This Regulation aims to ensure a coherent framework with a view to providing a high level of security and legal certainty of trust services. In this regard, when addressing the conformity assessment of products and services, the Commission should, where appropriate, seek synergies with existing relevant European and international schemes such as the Regulation (EC) No 765/2008 of the European Parliament and of the Council (9) which sets out the requirements for accreditation of conformity assessment bodies and market surveillance of products.

(45)

In order to allow an efficient initiation process, which should lead to the inclusion of qualified trust service providers and the qualified trust services they provide into trusted lists, preliminary interactions between prospective qualified trust service providers and the competent supervisory body should be encouraged with a view to facilitating the due diligence leading to the provisioning of qualified trust services.

(46)	Trusted lists are essential elements in the building of trust among market operators as they indicate the qualified status of the service provider at the time of supervision.

(47)

Confidence in and convenience of online services are essential for users to fully benefit and consciously rely on electronic services. To this end, an EU trust mark should be created to identify the qualified trust services provided by qualified trust service providers. Such an EU trust mark for qualified trust services would clearly differentiate qualified trust services from other trust services thus contributing to transparency in the market. The use of an EU trust mark by qualified trust service providers should be voluntary and should not lead to any requirement other than those provided for in this Regulation.

(48)	While a high level of security is needed to ensure mutual recognition of electronic signatures, in specific cases, such as in the context of Commission Decision 2009/767/EC (10), electronic signatures with a lower security assurance should also be accepted.

(49)

This Regulation should establish the principle that an electronic signature should not be denied legal effect on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic signature. However, it is for national law to define the legal effect of electronic signatures, except for the requirements provided for in this Regulation according to which a qualified electronic signature should have the equivalent legal effect of a handwritten signature.

(50)

As competent authorities in the Member States currently use different formats of advanced electronic signatures to sign their documents electronically, it is necessary to ensure that at least a number of advanced electronic signature formats can be technically supported by Member States when they receive documents signed electronically. Similarly, when competent authorities in the Member States use advanced electronic seals, it would be necessary to ensure that they support at least a number of advanced electronic seal formats.

(51)

It should be possible for the signatory to entrust qualified electronic signature creation devices to the care of a third party, provided that appropriate mechanisms and procedures are implemented to ensure that the signatory has sole control over the use of his electronic signature creation data, and the qualified electronic signature requirements are met by the use of the device.

(52)

The creation of remote electronic signatures, where the electronic signature creation environment is managed by a trust service provider on behalf of the signatory, is set to increase in the light of its multiple economic benefits. However, in order to ensure that such electronic signatures receive the same legal recognition as electronic signatures created in an entirely user-managed environment, remote electronic signature service providers should apply specific management and administrative security procedures and use trustworthy systems and products, including secure electronic communication channels, in order to guarantee that the electronic signature creation environment is reliable and is used under the sole control of the signatory. Where a qualified electronic signature has been created using a remote electronic signature creation device, the requirements applicable to qualified trust service providers set out in this Regulation should apply.

(53)

The suspension of qualified certificates is an established operational practice of trust service providers in a number of Member States, which is different from revocation and entails the temporary loss of validity of a certificate. Legal certainty calls for the suspension status of a certificate to always be clearly indicated. To that end, trust service providers should have the responsibility to clearly indicate the status of the certificate and, if suspended, the precise period of time during which the certificate has been suspended. This Regulation should not impose the use of suspension on trust service providers or Member States, but should provide for transparency rules when and where such a practice is available.

(54)

Cross-border interoperability and recognition of qualified certificates is a precondition for cross-border recognition of qualified electronic signatures. Therefore, qualified certificates should not be subject to any mandatory requirements exceeding the requirements laid down in this Regulation. However, at national level, the inclusion of specific attributes, such as unique identifiers, in qualified certificates should be allowed, provided that such specific attributes do not hamper cross-border interoperability and recognition of qualified certificates and electronic signatures.

(55)

IT security certification based on international standards such as ISO 15408 and related evaluation methods and mutual recognition arrangements is an important tool for verifying the security of qualified electronic signature creation devices and should be promoted. However, innovative solutions and services such as mobile signing and cloud signing rely on technical and organisational solutions for qualified electronic signature creation devices for which security standards may not yet be available or for which the first IT security certification is ongoing. The level of security of such qualified electronic signature creation devices could be evaluated by using alternative processes only where such security standards are not available or where the first IT security certification is ongoing. Those processes should be comparable to the standards for IT security certification insofar as their security levels are equivalent. Those processes could be facilitated by a peer review.

(56)

This Regulation should lay down requirements for qualified electronic signature creation devices to ensure the functionality of advanced electronic signatures. This Regulation should not cover the entire system environment in which such devices operate. Therefore, the scope of the certification of qualified signature creation devices should be limited to the hardware and system software used to manage and protect the signature creation data created, stored or processed in the signature creation device. As detailed in relevant standards, the scope of the certification obligation should exclude signature creation applications.

(57)

To ensure legal certainty as regards the validity of the signature, it is essential to specify the components of a qualified electronic signature, which should be assessed by the relying party carrying out the validation. Moreover, specifying the requirements for qualified trust service providers that can provide a qualified validation service to relying parties unwilling or unable to carry out the validation of qualified electronic signatures themselves, should stimulate the private and public sector to invest in such services. Both elements should make qualified electronic signature validation easy and convenient for all parties at Union level.

(58)	When a transaction requires a qualified electronic seal from a legal person, a qualified electronic signature from the authorised representative of the legal person should be equally acceptable.

(59)	Electronic seals should serve as evidence that an electronic document was issued by a legal person, ensuring certainty of the document’s origin and integrity.

(60)

Trust service providers issuing qualified certificates for electronic seals should implement the necessary measures in order to be able to establish the identity of the natural person representing the legal person to whom the qualified certificate for the electronic seal is provided, when such identification is necessary at national level in the context of judicial or administrative proceedings.

(61)	This Regulation should ensure the long-term preservation of information, in order to ensure the legal validity of electronic signatures and electronic seals over extended periods of time and guarantee that they can be validated irrespective of future technological changes.

(62)

In order to ensure the security of qualified electronic time stamps, this Regulation should require the use of an advanced electronic seal or an advanced electronic signature or of other equivalent methods. It is foreseeable that innovation may lead to new technologies that may ensure an equivalent level of security for time stamps. Whenever a method other than an advanced electronic seal or an advanced electronic signature is used, it should be up to the qualified trust service provider to demonstrate, in the conformity assessment report, that such a method ensures an equivalent level of security and complies with the obligations set out in this Regulation.

(63)

Electronic documents are important for further development of cross-border electronic transactions in the internal market. This Regulation should establish the principle that an electronic document should not be denied legal effect on the grounds that it is in an electronic form in order to ensure that an electronic transaction will not be rejected only on the grounds that a document is in electronic form.

(64)	When addressing formats of advanced electronic signatures and seals, the Commission should build on existing practices, standards and legislation, in particular Commission Decision 2011/130/EU (11).

(65)	In addition to authenticating the document issued by the legal person, electronic seals can be used to authenticate any digital asset of the legal person, such as software code or servers.

(66)

It is essential to provide for a legal framework to facilitate cross-border recognition between existing national legal systems related to electronic registered delivery services. That framework could also open new market opportunities for Union trust service providers to offer new pan-European electronic registered delivery services.

(67)

Website authentication services provide a means by which a visitor to a website can be assured that there is a genuine and legitimate entity standing behind the website. Those services contribute to the building of trust and confidence in conducting business online, as users will have confidence in a website that has been authenticated. The provision and the use of website authentication services are entirely voluntary. However, in order for website authentication to become a means to boosting trust, providing a better experience for the user and furthering growth in the internal market, this Regulation should lay down minimal security and liability obligations for the providers and their services. To that end, the results of existing industry-led initiatives, for example the Certification Authorities/Browsers Forum — CA/B Forum, have been taken into account. In addition, this Regulation should not impede the use of other means or methods to authenticate a website not falling under this Regulation nor should it prevent third country providers of website authentication services from providing their services to customers in the Union. However, a third country provider should only have its website authentication services recognised as qualified in accordance with this Regulation, if an international agreement between the Union and the country of establishment of the provider has been concluded.

(68)

The concept of ‘legal persons’, according to the provisions of the Treaty on the Functioning of the European Union (TFEU) on establishment, leaves operators free to choose the legal form which they deem suitable for carrying out their activity. Accordingly, ‘legal persons’, within the meaning of the TFEU, means all entities constituted under, or governed by, the law of a Member State, irrespective of their legal form.

(69)

The Union institutions, bodies, offices and agencies are encouraged to recognise electronic identification and trust services covered by this Regulation for the purpose of administrative cooperation capitalising, in particular, on existing good practices and the results of ongoing projects in the areas covered by this Regulation.

(70)

In order to complement certain detailed technical aspects of this Regulation in a flexible and rapid manner, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission in respect of criteria to be met by the bodies responsible for the certification of qualified electronic signature creation devices. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level. The Commission, when preparing and drawing up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and to the Council.

(71)

In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission, in particular for specifying reference numbers of standards the use of which would raise a presumption of compliance with certain requirements laid down in this Regulation. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council (12).

(72)

When adopting delegated or implementing acts, the Commission should take due account of the standards and technical specifications drawn up by European and international standardisation organisations and bodies, in particular the European Committee for Standardisation (CEN), the European Telecommunications Standards Institute (ETSI), the International Organisation for Standardisation (ISO) and the International Telecommunication Union (ITU), with a view to ensuring a high level of security and interoperability of electronic identification and trust services.

(73)	For reasons of legal certainty and clarity, Directive 1999/93/EC should be repealed.

(74)

To ensure legal certainty for market operators already using qualified certificates issued to natural persons in compliance with Directive 1999/93/EC, it is necessary to provide for a sufficient period of time for transitional purposes. Similarly, transitional measures should be established for secure signature creation devices, the conformity of which has been determined in accordance with Directive 1999/93/EC, as well as for certification service providers issuing qualified certificates before 1 July 2016. Finally, it is also necessary to provide the Commission with the means to adopt the implementing acts and delegated acts before that date.

(75)	The application dates set out in this Regulation do not affect existing obligations that Member States already have under Union law, in particular under Directive 2006/123/EC.

(76)

Since the objectives of this Regulation cannot be sufficiently achieved by the Member States but can rather, by reason of the scale of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives.

(77)	The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 of the European Parliament and of the Council (13) and delivered an opinion on 27 September 2012 (14),

HAVE ADOPTED THIS REGULATION:

CHAPTER I

GENERAL PROVISIONS

Article 1

Subject matter

With a view to ensuring the proper functioning of the internal market while aiming at an adequate level of security of electronic identification means and trust services this Regulation:

(a)	lays down the conditions under which Member States recognise electronic identification means of natural and legal persons falling under a notified electronic identification scheme of another Member State;

(b)	lays down rules for trust services, in particular for electronic transactions; and

(c)	establishes a legal framework for electronic signatures, electronic seals, electronic time stamps, electronic documents, electronic registered delivery services and certificate services for website authentication.

Article 2

Scope

1.   This Regulation applies to electronic identification schemes that have been notified by a Member State, and to trust service providers that are established in the Union.

2.   This Regulation does not apply to the provision of trust services that are used exclusively within closed systems resulting from national law or from agreements between a defined set of participants.

3.   This Regulation does not affect national or Union law related to the conclusion and validity of contracts or other legal or procedural obligations relating to form.

Article 3

Definitions

For the purposes of this Regulation, the following definitions apply:

(1)	‘electronic identification’ means the process of using person identification data in electronic form uniquely representing either a natural or legal person, or a natural person representing a legal person;

(2)	‘electronic identification means’ means a material and/or immaterial unit containing person identification data and which is used for authentication for an online service;

(3)	‘person identification data’ means a set of data enabling the identity of a natural or legal person, or a natural person representing a legal person to be established;

(4)	‘electronic identification scheme’ means a system for electronic identification under which electronic identification means are issued to natural or legal persons, or natural persons representing legal persons;

(5)	‘authentication’ means an electronic process that enables the electronic identification of a natural or legal person, or the origin and integrity of data in electronic form to be confirmed;

(6)	‘relying party’ means a natural or legal person that relies upon an electronic identification or a trust service;

(7)

‘public sector body’ means a state, regional or local authority, a body governed by public law or an association formed by one or several such authorities or one or several such bodies governed by public law, or a private entity mandated by at least one of those authorities, bodies or associations to provide public services, when acting under such a mandate;

(8)	‘body governed by public law’ means a body defined in point (4) of Article 2(1) of Directive 2014/24/EU of the European Parliament and of the Council (15);

(9)	‘signatory’ means a natural person who creates an electronic signature;

(10)	‘electronic signature’ means data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign;

(11)	‘advanced electronic signature’ means an electronic signature which meets the requirements set out in Article 26;

(12)	‘qualified electronic signature’ means an advanced electronic signature that is created by a qualified electronic signature creation device, and which is based on a qualified certificate for electronic signatures;

(13)	‘electronic signature creation data’ means unique data which is used by the signatory to create an electronic signature;

(14)	‘certificate for electronic signature’ means an electronic attestation which links electronic signature validation data to a natural person and confirms at least the name or the pseudonym of that person;

(15)	‘qualified certificate for electronic signature’ means a certificate for electronic signatures, that is issued by a qualified trust service provider and meets the requirements laid down in Annex I;

(16)

‘trust service’ means an electronic service normally provided for remuneration which consists of: (a) the creation, verification, and validation of electronic signatures, electronic seals or electronic time stamps, electronic registered delivery services and certificates related to those services, or (b) the creation, verification and validation of certificates for website authentication; or (c) the preservation of electronic signatures, seals or certificates related to those services;

(17)	‘qualified trust service’ means a trust service that meets the applicable requirements laid down in this Regulation;

(18)	‘conformity assessment body’ means a body defined in point 13 of Article 2 of Regulation (EC) No 765/2008, which is accredited in accordance with that Regulation as competent to carry out conformity assessment of a qualified trust service provider and the qualified trust services it provides;

(19)	‘trust service provider’ means a natural or a legal person who provides one or more trust services either as a qualified or as a non-qualified trust service provider;

(20)	‘qualified trust service provider’ means a trust service provider who provides one or more qualified trust services and is granted the qualified status by the supervisory body;

(21)	‘product’ means hardware or software, or relevant components of hardware or software, which are intended to be used for the provision of trust services;

(22)	‘electronic signature creation device’ means configured software or hardware used to create an electronic signature;

(23)	‘qualified electronic signature creation device’ means an electronic signature creation device that meets the requirements laid down in Annex II;

(24)	‘creator of a seal’ means a legal person who creates an electronic seal;

(25)	‘electronic seal’ means data in electronic form, which is attached to or logically associated with other data in electronic form to ensure the latter’s origin and integrity;

(26)	‘advanced electronic seal’ means an electronic seal, which meets the requirements set out in Article 36;

(27)	‘qualified electronic seal’ means an advanced electronic seal, which is created by a qualified electronic seal creation device, and that is based on a qualified certificate for electronic seal;

(28)	‘electronic seal creation data’ means unique data, which is used by the creator of the electronic seal to create an electronic seal;

(29)	‘certificate for electronic seal’ means an electronic attestation that links electronic seal validation data to a legal person and confirms the name of that person;

(30)	‘qualified certificate for electronic seal’ means a certificate for an electronic seal, that is issued by a qualified trust service provider and meets the requirements laid down in Annex III;

(31)	‘electronic seal creation device’ means configured software or hardware used to create an electronic seal;

(32)	‘qualified electronic seal creation device’ means an electronic seal creation device that meets mutatis mutandis the requirements laid down in Annex II;

(33)	‘electronic time stamp’ means data in electronic form which binds other data in electronic form to a particular time establishing evidence that the latter data existed at that time;

(34)	‘qualified electronic time stamp’ means an electronic time stamp which meets the requirements laid down in Article 42;

(35)	‘electronic document’ means any content stored in electronic form, in particular text or sound, visual or audiovisual recording;

(36)

‘electronic registered delivery service’ means a service that makes it possible to transmit data between third parties by electronic means and provides evidence relating to the handling of the transmitted data, including proof of sending and receiving the data, and that protects transmitted data against the risk of loss, theft, damage or any unauthorised alterations;

(37)	‘qualified electronic registered delivery service’ means an electronic registered delivery service which meets the requirements laid down in Article 44;

(38)	‘certificate for website authentication’ means an attestation that makes it possible to authenticate a website and links the website to the natural or legal person to whom the certificate is issued;

(39)	‘qualified certificate for website authentication’ means a certificate for website authentication, which is issued by a qualified trust service provider and meets the requirements laid down in Annex IV;

(40)	‘validation data’ means data that is used to validate an electronic signature or an electronic seal;

(41)	‘validation’ means the process of verifying and confirming that an electronic signature or a seal is valid.

Article 4

Internal market principle

1.   There shall be no restriction on the provision of trust services in the territory of a Member State by a trust service provider established in another Member State for reasons that fall within the fields covered by this Regulation.

2.   Products and trust services that comply with this Regulation shall be permitted to circulate freely in the internal market.

Article 5

Data processing and protection

1.   Processing of personal data shall be carried out in accordance with Directive 95/46/EC.

2.   Without prejudice to the legal effect given to pseudonyms under national law, the use of pseudonyms in electronic transactions shall not be prohibited.

CHAPTER II

ELECTRONIC IDENTIFICATION

Article 6

Mutual recognition

1.   When an electronic identification using an electronic identification means and authentication is required under national law or by administrative practice to access a service provided by a public sector body online in one Member State, the electronic identification means issued in another Member State shall be recognised in the first Member State for the purposes of cross-border authentication for that service online, provided that the following conditions are met:

(a)	the electronic identification means is issued under an electronic identification scheme that is included in the list published by the Commission pursuant to Article 9;

(b)

the assurance level of the electronic identification means corresponds to an assurance level equal to or higher than the assurance level required by the relevant public sector body to access that service online in the first Member State, provided that the assurance level of that electronic identification means corresponds to the assurance level substantial or high;

(c)	the relevant public sector body uses the assurance level substantial or high in relation to accessing that service online.

Such recognition shall take place no later than 12 months after the Commission publishes the list referred to in point (a) of the first subparagraph.

2.   An electronic identification means which is issued under an electronic identification scheme included in the list published by the Commission pursuant to Article 9 and which corresponds to the assurance level low may be recognised by public sector bodies for the purposes of cross-border authentication for the service provided online by those bodies.

Article 7

Eligibility for notification of electronic identification schemes

An electronic identification scheme shall be eligible for notification pursuant to Article 9(1) provided that all of the following conditions are met:

(a)	the electronic identification means under the electronic identification scheme are issued: (i) by the notifying Member State; (ii) under a mandate from the notifying Member State; or (iii) independently of the notifying Member State and are recognised by that Member State;

(b)	the electronic identification means under the electronic identification scheme can be used to access at least one service which is provided by a public sector body and which requires electronic identification in the notifying Member State;

(c)	the electronic identification scheme and the electronic identification means issued thereunder meet the requirements of at least one of the assurance levels set out in the implementing act referred to in Article 8(3);

(d)

the notifying Member State ensures that the person identification data uniquely representing the person in question is attributed, in accordance with the technical specifications, standards and procedures for the relevant assurance level set out in the implementing act referred to in Article 8(3), to the natural or legal person referred to in point 1 of Article 3 at the time the electronic identification means under that scheme is issued;

(e)

the party issuing the electronic identification means under that scheme ensures that the electronic identification means is attributed to the person referred to in point (d) of this Article in accordance with the technical specifications, standards and procedures for the relevant assurance level set out in the implementing act referred to in Article 8(3);

(f)

the notifying Member State ensures the availability of authentication online, so that any relying party established in the territory of another Member State is able to confirm the person identification data received in electronic form. For relying parties other than public sector bodies the notifying Member State may define terms of access to that authentication. The cross-border authentication shall be provided free of charge when it is carried out in relation to a service online provided by a public sector body. Member States shall not impose any specific disproportionate technical requirements on relying parties intending to carry out such authentication, where such requirements prevent or significantly impede the interoperability of the notified electronic identification schemes;

(g)

at least six months prior to the notification pursuant to Article 9(1), the notifying Member State provides the other Member States for the purposes of the obligation under Article 12(5) a description of that scheme in accordance with the procedural arrangements established by the implementing acts referred to in Article 12(7);

(h)	the electronic identification scheme meets the requirements set out in the implementing act referred to in Article 12(8).

Article 8

Assurance levels of electronic identification schemes

1.   An electronic identification scheme notified pursuant to Article 9(1) shall specify assurance levels low, substantial and/or high for electronic identification means issued under that scheme.

2.   The assurance levels low, substantial and high shall meet respectively the following criteria:

(a)

assurance level low shall refer to an electronic identification means in the context of an electronic identification scheme, which provides a limited degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease the risk of misuse or alteration of the identity;

(b)

assurance level substantial shall refer to an electronic identification means in the context of an electronic identification scheme, which provides a substantial degree of confidence in the claimed or asserted identity of a person, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to decrease substantially the risk of misuse or alteration of the identity;

(c)

assurance level high shall refer to an electronic identification means in the context of an electronic identification scheme, which provides a higher degree of confidence in the claimed or asserted identity of a person than electronic identification means with the assurance level substantial, and is characterised with reference to technical specifications, standards and procedures related thereto, including technical controls, the purpose of which is to prevent misuse or alteration of the identity.

3.   By 18 September 2015, taking into account relevant international standards and subject to paragraph 2, the Commission shall, by means of implementing acts, set out minimum technical specifications, standards and procedures with reference to which assurance levels low, substantial and high are specified for electronic identification means for the purposes of paragraph 1.

Those minimum technical specifications, standards and procedures shall be set out by reference to the reliability and quality of the following elements:

(a)	the procedure to prove and verify the identity of natural or legal persons applying for the issuance of electronic identification means;

(b)	the procedure for the issuance of the requested electronic identification means;

(c)	the authentication mechanism, through which the natural or legal person uses the electronic identification means to confirm its identity to a relying party;

(d)	the entity issuing the electronic identification means;

(e)	any other body involved in the application for the issuance of the electronic identification means; and

(f)	the technical and security specifications of the issued electronic identification means.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 9

Notification

1.   The notifying Member State shall notify to the Commission the following information and, without undue delay, any subsequent changes thereto:

(a)	a description of the electronic identification scheme, including its assurance levels and the issuer or issuers of electronic identification means under the scheme;

(b)	the applicable supervisory regime and information on the liability regime with respect to the following: (i) the party issuing the electronic identification means; and (ii) the party operating the authentication procedure;

(c)	the authority or authorities responsible for the electronic identification scheme;

(d)	information on the entity or entities which manage the registration of the unique person identification data;

(e)	a description of how the requirements set out in the implementing acts referred to in Article 12(8) are met;

(f)	a description of the authentication referred to in point (f) of Article 7;

(g)	arrangements for suspension or revocation of either the notified electronic identification scheme or authentication or the compromised parts concerned.

2.   One year from the date of application of the implementing acts referred to in Articles 8(3) and 12(8), the Commission shall publish in the Official Journal of the European Union a list of the electronic identification schemes which were notified pursuant to paragraph 1 of this Article and the basic information thereon.

3.   If the Commission receives a notification after the expiry of the period referred to in paragraph 2, it shall publish in the Official Journal of the European Union the amendments to the list referred to in paragraph 2 within two months from the date of receipt of that notification.

4.   A Member State may submit to the Commission a request to remove an electronic identification scheme notified by that Member State from the list referred to in paragraph 2. The Commission shall publish in the Official Journal of the European Union the corresponding amendments to the list within one month from the date of receipt of the Member State’s request.

5.   The Commission may, by means of implementing acts, define the circumstances, formats and procedures of notifications under paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 10

Security breach

1.   Where either the electronic identification scheme notified pursuant to Article 9(1) or the authentication referred to in point (f) of Article 7 is breached or partly compromised in a manner that affects the reliability of the cross-border authentication of that scheme, the notifying Member State shall, without delay, suspend or revoke that cross-border authentication or the compromised parts concerned, and shall inform other Member States and the Commission.

2.   When the breach or compromise referred to in paragraph 1 is remedied, the notifying Member State shall re-establish the cross-border authentication and shall inform other Member States and the Commission without undue delay.

3.   If the breach or compromise referred to in paragraph 1 is not remedied within three months of the suspension or revocation, the notifying Member State shall notify other Member States and the Commission of the withdrawal of the electronic identification scheme.

The Commission shall publish in the Official Journal of the European Union the corresponding amendments to the list referred to in Article 9(2) without undue delay.

Article 11

Liability

1.   The notifying Member State shall be liable for damage caused intentionally or negligently to any natural or legal person due to a failure to comply with its obligations under points (d) and (f) of Article 7 in a cross-border transaction.

2.   The party issuing the electronic identification means shall be liable for damage caused intentionally or negligently to any natural or legal person due to a failure to comply with the obligation referred to in point (e) of Article 7 in a cross-border transaction.

3.   The party operating the authentication procedure shall be liable for damage caused intentionally or negligently to any natural or legal person due to a failure to ensure the correct operation of the authentication referred to in point (f) of Article 7 in a cross-border transaction.

4.   Paragraphs 1, 2 and 3 shall be applied in accordance with national rules on liability.

5.   Paragraphs 1, 2 and 3 are without prejudice to the liability under national law of parties to a transaction in which electronic identification means falling under the electronic identification scheme notified pursuant to Article 9(1) are used.

Article 12

Cooperation and interoperability

1.   The national electronic identification schemes notified pursuant to Article 9(1) shall be interoperable.

2.   For the purposes of paragraph 1, an interoperability framework shall be established.

3.   The interoperability framework shall meet the following criteria:

(a)	it aims to be technology neutral and does not discriminate between any specific national technical solutions for electronic identification within a Member State;

(b)	it follows European and international standards, where possible;

(c)	it facilitates the implementation of the principle of privacy by design; and

(d)	it ensures that personal data is processed in accordance with Directive 95/46/EC.

4.   The interoperability framework shall consist of:

(a)	a reference to minimum technical requirements related to the assurance levels under Article 8;

(b)	a mapping of national assurance levels of notified electronic identification schemes to the assurance levels under Article 8;

(c)	a reference to minimum technical requirements for interoperability;

(d)	a reference to a minimum set of person identification data uniquely representing a natural or legal person, which is available from electronic identification schemes;

(e)	rules of procedure;

(f)	arrangements for dispute resolution; and

(g)	common operational security standards.

5.   Member States shall cooperate with regard to the following:

(a)	the interoperability of the electronic identification schemes notified pursuant to Article 9(1) and the electronic identification schemes which Member States intend to notify; and

(b)	the security of the electronic identification schemes.

6.   The cooperation between Member States shall consist of:

(a)	the exchange of information, experience and good practice as regards electronic identification schemes and in particular technical requirements related to interoperability and assurance levels;

(b)	the exchange of information, experience and good practice as regards working with assurance levels of electronic identification schemes under Article 8;

(c)	peer review of electronic identification schemes falling under this Regulation; and

(d)	examination of relevant developments in the electronic identification sector.

7.   By 18 March 2015, the Commission shall, by means of implementing acts, establish the necessary procedural arrangements to facilitate the cooperation between the Member States referred to in paragraphs 5 and 6 with a view to fostering a high level of trust and security appropriate to the degree of risk.

8.   By 18 September 2015, for the purpose of setting uniform conditions for the implementation of the requirement under paragraph 1, the Commission shall, subject to the criteria set out in paragraph 3 and taking into account the results of the cooperation between Member States, adopt implementing acts on the interoperability framework as set out in paragraph 4.

9.   The implementing acts referred to in paragraphs 7 and 8 of this Article shall be adopted in accordance with the examination procedure referred to in Article 48(2).

CHAPTER III

TRUST SERVICES

SECTION 1

General provisions

Article 13

Liability and burden of proof

1.   Without prejudice to paragraph 2, trust service providers shall be liable for damage caused intentionally or negligently to any natural or legal person due to a failure to comply with the obligations under this Regulation.

The burden of proving intention or negligence of a non-qualified trust service provider shall lie with the natural or legal person claiming the damage referred to in the first subparagraph.

The intention or negligence of a qualified trust service provider shall be presumed unless that qualified trust service provider proves that the damage referred to in the first subparagraph occurred without the intention or negligence of that qualified trust service provider.

2.   Where trust service providers duly inform their customers in advance of the limitations on the use of the services they provide and where those limitations are recognisable to third parties, trust service providers shall not be liable for damages arising from the use of services exceeding the indicated limitations.

3.   Paragraphs 1 and 2 shall be applied in accordance with national rules on liability.

Article 14

International aspects

1.   Trust services provided by trust service providers established in a third country shall be recognised as legally equivalent to qualified trust services provided by qualified trust service providers established in the Union where the trust services originating from the third country are recognised under an agreement concluded between the Union and the third country in question or an international organisation in accordance with Article 218 TFEU.

2.   Agreements referred to in paragraph 1 shall ensure, in particular, that:

(a)

the requirements applicable to qualified trust service providers established in the Union and the qualified trust services they provide are met by the trust service providers in the third country or international organisations with which the agreement is concluded, and by the trust services they provide;

(b)	the qualified trust services provided by qualified trust service providers established in the Union are recognised as legally equivalent to trust services provided by trust service providers in the third country or international organisation with which the agreement is concluded.

Article 15

Accessibility for persons with disabilities

Where feasible, trust services provided and end-user products used in the provision of those services shall be made accessible for persons with disabilities.

Article 16

Penalties

Member States shall lay down the rules on penalties applicable to infringements of this Regulation. The penalties provided for shall be effective, proportionate and dissuasive.

SECTION 2

Supervision

Article 17

Supervisory body

1.   Member States shall designate a supervisory body established in their territory or, upon mutual agreement with another Member State, a supervisory body established in that other Member State. That body shall be responsible for supervisory tasks in the designating Member State.

Supervisory bodies shall be given the necessary powers and adequate resources for the exercise of their tasks.

2.   Member States shall notify to the Commission the names and the addresses of their respective designated supervisory bodies.

3.   The role of the supervisory body shall be the following:

(a)

to supervise qualified trust service providers established in the territory of the designating Member State to ensure, through ex ante and ex post supervisory activities, that those qualified trust service providers and the qualified trust services that they provide meet the requirements laid down in this Regulation;

(b)

to take action if necessary, in relation to non-qualified trust service providers established in the territory of the designating Member State, through ex post supervisory activities, when informed that those non-qualified trust service providers or the trust services they provide allegedly do not meet the requirements laid down in this Regulation.

4.   For the purposes of paragraph 3 and subject to the limitations provided therein, the tasks of the supervisory body shall include in particular:

(a)	to cooperate with other supervisory bodies and provide them with assistance in accordance with Article 18;

(b)	to analyse the conformity assessment reports referred to in Articles 20(1) and 21(1);

(c)	to inform other supervisory bodies and the public about breaches of security or loss of integrity in accordance with Article 19(2);

(d)	to report to the Commission about its main activities in accordance with paragraph 6 of this Article;

(e)	to carry out audits or request a conformity assessment body to perform a conformity assessment of the qualified trust service providers in accordance with Article 20(2);

(f)	to cooperate with the data protection authorities, in particular, by informing them without undue delay, about the results of audits of qualified trust service providers, where personal data protection rules appear to have been breached;

(g)	to grant qualified status to trust service providers and to the services they provide and to withdraw this status in accordance with Articles 20 and 21;

(h)	to inform the body responsible for the national trusted list referred to in Article 22(3) about its decisions to grant or to withdraw qualified status, unless that body is also the supervisory body;

(i)	to verify the existence and correct application of provisions on termination plans in cases where the qualified trust service provider ceases its activities, including how information is kept accessible in accordance with point (h) of Article 24(2);

(j)	to require that trust service providers remedy any failure to fulfil the requirements laid down in this Regulation.

5.   Member States may require the supervisory body to establish, maintain and update a trust infrastructure in accordance with the conditions under national law.

6.   By 31 March each year, each supervisory body shall submit to the Commission a report on its previous calendar year’s main activities together with a summary of breach notifications received from trust service providers in accordance with Article 19(2).

7.   The Commission shall make the annual report referred to in paragraph 6 available to Member States.

8.   The Commission may, by means of implementing acts, define the formats and procedures for the report referred to in paragraph 6. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 18

Mutual assistance

1.   Supervisory bodies shall cooperate with a view to exchanging good practice.

A supervisory body shall, upon receipt of a justified request from another supervisory body, provide that body with assistance so that the activities of supervisory bodies can be carried out in a consistent manner. Mutual assistance may cover, in particular, information requests and supervisory measures, such as requests to carry out inspections related to the conformity assessment reports as referred to in Articles 20 and 21.

2.   A supervisory body to which a request for assistance is addressed may refuse that request on any of the following grounds:

(a)	the supervisory body is not competent to provide the requested assistance;

(b)	the requested assistance is not proportionate to supervisory activities of the supervisory body carried out in accordance with Article 17;

(c)	providing the requested assistance would be incompatible with this Regulation.

3.   Where appropriate, Member States may authorise their respective supervisory bodies to carry out joint investigations in which staff from other Member States’ supervisory bodies is involved. The arrangements and procedures for such joint actions shall be agreed upon and established by the Member States concerned in accordance with their national law.

Article 19

Security requirements applicable to trust service providers

1.   Qualified and non-qualified trust service providers shall take appropriate technical and organisational measures to manage the risks posed to the security of the trust services they provide. Having regard to the latest technological developments, those measures shall ensure that the level of security is commensurate to the degree of risk. In particular, measures shall be taken to prevent and minimise the impact of security incidents and inform stakeholders of the adverse effects of any such incidents.

2.   Qualified and non-qualified trust service providers shall, without undue delay but in any event within 24 hours after having become aware of it, notify the supervisory body and, where applicable, other relevant bodies, such as the competent national body for information security or the data protection authority, of any breach of security or loss of integrity that has a significant impact on the trust service provided or on the personal data maintained therein.

Where the breach of security or loss of integrity is likely to adversely affect a natural or legal person to whom the trusted service has been provided, the trust service provider shall also notify the natural or legal person of the breach of security or loss of integrity without undue delay.

Where appropriate, in particular if a breach of security or loss of integrity concerns two or more Member States, the notified supervisory body shall inform the supervisory bodies in other Member States concerned and ENISA.

The notified supervisory body shall inform the public or require the trust service provider to do so, where it determines that disclosure of the breach of security or loss of integrity is in the public interest.

3.   The supervisory body shall provide ENISA once a year with a summary of notifications of breach of security and loss of integrity received from trust service providers.

4.   The Commission may, by means of implementing acts,:

(a)	further specify the measures referred to in paragraph 1; and

(b)	define the formats and procedures, including deadlines, applicable for the purpose of paragraph 2.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 3

Qualified trust services

Article 20

Supervision of qualified trust service providers

1.   Qualified trust service providers shall be audited at their own expense at least every 24 months by a conformity assessment body. The purpose of the audit shall be to confirm that the qualified trust service providers and the qualified trust services provided by them fulfil the requirements laid down in this Regulation. The qualified trust service providers shall submit the resulting conformity assessment report to the supervisory body within the period of three working days after receiving it.

2.   Without prejudice to paragraph 1, the supervisory body may at any time audit or request a conformity assessment body to perform a conformity assessment of the qualified trust service providers, at the expense of those trust service providers, to confirm that they and the qualified trust services provided by them fulfil the requirements laid down in this Regulation. Where personal data protection rules appear to have been breached, the supervisory body shall inform the data protection authorities of the results of its audits.

3.   Where the supervisory body requires the qualified trust service provider to remedy any failure to fulfil requirements under this Regulation and where that provider does not act accordingly, and if applicable within a time limit set by the supervisory body, the supervisory body, taking into account, in particular, the extent, duration and consequences of that failure, may withdraw the qualified status of that provider or of the affected service it provides and inform the body referred to in Article 22(3) for the purposes of updating the trusted lists referred to in Article 22(1). The supervisory body shall inform the qualified trust service provider of the withdrawal of its qualified status or of the qualified status of the service concerned.

4.   The Commission may, by means of implementing acts, establish reference number of the following standards:

(a)	accreditation of the conformity assessment bodies and for the conformity assessment report referred to in paragraph 1;

(b)	auditing rules under which conformity assessment bodies will carry out their conformity assessment of the qualified trust service providers as referred to in paragraph 1.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 21

Initiation of a qualified trust service

1.   Where trust service providers, without qualified status, intend to start providing qualified trust services, they shall submit to the supervisory body a notification of their intention together with a conformity assessment report issued by a conformity assessment body.

2.   The supervisory body shall verify whether the trust service provider and the trust services provided by it comply with the requirements laid down in this Regulation, and in particular, with the requirements for qualified trust service providers and for the qualified trust services they provide.

If the supervisory body concludes that the trust service provider and the trust services provided by it comply with the requirements referred to in the first subparagraph, the supervisory body shall grant qualified status to the trust service provider and the trust services it provides and inform the body referred to in Article 22(3) for the purposes of updating the trusted lists referred to in Article 22(1), not later than three months after notification in accordance with paragraph 1 of this Article.

If the verification is not concluded within three months of notification, the supervisory body shall inform the trust service provider specifying the reasons for the delay and the period within which the verification is to be concluded.

3.   Qualified trust service providers may begin to provide the qualified trust service after the qualified status has been indicated in the trusted lists referred to in Article 22(1).

4.   The Commission may, by means of implementing acts, define the formats and procedures for the purpose of paragraphs 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 22

Trusted lists

1.   Each Member State shall establish, maintain and publish trusted lists, including information related to the qualified trust service providers for which it is responsible, together with information related to the qualified trust services provided by them.

2.   Member States shall establish, maintain and publish, in a secured manner, the electronically signed or sealed trusted lists referred to in paragraph 1 in a form suitable for automated processing.

3.   Member States shall notify to the Commission, without undue delay, information on the body responsible for establishing, maintaining and publishing national trusted lists, and details of where such lists are published, the certificates used to sign or seal the trusted lists and any changes thereto.

4.   The Commission shall make available to the public, through a secure channel, the information referred to in paragraph 3 in electronically signed or sealed form suitable for automated processing.

5.   By 18 September 2015 the Commission shall, by means of implementing acts, specify the information referred to in paragraph 1 and define the technical specifications and formats for trusted lists applicable for the purposes of paragraphs 1 to 4. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 23

EU trust mark for qualified trust services

1.   After the qualified status referred to in the second subparagraph of Article 21(2) has been indicated in the trusted list referred to in Article 22(1), qualified trust service providers may use the EU trust mark to indicate in a simple, recognisable and clear manner the qualified trust services they provide.

2.   When using the EU trust mark for the qualified trust services referred to in paragraph 1, qualified trust service providers shall ensure that a link to the relevant trusted list is made available on their website.

3.   By 1 July 2015 the Commission shall, by means of implementing acts, provide for specifications with regard to the form, and in particular the presentation, composition, size and design of the EU trust mark for qualified trust services. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 24

Requirements for qualified trust service providers

1.   When issuing a qualified certificate for a trust service, a qualified trust service provider shall verify, by appropriate means and in accordance with national law, the identity and, if applicable, any specific attributes of the natural or legal person to whom the qualified certificate is issued.

The information referred to in the first subparagraph shall be verified by the qualified trust service provider either directly or by relying on a third party in accordance with national law:

(a)	by the physical presence of the natural person or of an authorised representative of the legal person; or

(b)

remotely, using electronic identification means, for which prior to the issuance of the qualified certificate, a physical presence of the natural person or of an authorised representative of the legal person was ensured and which meets the requirements set out in Article 8 with regard to the assurance levels ‘substantial’ or ‘high’; or

(c)	by means of a certificate of a qualified electronic signature or of a qualified electronic seal issued in compliance with point (a) or (b); or

(d)	by using other identification methods recognised at national level which provide equivalent assurance in terms of reliability to physical presence. The equivalent assurance shall be confirmed by a conformity assessment body.

2.   A qualified trust service provider providing qualified trust services shall:

(a)	inform the supervisory body of any change in the provision of its qualified trust services and an intention to cease those activities;

(b)

employ staff and, if applicable, subcontractors who possess the necessary expertise, reliability, experience, and qualifications and who have received appropriate training regarding security and personal data protection rules and shall apply administrative and management procedures which correspond to European or international standards;

(c)	with regard to the risk of liability for damages in accordance with Article 13, maintain sufficient financial resources and/or obtain appropriate liability insurance, in accordance with national law;

(d)	before entering into a contractual relationship, inform, in a clear and comprehensive manner, any person seeking to use a qualified trust service of the precise terms and conditions regarding the use of that service, including any limitations on its use;

(e)	use trustworthy systems and products that are protected against modification and ensure the technical security and reliability of the processes supported by them;

(f)

use trustworthy systems to store data provided to it, in a verifiable form so that: (i) they are publicly available for retrieval only where the consent of the person to whom the data relates has been obtained, (ii) only authorised persons can make entries and changes to the stored data, (iii) the data can be checked for authenticity;

(g)	take appropriate measures against forgery and theft of data;

(h)

record and keep accessible for an appropriate period of time, including after the activities of the qualified trust service provider have ceased, all relevant information concerning data issued and received by the qualified trust service provider, in particular, for the purpose of providing evidence in legal proceedings and for the purpose of ensuring continuity of the service. Such recording may be done electronically;

(i)	have an up-to-date termination plan to ensure continuity of service in accordance with provisions verified by the supervisory body under point (i) of Article 17(4);

(j)	ensure lawful processing of personal data in accordance with Directive 95/46/EC;

(k)	in case of qualified trust service providers issuing qualified certificates, establish and keep updated a certificate database.

3.   If a qualified trust service provider issuing qualified certificates decides to revoke a certificate, it shall register such revocation in its certificate database and publish the revocation status of the certificate in a timely manner, and in any event within 24 hours after the receipt of the request. The revocation shall become effective immediately upon its publication.

4.   With regard to paragraph 3, qualified trust service providers issuing qualified certificates shall provide to any relying party information on the validity or revocation status of qualified certificates issued by them. This information shall be made available at least on a per certificate basis at any time and beyond the validity period of the certificate in an automated manner that is reliable, free of charge and efficient.

5.   The Commission may, by means of implementing acts, establish reference numbers of standards for trustworthy systems and products, which comply with the requirements under points (e) and (f) of paragraph 2 of this Article. Compliance with the requirements laid down in this Article shall be presumed where trustworthy systems and products meet those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 4

Electronic signatures

Article 25

Legal effects of electronic signatures

1.   An electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic signatures.

2.   A qualified electronic signature shall have the equivalent legal effect of a handwritten signature.

3.   A qualified electronic signature based on a qualified certificate issued in one Member State shall be recognised as a qualified electronic signature in all other Member States.

Article 26

Requirements for advanced electronic signatures

An advanced electronic signature shall meet the following requirements:

(a)	it is uniquely linked to the signatory;

(b)	it is capable of identifying the signatory;

(c)	it is created using electronic signature creation data that the signatory can, with a high level of confidence, use under his sole control; and

(d)	it is linked to the data signed therewith in such a way that any subsequent change in the data is detectable.

Article 27

Electronic signatures in public services

1.   If a Member State requires an advanced electronic signature to use an online service offered by, or on behalf of, a public sector body, that Member State shall recognise advanced electronic signatures, advanced electronic signatures based on a qualified certificate for electronic signatures, and qualified electronic signatures in at least the formats or using methods defined in the implementing acts referred to in paragraph 5.

2.   If a Member State requires an advanced electronic signature based on a qualified certificate to use an online service offered by, or on behalf of, a public sector body, that Member State shall recognise advanced electronic signatures based on a qualified certificate and qualified electronic signatures in at least the formats or using methods defined in the implementing acts referred to in paragraph 5.

3.   Member States shall not request for cross-border use in an online service offered by a public sector body an electronic signature at a higher security level than the qualified electronic signature.

4.   The Commission may, by means of implementing acts, establish reference numbers of standards for advanced electronic signatures. Compliance with the requirements for advanced electronic signatures referred to in paragraphs 1 and 2 of this Article and in Article 26 shall be presumed when an advanced electronic signature meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

5.   By 18 September 2015, and taking into account existing practices, standards and Union legal acts, the Commission shall, by means of implementing acts, define reference formats of advanced electronic signatures or reference methods where alternative formats are used. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 28

Qualified certificates for electronic signatures

1.   Qualified certificates for electronic signatures shall meet the requirements laid down in Annex I.

2.   Qualified certificates for electronic signatures shall not be subject to any mandatory requirement exceeding the requirements laid down in Annex I.

3.   Qualified certificates for electronic signatures may include non-mandatory additional specific attributes. Those attributes shall not affect the interoperability and recognition of qualified electronic signatures.

4.   If a qualified certificate for electronic signatures has been revoked after initial activation, it shall lose its validity from the moment of its revocation, and its status shall not in any circumstances be reverted.

5.   Subject to the following conditions, Member States may lay down national rules on temporary suspension of a qualified certificate for electronic signature:

(a)	if a qualified certificate for electronic signature has been temporarily suspended that certificate shall lose its validity for the period of suspension;

(b)	the period of suspension shall be clearly indicated in the certificate database and the suspension status shall be visible, during the period of suspension, from the service providing information on the status of the certificate.

6.   The Commission may, by means of implementing acts, establish reference numbers of standards for qualified certificates for electronic signature. Compliance with the requirements laid down in Annex I shall be presumed where a qualified certificate for electronic signature meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 29

Requirements for qualified electronic signature creation devices

1.   Qualified electronic signature creation devices shall meet the requirements laid down in Annex II.

2.   The Commission may, by means of implementing acts, establish reference numbers of standards for qualified electronic signature creation devices. Compliance with the requirements laid down in Annex II shall be presumed where a qualified electronic signature creation device meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 30

Certification of qualified electronic signature creation devices

1.   Conformity of qualified electronic signature creation devices with the requirements laid down in Annex II shall be certified by appropriate public or private bodies designated by Member States.

2.   Member States shall notify to the Commission the names and addresses of the public or private body referred to in paragraph 1. The Commission shall make that information available to Member States.

3.   The certification referred to in paragraph 1 shall be based on one of the following:

(a)	a security evaluation process carried out in accordance with one of the standards for the security assessment of information technology products included in the list established in accordance with the second subparagraph; or

(b)

a process other than the process referred to in point (a), provided that it uses comparable security levels and provided that the public or private body referred to in paragraph 1 notifies that process to the Commission. That process may be used only in the absence of standards referred to in point (a) or when a security evaluation process referred to in point (a) is ongoing.

The Commission shall, by means of implementing acts, establish a list of standards for the security assessment of information technology products referred to in point (a). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

4.   The Commission shall be empowered to adopt delegated acts in accordance with Article 47 concerning the establishment of specific criteria to be met by the designated bodies referred to in paragraph 1 of this Article.

Article 31

Publication of a list of certified qualified electronic signature creation devices

1.   Member States shall notify to the Commission without undue delay and no later than one month after the certification is concluded, information on qualified electronic signature creation devices that have been certified by the bodies referred to in Article 30(1). They shall also notify to the Commission, without undue delay and no later than one month after the certification is cancelled, information on electronic signature creation devices that are no longer certified.

2.   On the basis of the information received, the Commission shall establish, publish and maintain a list of certified qualified electronic signature creation devices.

3.   The Commission may, by means of implementing acts, define formats and procedures applicable for the purpose of paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 32

Requirements for the validation of qualified electronic signatures

1.   The process for the validation of a qualified electronic signature shall confirm the validity of a qualified electronic signature provided that:

(a)	the certificate that supports the signature was, at the time of signing, a qualified certificate for electronic signature complying with Annex I;

(b)	the qualified certificate was issued by a qualified trust service provider and was valid at the time of signing;

(c)	the signature validation data corresponds to the data provided to the relying party;

(d)	the unique set of data representing the signatory in the certificate is correctly provided to the relying party;

(e)	the use of any pseudonym is clearly indicated to the relying party if a pseudonym was used at the time of signing;

(f)	the electronic signature was created by a qualified electronic signature creation device;

(g)	the integrity of the signed data has not been compromised;

(h)	the requirements provided for in Article 26 were met at the time of signing.

2.   The system used for validating the qualified electronic signature shall provide to the relying party the correct result of the validation process and shall allow the relying party to detect any security relevant issues.

3.   The Commission may, by means of implementing acts, establish reference numbers of standards for the validation of qualified electronic signatures. Compliance with the requirements laid down in paragraph 1 shall be presumed where the validation of qualified electronic signatures meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 33

Qualified validation service for qualified electronic signatures

1.   A qualified validation service for qualified electronic signatures may only be provided by a qualified trust service provider who:

(a)	provides validation in compliance with Article 32(1); and

(b)	allows relying parties to receive the result of the validation process in an automated manner, which is reliable, efficient and bears the advanced electronic signature or advanced electronic seal of the provider of the qualified validation service.

2.   The Commission may, by means of implementing acts, establish reference numbers of standards for qualified validation service referred to in paragraph 1. Compliance with the requirements laid down in paragraph 1 shall be presumed where the validation service for a qualified electronic signature meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 34

Qualified preservation service for qualified electronic signatures

1.   A qualified preservation service for qualified electronic signatures may only be provided by a qualified trust service provider that uses procedures and technologies capable of extending the trustworthiness of the qualified electronic signature beyond the technological validity period.

2.   The Commission may, by means of implementing acts, establish reference numbers of standards for the qualified preservation service for qualified electronic signatures. Compliance with the requirements laid down in paragraph 1 shall be presumed where the arrangements for the qualified preservation service for qualified electronic signatures meet those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 5

Electronic seals

Article 35

Legal effects of electronic seals

1.   An electronic seal shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic seals.

2.   A qualified electronic seal shall enjoy the presumption of integrity of the data and of correctness of the origin of that data to which the qualified electronic seal is linked.

3.   A qualified electronic seal based on a qualified certificate issued in one Member State shall be recognised as a qualified electronic seal in all other Member States.

Article 36

Requirements for advanced electronic seals

An advanced electronic seal shall meet the following requirements:

(a)	it is uniquely linked to the creator of the seal;

(b)	it is capable of identifying the creator of the seal;

(c)	it is created using electronic seal creation data that the creator of the seal can, with a high level of confidence under its control, use for electronic seal creation; and

(d)	it is linked to the data to which it relates in such a way that any subsequent change in the data is detectable.

Article 37

Electronic seals in public services

1.   If a Member State requires an advanced electronic seal in order to use an online service offered by, or on behalf of, a public sector body, that Member State shall recognise advanced electronic seals, advanced electronic seals based on a qualified certificate for electronic seals and qualified electronic seals at least in the formats or using methods defined in the implementing acts referred to in paragraph 5.

2.   If a Member State requires an advanced electronic seal based on a qualified certificate in order to use an online service offered by, or on behalf of, a public sector body, that Member State shall recognise advanced electronic seals based on a qualified certificate and qualified electronic seal at least in the formats or using methods defined in the implementing acts referred to in paragraph 5.

3.   Member States shall not request for the cross-border use in an online service offered by a public sector body an electronic seal at a higher security level than the qualified electronic seal.

4.   The Commission may, by means of implementing acts, establish reference numbers of standards for advanced electronic seals. Compliance with the requirements for advanced electronic seals referred to in paragraphs 1 and 2 of this Article and Article 36 shall be presumed when an advanced electronic seal meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

5.   By 18 September 2015, and taking into account existing practices, standards and legal acts of the Union, the Commission shall, by means of implementing acts, define reference formats of advanced electronic seals or reference methods where alternative formats are used. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 38

Qualified certificates for electronic seals

1.   Qualified certificates for electronic seals shall meet the requirements laid down in Annex III.

2.   Qualified certificates for electronic seals shall not be subject to any mandatory requirements exceeding the requirements laid down in Annex III.

3.   Qualified certificates for electronic seals may include non-mandatory additional specific attributes. Those attributes shall not affect the interoperability and recognition of qualified electronic seals.

4.   If a qualified certificate for an electronic seal has been revoked after initial activation, it shall lose its validity from the moment of its revocation, and its status shall not in any circumstances be reverted.

5.   Subject to the following conditions, Member States may lay down national rules on temporary suspension of qualified certificates for electronic seals:

(a)	if a qualified certificate for electronic seal has been temporarily suspended, that certificate shall lose its validity for the period of suspension;

(b)	the period of suspension shall be clearly indicated in the certificate database and the suspension status shall be visible, during the period of suspension, from the service providing information on the status of the certificate.

6.   The Commission may, by means of implementing acts, establish reference numbers of standards for qualified certificates for electronic seals. Compliance with the requirements laid down in Annex III shall be presumed where a qualified certificate for electronic seal meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

Article 39

Qualified electronic seal creation devices

1.   Article 29 shall apply mutatis mutandis to requirements for qualified electronic seal creation devices.

2.   Article 30 shall apply mutatis mutandis to the certification of qualified electronic seal creation devices.

3.   Article 31 shall apply mutatis mutandis to the publication of a list of certified qualified electronic seal creation devices.

Article 40

Validation and preservation of qualified electronic seals

Articles 32, 33 and 34 shall apply mutatis mutandis to the validation and preservation of qualified electronic seals.

SECTION 6

Electronic time stamps

Article 41

Legal effect of electronic time stamps

1.   An electronic time stamp shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic time stamp.

2.   A qualified electronic time stamp shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound.

3.   A qualified electronic time stamp issued in one Member State shall be recognised as a qualified electronic time stamp in all Member States.

Article 42

Requirements for qualified electronic time stamps

1.   A qualified electronic time stamp shall meet the following requirements:

(a)	it binds the date and time to data in such a manner as to reasonably preclude the possibility of the data being changed undetectably;

(b)	it is based on an accurate time source linked to Coordinated Universal Time; and

(c)	it is signed using an advanced electronic signature or sealed with an advanced electronic seal of the qualified trust service provider, or by some equivalent method.

2.   The Commission may, by means of implementing acts, establish reference numbers of standards for the binding of date and time to data and for accurate time sources. Compliance with the requirements laid down in paragraph 1 shall be presumed where the binding of date and time to data and the accurate time source meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 7

Electronic registered delivery services

Article 43

Legal effect of an electronic registered delivery service

1.   Data sent and received using an electronic registered delivery service shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic registered delivery service.

2.   Data sent and received using a qualified electronic registered delivery service shall enjoy the presumption of the integrity of the data, the sending of that data by the identified sender, its receipt by the identified addressee and the accuracy of the date and time of sending and receipt indicated by the qualified electronic registered delivery service.

Article 44

Requirements for qualified electronic registered delivery services

1.   Qualified electronic registered delivery services shall meet the following requirements:

(a)	they are provided by one or more qualified trust service provider(s);

(b)	they ensure with a high level of confidence the identification of the sender;

(c)	they ensure the identification of the addressee before the delivery of the data;

(d)	the sending and receiving of data is secured by an advanced electronic signature or an advanced electronic seal of a qualified trust service provider in such a manner as to preclude the possibility of the data being changed undetectably;

(e)	any change of the data needed for the purpose of sending or receiving the data is clearly indicated to the sender and addressee of the data;

(f)	the date and time of sending, receiving and any change of data are indicated by a qualified electronic time stamp.

In the event of the data being transferred between two or more qualified trust service providers, the requirements in points (a) to (f) shall apply to all the qualified trust service providers.

2.   The Commission may, by means of implementing acts, establish reference numbers of standards for processes for sending and receiving data. Compliance with the requirements laid down in paragraph 1 shall be presumed where the process for sending and receiving data meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

SECTION 8

Website authentication

Article 45

Requirements for qualified certificates for website authentication

1.   Qualified certificates for website authentication shall meet the requirements laid down in Annex IV.

2.   The Commission may, by means of implementing acts, establish reference numbers of standards for qualified certificates for website authentication. Compliance with the requirements laid down in Annex IV shall be presumed where a qualified certificate for website authentication meets those standards. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 48(2).

CHAPTER IV

ELECTRONIC DOCUMENTS

Article 46

Legal effects of electronic documents

An electronic document shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in electronic form.

CHAPTER V

DELEGATIONS OF POWER AND IMPLEMENTING PROVISIONS

Article 47

Exercise of the delegation

1.   The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

2.   The power to adopt delegated acts referred to in Article 30(4) shall be conferred on the Commission for an indeterminate period of time from 17 September 2014.

3.   The delegation of power referred to in Article 30(4) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

4.   As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

5.   A delegated act adopted pursuant to Article 30(4) shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.

Article 48

Committee procedure

1.   The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

2.   Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.

CHAPTER VI

FINAL PROVISIONS

Article 49

Review

The Commission shall review the application of this Regulation and shall report to the European Parliament and to the Council no later than 1 July 2020. The Commission shall evaluate in particular whether it is appropriate to modify the scope of this Regulation or its specific provisions, including Article 6, point (f) of Article 7 and Articles 34, 43, 44 and 45, taking into account the experience gained in the application of this Regulation, as well as technological, market and legal developments.

The report referred to in the first paragraph shall be accompanied, where appropriate, by legislative proposals.

In addition, the Commission shall submit a report to the European Parliament and the Council every four years after the report referred to in the first paragraph on the progress towards achieving the objectives of this Regulation.

Article 50

Repeal

1.   Directive 1999/93/EC is repealed with effect from 1 July 2016.

2.   References to the repealed Directive shall be construed as references to this Regulation.

Article 51

Transitional measures

1.   Secure signature creation devices of which the conformity has been determined in accordance with Article 3(4) of Directive 1999/93/EC shall be considered as qualified electronic signature creation devices under this Regulation.

2.   Qualified certificates issued to natural persons under Directive 1999/93/EC shall be considered as qualified certificates for electronic signatures under this Regulation until they expire.

3.   A certification-service-provider issuing qualified certificates under Directive 1999/93/EC shall submit a conformity assessment report to the supervisory body as soon as possible but not later than 1 July 2017. Until the submission of such a conformity assessment report and the completion of its assessment by the supervisory body, that certification-service-provider shall be considered as qualified trust service provider under this Regulation.

4.   If a certification-service-provider issuing qualified certificates under Directive 1999/93/EC does not submit a conformity assessment report to the supervisory body within the time limit referred to in paragraph 3, that certification-service-provider shall not be considered as qualified trust service provider under this Regulation from 2 July 2017.

Article 52

Entry into force

1.   This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

2.   This Regulation shall apply from 1 July 2016, except for the following:

(a)	Articles 8(3), 9(5), 12(2) to (9), 17(8), 19(4), 20(4), 21(4), 22(5), 23(3), 24(5), 27(4) and (5), 28(6), 29(2), 30(3) and (4), 31(3), 32(3), 33(2), 34(2), 37(4) and (5), 38(6), 42(2), 44(2), 45(2), and Articles 47 and 48 shall apply from 17 September 2014;

(b)	Article 7, Article 8(1) and (2), Articles 9, 10, 11 and Article 12(1) shall apply from the date of application of the implementing acts referred to in Articles 8(3) and 12(8);

(c)	Article 6 shall apply from three years as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8).

3.   Where the notified electronic identification scheme is included in the list published by the Commission pursuant to Article 9 before the date referred to in point (c) of paragraph 2 of this Article, the recognition of the electronic identification means under that scheme pursuant to Article 6 shall take place no later than 12 months after the publication of that scheme but not before the date referred to in point (c) of paragraph 2 of this Article.

4.   Notwithstanding point (c) of paragraph 2 of this Article, a Member State may decide that electronic identification means under electronic identification scheme notified pursuant to Article 9(1) by another Member State are recognised in the first Member State as from the date of application of the implementing acts referred to in Articles 8(3) and 12(8). Member States concerned shall inform the Commission. The Commission shall make this information public.

---

(1)  OJ C 351, 15.11.2012, p. 73.

(2)  Position of the European Parliament of 3 April 2014 (not yet published in the Official Journal) and decision of the Council of 23 July 2014.

(3)  Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures (OJ L 13, 19.1.2000, p. 12).

(4)  OJ C 50 E, 21.2.2012, p. 1.

(5)  Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market (OJ L 376, 27.12.2006, p. 36).

(6)  Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

(7)  Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

(8)  Council Decision 2010/48/EC of 26 November 2009 concerning the conclusion, by the European Community, of the United Nations Convention on the Rights of Persons with Disabilities (OJ L 23, 27.1.2010, p. 35).

(9)  Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (OJ L 218, 13.8.2008, p. 30).

(10)  Commission Decision 2009/767/EC of 16 October 2009 setting out measures facilitating the use of procedures by electronic means through the ‘points of single contact’ under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 274, 20.10.2009, p. 36).

(11)  Commission Decision 2011/130/EU of 25 February 2011 establishing minimum requirements for the cross-border processing of documents signed electronically by competent authorities under Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market (OJ L 53, 26.2.2011, p. 66).

(12)  Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

(13)  Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

(14)  OJ C 28, 30.1.2013, p. 6.

(15)  Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement and repealing Directive 2004/18/EC (OJ L 94, 28.3.2014, p. 65).

---

---

---

---

---

28.8.2014

EN

Official Journal of the European Union

L 257/115

---

REGULATION (EU) No 911/2014 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 23 July 2014

on multiannual funding for the action of the European Maritime Safety Agency in the field of response to marine pollution caused by ships and oil and gas installations

(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 100(2) thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Economic and Social Committee (1),

After consulting the Committee of the Regions,

Acting in accordance with the ordinary legislative procedure (2),

Whereas:

(1)	Regulation (EC) No 1406/2002 of the European Parliament and of the Council (3) established a European Maritime Safety Agency (‘the Agency’) for the purpose of ensuring a high, uniform and effective level of maritime safety and prevention of pollution by ships.

(2)

Regulation (EC) No 724/2004 of the European Parliament and of the Council (4), which amended Regulation (EC) No 1406/2002, assigned to the Agency tasks in the fields of prevention and response to pollution caused by ships, following accidents in Union waters, particularly those of the oil tankers ‘Erika’ and ‘Prestige’.

(3)

Regulation (EU) No 100/2013 of the European Parliament and of the Council (5), amending Regulation (EC) No 1406/2002, assigned to the Agency tasks with regard to response to marine pollution caused by oil and gas installations and extended the Agency’s services to the States applying for accession to the Union and to the European Neighbourhood partner countries.

(4)	Regulation (EC) No 2038/2006 of the European Parliament and of the Council (6) established a multiannual funding for the action of the Agency in the field of response to pollution caused by ships which expired on 31 December 2013.

(5)

Given the potentially devastating ecological impact and extremely high economic costs of pollution incidents, as well as the possible socioeconomic impact of such incidents on other sectors, such as tourism and fisheries, the Agency should have sufficient means to allow it to carry out its assigned tasks in relation to response to marine pollution by ships and oil and gas installations. Those tasks are important in preventing further damage of both a monetary and non-monetary nature.

(6)

For the purposes of implementing the tasks of preventing and responding to pollution by ships, the Administrative Board of the Agency adopted on 22 October 2004 an Action Plan for Oil Pollution Preparedness and Response, which determines the Agency’s oil pollution response activities and which is aimed at the optimum use of the financial resources available to the Agency. On 12 June 2007, the Administrative Board adopted an Action Plan for Hazardous and Noxious Substances Pollution Preparedness and Response. In accordance with Article 15 of Regulation (EC) No 1406/2002, both Action Plans are updated yearly through the Agency’s annual work programme.

(7)

Regard should be had to the existing agreements on accidental pollution, which facilitate mutual assistance and cooperation between Member States in this field, as well as to the relevant international conventions and agreements for the protection of European maritime areas from pollution incidents requiring parties to take all appropriate measures to prepare for and respond to an oil pollution incident.

(8)

The pollution response action of the Agency, as specified in its action plans, relates to activities in the fields of information, cooperation and coordination, including with regard to marine pollution caused by hazardous and noxious substances. Above all, that response action relates to the provision of operational assistance to the affected Member States or third countries sharing a regional sea basin with the Union (‘affected States’) by supplying, on request, additional anti-pollution vessels to combat oil pollution caused by ships as well as marine pollution caused by oil and gas installations. The Agency should pay particular attention to those areas identified as most vulnerable without prejudice to any other area in need.

(9)

The activities of the Agency in the field of pollution response should comply with existing cooperation arrangements providing for mutual assistance in the event of a maritime pollution incident. The Union has acceded to various regional organisations and is preparing to accede to other regional organisations.

(10)	The Agency’s action should be coordinated with the activities under the bilateral and regional agreements to which the Union is a party. In the event of a maritime pollution incident, the Agency should assist affected States, under whose authority clean-up operations are conducted.

(11)

The Agency should play an active role in maintaining and further developing the European Satellite Oil Monitoring Service (CleanSeaNet) for surveillance, the early detection of pollution and the identification of the ships or oil and gas installations responsible, for example in the case of discharges of oil from ships and of operational releases and accidental spills from offshore platforms. That service should improve the availability of data and the effectiveness and timeliness of the pollution response.

(12)	The additional means to be provided by the Agency to affected States should be made available through the Union Civil Protection Mechanism established by Decision No 1313/2013/EU of the European Parliament and of the Council (7).

(13)

The information related to public and private pollution response mechanisms and associated response capabilities in the various regions of the Union should be made available by Member States through the Common Emergency Communication and Information System (CECIS) established by Council Decision 2007/779/EC, Euratom (8), when available for that purpose.

(14)

In order to make the Agency’s operational assistance more efficient in view of the extension of the Agency’s pollution response mandate to third countries sharing a regional sea basin with the Union, the Agency should make every effort to encourage those third countries to pool information and cooperate in the maintenance by the Agency of a list of response mechanisms and associated response capabilities.

(15)	In order to improve the effectiveness of the Agency’s pollution response activities, Member States should share with the Agency scientific studies they may have carried out on the effects of chemicals used as dispersants which could be relevant for those activities.

(16)	In order to ensure thorough implementation of the Agency’s action plans, the Agency should be provided with a viable and cost-effective system for financing, in particular, the provision of operational assistance to affected States.

(17)

Financial security should therefore be provided for the funding of the tasks entrusted to the Agency in the field of pollution response and associated actions on the basis of a multiannual commitment. The size of that multiannual commitment should reflect the expansion of the Agency’s remit with regard to pollution response, and also the need for the Agency to increase the efficiency in using the funds allocated to it, in a context of budgetary constraints. The annual amounts of the Union contribution should be determined by the European Parliament and the Council in accordance with the annual budgetary procedure. It is of particular importance that the Commission carry out a mid-term evaluation of the Agency’s ability to fulfil its responsibilities in the field of response to marine pollution caused by ships and oil and gas installations in an effective and cost-efficient manner.

(18)

The amounts to be committed for the funding of pollution response should cover the period from 1 January 2014 to 31 December 2020, in line with the multiannual financial framework laid down in Council Regulation (EU, Euratom) No 1311/2013 (9) (‘the multiannual financial framework’). A financial envelope covering the same period should therefore be provided.

(19)	The Agency’s support to States applying for accession to the Union and to the European Neighbourhood partner countries should be financed through existing Union programmes for those States and countries and should therefore not be part of the multiannual funding of the Agency.

(20)

In order to optimise the allocation of commitments and take into account any changes with regard to activities in response to pollution caused by ships, it is necessary to ensure continuous monitoring of the particular needs for action so as to allow for adaptation of the annual financial commitments.

(21)	In accordance with Regulation (EC) No 1406/2002, the Agency should report on the financial execution of the multiannual funding of the Agency in its annual report.

(22)

It is appropriate to ensure continuity in the funding support provided under the action of the Agency in the field of response to marine pollution caused by ships and oil and gas installations, and to align the period of application of this Regulation with that of Regulation (EU, Euratom) No 1311/2013. Therefore, this Regulation should apply from 1 January 2014,

HAVE ADOPTED THIS REGULATION:

Article 1

Subject matter

1.   This Regulation lays down the detailed arrangements for the financial contribution of the Union to the budget of the European Maritime Safety Agency (‘the Agency’) for the implementation of the tasks assigned to it in the field of response to marine pollution caused by ships and oil and gas installations, pursuant to Articles 1 and 2 of Regulation (EC) No 1406/2002.

2.   The activities of the Agency in the field of pollution response shall not relieve coastal States of their responsibility to have appropriate pollution response mechanisms in place.

Article 2

Definitions

For the purposes of this Regulation the following definitions shall apply:

(a)	‘oil’ means petroleum in any form, including crude oil, fuel oil, sludge, oil refuse and refined products as established by the International Convention on Oil Pollution Preparedness, Response and Cooperation, 1990, of the International Maritime Organisation (IMO);

(b)

‘hazardous and noxious substances’ means any substance other than oil which, if introduced into the marine environment, is likely to create hazards to human health, to harm living resources and marine life, to damage amenities or to interfere with other legitimate uses of the sea, as established by the Protocol on Preparedness, Response and Cooperation to Pollution Incidents by Hazardous and Noxious Substances, 2000, of the IMO;

(c)

‘oil and gas installation’ means a stationary fixed or mobile facility, or a combination of facilities permanently interconnected by bridges or other structures, used for offshore oil or gas operations or in connection with those operations; ‘oil and gas installation’ includes mobile offshore drilling units only if they are stationed in offshore waters for drilling, production or other activities associated with offshore oil or gas operations, as well as infrastructure and facilities used to transport the oil and gas onshore and to onshore terminals.

Article 3

Scope

The financial contribution of the Union referred to in Article 1 shall be allocated to the Agency with the aim of financing actions in the field of response to marine pollution caused by ships and oil and gas installations as referred to in the detailed plan established in accordance with point (k) of Article 10(2) of Regulation (EC) No 1406/2002, in particular those relating to:

(a)

operational assistance and supporting with additional means, such as stand-by anti-pollution ships, satellite images and equipment, of pollution response actions, upon request by the affected States, in accordance with point (d) of Article 2(3) and Article 2(5) of Regulation (EC) No 1406/2002 in the event of accidental or deliberate marine pollution caused by ships or oil and gas installations;

(b)	cooperation and coordination and the provision to the Member States and the Commission of technical and scientific assistance in the framework of the relevant activities of the Union Civil Protection Mechanism, the IMO and the relevant regional organisations;

(c)	information, in particular the gathering, analysis and dissemination of best practices, expertise, techniques and innovations in the field of response to marine pollution caused by ships and oil and gas installations.

Article 4

Union funding

1.   Within the limits of the multiannual financial framework, the Agency shall be given the appropriations necessary to fulfil its responsibilities in the field of response to marine pollution caused by ships and oil and gas installations in an effective and cost-efficient manner.

2.   The financial envelope for the implementation of the tasks referred to in Article 3 for the period from 1 January 2014 to 31 December 2020 shall be EUR 160 500 000 expressed in current prices.

3.   Annual appropriations shall be determined by the European Parliament and the Council within the limits of the multiannual financial framework. In this connection the necessary funding of operational assistance to the Member States pursuant to point (a) of Article 3 shall be guaranteed.

Article 5

Monitoring existing capabilities

1.   In order to define the requirements for, and to improve the efficiency of, the Agency’s provision of operational assistance, for example in the form of anti-pollution vessels additional to Member States’ capacities, the Agency shall maintain a list of the public and, where available, private pollution response mechanisms and associated response capabilities in the various regions of the Union.

2.   The Agency shall maintain that list on the basis of information that Member States shall provide. In maintaining that list, the Agency shall aim at obtaining information on pollution response mechanisms and associated response capabilities from third countries sharing a regional sea basin with the Union.

3.   The Administrative Board of the Agency shall take into account that list and other appropriate information relevant to the pollution response objectives set out in Article 1 of Regulation (EC) No 1406/2002, such as that contained in risk assessments and scientific studies on the effects of chemicals used as dispersants, before deciding on the Agency’s pollution response activities in the framework of the Agency’s annual work programmes. In this context, the Agency shall pay particular attention to those areas identified as most vulnerable, without prejudice to any other area in need.

Article 6

Protection of the Union’s financial interests

1.   The Commission and the Agency shall ensure that, when actions funded under this Regulation are implemented, the financial interests of the Union are protected by the application of preventive measures against fraud, corruption and any other illegal activities, by means of effective checks and inspections and, where irregularities are detected, the recovery of any amounts unduly paid and by imposing effective, proportional and dissuasive penalties, in accordance with Council Regulations (EC, Euratom) No 2988/95 (10) and (Euratom, EC) No 2185/96 (11) and Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council (12).

2.   For the Union actions funded under this Regulation, the notion of irregularity referred to in Article 1(2) of Regulation (EC, Euratom) No 2988/95 shall mean any infringement of a provision of Union law or any breach of a contractual obligation resulting from an act or omission by an economic operator which has, or would have, the effect of prejudicing the general budget of the Union or budgets managed by it, by an unjustified item of expenditure.

3.   The Commission and the Agency shall, each within its respective sphere of competence, ensure that best value for money is achieved in the funding of Union actions under this Regulation.

Article 7

Mid-term evaluation

1.   No later than 31 December 2017, the Commission shall submit to the European Parliament and to the Council, on the basis of information provided by the Agency, a report on the implementation of this Regulation. That report, which shall be established without prejudice to the role of the Administrative Board of the Agency, shall set out the results of the use of the Union contribution referred to in Article 4 as regards commitments and expenditure covering the period between 1 January 2014 and 31 December 2016.

2.   In that report, the Commission shall present an evaluation of the Agency’s ability to fulfil its responsibilities in an effective and cost-efficient manner. For the period 2018–2020, based on the evaluation and considering the need for the Agency to carry out the tasks assigned to it, the Commission shall, if necessary, propose an appropriate adjustment, by a maximum of 8 %, of the multiannual financial envelope allocated to the Agency for the implementation of the tasks referred to in Article 3. The possible adjustment shall remain within the limits of the multiannual financial framework and is without prejudice to the annual budgetary procedures or the upcoming review of the multiannual financial framework.

3.   That report shall contain information on the socioeconomic, ecological and financial implications, if available, of the Agency’s response preparedness relating to marine pollution caused by ships and oil and gas installations.

4.   Furthermore, on the basis of that report, the Commission may, if appropriate, propose amendments to this Regulation, in particular in order to take account of scientific progress in the field of combating marine pollution caused by ships and oil and gas installations, including with regard to pollution caused by hazardous and noxious substances, as well as of relevant changes to the instruments establishing regional organisations whose activities are covered by the Agency’s activities with regard to pollution response and to which the Union has acceded.

Article 8

Entry into force and date of application

This Regulation shall enter into force on the day following that of its publication in the Official Journal of the European Union.

It shall apply from 1 January 2014 to 31 December 2020.

---

(1)  OJ C 327, 12.11.2013, p. 108.

(2)  Position of the European Parliament of 15 April 2014 (not yet published in the Official Journal) and decision of the Council of 23 July 2014.

(3)  Regulation (EC) No 1406/2002 of the European Parliament and of the Council of 27 June 2002 establishing a European Maritime Safety Agency (OJ L 208, 5.8.2002, p. 1).

(4)  Regulation (EC) No 724/2004 of the European Parliament and of the Council of 31 March 2004 amending Regulation (EC) No 1406/2002 establishing a European Maritime Safety Agency (OJ L 129, 29.4.2004, p. 1).

(5)  Regulation (EU) No 100/2013 of the European Parliament and of the Council of 15 January 2013 amending Regulation (EC) No 1406/2002 establishing a European Maritime Safety Agency (OJ L 39, 9.2.2013, p. 30).

(6)  Regulation (EC) No 2038/2006 of the European Parliament and of the Council of 18 December 2006 on multiannual funding for the action of the European Maritime Safety Agency in the field of response to pollution caused by ships (OJ L 394, 30.12.2006, p. 1).

(7)  Decision No 1313/2013/EU of the European Parliament and of the Council of 17 December 2013 on a Union Civil Protection Mechanism (OJ L 347, 20.12.2013, p. 924).

(8)  Council Decision 2007/779/EC, Euratom of 8 November 2007 establishing a Community Civil Protection Mechanism (OJ L 314, 1.12.2007, p. 9).

(9)  Council Regulation (EU, Euratom) No 1311/2013 of 2 December 2013 laying down the multiannual financial framework for the years 2014-2020 (OJ L 347, 20.12.2013, p. 884).

(10)  Council Regulation (EC, Euratom) No 2988/95 of 18 December 1995 on the protection of the European Communities financial interests (OJ L 312, 23.12.1995, p. 1).

(11)  Council Regulation (Euratom, EC) No 2185/96 of 11 November 1996 concerning on-the-spot checks and inspections carried out by the Commission in order to protect the European Communities’ financial interests against fraud and other irregularities (OJ L 292, 15.11.1996, p. 2).

(12)  Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ L 248, 18.9.2013, p. 1).

---