Commission Delegated Regulation (EU) 2019/362

Contents

THE EUROPEAN COMMISSION,Having regard to the Treaty on the Functioning of the European Union,Having regard to Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories^note, and in particular Article 56(3) thereof,Whereas:

(1)Experience in applying Commission Delegated Regulation (EU) No 150/2013^note has proved that the provisions of Regulation (EU) No 648/2012 concerning the registration of trade repositories constitute a sound basis to build the framework for registration of trade repositories. In order to strengthen that framework further, Regulation (EU) No 150/2013 should reflect the evolving nature of the industry.

(2)Establishing a consistent framework for registration and extension of registration of trade repositories under both Regulation (EU) No 648/2012 and Regulation (EU) 2015/2365 of the European Parliament and of the Council^note is essential for achieving a level playing field among trade repositories and for the efficient provision of repository functions.

(3)The verification function of trade repositories is of primary importance for the transparency of derivative markets and to ensure data quality. Trade repositories should therefore demonstrate that they have established appropriate systems and procedures to verify the completeness and correctness of the details of derivative contracts. Those systems and procedures should therefore be further detailed in order to strengthen the framework for the registration. They should set out how the trade repositories will authenticate users, validate schema of the data, authorise the recording of data, validate the logic and content of the data, reconcile the details of derivatives and provide feedback to their users.

(4)Applications for registration as a trade repository should include more detailed information on the relevant internal control mechanisms and structures, the internal audit function and the audit work plan to enable ESMA to assess how those factors contribute to the efficient functioning of the trade repository.

(5)To enable ESMA to better assess the good repute, experience and skills of the board members, senior management and relevant senior staff of the applicant trade repository, an applicant trade repository should provide additional information about those persons, including information on their knowledge and experience in IT management, operations and development.

(6)The use of common resources within a trade repository for derivatives reporting services on the one hand and ancillary services or reporting services for securities financing transactions on the other, may lead to contagion of operational risks across those services. The validation, reconciliation, processing and recordkeeping of data may require an effective operational separation to avoid such contagion of risks. However, certain practices, such as a common front-end of systems, a common access point to data for authorities or the use of the same staff working in sales, compliance, or a client services helpdesk may be less prone to contagion and hence do not necessarily require operational separation. Trade repositories should therefore establish an appropriate level of operational separation between the resources, systems or procedures used in different business lines. That separation should include business lines that provide services subject to other Union legislation or third country legislation. It should also ensure that the application for registration contains detailed and clear information on the ancillary services, or on other business lines that the trade repository offers outside its core activity of repository services under Regulation (EU) No 648/2012.

(7)The soundness, resilience and protection of the information technology systems of trade repositories are essential to ensure compliance with the objectives of Regulation (EU) No 648/2012. Accordingly, trade repositories should provide comprehensive and more detailed information on those systems to enable ESMA to assess the soundness and resilience of their information technology systems. Where the provision of repository functions is outsourced to third parties, either at the level of the group or outside the group, trade repositories should provide detailed information on the relevant outsourcing arrangements to enable ESMA to assess compliance with the conditions for registration, including information on any service level agreements, on metrics and on how those metrics are effectively monitored. Finally, trade repositories should provide information on the mechanisms and controls that they put in place to effectively manage potential cyber-risks and to protect the data on cyber-attacks.

(8)To better achieve the objectives of Regulation (EU) No 648/2012 regarding the transparency of the derivatives market, trade repositories should demonstrate that they apply the terms and conditions of access to data held in trade repositories in accordance with Commission Delegated Regulation (EU) No 151/2013^note. Those terms and conditions should ensure the integrity of the data provided to authorities and that the trade repositories are able to provide access to the data in accordance with Delegated Regulation (EU) No 151/2013. An application for registration should therefore detail the trade repositories' policies and procedures pursuant to which the different types of users report and access the data held in a trade repository. For the same reason, an application for registration should contain a description of the channels and mechanisms used to publicly disclose information on the access rules to the data held in that trade repository. Trade repositories shall also provide more detailed information on their procedures for the verification of completeness and correctness of data.

(9)The fees associated with the services provided by trade repositories are essential information for market participants to enable them to make an informed choice. Those fees should therefore form part of the application for registration as a trade repository.

(10)To enable ESMA to establish the baseline for capacity and performance planning of the trade repositories, applications for registration should contain information which demonstrates that applicant trade repository has the necessary financial resources to perform its functions as a trade repository on an on-going basis. For the same reason, an application for registration should contain effective business continuity arrangements. Trade repositories should in particular provide information about their plans, procedures and arrangements for the managements of emergencies and crisis, including procedures to ensure the orderly substitution of the original trade repository if its registration is withdrawn or if a reporting counterparty decides to report to another trade repository.

(11)Because market participants and authorities rely on the data maintained by trade repositories, a trade repository's application for registration should clearly describe operational and record-keeping arrangements, which should be strict and effective. To demonstrate how the confidentiality and protection of data maintained by the trade repository is preserved and to allow for the traceability of those data, the application for registration should contain a specific reference regarding the set-up of a reporting log.

(12)This Regulation is based on the draft regulatory technical standards submitted by the European Securities and Markets Authority (ESMA) to the European Commission pursuant to the procedure in Article 10 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council^note.

(13)ESMA has conducted open public consultations on these draft regulatory technical standards, analysed the potential related costs and benefits and requested the opinion of the ESMA Securities and Markets Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1095/2010.

(14)Delegated Regulation (EU) No 150/2013 should therefore be amended accordingly,

HAS ADOPTED THIS REGULATION:

Article 1Amendments to Delegated Regulation (EU) No 150/2013#

(1)in Article 1, paragraph 2 is replaced by the following:‘2.The application for registration as a trade repository shall in particular contain the following information:

(a)the corporate name of the applicant and legal address within the Union;

(b)an excerpt from the relevant commercial or court register, or other forms of certified evidence of the place of incorporation and scope of business activity of the applicant, valid at the application date;

(c)information on the classes of derivatives for which the applicant wishes to be registered;

(d)information on whether the applicant is authorised or registered by a competent authority in the Member State where it is established, and in such case, the name of the authority and any reference number related to the authorisation or registration;

(e)the articles of incorporation of the applicant, and, where relevant, other statutory documentation stating that the applicant is to conduct trade repository services;

(f)the minutes from the meeting where the applicant's Board approved the application;

(g)the name and contact details of the person(s) responsible for compliance, or any other staff involved in compliance assessments for the applicant;

(h)the programme of operations, including indications of the location of the main business activities;

(i)the identification of any subsidiaries and, where relevant, the group structure;

(j)any service, other than the trade repository function, that the applicant provides or intends to provide;

(k)any information on any pending judicial, administrative, arbitration or any other litigation proceedings irrespective of their type, that the applicant may be party to, particularly as regards tax and insolvency matters and where significant financial or reputational costs may be incurred, or any non- pending proceedings, that may still have any material impact on trade repository costs.’

(2)Article 2 is replaced by the following:‘Article 2Policies and proceduresWhere information regarding policies and procedures is provided as part of an application, an applicant shall ensure that the application includes the following items:

(a)an indication that the Board approves the policies, that the senior management approves the procedures and that the senior management is responsible for the implementation and maintenance of the policies and procedures;

(b)a description of how the communication of policies and procedures within the applicant is organised, how compliance with the policies will be ensured and monitored on a day to day basis, and the person or persons responsible for compliance in that regard;

(c)any records indicating that employed and dedicated staff are aware of the policies and procedures;

(d)a description of the measures to adopt in the event of a breach of policies and procedures;

(e)an indication of the procedure for reporting to ESMA any material breach of policies or procedures which may result in a breach of the conditions for initial registration.’;

(3)in Article 3, paragraph 2 is replaced by the following:‘2.Where the applicant has a parent undertaking, it shall:

(a)identify the legal address of that parent undertaking;

(b)indicate whether the parent undertaking is authorised or registered and subject to supervision, and when this is the case, state any reference number and the name of the responsible supervisory authority.’;

(4)Article 7 is replaced by the following:‘Article 7Internal control1.An application for registration as a trade repository shall contain detailed information relating to the internal control system of the applicant, including information regarding its compliance function, risk assessment, internal control mechanisms and arrangements of its internal audit function.2.The detailed information referred to in paragraph 1 shall contain:

(a)the applicant's internal control policies and respective procedures related to their consistent and effective implementation;

(a)the composition of any Internal Audit Committee, its competences and responsibilities;

(b)any policies, procedures and manuals regarding the monitoring and evaluation of the adequacy and effectiveness of the applicant's systems;

(b)its internal audit function charter, methodologies, standards and procedures;

(c)any policies, procedures and manuals regarding the control and safeguard for the applicant's information processing systems;

(c)an explanation how its internal audit charter, methodology and procedures are developed and applied taking into account the nature and extent of the applicant's activities, complexities and risks;

(d)the identity of the internal bodies in charge of the evaluation of the relevant internal control findings.

(d)a work plan for three years following the date of application addressing the nature and extent of the applicant's activities, complexities and risks.’;

3.An application for registration as a trade repository shall contain the following information with respect to the applicant's internal audit activities:

(5)Article 9 is replaced by the following:‘Article 9Senior management and members of the Board1.An application for registration as a trade repository shall contain the following information in respect of each member of the senior management and each member of the Board:

(a)a copy of the curriculum vitae;

(b)detailed information on the knowledge and experience in IT management, operations and development;

(c)details regarding any criminal convictions in connection with the provision of financial or data services or in relation to acts of fraud or embezzlement, in particular in the form of an official certificate if available within the relevant Member State;

(d)a self-declaration of good repute in relation to the provision of a financial or data service, where each member of the senior management and the board states whether they:

(i)have been convicted of any criminal offence in connection with the provision of financial or data services or in relation to acts of fraud or embezzlement;

(ii)have been subject to an adverse decision in any proceedings of a disciplinary nature brought by a regulatory authority or government bodies or agencies or are the subject of any such proceedings which are not concluded;

(iii)have been subject to an adverse judicial finding in civil proceedings before a court in connection with the provision of financial or data services, or for impropriety or fraud in the management of a business;

(iv)have been part of the board or senior management of an undertaking whose registration or authorisation was withdrawn by a regulatory body;

(v)have been refused the right to carry on activities which require registration or authorisation by a regulatory body;

(vi)have been part of the board or senior management of an undertaking which has gone into insolvency or liquidation while this person was connected to the undertaking or within a year of the person ceasing to be connected to the undertaking;

(vii)have been part of the board or senior management of an undertaking which was subject to an adverse decision or penalty by a regulatory body;

(viii)have been otherwise fined, suspended, disqualified, or been subject to any other sanction in relation to fraud, embezzlement or in connection with the provision of financial or data services, by a government, regulatory or professional body;

(ix)have been disqualified from acting as a director, disqualified from acting in any managerial capacity, dismissed from employment or other appointment in an undertaking as a consequence of misconduct or malpractice;

(e)a declaration of any potential conflicts of interests that the senior management and the members of the board may have in performing their duties and how these conflicts are managed.’;

(6)Article 11 is replaced by the following:‘Article 11Fitness and propernessAn application for registration as a trade repository shall contain the following information about the applicant's staff:

(a)a general list of the staff directly employed by the trade repository, including their role and qualifications per role;

(b)a specific description of the information technology staff directly employed to provide trade repository services, together with the role and the qualifications of each individual;

(c)a description of the roles and qualifications of each individual who is responsible for internal audit, internal controls, compliance and risk assessment;

(d)the identity of the dedicated staff members and those members of the staff that are operating under an outsourcing arrangement;

(e)details of the training on the applicant's policies and procedures as well as the trade repository business, including any examination or other type of formal assessment required for staff regarding the conduct of trade repository activities.

The description referred to in point (b) shall include written evidence of the academic diploma and experience in information technology of at least one senior staff member responsible for IT matters.;’

(7)Article 12 is replaced by the following:‘Article 12Financial reports and business plans1.An application for registration as a trade repository shall contain the following financial and business information about the applicant:

(a)a complete set of financial statements, prepared in conformity with international standards adopted in accordance with Article 3 of Regulation (EC) No 1606/2002 of the European Parliament and of the Council^note;

(a)the expected level of reporting activity in number of transactions;

(a)the pro-forma statement demonstrating proper resources and expected business status in six months after registration is granted;

(a)an indication of any future plans for the establishment of subsidiaries and their location;

(b)where the financial statements of the applicant are subject to statutory audit within the meaning given in Article 2(1) of the Directive 2006/43/EC of the European Parliament and of the Council^note, the financial reports shall include the audit report on the annual and consolidated financial statements;

(b)the relevant fixed and variable costs identified with respect to the provision of repository services under Regulation (EU) No 648/2012;

(b)an interim financial report where the financial statements are not yet available for the requested period of time;

(b)a description of the business activities which the applicant plans to carry out, specifying the activities of any subsidiaries or branches.

(c)if the applicant is audited, the name and the national registration number of the external auditor.

(c)positive and negative variations of at least 20 % from the base activity scenario identified.

(c)a statement of financial position, such as a balance sheet, income statement, changes in equity and of cash flows and notes comprising a summary of accounting policies and other explanatory notes.

2.An application for registration as a trade repository shall contain a financial business plan contemplating different business scenarios for the trade repository services over a minimum three years' reference period and including the following additional information:3.Where the historical financial information referred to in paragraph 1 is not available, an application for registration as a trade repository shall contain the following information about the applicant:4.An application for registration as a trade repository shall contain the audited annual financial statements of any parent undertaking for the three financial years preceding the date of the application.5.An application for registration as a trade repository shall also contain the following financial information about the applicant:

(8)Article 14 is replaced by the following:‘Article 14Confidentiality1.An application for registration as a trade repository shall contain the internal policies, procedures and mechanisms preventing any use of information maintained in the applicant trade repository:

(a)for illegitimate purposes;

(b)for disclosure of confidential information;

(c)not permitted for commercial use.

2.The internal policies, procedures and mechanisms shall include the internal procedures on the staff permissions for using passwords to access the data, specifying the staff purpose, the scope of data being viewed and any restrictions on the use of data, as well as detailed information on any mechanisms and controls in place to effectively manage potential cyber-risks and to protect the data maintained from cyber-attacks.3.Applicants shall provide ESMA with information on the processes to keep a log identifying each staff member accessing the data, the time of access, the nature of data accessed and the purpose.’;

(9)Article 16 is replaced by the following:‘Article 16Information Technology resources and outsourcingAn application for registration as a trade repository shall contain the following information relating to information technology resources:

(a)a detailed description of the information technology system including the relevant business requirements, functional and technical specifications, system architectural and technical design, data model and data flows, and operations and administrative procedures and manuals;

(b)user facilities developed by the applicant in order to provide services to the relevant users, including a copy of any user manual and internal procedures;

(c)the investment and renewal policies on information technology resources of the applicant;

(d)the outsourcing arrangements entered into by the applicant, including:

(i)detailed definitions of the services to be provided, including measurable scope of those services, the granularity of the activities as well as conditions under which those activities are rendered, and their timelines;

(ii)service level agreements with clear roles and responsibilities, metrics and targets for every key requirement of the trade repository that is outsourced, the methods employed to monitor the service level of the outsourced functions and the measures or actions to be taken in the event of not meeting service level targets;

(iii)a copy of the contracts governing such arrangements.’;

(10)Article 17 is replaced by the following:‘Article 17Ancillary servicesWhere an applicant, an undertaking within its group, or an undertaking with which the applicant has an agreement relating to trading or post-trading service offers, or plans to offer any ancillary services, its application for registration as a trade repository shall contain the following information:

(a)a description of the ancillary services that the applicant, or the undertaking within its group, performs and a description of any agreement that the trade repository may have with companies offering trading, post-trading, or other related services, as well as copies of such agreements;

(b)the procedures and policies that ensure the necessary degree of operational separation in terms of resources, systems and procedures, between the applicant's trade repository services under Regulation (EU) No 648/2012 and other business lines, including those business lines that comprise the provision of services under Union or third country legislation, irrespective of whether that separate business line is run by the trade repository, a company belonging to its holding company, or any other company within which it has an agreement in the context of the trading or post-trading chain or business line.’;

(11)Articles 18, 19 and 20 are replaced by the following:‘Article 18Transparency of access rules1.An application for registration as a trade repository shall contain the following information:

(a)the policies and procedures pursuant to which the different types of users report and access the data in a trade repository, including any process that the relevant users may need to access, consult, or modify the information maintained by the trade repository;

(a)internal users;

(a)procedures for the authentication of the identity of the users accessing the trade repository;

(a)pricing policy, including any existing discounts and rebates and conditions to benefit from such reductions;

(b)a copy of the terms and conditions which determine the rights and obligations of the different types of users in relation to the information maintained by the trade repository;

(b)reporting counterparties;

(b)procedures for the verification of the completeness and correctness of derivatives reported to the trade repository;

(b)fee structure for providing any trade repository and ancillary services, including the estimated cost of the trade repository services and ancillary services, along with the details of the methods used to account the separate cost that the applicant may incur when providing trade repository services and ancillary services;

(c)a description of the different categories of access available to users;

(c)report submitting entities;

(c)procedures for the verification of the authorisation and IT permission of the entity reporting on behalf of the reporting counterparty;

(c)methods used to make the information publicly available to all types of users, including a copy of the fee structure in which trade repository services and ancillary services are unbundled.’;

(d)the access policies and procedures pursuant to which other service providers may have non-discriminatory access to information maintained by the trade repository where the relevant counterparties have provided their written, voluntary and revocable consent;

(d)entities responsible for reporting;

(d)procedures for verification that the logical sequence of the details of the reported derivatives is maintained at all times;

(e)a description of the channels and mechanisms used by the trade repository to publicly disclose information on the access to that trade repository.

(e)non-reporting counterparties;

(e)procedures for the verification of the completeness and correctness of the details of the reported derivatives;

(f)non-reporting third parties;

(f)procedures for the reconciliation of data between trade repositories where counterparties report to different trade repositories;

(g)entities listed in Article 81(3) of Regulation (EU) No 648/2012;

(g)procedures for the provision of feedback to the counterparties to the derivatives or the third parties reporting on their behalf, on the verifications performed under points (a) to (e) and the outcomes of the reconciliation process point (f).

(h)other types of users, where applicable.

2.The information referred to in points (a), (b) and (c) of paragraph 1 shall be specified for the following types of users:Article 19Verification of completeness and correctness of dataAn application for registration as a trade repository shall contain the following information:Article 20Pricing policy transparencyAn application for registration as a trade repository shall contain a description of the applicant's:

(12)Article 21 is replaced by the following:‘Article 21Operational risk1.An application for registration as a trade repository shall contain:

(a)a detailed description of the resources available and procedures designed to identify and mitigate operational risk and any other material risk to which the applicant is exposed, including a copy of any relevant policies, methodologies, internal procedures and manuals;

(b)a description of the liquid net assets funded by equity to cover potential general business losses in order to continue providing services as a going concern, and an assessment of the sufficiency of its financial resources with the aim of covering the operation costs of a wind-down or reorganisation of the critical operations and services over at least a six-months period;

(c)the applicant's business continuity plan and the policy for updating it, including the following:

(i)all business processes, resources, escalation procedures and related systems which are critical to ensuring the services of the trade repository applicant, including any relevant outsourced service and the trade repository strategy, policy and objectives towards the continuity of these processes;

(ii)the arrangements in place with other financial market infrastructure providers including other trade repositories;

(iii)the arrangements to ensure a minimum service level of the critical functions and the expected timing of the completion of the full recovery of those processes;

(iv)the maximum acceptable recovery time for business processes and systems, having in mind the deadline for reporting to trade repositories as provided for in Article 9(1) of Regulation (EU) No 648/2012 and the volume of data that the trade repository needs to process within that daily period;

(v)the procedures to deal with incident logging and reviews;

(vi)testing programme and the results of any tests;

(vii)the number of alternative technical and operational sites available, their location, the resources when compared with the main site and the business continuity procedures in place in the event that alternate sites need to be used;

(viii)information on access to a secondary business site to allow staff to ensure continuity of the service if a main office location is not available;

(ix)plans, procedures and arrangements for handling emergencies and ensuring personnel safety;

(x)plans, procedures and arrangements for the management of crises, including the coordination of the overall business continuity action and its timely and effective activation within a given recovery time objective;

(xi)plans, procedures and arrangements to recover the applicant's system, application and infrastructure components within the prescribed recovery time objective.’;

(d)a description of the arrangements for ensuring the applicant's trade repository activities in case of disruption and the involvement of trade repository users and other third parties in them.

2.An application for registration as a trade repository shall contain the procedures to ensure the orderly substitution of the original trade repository where requested by a reporting counterparty, or where requested by a third party reporting on behalf of non reporting counterparties, or whereby such substitution is the result of a withdrawal of registration, and shall include the procedures for the transfer of data and the redirection of reporting flows to another trade repository.’;

(13)Article 22 is replaced by the following:‘Article 22Recordkeeping policy1.An application for registration as a trade repository shall contain information about the receipt and administration of data, including any policies and procedures put in place by the applicant to ensure:

(a)a timely and accurate registration of the information reported;

(b)a record-keeping of all reported information relating to the conclusion, modification or termination of a derivative contract in a reporting log;

(c)that the data is maintained both online and offline;

(d)that the data is adequately copied for business continuity purposes.

2.An application for registration as a trade repository shall contain information on the recordkeeping systems, policies and procedures that are used in order to ensure that the data reported is modified appropriately and that positions are calculated correctly in accordance with relevant legislative or regulatory requirements.’;

(14)Article 23 is replaced by the following:‘Article 23Data availability mechanismsAn application for registration as a trade repository shall contain a description of the resources, methods and channels that the applicant uses to give access to the information in accordance with paragraphs 1, 3 and 5 of Article 81 of Regulation (EU) No 648/2012, and shall contain the following information:

(a)a procedure to calculate the aggregate positions in accordance with Commission Delegated Regulation (EU) No 151/2013^note, and a description of the resources, methods and channels that the trade repository will employ in order to facilitate access to the data contained therein to the public in accordance with Article 81(1) of Regulation (EU) No 648/2012, and a description of the frequency of updates, along with a copy of any specific manuals and internal policies;

(b)a description of the resources, methods and facilities that the trade repository employs in order to facilitate the access to its information to the relevant authorities in accordance with Article 81(3) of Regulation (EU) No 648/2012, the frequency of the update and the controls and verifications that the trade repository may establish for the access filtering process, along with a copy of any specific manuals and internal procedures;

(c)a procedure and a description of the resources, methods and channels that the trade repository employs in order to facilitate the timely structured and comprehensive collection of data from counterparties, the access to its information to counterparties to derivatives in accordance with Article 80(5) of Regulation (EU) No 648/2012, along with a copy of the specific manuals and internal policies.

(15)the following Article 23a is inserted:‘Article 23aDirect and immediate access to data by authoritiesAn application for registration as a trade repository shall contain information on the following:

(a)the terms and conditions under which the authorities referred to in Article 81(3) of Regulation (EU) No 648/2012 are given direct and immediate access to the details of derivatives maintained at the trade repository in accordance with Delegated Regulation (EU) No 151/2013;

(b)the procedure under which the authorities referred to in point (a) are given direct and immediate access to the details of derivatives contracts maintained at the trade repository in accordance with Delegated Regulation (EU) No 151/2013;

(c)the procedure to ensure the integrity of the data accessed by those authorities.’.

Article 2Entry into force and application#

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Commission Delegated Regulation (EU) 2019/362

Article 1Amendments to Delegated Regulation (EU) No 150/2013#

Article 2Entry into force and application#

Connections

History · 2 versions

Key facts

Article 1Amendments to Delegated Regulation (EU) No 150/2013#

Article 2Entry into force and application#