Commission Delegated Regulation (EU) 2026/1519

Contents

THE EUROPEAN COMMISSION,Having regard to the Treaty on the Functioning of the European Union,Having regard to Regulation (EU) No 909/2014 of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives 98/26/EC and 2014/65/EU and Regulation (EU) No 236/2012^note, and in particular Article 22(10), third subparagraph thereof,Whereas:

(1)The amendments introduced to Regulation (EU) No 909/2014 by Regulation (EU) 2023/2845 of the European Parliament and of the Council^note require amending certain provisions of Commission Delegated Regulation (EU) 2017/392^note accordingly.

(2)Considering the strengthening of the role of relevant authorities and, where applicable, of the authorities referred to in Article 67 of Directive 2014/65/EU of the European Parliament and of the Council^note in the review and evaluation process foreseen by Regulation (EU) No 909/2014, competent authorities should transmit to those authorities the information necessary to fulfil their role, which has been extended beyond the functioning of the securities settlement systems operated by the central securities depository (CSD) to compliance with Regulation (EU) No 909/2014 and other requirements of Union law as regards the functioning of the securities settlement systems. In light of the longer review period of three years introduced by Regulation (EU) 2023/2845, CSDs should be required to report to competent authorities certain new information items. It is also necessary to make the reporting requirements laid down in Article 22(1), (7) and (8) of Regulation (EU) No 909/2014 more predictable, to reduce the administrative burden for both CSDs and competent authorities and reduce ad hoc information requests.

(3)To ensure minimum harmonisation, to enable competent authorities to compare information received, and to foster supervisory convergence, CSDs should provide their competent authority with a summary of the key changes they have made to their arrangements, strategies, processes and mechanisms with respect to compliance with Regulation (EU) No 909/2014 since the most recent review of those arrangements, strategies, processes and mechanisms by their competent authority. Due to the new longer minimum frequency for the review and evaluation laid down in Article 22(1), third subparagraph, of Regulation (EU) No 909/2014 and taking into account the new elements highlighted by the supervisory experience developed since the introduction of the review and evaluation process, that report should cover more detailed information on the changes that occurred during the relevant review period on the core elements of the structure and functioning of the CSD from a supervisory perspective. Those core elements should include the group structure of the CSD, its management and shareholders, its activities or services, and the termination of services and links. A number of information items on the changes in the CSD’s risk management framework, in terms of legal risks, general business risks and operational risks, should be included in the set of periodic information that is to be provided to the competent authorities for the review and evaluation.

(4)Since CSDs can provide their services cross-border, in other Member States and in third countries, the review of the arrangements, strategies, processes and mechanisms implemented by a CSD with respect to compliance with Regulation (EU) No 909/2014, and the evaluation of the risks to which the CSD is, or might be, exposed or which it creates for the smooth functioning of securities markets or stability of the financial markets, should cover such cross-border activities. CSDs should therefore provide their competent authorities with statistical data on their cross-border activities, including the jurisdictions of their participants or issuers and the governing law of the securities for which they provide core services. That information will enable authorities to thoroughly understand the operational, legal, and liquidity risks associated with the cross-border provision of services by CSDs.

(5)To ensure that competent authorities are able to monitor whether CSDs properly identify, rate, and manage their legal risk exposure, CSDs should inform their competent authorities about any changes to their legal management framework in the course of the review period.

(6)To ensure that CSDs comply at all times with the conditions for authorisation, their progress in addressing any outstanding findings and recommendations from the competent authorities should be closely monitored. CSDs should inform their competent authorities about measures taken to address those outstanding findings and recommendations, as part of the review and evaluation process referred to in Article 22(1) of Regulation (EU) No 909/2014. In particular, CSDs that have obtained a risk rating from a third-party in accordance with Article 32 of Delegated Regulation (EU) 2017/392 should periodically report any changes in the risk rating of the CSD that occurred during the review period.

(7)While CSDs remain liable for any issues that arise in relation to outsourced activities or services, such activities or services may have a direct impact on the management of securities settlement systems. To ensure that the outsourcing contracts adequately provide for oversight and proper control of the outsourced functions by CSDs, CSDs should periodically inform their competent authorities about major changes in those contracts during the review period.

(8)Deferred net settlement entails credit and liquidity risks. CSDs should therefore periodically inform their competent authorities about the way in which those credit and liquidity risks are managed.

(9)Under Article 70(7) of Delegated Regulation (EU) 2017/392, CSDs are required to periodically review their operational objectives to incorporate new technological and business developments. It follows that CSDs, to enable competent authorities to properly perform the review and evaluation referred to in Article 22(1) of Regulation (EU) No 909/2014, should also inform their competent authorities about the outcome of such review and in particular about the processes and activities that contribute to the delivery of the services that CSDs provide and the IT systems that support them.

(10)Operational risk is one of the main risks that CSDs face on an ongoing basis. CSDs should therefore inform their competent authorities about the operational risks faced during the review period and the procedures they have followed to mitigate those risks. For the same reason, CSDs should periodically inform their competent authorities about the outcome of their tests on, and reviews of, their operational arrangements, policies and procedures with users.

(11)Pursuant to Articles 6 and 7 of Regulation (EU) No 909/2014, CSDs are required to promote early settlement on the intended settlement date, to monitor settlement fails of transactions, and to establish procedures to facilitate the settlement of transactions that are not settled on the intended settlement date, by means of cash penalties, settlement fails reporting and eventually, mandatory buy-in. Therefore, and to enable competent authorities to monitor any changes that CSDs implement in that area during the review period for the review and evaluation referred to in Article 22(1) of Regulation (EU) No 909/2014, CSDs should provide periodic information on developments that occurred in relation to the measures they put in place to prevent and address settlement fails.

(12)To ensure that CSDs have the capacity to take timely action when there is a default of one or more of its participants, the rules and procedures to ensure that such action is taken should periodically be tested and reviewed. To enable competent authorities to identify the risks to which CSDs might be exposed, CSDs should inform their competent authorities about the outcome of such testing and review.

(13)Under Article 80 of Delegated Regulation (EU) 2017/392, CSDs are required to periodically review and update their business continuity policy and the disaster recovery plan. To enable competent authorities to properly perform the review and evaluation referred to in Article 22(1) of Regulation (EU) No 909/2014, CSDs should provide their competent authorities with the result of those periodic reviews and updates.

(14)CSDs may use measures or tools to condition the delivery of securities to the payment of the cash leg operated outside its system for free of payment settlement instructions. Given the relevance of those measures or tools for the securities settlement system, CSDs should inform their competent authorities about their implementation during the review period.

(15)The introduction of new information requirements may lead to changes in CSDs’ reporting structure. To provide CSDs with enough time to undertake such changes, the date of application of certain provisions should be deferred by one year.

(16)Delegated Regulation (EU) 2017/392 should therefore be amended accordingly.

(17)This Regulation is based on the draft regulatory technical standards submitted to the Commission by the European Securities and Markets Authority (ESMA.)

(18)ESMA has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the advice of the Securities and Markets Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council^note,

HAS ADOPTED THIS REGULATION:

Article 1Amendments to Delegated Regulation (EU) 2017/392#

Delegated Regulation (EU) 2017/392 is amended as follows:

(1)in Article 40, paragraph 2 is replaced by the following:‘2.For the purposes of the review and evaluation referred to in Article 22(1) of Regulation (EU) No 909/2014, a CSD shall provide its competent authority with all of the following:

(a)the information referred to in Articles 41 and 42 of this Regulation;

(b)a report on the CSD’s activities for the review period concerned and the substantive changes referred to in Article 16(4) of Regulation (EU) No 909/2014 notified during the review period, together with all related documents, with the report containing information on the following aspects, relevant to the review period:

(i)changes in the provision of the CSD core and ancillary services, as referred to in the Annex to Regulation (EU) No 909/2014, in its home Member State, and, where applicable, in other Member States and third countries;

(ii)changes to the CSD’s corporate governance and organisational structure, including in the number of employees;

(iii)changes to the CSD’s risk management framework in respect of legal, business, operational and other direct or indirect risks as referred to in Article 42 of Regulation (EU) No 909/2014, demonstrating the link between the changes introduced and the CSD’s evaluation of the changing landscape of risks it faces through a classification of the main risks;

(iv)a summary of the user committee activities referred to in Article 28 of Regulation (EU) No 909/2014, including the number of meetings, advice and opinions delivered, indicating their topics and identifying those that have not been followed by the CSD’s management body, if any;

(v)the main changes to the outsourcing by the CSD of services and activities referred to in Article 30 of Regulation (EU) No 909/2014;

(vi)details on the substantive changes referred to in Article 16(4) of Regulation (EU) No 909/2014 including any of the following events if notified during the review period:

(1)changes to the CSD’s group structure, senior management, management body and shareholders pursuant to Article 27a of Regulation (EU) No 909/2014;

(2)changes to an existing activity or service other than in the context of Article 19(1) of Regulation (EU) No 909/2014, where the description of the services referred to in Article 4(2), points (l) to (p), of this Regulation would need to be amended;

(3)a termination of a CSD service;

(4)a termination of a CSD link;

(5)changes to the CSD’s risk management framework that impact the calculation of the capital requirements laid down in Article 47 of Regulation (EU) No 909/2014;

(c)any additional information requested by the competent authority that is necessary:

(i)to assess whether the CSD has complied with its obligations laid down Regulation (EU) No 909/2014 during the review period;

(ii)to evaluate the risks to which the CSD is, or might be, exposed or which the CSD creates for the smooth functioning of securities markets or stability of the financial markets.’

;

(2)Article 41 is replaced by the following:‘Article 41Periodic information relevant for each review and evaluationFor each review period, the CSD shall provide the competent authority with all of the following:

(a)a complete set of the latest audited financial statements of the CSD, including those consolidated at group level;

(aa)information about the outcome of the CSD’s tests and reviews of its operational arrangements, policies and procedures with users, as referred to in Article 73(4) of this Regulation, that occurred during the review period;

(ab)information about any updates of the CSD’s business impact analysis and risk analysis during the review period stemming from either its annual review or any ad hoc review following a material incident or significant operational changes and taking into account all relevant developments, including market and IT developments as referred to in Article 45 of Regulation (EU) No 909/2014 and in Article 77(3) of this Regulation;

(ac)information about developments that occurred in relation to the CSD’s measures to prevent and address settlement fails as referred to in Article 6(3) and (4) and Article 7(1) and (2) of Regulation (EU) No 909/2014 and in Articles 4 to 15 of Delegated Regulation (EU) 2018/1229;

(ad)information about the outcome of the CSD’s testing of its participant default rules and procedures as referred to in Article 41(3) of Regulation (EU) No 909/2014 that occurred during the review period;

(ae)information about the review or update of the CSD’s business continuity policy and disaster recovery plan referred to in Article 80 of this Regulation that occurred during the review period;

(af)information about the measures or tools the CSD has used during the review period to condition the delivery of securities to the payment of the cash leg operated outside its system for free of payment (FOP) settlement instructions, if any;

(ag)information about the progress that the CSD has achieved, if any, in addressing the outstanding findings and recommendations formulated in its authorisation or in previous reviews and evaluations of the CSD in accordance with Article 22(9) of Regulation (EU) No 909/2014;

(b)a summarised version of the most recent interim financial statements of the CSD;

(c)any decisions of the management body following the advice of the user committee, and any decisions where the management body has decided not to follow the advice of the user committee;

(d)information on any pending civil, administrative or any other judicial or extrajudicial proceedings involving the CSD, in particular in relation to matters concerning tax and insolvency, or matters that may cause financial or reputational costs for the CSD;

(e)information on any pending civil, administrative or any other judicial or extrajudicial, proceedings involving a member of the management body or a member of the senior management that may have a negative impact on the CSD;

(f)any final decisions resulting from the proceedings referred to in points (d) and (e);

(g)a copy of the results of the business continuity and disaster recovery tests or similar exercises performed during the review period as referred to in Article 79 of this Regulation, and of the audit reviews referred to in Article 76(1), point (b)of this Regulation;

(h)a report on the operational incidents that occurred during the review period and that affected the smooth provision of any core services, information on the classification of those incidents, the measures taken to address them, and the results of those measures;

(i)a report on whether the CSD’s established operational reliability objectives, as referred to in Article 70(3) of this Regulation, including operational performance objectives and committed service-level targets for its services and securities settlement systems, are met, including:

(i)information on the CSD’s actions to regularly monitor, assess, and report on those operational reliability objectives, as referred to in Article 70(5) and (6) of this Regulation;

(ii)an assessment of those systems’ availability during the review period, measured on a daily basis as the percentage of time those systems are operational and functioning in line with the agreed parameters;

(j)a summary of the types of manual intervention by the CSD in the automated settlement process, as referred to in Article 4(2) of Commission Delegated Regulation (EU) 2018/1229^note;

(k)the plans for recovery and orderly wind-down, as referred to in Article 22a of Regulation (EU) No 909/2014, and in particular information about any significant changes to such plans and information about any significant change to the CSD’s resolution plan that occurred during the review period, where such resolution plan is established or maintained for the CSD;

(l)information on any formal complaints received by the CSD during the review period, including information on all of the following:

(i)the nature of the complaint;

(ii)how the complaint was handled, including the outcome of the complaint;

(iii)the date the handling of the complaint ended;

(m)information about cases, if any, where the CSD denied access to its services to any existing or potential participant, any issuer, another CSD or another market infrastructure in accordance with Article 33(3), Article 49(3), Article 52(2) and Article 53(3) of Regulation (EU) No 909/2014;

(n)a report on significant changes that affect any CSD links established by the CSD and that have an impact on the requirements referred to in Chapter XII of this Regulation, including changes:

(i)in the type of CSD link;

(ii)to the mechanisms and procedures used for the settlement in those CSD links;

(o)information about all cases of identified conflicts of interests that materialised during the review period, including information about how those conflicts were managed;

(p)information about internal controls and audits performed by the CSD during the review period, including information about:

(i)the audit of the CSD’s operational risk-management framework and systems as referred to in Article 45 of Regulation (EU) No 909/2014 and in Article 73(1) and (2) of this Regulation;

(ii)the regular and independent audits of the CSD as referred to in Article 26(6) of Regulation (EU) No 909/2014 and in Article 51 and Article 52(1) of this Regulation;

(q)information about any identified infringement of Regulation (EU) No 909/2014, including infringements identified through the reporting channel referred to in Article 26(5) of that Regulation;

(r)detailed information about any disciplinary actions taken by the CSD during the review period, including any cases of suspension of participants in accordance with Article 7(7) of Regulation (EU) No 909/2014, with a specification of the period of suspension and the reason for the suspension;

(s)the general business strategy of the CSD and a detailed business plan for the services provided by the CSD covering at least the next review period;

(t)information about changes during the review period to the CSD’s management of legal risk, as referred to in Article 43 of Regulation (EU) No 909/2014 and Article 31 of this Regulation;

(u)information about changes during the review period to the CSD’s risk-management and control systems, and to the IT tools, referred to in Article 32(1) of this Regulation, that the CSD has put in place to manage business risk;

(v)where the CSD has obtained a risk rating from a third party, as referred to in Article 32(2) of this Regulation, information about any variation in the risk rating that the CSD obtained from a third party during the review period, including any relevant information supporting that risk rating;

(w)information about changes that occurred during the review period to the CSD’s management of services or activities outsourced to a third party, as referred to in Article 30 of Regulation (EU) No 909/2014, including information about changes to:

(i)staff sharing as referred to in Article 49 of this Regulation;

(ii)the methods used to monitor the service level of the outsourced services and activities, as referred to in Article 33(2), point (b), of this Regulation;

(x)a report about changes that occurred during the review period in the measurement, monitoring and management of the credit and liquidity risks arising from the use of deferred net settlement as referred to in Article 47a(2) of Regulation (EU) No 909/2014;

(y)information about the CSD’s actions taken during the review period to review its operational objectives to incorporate new technological and business developments, as referred to in Article 70(7) of this Regulation;

(z)information about:

(i)the CSD’s assessment of the operational risks that the CSD faced during the review period, including the operational risks faced from key participants, by providing the regular reporting to the senior management of operational risk exposures and losses experienced from operational risks;

(ii)the procedures followed to mitigate those exposures and losses, as referred to in Article 45 of Regulation (EU) No 909/2014 and in Article 66(2), Article 67(4) and Article 71(2) of this Regulation;

For the purpose of point (i), CSDs that use a common settlement infrastructure may provide extracts of the reports made available under the legal, regulatory and operational framework referred to in Article 30(5) of Regulation (EU) No 909/2014 to replace relevant parts of the report referred to in that point.^note

(3)Article 42 is amended as follows:

(a)in paragraph 1, the first subparagraph is amended as follows:

(i)the introductory sentence is replaced by the following:‘For each review period, the CSD shall provide the competent authority with the following statistical data per each calendar year, or per other period as determined by the competent authority:’;

(ii)points (a) and (b) are replaced the following:

(a)a list of the participants of each securities settlement system operated by the CSD, specifying all of the following:

(i)their country of incorporation;

(ii)their LEI code;

(iii)their corporate name;

(b)a list of issuers to whom the CSD provides the service referred to in Section A, point (1), of the Annex to Regulation (EU) No 909/2014, specifying all of the following:

(i)their country of incorporation;

(ii)their LEI code;

(iii)their corporate name;’;

(iii)the following points (ba) and (bb) are inserted:

(ba)a list of securities issues recorded in securities accounts centrally maintained in each securities settlement system operated by the CSD, specifying all of the following:

(i)the ISIN code of the securities;

(ii)the country of incorporation of the issuer;

(iii)the country of the governing corporate or similar law under which the securities are issued;

(iv)the LEI code of the issuer;

(v)the corporate name of the issuer;

(bb)a list of securities issues recorded in securities accounts not centrally maintained in each securities settlement system operated by the CSD, specifying all of the following:

(i)the ISIN code of the securities;

(ii)the country of incorporation of the issuer;

(iii)the LEI code of the issuer;

(iv)the corporate name of the issuer;’;

(iv)point (d) is amended as follows:

(1)points (ii) and (iii) are replaced by the following:

(ii)by country of incorporation of the participant to which the services are provided;

(iii)by country of incorporation of their issuer;’;

(2)the following point (iv) is added:

(iv)by country of the governing corporate or similar law under which they are issued;’;

(v)in point (f), the following point (iv) is added:

(iv)by country of the governing corporate or similar law under which they are issued;’;

(vi)in point (h), the following point (iiia) is inserted:

(iiia)by country of the governing corporate or similar law under which the financial instruments are issued;’;

(vii)point (i) is replaced by the following:

(i)the number and value of buy-in transactions referred to in Article 7a of Regulation (EU) No 909/2014;’;

(viii)point (l) is replaced by the following:

(l)the total number and value of settlement instructions settled via each CSD link, specifying:

(i)the linked CSD (its country of incorporation, its LEI and its corporate name) and, where the CSD operates several of them, the linked securities settlement system;

(ii)the type of link, as follows:

(1)standard, as referred to in Article 2(1), point (30), of Regulation (EU) No 909/2014;

(2)customised, as referred to in Article 2(1), point (31), of Regulation (EU) No 909/2014, per participant;

(3)indirect, as per Article 2(1), point (32), of Regulation (EU) No 909/2014

(4)interoperable, as per Article 2(1), point (33), of Regulation (EU) No 909/2014;

(iii)whether the CSD is the requesting CSD or the receiving CSD, for which purpose the receiving CSD shall be considered the CSD providing the service referred to in of Section A, point (1), of the Annex to Regulation (EU) No 909/2014;’;

(b)the following paragraphs 2a and 2b are inserted:‘2a.The nominal value referred to in paragraph 1 shall be set to zero for securities denominated in units and recorded as such in the securities settlement systems, where the nominal value is not available.2b.The information provided by the CSD under paragraph 1, points (a) to (f), shall reflect the situation at the end of the calendar year or of the period referred to in that paragraph, as applicable.’;

(4)Article 44 is replaced by the following:‘Article 44Information to be supplied to the authorities referred to in Article 22(7) of Regulation (EU) No 909/2014For each review period, the competent authority shall supply the relevant authorities, ESMA and, where applicable, the college referred to in Article 24a of Regulation (EU) No 909/2014 and the authority referred to in Article 67 of Directive 2014/65/EU, with all of the following:

(a)a report on the evaluation by the competent authority of whether the arrangements, strategies, processes and mechanisms implemented by the CSD comply with Regulation (EU) No 909/2014, including:

(i)the plans referred to in Article 22a of that Regulation;

(ii)an evaluation of the risks to which the CSD is or might be exposed or which it creates for the smooth functioning of securities markets or stability of the financial markets;

(a)the result of the most recent evaluation of whether the CSD has complied with Regulation (EU) 2022/2554, including any identified compliance gaps and related recommendations or remedial measures;

(b)any envisaged or final remedial actions or penalties against the CSD as a result of the review and evaluation.

(b)where applicable, about the result of the evaluation on issues relating to any outsourcing or extension of activities and services under Article 19 of Regulation (EU) No 909/2014;

(c)the provision of cross-border services by the CSD;

(d)issues relating to any potential breach of Regulation (EU) No 909/2014 arising from the provision of services in a host Member States as referred to in Article 24(5) of that Regulation.’

The report referred to in point (a) of the first subparagraph shall contain information about:;

(5)in Article 45(2), point (a) is replaced by the following:

(a)a report on the evaluation by the competent authority of the risks to which the CSD is or might be exposed or which it creates for the smooth functioning of securities markets or stability of the financial markets;’.

Article 2Entry into force and application#

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.However, Article 1, points (3)(a)(ii) to (3)(a)(vi) and (3)(a)(viii) shall apply from 3 November 2027.