Chapter II, Section I, Article 4 · Commission Delegated Regulation (EU) 2026/255

Contents

Article 4Supporting documents#

1.The application shall include supporting documents describing compliance with the general organisational requirements for IIPs and RRMs set out in Articles 11 to 18 and the policies and procedures that the applicant has in place to ensure orderly substitution pursuant to Article 38.In addition to the documents referred to in the first subparagraph, IIP applicants shall include supporting documents describing compliance with the IIP requirements set out in Articles 19 to 25 and RRM applicants shall include supporting documents describing compliance with the RRM requirements set out in Articles 26 to 29.

2.The application shall include the following:

(a)information on the policies, contingency plans and arrangements of the IIP or RRM to ensure compliance with the timing of disclosure of information and submitting inside information reports and reporting data records to the Agency, in accordance with Article 11, including the related supporting documents;

(b)information on the data validation system of the IIP or the RRM to check the accuracy and completeness of inside information reports or data records, including compliance with data validation principles and processes, in accordance with Article 12, including the related supporting documents;

(c)information on the arrangements of the IIP or the RRM designed to guarantee the compliance with security requirements in accordance with Article 13, including the related supporting documents;

(d)the organisational chart of the IIP or the RRM, relating to the functions and structures relevant to activities carried out under Regulation (EU) No 1227/2011;

(e)the programme of operations of the IIP or the RRM, relating to the activities carried out under Regulation (EU) No 1227/2011;

(f)information on the administrative arrangements of the IIP or the RRM to prevent conflicts of interest and discrimination referred to in Article 16, including the related supporting documents;

(g)information on the resources of the IIP or the RRM and the implemented back-up facilities to maintain their respective services in accordance with Article 17, including the related supporting documents;

(h)information on the implementation of technical standards, including any updates thereof, to ensure the secure and efficient operation of the data collection process and the subsequent reporting to the Agency, including the related supporting documents.

3.The organisational chart of the IIP or RRM referred to in paragraph 2, point (d), shall:

(a)display the group structure and ownership links between the parent undertaking and its subsidiaries or any other associated entities or branches, and indicate their respective activities;

(b)indicate the legal name and address of the undertakings shown in the organisational chart;

(c)identify the persons responsible for reporting of data records or operating the platform for the disclosure of information and submission of inside information reports to the Agency and provide descriptions of their tasks and business contact details.

4.The programme of operations referred to in paragraph 2, point (e), shall describe in detail the operational framework and the internal control mechanisms to ensure compliance with this Regulation and Regulation (EU) No 1227/2011.The description of the operational framework shall illustrate the business model of the applicant, including the services and products offered related to this Regulation and Regulation (EU) No 1227/2011, and indicate any relevant outsourcing arrangements, in which case it shall specify how such outsourcing arrangements ensure compliance with the requirements laid down in this Regulation and with Regulation (EU) No 1227/2011.The description of the internal control mechanisms shall illustrate the mechanisms to ensure effective governance and risk management, procedures and systems for monitoring and managing risks related to this Regulation and Regulation (EU) No 1227/2011, including the identification of potential risks and corresponding mitigation strategies.

5.Applicants may demonstrate compliance with any of the requirements referred to in paragraphs 2, 3 and 4 through submission to the Agency of a valid ISO/IEC 27000 standard series certificate on information security management systems or equivalent certifications. The Agency may ask the applicants for further clarifications regarding the certification provided, any missing information to demonstrate compliance with the requirements referred to in paragraphs 2, 3 and 4 and for an update of such certification after its expiration date.

6.IIP applicants shall provide to the Agency information about the time needed by the IIPs to disclose on their platform the information received from their IIP clients and successfully validated by their data validation systems. IIP applicants shall provide to the Agency information about the manner in which they set the fees to be paid by their IIP clients in accordance with Article 25.

7.RRM applicants shall provide supporting documents regarding the information systems they have in place to ensure data transfers from other systems or platforms in accordance with Article 15. RRM applicants shall indicate the name of such systems or platform, and of any user facilities generating reportable data to the technical solution implemented by the applicant, together with information on any data transformation having occurred in that process.