Commission Implementing Regulation (EU) 2026/543

Contents

THE EUROPEAN COMMISSION,Having regard to the Treaty on the Functioning of the European Union,Having regard to Regulation (EU) 2023/2631 of the European Parliament and of the Council of 22 November 2023 on European Green Bonds and optional disclosures for bonds marketed as environmentally sustainable and for sustainability-linked bonds^note, and in particular Article 24(2), fourth subparagraph, thereof,Whereas:

(1)To safeguard security and enhance data management and usability, the standard forms, templates, and procedures that external reviewers should use when notifying the European Securities and Markets Authority (ESMA) of material changes in the information provided for registration should be machine-readable and be provided in a durable medium.

(2)To assist ESMA in identifying the documents that an external reviewer has submitted as part of the notification of material changes in the information provided for registration, external reviewers should provide each document submitted with a unique reference number.

(3)For assurance and accountability purposes, an external reviewer that notifies ESMA of material changes in the information provided for registration should complement the notification with a letter signed by a member of its senior management, attesting that the submitted information is accurate and complete to the best of its knowledge.

(4)This Regulation respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union, and notably the right to protection of personal data. The processing of personal data for the purposes of this Regulation should be carried out in accordance with Union law on the protection of personal data. In that regard, any processing of personal data by ESMA in application of this Regulation should be carried out in accordance with Regulation (EU) 2018/1725 of the European Parliament and of the Council^note. Any processing of personal data by external reviewers within application of this Regulation should be carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council^note and national requirements on the protection of natural persons with regard to the processing of personal data.

(5)To enable ESMA to assess the notifications of material changes in the information provided for registration as an external reviewer, while ensuring proper safeguards, personal data regarding external reviewers should be retained by those external reviewers and ESMA for no longer than five years after the external reviewer has ceased to perform its function.

(6)The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered formal comments on 18 November 2025.

(7)This Regulation is based on the draft implementing technical standards submitted to the Commission by ESMA.

(8)ESMA conducted open public consultations on the draft implementing technical standards on which this Regulation is based. It has analysed the potential related costs and benefits and requested the advice of the Securities and Markets Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council^note,

HAS ADOPTED THIS REGULATION: