Delegated regulation 2019/359 - Supplement to Regulation 2015/2365 with regard to regulatory technical standards specifying the details of the application for registration and extension of registration as a trade repository - Main contents

EN

Official Journal of the European Union

L 81/45

Rules should be laid down specifying the information to be provided to the European Securities and Markets Authority (ESMA) as part of an application for registration or extension of registration as a trade repository.

Establishing a comprehensive and sound framework for registration and extension of registration of trade repositories is essential for the achievement of the objectives of Regulation (EU) 2015/2365 and for the efficient provision of repository functions.

The rules and standards for the registration and the extension of registration of trade repositories for the purposes of Regulation (EU) No 2365/2015 should build on pre-existing infrastructures, operational processes and formats which were introduced with regard to reporting derivative contracts to trade repositories, in order to minimise additional operational costs for market participants.

Experience in applying the provisions of Commission Delegated Regulation (EU) No 150/2013 (2) supplementing Regulation (EU) No 648/2012 of the European Parliament and of the Council on OTC derivatives, central counterparties and trade repositories with regard to regulatory technical standards specifying the details of the application for registration as a trade repository has proved that the provisions for registration of trade repositories under Regulation (EU) No 648/2012 constitute a sound basis to build the framework for registration of trade repositories under Regulation (EU) 2015/2365. In order to further strengthen that framework, this Regulation should reflect the evolving nature of the industry.

Any application for registration as a trade repository should contain information on the structure of its internal controls and the independence of its governing bodies, in order to enable ESMA to assess whether the corporate governance structure ensures the independence of the trade repository and whether that structure and its reporting routines are sufficient to ensure compliance with the requirements for trade repositories set out in Regulation (EU) 2015/2365. Detailed information on the relevant internal control mechanisms and structures, the internal audit function as well as the audit work plan should be included in the application for registration in order to enable ESMA to assess the way in which those factors contribute to the efficient functioning of the trade repository.

Although trade repositories which operate through branches are not considered separate legal persons, separate information on branches should be provided in order to enable ESMA to clearly identify the position of the branches in the organisational structure of the trade repository, assess the fitness for duty and appropriateness of the senior management of the branches, and evaluate whether the control mechanisms, compliance and other functions in place are robust enough to identify, evaluate and manage the branches' risks in an effective manner.

For the purpose of enabling ESMA to assess the good repute, experience and skills of the prospective trade repository's board members and senior management, an applicant trade repository should provide relevant information on those persons such as the curricula vitae, details regarding any criminal convictions, self-declarations of good repute and declarations of any potential conflicts of interests.

Any application for registration should contain information which demonstrates that the applicant has the necessary financial resources at its disposal for the performance of its functions as a trade repository on an on-going basis and effective business continuity arrangements.

Article 5(2) of Regulation (EU) 2015/2365 requires trade repositories to verify the completeness and correctness of data reported under Article 4 thereof. In order to be registered or be granted an extension of registration under Regulation (EU) 2015/2365, trade repositories should demonstrate that they have established systems and procedures which ensure their ability to verify the completeness and correctness of the details of the securities financing transactions (SFTs).

The use of common resources within a trade repository between SFT reporting services on the one hand and ancillary services or derivative reporting services on the other may lead to contagion of operational risks across services. Whereas the validation, reconciliation, processing and recordkeeping of data may require an effective operational separation to avoid such contagion of risks, practices such as a common front-end of systems, a common access point to data for authorities or the use of the same staff working in sales, compliance, or a client services helpdesk may be less prone to contagion and hence do not necessarily require operational separation. Trade repositories should therefore establish an appropriate level of operational separation between the resources, systems or procedures used in different business lines, including where those business lines comprise the provision of services subject to other Union or third country legislation, and ensure that detailed and clear information on the ancillary services, or other business lines that the trade repository offers outside its core activity of repository services under Regulation (EU) 2015/2365, is provided to ESMA in the application for registration or extension of registration.

The soundness, resilience and protection of the information technology systems of trade repositories are essential to ensure compliance with the objectives of Regulation (EU) 2015/2365. Accordingly, trade repositories should provide comprehensive and detailed information on those systems to allow ESMA to assess the soundness and resilience of their information technology systems. Where the provision of repository functions is outsourced to third parties, either at the level of the group or outside the group, the trade repository should provide detailed information on the relevant outsourcing arrangements to allow the assessment of compliance with the conditions for registration, including information on any service level agreements, on metrics and on how those metrics are effectively monitored. Finally, information should be provided by trade repositories on the mechanisms and controls that they put in place to effectively manage potential cyber-risks and to protect the data they maintain from cyber-attacks.

Different types of users can report, access or modify the data maintained by the trade repository. The characteristics, as well as the rights and obligations of the different types of users should be clearly defined by the trade repository and should be provided as part of the application for registration. The information provided by the trade repositories should also clearly identify the different categories of access available. To ensure the confidentiality of data, but also its availability to third parties, a trade repository should provide information about how it ensures that only the data for which the relevant counterparties have provided their explicit, revocable and discretionary consent is made available to third parties. Finally, the trade repository should provide information in its application on the channels and mechanisms used to publicly disclose information on its access rules in order to ensure an informed decision by its service users.

The fees associated with the services provided by trade repositories are essential information for enabling market participants to make an informed choice and should therefore form part of the application for registration as a trade repository.

Given that market participants and authorities rely on the data maintained by trade repositories, strict and effective operational and record-keeping arrangements should be clearly described in a trade repository's application for registration. To demonstrate how the confidentiality and protection of data maintained by the trade repository is preserved as well as to allow for its traceability, a specific reference regarding the set-up of a reporting log needs to be included in the application for registration.

To achieve the objectives of Regulation (EU) 2015/2365 regarding the transparency of SFTs, trade repositories should demonstrate that they apply the procedure for terms and conditions of access in accordance with Commission Delegated Regulation (EU) 2019/357 (3), that the integrity of the data provided to authorities is ensured and that they are in a position to provide access to the data in accordance with the relevant requirements included in Commission Delegated Regulation (EU) 2019/358 (4).

The effective payment of the registration fees by trade repositories at the time of application is essential to cover ESMA's necessary expenditure relating to the registration or extension of registration of a trade repository.

A simplified application procedure for the extension of registration should be established to allow those trade repositories already registered under Regulation (EU) No 648/2012 to have that registration extended under Regulation (EU) 2015/2365. To avoid any duplicate requirements, the information to be provided by the trade repository as part of an extension of registration should include detailed information on the adaptations necessary to ensure it complies with the requirements under Regulation (EU) 2015/2365.

This Regulation is based on the draft regulatory technical standards submitted by the European Securities and Markets Authority to the European Commission pursuant to the procedure in Article 10 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority) (5).

ESMA has conducted open public consultations on these draft regulatory technical standards, analysed the potential related costs and benefits and requested the opinion of the Securities and Markets Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1095/2010,

the corporate name of the applicant and legal address within the Union;

an excerpt from the relevant commercial or court register, or other forms of certified evidence of the place of incorporation and scope of business activity of the applicant, valid at the application date;

information on the types of securities financing transactions for which the applicant wishes to be registered;

information on whether the applicant is authorised or registered by a competent authority in the Member State where it is established, and in such case, the name of the authority and any reference number related to the authorisation or registration;

the articles of incorporation and, where relevant, other statutory documentation stating that the applicant is to conduct trade repository services;

the minutes from the meeting where the applicant's Board approved the application;

the name and contact details of the person(s) responsible for compliance, or any other staff involved in compliance assessments for the applicant;

the programme of operations, including indications of the location of the main business activities;

the identification of any subsidiaries and, where relevant, the group structure;

any service, other than the trade repository function, that the applicant provides or intends to provide;

any information on any pending judicial, administrative, arbitration or any other litigation proceedings irrespective of their type, that the applicant may be party to, particularly as regards tax and insolvency matters and where significant financial or reputational costs may be incurred, or any non- pending proceedings, that may still have any material impact on trade repository costs.

an indication that the Board approves the policies, that the senior management approves the procedures and that the senior management is responsible for the implementation and maintenance of the policies and procedures;

a description of how the communication of policies and procedures within the applicant is organised, how compliance with the policies is ensured and monitored on a day to day basis, and the person or persons responsible for compliance in that regard;

any records indicating that employed and dedicated staff are aware of the policies and procedures;

a description of the measures to adopt in the event of a breach of policies and procedures;

an indication of the procedure for reporting to ESMA any material breach of policies or procedures which may result in a breach of the conditions for initial registration.

a list containing the name of each person or entity who directly or indirectly holds 5 % or more of the applicant's capital or of its voting rights or whose holding makes it possible to exercise a significant influence over the applicant's management;

a list of any undertakings in which a person referred to in point (a) holds 5 % or more of the capital or voting rights or over whose management they exercise a significant influence.

identify the legal address of that parent undertaking;

indicate whether the parent undertaking is authorised or registered and subject to supervision, and when this is the case, state any reference number and the name of the responsible supervisory authority.

the applicant's internal control policies and respective procedures related to their consistent and effective implementation;

any policies, procedures and manuals regarding the monitoring and evaluation of the adequacy and effectiveness of the applicant's systems;

any policies, procedures and manuals regarding the control and safeguard for the applicant's information processing systems;

the identity of the internal bodies in charge of the evaluation of the relevant internal control findings.

the composition of any Internal Audit Committee, its competences and responsibilities;

its internal audit function charter, methodologies, standards and procedures;

an explanation how its internal audit charter, methodology and procedures are developed and applied taking into account the nature and extent of the applicant's activities, complexities and risks;

a work plan for three years following the date of application addressing the nature and extent of the applicant's activities, complexities and risks.

a description of the roles of the persons responsible for compliance and of any other staff involved in the compliance assessments, including how the independence of the compliance function from the rest of the business will be ensured;

the internal policies and procedures designed to ensure that the applicant, including its managers and employees, comply with all the provisions of Regulation (EU) 2015/2365, including a description of the role of the board and senior management;

where available, the most recent internal report prepared by the persons responsible for compliance or any other staff involved in compliance assessments within the applicant.

a copy of the curriculum vitae;

detailed information on the knowledge and experience in IT management, operations and development;

details regarding any criminal convictions in connection with the provision of financial or data services or in relation to acts of fraud or embezzlement, in particular in the form of an official certificate if available within the relevant Member State;

a self-declaration of good repute in relation to the provision of a financial or data service, where each member of the senior management and the Board states whether they:

a declaration of any potential conflicts of interests that the senior management and the members of the board may have in performing their duties and how these conflicts are managed.

a copy of the remuneration policy for the senior management, board members and the staff employed in risk and control functions of the applicant;

a description of the measures put in place by the applicant to mitigate the risk of over-reliance on any individual employees.

a general list of the staff directly employed by the trade repository, including their role and qualifications per role;

a specific description of the information technology staff directly employed to provide trade repository services, together with the role and the qualifications of each individual;

a description of the roles and qualifications of each individual who is responsible for internal audit, internal controls, compliance and risk assessment;

the identity of the dedicated staff members and those members of the staff that are operating under an outsourcing arrangement;

details of the training on the applicant's policies and procedures as well as the trade repository business, including any examination or other type of formal assessment required for staff regarding the conduct of trade repository activities.

a complete set of financial statements, prepared in conformity with international standards adopted in accordance with Article 3 of Regulation (EC) No 1606/2002 of the European Parliament and of the Council (6);

where the financial statements of the applicant are subject to statutory audit within the meaning given in Article 2(1) of the Directive 2006/43/EC of the European Parliament and of the Council (7), the financial reports shall include the audit report on the annual and consolidated financial statements;

if the applicant is audited, the name and the national registration number of the external auditor;

the expected level of reporting activity in number of transactions;

the relevant fixed and variable costs identified with respect to the provision of repository services under Regulation (EU) 2015/2365;

positive and negative variations of at least 20 % from the base activity scenario identified.

the pro-forma statement demonstrating proper resources and expected business status in six months after registration is granted;

an interim financial report where the financial statements are not yet available for the requested period of time;

a statement of financial position, such as a balance sheet, income statement, changes in equity and of cash flows and notes comprising a summary of accounting policies and other explanatory notes.

an indication of any future plans for the establishment of subsidiaries and their location;

a description of the business activities which the applicant plans to carry out, specifying the activities of any subsidiaries or branches.

policies and procedures with respect to the identification, management and disclosure of conflicts of interest and a description of the process used to ensure that the relevant persons are aware of the policies and procedures;

any other measures and controls put in place to ensure the requirements referred to in point (a) on conflicts of interest management are met.

for illegitimate purposes;

for disclosure of confidential information;

not permitted for commercial use.

a detailed description of the information technology system including the relevant business requirements, functional and technical specifications, system architectural and technical design, data model and data flows, and operations and administrative procedures and manuals;

user facilities developed by the applicant in order to provide services to the relevant users, including a copy of any user manual and internal procedures;

the investment and renewal policies on information technology resources of the applicant;

the outsourcing arrangements entered into by the applicant, including:

a description of the ancillary services that the applicant, or the undertaking within its group, performs and a description of any agreement that the trade repository may have with companies offering trading, post- trading, or other related services, as well as copies of such agreements;

the procedures and policies that ensure the necessary degree of operational separation in terms of resources, systems and procedures, between the applicant's trade repository services under Regulation (EU) 2015/2365 and other business lines, including those business lines that comprise the provision of services under Union or third country legislation, irrespective of whether that separate business line is run by the trade repository, a company belonging to its holding company, or any other company within which it has an agreement in the context of the trading or post-trading chain or business line.

the policies and procedures pursuant to which the different types of users report and access the data in a trade repository, including any process that the relevant users may need to access, consult, or modify the information maintained by the trade repository;

a copy of the terms and conditions which determine the rights and obligations of the different types of users in relation to the information maintained by the trade repository;

a description of the different categories of access available to users;

the access policies and procedures pursuant to which other services providers may have non-discriminatory access to information maintained by the trade repository where the relevant counterparties have provided their written, voluntary and revocable consent;

a description of the channels and mechanisms used by the trade repository to publicly disclose information on the access to that trade repository.

internal users;

reporting counterparties;

report submitting entities;

entities responsible for reporting;

non-reporting counterparties;

non-reporting third parties;

entities listed in Article 12(2) of Regulation (EU) 2015/2365;

other types of users, where applicable.

procedures for the authentication of the identity of the users accessing the trade repository in accordance with Article 1 of Delegated Regulation (EU) 2019/358;

procedures for the verification of the use of an XML template complying with the ISO 20022 methodology in accordance with Article 1 of Delegated Regulation (EU) 2019/358;

procedures for the verification of the authorisation and IT permission of the entity reporting on behalf of the reporting counterparty in accordance with Article 1 of Delegated Regulation (EU) 2019/358;

procedures for verification that the logical sequence of the reported SFT details is maintained at all times in accordance with Article 1 of Delegated Regulation (EU) 2019/358;

procedures for the verification of the completeness and correctness of the reported SFT details in accordance with Article 1 of Delegated Regulation (EU) 2019/358;

procedures for the reconciliation of data between trade repositories where counterparties report to different trade repositories in accordance with Article 2 of Delegated Regulation (EU) 2019/358;

procedures for the provision of feedback to the counterparties to the SFTs or the third parties reporting on their behalf, on the verifications performed under points (a) to (e) and the outcomes of the reconciliation process under point (f) in accordance with Article 3 of Delegated Regulation (EU) 2019/358.

pricing policy, including any existing discounts and rebates and conditions to benefit from such reductions;

fee structure for providing any trade repository and ancillary services including the estimated cost of the trade repository services and ancillary services, along with the details of the methods used to account the separate cost that the applicant may incur when providing trade repository services and ancillary services;

methods used to make the information publicly available to all types of users, including a copy of the fee structure in which trade repository services and ancillary services are unbundled.

a detailed description of the resources available and procedures designed to identify and mitigate operational risk and any other material risk to which the applicant is exposed, including a copy of any relevant policies, methodologies, internal procedures and manuals;

a description of the liquid net assets funded by equity to cover potential general business losses in order to continue providing services as a going concern, and an assessment of the sufficiency of its financial resources with the aim of covering the operational costs of a wind-down or reorganisation of the critical operations and services over at least a six-months period;

the applicant's business continuity plan and the policy for updating it, including the following:

a description of the arrangements for ensuring the applicant's trade repository activities in case of disruption and the involvement of trade repository users and other third parties in them.

a timely and accurate registration of the information reported;

a record-keeping of all reported information relating to the conclusion, modification or termination of an SFT in a reporting log;

that the data is maintained both online and offline;

that the data is adequately copied for business continuity purposes.

a procedure to calculate the aggregate positions in accordance with Article 6 of Delegated Regulation (EU) 2019/358 and a description of the resources, methods and channels that the trade repository will employ in order to facilitate access to the data contained therein to the public in accordance with Article 12(1) of Regulation (EU) 2015/2365, and a description of the frequency of updates, along with a copy of any specific manuals and internal policies;

a description of the resources, methods and facilities that the trade repository employs in order to facilitate the access to its information to the relevant authorities in accordance with Article 12(2) of Regulation (EU) 2015/2365, the frequency of the update and the controls and verifications that the trade repository may establish for the access filtering process, along with a copy of any specific manuals and internal procedures;

a procedure and a description of the resources, methods and channels that the trade repository employs in order to facilitate the timely structured and comprehensive collection of data from counterparties, the access to its information to counterparties to SFTs in accordance with Article 4(6) of Regulation (EU) 2015/2365 and Article 80(5) of Regulation (EU) No 648/2012, along with a copy of the specific manuals and internal policies.

the terms and conditions under which the authorities referred to in Article 12(2) of Regulation (EU) 2015/2365 are given direct and immediate access to the details of SFTs maintained at the trade repository in accordance with Delegated Regulation (EU) 2019/357;

the procedure under which the authorities referred to in point (a) are given direct and immediate access to the details of SFTs maintained at the trade repository in accordance with Articles 4 and 5 of Delegated Regulation (EU) 2019/358;

the procedure to ensure the integrity of the data accessed by those authorities.

Article 1, except point (k) of paragraph 1;

Article 2;

Article 5;

Article 7, except point (d) of paragraph 2;

Article 8(b);

Article 9(1)(b) and 9(1)(e);

Article 11;

Article 12(2);

Article 13;

Article 14(2);

Article 15;

Article 16, except point (c);

Article 17;

Article 18;

Article 19;

Article 20;

Article 21;

Article 22;

Article 23;

Article 24;

Article 25;

Article 27.