EBA Decision on Rules of Procedure for Investigation of Breach of Union Law

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW EBA Regular Use EBA/DC/2020/312 (consolidated version) ➢O Decision of the European Banking Authority of 22-01-2020 concerning rules of procedure for investigation of breach of Union law Amended by: ➢A1 EBA/DC/2021/419 03.12.2021 The Board of Supervisors of the European Banking Authority Having regard to Regulation (EU) No 1093/2010 of the European Parliament and of the Council establishing the European Banking Authority (the "Regulation" and "EBA", respectively), in particular Articles 17 and 41(4) thereof, Whereas: (1) Article 17 of the Regulation provides for the EBA to investigate the non-application by competent authorities of the acts referred to in Article 1(2) of the Regulation, or their application in a way which appears to be a breach of Union law. (2) Although initiating investigations remains within the EBA's discretion, for reasons of transparency and legal certainty, these rules of procedure (“Rules of Procedure”) should set out factors, criteria and other related matters to be taken into account in relation to requests to initiate investigations that are received from third parties or, to the extent relevant, to EBA own initiative investigations. (3) According to Article 41(1) of the Regulation, the Board of Supervisors may provide for the delegation of certain tasks. In order to meet the very short timescales provided in the Regulation for carrying out an investigation and making any necessary recommendations to competent authorities, it would be appropriate that initiating investigations should be determined by the Chairperson, whereas the panel established in accordance with Article 41(2) of the Regulation should close an investigation that has been initiated.

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW 2 EBA Regular Use (4) The Regulation has been amended by Regulation (EU) 2175/20191 in a number of respects relating to the investigation of breaches of Union law and it is therefore necessary to update the EBA’s framework in this area. The existing rules of procedure for investigating breaches of Union law should therefore be replaced by this decision which should take effect immediately. Has decided as follows: Title 1 – Scope Article 1 – Scope and application of the Rules of Procedure This Decision sets out the Rules of Procedures for applying Article 17 of the Regulation on investigating breaches of Union law. They shall apply to Requests to investigate that the EBA received as well as, to the extent relevant, to own initiative investigations in the absence of a Request. Title 2 – Request to investigate a breach of Union law Article 2 – The Requester Requests to investigate an alleged breach or non-application of Union law by a competent authority (“Request”) may be made by one or more competent authorities, the European Parliament, the Council, the European Commission or the Banking Stakeholder Group ("Requester"). The Chairperson may also initiate investigations on his/her own initiative and for that purpose may take into account any Request made to the EBA by any other legal or natural person (also referred to as a "Requester") pointing to measures or practices of a competent authority indicating a breach or non-application of Union law. Requesters shall not have to demonstrate a formal interest; nor shall they have to prove that they are principally and directly concerned by the breach or non-application which is the subject of the Request. The EBA shall respond to a Request by outlining how it intends to proceed with the case and, if appropriate, investigate the alleged breach of or non-application of Union law, in accordance with these Rules of Procedure. Article 3 – Submission of a Request and admissibility criteria

1. Requests shall be sent to the EBA via the EBA's website, by electronic mail or by post. The relevant contacts shall be published on the EBA website. Requests shall be made in one of the official languages of the Union.
2. A Request shall fulfil each of the following conditions: (i) it shall set out a clear grievance explaining how a competent authority has not applied the acts referred to in Article 1(2) of the Regulation, or has applied them 1 OJ L 334, 27.12.2019, p. 1–145

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW 3 EBA Regular Use in a way which appears to be a breach of Union law, including the technical standards established in accordance with Articles 10 to 15 of the Regulation, in particular a failure of a competent authority to ensure that a financial institution satisfies the requirements laid down in those acts; (ii) where the Request is made by a natural or legal person, it shall be based on well substantiated information; and (iii) it shall not fall into one of the categories set out in Annex 1. ➢A1 3. The EBA shall examine Requests with a view to arriving at a decision as to whether a Request is admissible within 6 months from the date of its receipt. ➢O Article 4 – Preliminary enquiry

1. The Chairperson may invite the competent authority concerned, the Requester or any other legal or natural person to provide information within a specified period. Taking account of the urgency and complexity of the case, the Chairperson may set clear deadlines and other terms, including as to the volume and format of written submissions, for information to be provided by the competent authority.
2. Where deemed appropriate to resolve a breach of Union law, the Chairperson may engage with the competent authority concerned in an attempt to reach agreement on actions necessary for the competent authority to comply with Union law. Article 5 – Closure of the case without opening an investigation
3. The Chairperson may close the case without initiating an investigation where the Chairperson considers that any of the following applies: (i) the Request does not meet the requirements in Article 3 (2); (ii) an investigation should not be initiated as a matter of discretion, taking into account the non-exhaustive list of factors included in Annex 2; (iii) agreement has been reached on actions necessary for the competent authority to comply with Union law.
4. The Chairperson may delegate the closure of cases referred to in point (i) of paragraph (1) to a Director or Head of Unit.
5. Where the case is closed without initiating an investigation in accordance with paragraph 1, (i) the Requester shall be notified of the fact that the case has been closed and the reasons for closing the case;

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW 4 EBA Regular Use (ii) where the Requester is a natural or legal person, the Requester shall also be informed of appropriate alternative forms of redress, such as recourse to national courts, the European Ombudsman, a national ombudsman or any other national or international complaints procedure; (iii) if the competent authority concerned has been notified of the Request, that authority shall also be notified. ➢A1 4. The EBA shall examine Requests with a view to arriving at a decision to open an investigation or close the case within 6 months from the date of receipt of the Request, except where a longer period, which should not normally exceed 12 months, is justified due to the complexity of the case, the extent of the preliminary enquiries which have to be made and the timeliness of those responses, and the need to prioritise some Requests over others. ➢O Title 3 – Investigation of an alleged breach or non-application of Union law Article 6 – Initiation of the investigation

1. If the Chairperson determines that the information received is complete and sufficient to initiate an investigation and that such an investigation should be initiated, the Chairperson shall inform the Vice-Chairperson about the proposal to initiate an investigation.
2. If the Vice-Chairperson objects to this proposal within five working days, the Chairperson shall review whether to proceed with an investigation.
3. Where the Vice-Chairperson acts instead of the Chairperson in proposing initiation of an investigation, the Vice-Chairperson shall inform a member of the Management Board of the proposal. If the member of the Management Board objects to this proposal within five working days, the Vice-Chairperson shall review whether to proceed with an investigation.
4. The Requester and the competent authority concerned shall be informed of the initiation of an investigation.
5. The date of this communication to the competent authority concerned shall be considered to be the date of the initiation of the EBA's investigation. Article 7 – Investigation
6. Where an investigation has been initiated, the Chairperson shall be responsible for investigating the alleged breach or non-application of Union law.
7. The Chairperson may request additional information from the competent authority concerned in accordance with Article 17(2) of the Regulation.

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW 5 EBA Regular Use 3. The Chairperson may request additional information from any other relevant legal or natural person. Taking account of the urgency and complexity of the case and to ensure that the Panel retains sufficient opportunity to carry out its tasks, the Chairperson may set clear deadlines for information to be provided by the competent authority. 4. Where deemed appropriate to resolve a breach of Union law, the Chairperson may engage with the competent authority concerned in an attempt to reach agreement on actions necessary for the competent authority to comply with Union law, including where such engagement has taken place prior to opening the investigation provided there has been a significant material change in circumstances. 5. The methodology applied across investigations by investigating staff shall be consistent. ➢A1 Article 8 – Composition, appointment, convocation and independence of the panel ➢O

1. Upon initiation of an investigation, the Chairperson shall propose a decision to convene an independent panel to be adopted by the Board of Supervisors pursuant to Article 41(2) of the Regulation (“Panel”). The Panel shall determine whether to close the investigation without adopting a recommendation or, in the event that a breach of Union law by the competent authority is established, propose a draft recommendation for adoption. Where necessary, the Chairperson shall propose replacement members for the Panel.
2. When the Chairperson convenes the Panel upon the initiation of an investigation, the Chairperson shall provide the investigation report, including the EBA’s staff assessment and conclusions on the case and the response of the competent authority to the EBA’s investigation. The Chairperson shall ensure that the Panel has adequate time to review the documents and to discuss them, where possible in person, taking into account the nature and complexity of the case as well as the two month period for carrying out an investigation specified in Article 17 of the EBA Regulation.
3. When the Chairperson convenes the Panel pursuant to Article 11 (2) of these Rules of Procedure, the Chairperson shall provide the formal opinion issued by the Commission and any other document of relevance. ➢A1
4. The members of the Panel shall act independently and objectively in the sole interest of the Union as a whole. The proceedings of the Panel shall be secret pending the closure of the investigation. Members of the Panel shall not divulge information concerning the investigation or discuss it with any person outside the proceedings of the investigation, except staff of a competent authority on a need-to-know basis for the specific purpose of receiving advice in relation to the investigation proceedings. For that purpose, the members of the Panel shall make a written declaration of commitment and absence of any interest or external influence which may be considered prejudicial to their independence.

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW 6 EBA Regular Use 5. No other persons, including members of the Board of Supervisors who are not members of the Panel, shall interfere in the work of the Panel or influence its members, except in accordance with the proceedings of the investigation. 6. The members of the Panel shall report to the Chairperson, without undue delay, any such attempt to influence them in the performance of the Panel's tasks. 7. The Chairperson shall take any appropriate action to ensure the independence of the Panel. ➢O Article 9 – Closure of an investigation without issuing a recommendation If the Panel closes the investigation without issuing a recommendation, the Requester and the competent authority concerned shall be informed of the reasons. Where the Requester is a natural or legal person, the Requester shall also be informed of appropriate alternative forms of redress, such as recourse to national courts, the European Ombudsman, a national ombudsman or any other national or international complaints procedure. Article 10 – Breach or non-application of Union law

1. The competent authority concerned shall provide the Panel with further information, orally or in writing, where requested by the Chairperson in accordance with Article 7(3).
2. The Panel shall hear the competent authority’s case in a telephone conference or physical meeting unless the Panel considers that it does not require such a teleconference or meeting in order to hear the competent authority’s case adequately. The Chairperson shall specify the timing, preparation and format of that meeting that take account of the urgency and complexity of the case and retain sufficient opportunity for the Panel to carry out its tasks.
3. If the Panel concludes that there has been a breach of Union law, the Chairperson shall inform, in accordance with Article 39 of the Regulation, the competent authority concerned about the proposal for the draft recommendation.
4. The draft recommendation shall contain all of the following: (i) the action necessary to comply with Union law; (ii) the reasons on which it is based; (iii) a deadline within which the competent authority shall comply with it and report on compliance to the Chairperson.
5. After hearing the views of the competent authority concerned, the Panel shall determine whether to propose a draft recommendation and shall make any revisions to the draft recommendation considered necessary.
6. Once the Panel proposes the draft recommendation, the Chairperson shall submit the draft recommendation, a summary of the Panel’s discussion, the investigation report and the views of the competent authority concerned for decision.

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW 7 EBA Regular Use 7. Where the Board of Supervisors concludes that there has been a breach of Union Law and agrees to address a recommendation to the competent authority concerned, in accordance with Article 17(3) of the Regulation, the competent authority has ten working days from the receipt of the recommendation to inform the Chairperson of the steps it has taken or intends to take to ensure compliance with Union law. The Chairperson shall inform the Commission and the Board of Supervisors accordingly. ➢A1 Members of EBA bodies responsible for preparing breach of Union law recommendations for the Board of Supervisors shall act independently and objectively in the sole interest of the Union as a whole when doing so. The proceedings of bodies referred to in paragraph 8 and of the Board of Supervisors shall be secret pending the closure of the investigation. Members of the Board of Supervisors and of such bodies shall not divulge information concerning the investigation or discuss it with any person outside those participating in the investigation proceedings of the Board of Supervisors or of that body, except staff of a competent authority on a need-to-know basis for the specific purpose of receiving advice in relation to the investigation proceedings. No other persons shall interfere in the work of the Board of Supervisors or of a body referred to in paragraph 8 or shall influence its members, except in accordance with the proceedings of the investigation. The members of the Board of Supervisors and of a body referred to in paragraph 8 shall report to the Chairperson, without undue delay, any attempt to influence them in the performance of their tasks relating to the investigation. The Chairperson shall take any appropriate action to ensure the independence of the Board of Supervisors and of a body referred to in paragraph 8. ➢O Article 11 – Decision addressed to competent authority to comply with the formal opinion of the Commission concerning non-compliance with an EBA Recommendation In AML/CFT cases where the relevant requirements of the acts referred to in Article 1(2) are not directly applicable to financial sector operators and where the Commission has adopted a formal opinion in accordance with Article 17(4) of the Regulation, the Chairperson may convoke the Panel in order to propose the adoption of a decision requiring the competent authority to comply with that formal opinion within the period of time specified therein. Article 10 shall apply mutatis mutandis for this purpose. Title 4 – Financial Institutions and other financial sector operators Article 12 – Individual decision addressed to financial institutions

1. The EBA shall provide any necessary assistance to the Commission in relation to any formal opinion the Commission proposes to issue in case of non-compliance by the competent authority in accordance with Article 17(4) of the Regulation.

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW 8 EBA Regular Use 2. When Article 17 (6) of the Regulation applies, the Chairperson shall, where relevant, convoke the Panel in order to propose to the Board of Supervisors an individual decision addressed to a financial institution or other financial sector operator requiring the necessary action to comply with its obligations under Union law. The decision may require the cessation of any conduct. 3. The Decision shall be in conformity with the formal opinion issued by the Commission and shall state the reasons on which it is based, the period within which the financial institution shall express its views and the legal remedies available. 4. The Chairperson shall inform the financial institution or financial sector operator concerned in accordance with Article 39 of the Regulation. Article 10(3), 10(5) and 10(6) shall apply mutatis mutandis. 5. A copy of the decision shall be provided to the competent authority concerned and to the Commission. Title 5 – Monitoring and publication Article 13 – Publication

1. A decision addressed to a financial institution or other financial sector operator shall be published on the EBA's website and shall state the identity of the financial institution concerned and the main content of the decision, unless such publication is in conflict with the legitimate interests of financial institutions in the protection of their business secrets or could seriously jeopardise the orderly functioning and integrity of financial markets or the stability of the whole or part of the financial system of the Union.
2. The EBA shall publish such details as are appropriate in respect of any recommendation or decision that has been addressed to a competent authority under these Rules of Procedure. The Chairperson shall provide the Requester with any non-confidential details of the recommendation as appropriate in the circumstances, in line with the Code of Good Administrative Behaviour.
3. In its annual report, the EBA shall set out which competent authorities and financial institutions have not complied with the formal opinions, recommendations or decisions referred to in Articles 10 to 12. Title 6 – Final provisions Article 14 – EBA staff The Chairperson shall be advised on legal and policy issues by the EBA staff. Article 15 – Confidentiality

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW 9 EBA Regular Use

1. If the Requester is an individual, disclosure of his/her identity and of information submitted by him/her to the competent authority concerned is subject to the individual’s prior agreement and shall be carried in accordance, inter alia, with Regulation (EU) 2018/17252 .
2. The Rules governing confidentiality in accordance with Article 70 of the Regulation and with the EBA’s Rules on Professional Secrecy and Confidentiality 3 which lay down practical arrangements for the implementation of the Regulation, shall apply to these proceedings. Moreover, anonymity and/or confidentiality of Requesters shall be ensured as requested or otherwise deemed appropriate using the EBA’s dedicated reporting channels pursuant to Article 17a of the Regulation. Article 16 – Conflict of interest
3. The Management Board, upon proposal of the Chairperson, shall nominate one of its members in place of the Vice-Chairperson where any of the following situations applies: (i) the alleged breach of Union Law concerns a competent authority of the Member State of the Vice-Chairperson; (i) the alleged breach of Union Law relates to an establishment of a credit institution in the Member State of the Vice-Chairperson; (ii) any other conflict of interest of the Vice-Chairperson is identified. The Chairperson shall ensure that none of these situations applies to the proposed member of the Management Board. Article 17 – Monitoring, recordkeeping and reporting to the Board of Supervisors
4. The Chairperson shall take any necessary steps to monitor whether addressees of recommendations, formal opinions and individual decisions comply and shall report regularly to the Board of Supervisors on that compliance.
5. The Chairperson shall maintain a record of the Requests to investigate that it has received and of the actions taken under this procedure and shall report that information annually to the Board of Supervisors on the basis of anonymised information. Article 18 – Requests concerning to an EEA EFTA State This Decision shall apply to investigations of an alleged breach of the EEA Agreement by a competent authority of an EEA EFTA State, and to requests to carry out such an investigation, with the following modifications: (1) References to Union law shall be understood as references to the EEA Agreement. (2) In Article 2(1), the Standing Committee of the EFTA States and the EFTA 2 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, OJ L 295, 21.11.2018, p. 39–98. 3 EBA DC 004 Decision on Professional Secrecy and Confidentiality.

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW 10 EBA Regular Use Surveillance Authority shall also be considered as‘Requesters’. (3) For the purpose of Article 6, the Chairperson shall inform the EFTA Surveillance Authority of the initiation of aninvestigation. (4) For the purpose of Article 8, the EFTA Surveillance Authority shall be an observer to the Panel. (5) For the purpose of Article 10(3), the Chairperson shall also inform the EFTA Surveillance Authority about the draft recommendation. (6) For the purpose of Article 10(7), the Chairperson shall provide a copy of the recommendation to the EFTA Surveillance Authority. The EEA EFTA competent authority concerned shall, within 10 working days of receipt of the recommendation, inform the EBA and the EFTA Surveillance Authority of the steps that it has taken or intends to take to ensure compliance with the EEA Agreement. (7) Article 11(1) shall be replaced with the following: “Where the Chairperson considers that the EEA EFTA competent authority has not complied with the EEA Agreement within 1 month from receipt of the recommendation, the Chairperson may ask the EFTA Surveillance Authority to issue a formal opinion on the basis of the EBA recommendation or, where new developments require it, may prepare a draft formal opinion to be submitted to the EFTA Surveillance Authority, on his own initiative or at the request of the EFTA Surveillance Authority. That draft formal opinion shall be based on the recommendation and shall be adopted as a draft formal opinion by the Board of Supervisors. The EEA EFTA competent authority shall, within 10 working days of receipt of any formal opinion adopted by the Surveillance Authority, inform the EBA and the EFTA Surveillance Authority of the steps it has taken or intends to take to comply with that formal opinion. (8) In Articles 12(2) and 12(3), references to the Commission shall be understood as references to the EFTA Surveillance Authority and references to a decision shall be understood as references to a draft prepared by the EBA and to be adopted by the EFTA Surveillance Authority. (9) Article 12(4)shall be replaced with the following: “The Chairperson shall inform the EFTA Surveillance Authority, setting a time limit within which the EFTA Surveillance Authority may allow any natural or legal person, including an EEA EFTA competent authority, which is the addressee of the decision to be taken to express its views on the matter, taking full account of the urgency, complexity and potential consequences of the matter.” (10) Article 12(5) shall not apply. (11) For the purpose of Article 13, the EBA shall coordinate publication of any decision with the EFTA Surveillance Authority. (12) The Rules of Procedure of the Board of Supervisors, in particular Article 4(20)(a), shall apply for taking decisions in accordance to Articles 8, 10, 11 and 12. Article 19 – Executive Director

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW 11 EBA Regular Use The Executive Director shall establish the necessary internal procedures for the implementation of this Decision. Article 20 – Communications Competent authorities shall be invited to agree to written and oral communications being in the working language of the EBA for the purposes of preliminary enquiries and breach of Union law investigations where possible. Article 21 – Entry into force The Decision EBA/DC/2016/174 of 23 December 2016 adopting Rules of Procedure for Investigation of Breach of Union Law is repealed and replaced by this Decision. This Decision enters into force immediately. Done at Paris, 22/01/2020 José Manuel Campa Chairperson For the Board of Supervisors

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW 12 EBA Regular Use Annex 1 Inadmissible Requests A request is inadmissible if: ▪ it is anonymous, fails to show the address of the sender or shows an incomplete address; ▪ it fails to set out a grievance based on well substantiated information; ▪ it sets out a grievance which is outside the scope of the acts referred to in Article 1(2) of the Regulation ▪ it fails to refer, explicitly or implicitly, to a competent authority to which the alleged breach of Union law may be attributed; ▪ it concerns the acts or omissions of a private person or body, unless the request reveals the involvement of competent authorities or alleges their failure to act in response to those acts or omissions; ▪ it sets out a grievance which is materially the same as one for which the EBA has already informed the Requester of its position or has adopted a clear, public and consistent position.

DECISION ON THE RULES OF PROCEDURE FOR INVESTIGATION OF BREACH OF UNION LAW 13 EBA Regular Use Annex 2 Positive investigation factors ▪ The alleged breach concerns a repeated or systemic infringement (for example a pattern of complaints indicating systematic incorrect application, interpretation, practice or approach of the competent authority concerned) or general policy approach; ▪ The alleged breach may have significant, direct impact on EBA’s objectives concerning: contributing to the short, medium and long-term stability and effectiveness of the financial system, functioning of the internal market; integrity, transparency, efficiency and orderly functioning of financial markets; preventing regulatory arbitrage and promoting equal conditions of competition; and enhancing customer protection. Negative investigation factors ▪ The Request is more suitable to be dealt with by another person or body, such as inter alia, the European Commission, another European Supervisory Authority, a national competent authority, a national complaints scheme or acourt; ▪ The Request is more suitable to be dealt by other means (for example peer review, mediation, guidelines), including where it falls within the scope of Article 9b of the Regulation or the alleged breach has ceased; ▪ The Request appears frivolous or vexatious; ▪ The Request sets out a grievance which does not relate to a clear and unconditional obligation in an act referred to in Article 1(2) of the Regulation.