Pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz)

All English translation of the authentic German text is unofficial and serves merely information purposes. The official wording in German can be found in the Austrian Federal Law Gazette (Bundesgesetzblatt; BGBl.). All translations have been prepared with great care, but linguistic compromises had to be made. The reader should also bear in mind that some provisions of these laws will remain unclear without certain background knowledge of the Austrian legal and political system. Please note that these laws may be amended in the future and check occasionally for updates. FEDERAL ACT TRANSPOSING REGULATION (EU) 2019/1238 ON A PAN-EUROPEAN PERSONAL PENSION PRODUCT (PEPP￾VOLLSZUGSGESETZ) pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) Original Version: Federal Law Gazette I 74/2022 Amendments (in Federal Law Gazette I unless stated otherwise): 50/2025; 5/2026. Date: 16.04.2026

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 2 / 18 TABLE OF CONTENTS Text.......................................................................................................................................................... 3 Purpose of this Act........................................................................................................................ 3 Competent authority.................................................................................................................... 3 ESAP Collection Body................................................................................................................... 5 FMA Powers .................................................................................................................................. 5 Penal provisions ........................................................................................................................... 6 FMA Measures ............................................................................................................................. 11 Exercise of supervisory powers and powers to impose penalties............................................ 12 Publication of decisions............................................................................................................. 12 Right of appeal ........................................................................................................................... 13 Reporting of penalties and administrative measures to EIOPA ............................................... 14 Publication of national provisions............................................................................................. 14 Distribution regime applicable for PEPP providers and PEPP distributors ............................. 14 Knowledge and Competence for PEPP Advice.......................................................................... 15 Reporting .................................................................................................................................... 15 Form of communication with the FMA - electronic transmission ............................................ 16 Making a complaint to the FMA ................................................................................................. 16 Confidentiality............................................................................................................................ 16 Professional secrecy................................................................................................................... 17 Special procedural provisions ................................................................................................... 17 Costs ........................................................................................................................................... 17 Gender-neutral use of language ................................................................................................ 17 References .................................................................................................................................. 17 Entry into force........................................................................................................................... 18 Enforcement............................................................................................................................... 18

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 3 / 18 TEXT Purpose of this Act Article 1. This Federal Act transposes Regulation (EU) 2019/1238 on a pan-European Personal Pension Product (PEPP), OJ L 198, 25.07.2019, p. 1, in the version of Regulation (EU) 2023/2869 amending certain regulations as regards the establishment and functioning of the European single access point, OJ L 2023/2869, 20.12.2023. Competent authority Article 2. (1) The Austrian Financial Market Authority (FMA) shall be the competent authority pursuant to Article 2 point 18 of Regulation (EU) 2019/1238 in accordance with the following provisions:

1. the FMA is the competent authority for the following financial undertakings, which are active as PEPP providers pursuant to Article 2 point 15 of Regulation (EU) 2019/1238 or in accordance with the relevant sector-specific regulations, where such regulations exist, pursuant to Article 10 (1) of Regulation (EU) 2019/1238 as PEPP distributors pursuant to Article 2 point 16 of Regulation (EU) 2019/1238: a. CRR credit institutions pursuant to Article 1a para. 1 no. 1 of the Austrian Banking Act (BWG; Bankwesengesetz), published in Federal Law Gazette no. 532/1993, that hold a licence pursuant to Article 4 para. 1 BWG; b. insurance undertakings pursuant to Article 5 para. 1 of the Insurance Supervision Act 2016 (VAG 2016; Versicherungsaufsichtsgesetz 2016), published in Federal Law Gazette I no. 34/2015, that hold a licence for providing life insurance pursuant to Article 6 para. 1 and Annex A VAG 2016; c. investment firms pursuant to Article 3 para. 1 of the Securities Supervision Act 2018 (WAG 2018; Wertpapieraufsichtsgesetz 2018), Federal Law Gazette I no. 107/2017, that hold a licence for portfolio management pursuant to Article 3 para. 2 no. 2 WAG 2018; d. management companies pursuant to Article 3 para. 2 no. 1 of the Investment Funds Act 2011 (InvFG 2011; Investmentfondsgesetz 2011), published in Federal Law Gazette I no. 77/2011 that hold a licence pursuant to Article 5 para. 1 InvFG 2011; e. AIFMs pursuant to Article 2 para. 1 no. 2 of the Alternative Investment Fund Managers Act (AIFMG; Alternative Investmentfonds Manager-Gesetz) published in Federal Law Gazette I no. 135/2013, established in Austria that hold a licence pursuant to Article 4 para. 1 AIFMG;
2. the FMA is the competent authority of the host Member State pursuant to Article 2 point 21 of Regulation (EU) 2019/1238 for financial undertakings pursuant to Article 6 (1) points a to f of

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 4 / 18 Regulation (EU) 2019/1238 that offer PEPPs in Austria under the freedom to provide services or the freedom of establishment, or that open a sub-account for Austria. 3. the FMA is the competent authority of the host Member State pursuant to Article 2 point 22 of Regulation (EU) 2019/1238 for financial undertakings pursuant to Article 6 (1) points a to f of Regulation (EU) 2019/1238, that distribute PEPPs pursuant to Article 10 (1) of Regulation (EU) 2019/1238 in accordance with the relevant sector-specific regulations, where they exist, as PEPP distributors pursuant to Article 2 point 16 of that Regulation that they have not manufactured themselves in Austria under the freedom to provide services or the freedom of establishment. 4. the FMA is the competent authority for investment firms pursuant to Article 3 para. 1 WAG 2018 that hold a licence for investment advice pursuant to Article 3 para. 2 no. 1 WAG 2018, and which pursuant to Article 10 (2) of Regulation (EU) 2019/1238 distribute PEPPs as PEPP distributors pursuant to Article 2 point 16 of this Regulation, that they have not manufactured themselves. 5. the FMA is the competent authority in the host Member State pursuant to Article 2 point 22 of Regulation (EU) 2019/1238 for investment firms authorised in accordance with Directive 2014/65/EU on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU, OJ L 173, 12.06.2014, p. 349, which offer investment advice as defined in Article 4 (1) point 4 of Directive 2014/65/EU and pursuant to Article 10 (2) of Regulation (EU) 2019/1238 and as a PEPP distributor pursuant to Article 2 point 16 of that Regulation that offers PEPPs that it has not manufactured itself in Austria under the freedom to provide services or the freedom of establishment. (2) As the competent authority pursuant to para. 1, the FMA, irrespective of the tasks conferred upon it in other Federal Acts, shall perform the duties and powers conferred upon it pursuant to this Federal Act and Regulation (EU) 2019/1238, and shall monitor the observances of the regulations contained in this Federal Act and in Regulation (EU) 2019/1238, as well as delegated and implemented acts issued on the basis of this Regulation on an ongoing basis, and in accordance with the relevant sector-specific regulations under supervisory law and the sectoral standards. Moreover, the FMA shall monitor the observance of the obligations listed in the contractual conditions or the statutes of the PEPP provider, as well as the adequacy of its measures and its organisation with regard to the observance of the duties that arise when offering a PEPP. In doing so, the FMA shall act exclusively in the public interest. (3) The FMA shall monitor the offering and distribution of personal pension products, in order to ensure that such products shall only bear the designation “pan-European Personal Pension Product” or “PEPP” or that it is only suggested that such products are PEPPs, only if they are entered in the central public register kept by EIOPA pursuant to Article 13 of Regulation (EU) 2019/1238. (4) The FMA shall take into account European convergence in respect of supervisory tools and supervisory procedures in the enforcement of this Federal Act, Regulation (EU) 2019/1238, as well as delegated and implementing acts issued on the basis of that Regulation. For this purpose, the FMA

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 5 / 18 shall apply the Guidelines, Recommendations and other measures decided upon by the EIOPA within the scope of application of Regulation (EU) 2019/1238. The FMA may deviate from the guidelines and recommendations, provided that justified grounds exist to do so, in particular where they conflict provisions set out under national law. (5) The FMA shall cooperate with the other competent authorities pursuant to Article 2 point 18 of Regulation (EU) 2019/1238 in accordance with the respective sector-specific regulations. (6) The FMA shall cooperate with EIOPA in order to observe the respective duties within the scope of Regulation (EU) 2019/1238 and delegated and implementing acts issued on the basis of that Regulation in accordance with Regulation (EU) No 1094/2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC, OJ L 331, 15.12.2010, p. 48 in the version of Regulation (EU) 2019/2175, OJ L 334, 27.12.2019, p. 1. (7) The FMA may exchange all information and documentation with EIOPA that are necessary in order to carry the respective duties within the scope of Regulation (EU) 2019/1238 and Delegated and Implementing Acts issued on the basis on this Regulation in accordance with Regulation (EU) No 1094/2010, in particular to identify and remedy infringements of Regulation (EU) 2019/1238 and Delegated and Implementing Acts issued on the basis on this Regulation. ESAP Collection Body Article 2a. (1) The FMA is the collection body as defined in Article 2 point 2 of Regulation (EU) 2023/2859 (ESAP collection body) pursuant to Article 70a (3) of Regulation (EU) 2019/1238. (2) The FMA shall be the collection body pursuant to Article 3 (2) of Regulation (EU) 2023/2859 for the collection of information stated in Regulation (EU) 2023/1238 submitted on a voluntary basis. (3) The FMA is mandated as the controller under data protection law pursuant to Article 4 point 7 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 04.05.2016, p. 1, in conjunction with the duties of paras. 1 and 2 of this Federal Act as well as Article 70a (5) of Regulation (EU) 2019/1238 for processing of personal data as defined in the General Data Protection Regulation. FMA Powers Article 3. (1) The FMA shall be afforded the supervisory powers and means pursuant to Article 2 in addition to the powers in accordance with this Federal Act in the same way and scope as set out in the respective relevant supervisory laws, that it may also make use of in enforcing other obligations in accordance with these supervisory laws. (2) The FMA may within its scope of competence pursuant to Article 2

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 6 / 18

1. prohibit the providing of a PEPP key information document (PEPP KID), which fails to satisfy the requirements set out in Articles 26, 27, 28 or 30 of Regulation (EU) 2019/1238, and at the same time to instruct the publication of a new version of the PEPP key information document that does conform to the Regulation;
2. restrict or prohibit the marketing or distribution of a PEPP in or from Austria pursuant to Article 63 of Regulation (EU) 2019/1238 by means of an administrative decision or Regulation and publish this decision on its official Internet presence;
3. shall inform the public by means of an announcement on the Internet, publication in the official gazette “Amtsblatt zur Wiener Zeitung”, or in a newspaper with nationwide circulation, that: a. a named natural or legal person (person) is not authorised to offer or distribute a PEPP, provided that this person has given cause to do so and where informing the public is necessary and proportionate with regard to potential detriments for the affected party. Such publication measures may also be taken on a cumulative basis. The person must be clearly identifiable in the publication. For this purpose, the FMA may also state, if known, the business or residential address, Commercial Register number, internet address, telephone number and fax number; b. a product is not a PEPP, where this product is offered or distributed bearing the designation “pan-European Personal Pension Product” or “PEPP” or the impression is otherwise given that this product is a PEPP, without the product being entered in EIOPA’s central public register pursuant to Article 13 of Regulation (EU) 2019/1238. (3) In the scope of its competence pursuant to Article 2a the FMA shall be authorised under the threat of a coercive penalty to order by means of an administrative decision to establish legal competence within a certain time limit that is appropriate with regard to the circumstances of the case in hand. Penal provisions Article 4. (1) Any person who, as the person responsible (Article 9 Administrative Penal Act (VStG; Verwaltungsstrafgesetz 1991), published in Federal Law Gazette no. 52/1991) of a PEPP provider or a PEPP distributor pursuant to Article 2 para. 1:
4. has managed to register a PEPP on the basis of false or misleading information or in another unlawful manner by infringing Articles 6 and 7 of Regulation (EU) 2019/1238,
5. has failed to make the portability service available, thereby breaching Articles 18 and 19 of Regulation (EU) 2019/1238, or has failed to make the prescribed information available about this service in breach of Articles 20 and 21 of that Regulation,
6. breaches obligations pursuant to Article 22 of Regulation (EU) 2019/1238 to act in an honest, fair and professional manner,
7. fails to make information and documentation available pursuant to Article 24 of Regulation (EU) 2019/1238,

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 7 / 18 5. breaches oversight and governance requirements pursuant to Article 25 of Regulation (EU) 2019/1238, 6. breaches Article 26 (1) of Regulation (EU) No 2019/1238, by failing to draw up and publish a PEPP key information document before the PEPP is offered to PEPP savers, 7. breaches Article 26 (2) to (7) or Article 28 (1) to (4) of Regulation (EU) 2019/1238 or Articles 1 to 6 of Delegated Regulation (EU) 2021/473 supplementing Regulation (EU) 2019/1238 of the European Parliament and of the Council with regard to regulatory technical standards specifying the requirements on information documents, on the costs and fees included in the cost cap and on risk-mitigation techniques for the pan-European Personal Pension Product, OJ L 99, 22.03.2021, p. 1, by drawing and publishing a PEPP key information document incorrectly, incompletely or not in the prescribed manner, 8. breaches information requirements pursuant to Article 26 paras. 8 and 9 of Regulation (EU) 2019/1238, 9. breaches Article 27 of Regulation (EU) 2019/1238, by not drawing up a PEPP key information document in the prescribed language or failing to translate it into the prescribed language, or fails to make the PEPP key information document available in an appropriate format for PEPP savers with visual impairment despite being requested to do so, 10. breaches Article 29 of Regulation (EU) 2019/1238 by making claims in advertising materials that contradict the information contained in the PEPP key information document or which downgrades the importance of the key information document or omits, or incorrectly or incompletely includes the necessary information, 11. breaches Article 30 of Regulation (EU) 2019/1238 or Article 7 or 8 of Delegated Regulation (EU) 2021/473, by not regularly reviewing a PEPP key information document, failing to revise it or failing to revise it promptly, or failing to make the revised version available or failing to make it available promptly, 12. breaches Article 33 of Regulation (EU) 2019/1238 or Article 9 of Regulation (EU) 2021/473, by failing to make a PEPP key information document available, or failing to make one available in a timely manner, or failing to make one available in the prescribed manner, 13. breaches the obligation to offer a PEPP contract pursuant to Article 34 (1) of Regulation (EU) 2019/1238 that corresponds to retirement-related demands and needs, 14. breaches advice requirements pursuant to Article 34 para. 2 first subparagraph and para. 4 of Regulation (EU) 2019/1238, 15. breaches pre-contractual information requirements pursuant to Article 34 (1), (2) second subparagraph and (3) of Regulation (EU) 2019/1238, 16. breaches obligations regarding the PEPP Benefit Statement pursuant to Article 35 (1) to (5), Article 36 (1) or Article 37 (1) of Regulation (EU) 2019/1238 or Articles 1, 2, 10 and 11 of Delegated Regulation (EU) 2021/473 as well as other information obligations during the term of the contract pursuant to Article 35 (6), Article 38 or Article 39 of Regulation (EU) 2019/1238, 17. breaches reporting obligations pursuant to

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 8 / 18 a. Article 40 (1) to (5) and (8) of Regulation (EU) 2019/1238, b. Delegated Regulation (EU) 2021/896 supplementing Regulation (EU) 2019/1238 of the European Parliament and of the Council with regard to additional information for the purposes of the convergence of supervisory reporting, OJ L 197, 04.06.2021, p. 5, c. Implementing Regulation (EU) 2021/897 laying down implementing technical standards for the application of Regulation (EU) 2019/1238 of the European Parliament and of the Council with regard to the format of supervisory reporting to the competent authorities and the cooperation and exchange of information between competent authorities and with the European Insurance and Occupational Pensions Authority, OJ L 197, 04.06.2021, p. 7, or d. Article 13 paras. 1 to 5, 18. does not have expedient systems and structures in place in order to observe the requirements pursuant to Article 40 (1) to (5) of Regulation (EU) 2019/1238, or does not have written guidelines in place in order to guarantee the continuous appropriateness of the submitted information, 19. breaches investment rules pursuant to Article 41 (1) of Regulation (EU) 2019/1238, 20. offers PEPP savers more than six investment options, offers an investment option that fails to meet the conditions pursuant to Article 42 (3) to (5) of Regulation (EU) 2019/1238, fails to make a Basic PEPP available or makes a Basic PEPP available that fails to meet all requirements pursuant to Article 45 (1) and (2) of Regulation (EU) 2019/1238 and Articles 12 and 13 of Delegated Regulation (EU) 2021/473, or fails to permit a modification of the investment option pursuant to Article 44 of Regulation (EU) 2019/1238, 21. applies risk-mitigation techniques that do not correspond to the rules pursuant to Article 46 (1) and (2) of Regulation (EU) 2019/1238 or Chapter VI of Delegated Regulation (EU) 2021/473, 22. breaches obligations pursuant to Article 50 (1) to (3) of Regulation (EU) 2019/1238 to put in place adequate and effective procedures for the settlement of complaints lodged by PEPP customers and responding to them, 23. breaches information requirements regarding alternative dispute resolution (ADR) or complaints pursuant to Article 50 (4) or (5) of Regulation (EU) 2019/1238, 24. breaches obligations in relation to the provision of the switching service pursuant to Article 52 (1), (3) and (4) of Regulation (EU) 2019/1238, 25. breaches obligations when conducting the switching service pursuant to Article 53 (4) and (5) of Regulation (EU) 2019/1238, 26. breaches the restrictions regarding the charges and fees associated with the switching service pursuant to Article 54 of Regulation (EU) 2019/1238, 27. fails to refund without delay any financial loss incurred, including fees, charges and interest directly incurred by the PEPP saver as a result of the PEPP provider failing to comply with its obligations under Article 53 of Regulation (EU) 2019/1238, except in the cases listed in Article 55 (2) of Regulation (EU) 2019/1238,

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 9 / 18 28. breaches information requirements in relation to the switching service pursuant to Article 56 of Regulation (EU) 2019/1238, 29. fails to enable a modification of the form of out-payment pursuant to Article 59(1) of Regulation (EU) 2019/1238, 30. breaches information requirements modification of the forms of out-payment pursuant to Article 2 of Regulation (EU) 2019/1238, 31. breaches obligations regarding the drawing up of a retirement plan pursuant to Article 60 (1) of Regulation (EU) 2019/1238, or 32. breaches advice obligations in relation to out-payments pursuant to Article 60 (2) of Regulation (EU) 2019/1238, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 700 000 or up to double the amount of the gain arising from the breach, where this amount is able to be determined. (2) Any person who, as the person responsible (Article 9 VStG) of a PEPP provider or PEPP distributor pursuant to Article 2 para. 1 no. 1 lit. b as well as of a financial undertaking pursuant to Article 6 (1) lit. b of Regulation (EU) 2019/1238, that offers or distributes PEPPs in Austria under the freedom to provide services or the freedom of establishment (Article 2 para. 1 nos. 2 and 3), breaches

1. pursuant to Article 11 para. 1 applicable information and conduct obligations pursuant to Articles 128, 130, 130a, 133, 134, 135, 135a, 135b paras. 2 or 3 or Article 135d VAG 2016 or
2. Delegated Regulation (EU) 2017/2359 supplementing Directive (EU) 2016/97 with regard to information requirements and conduct of business rules applicable to the distribution of insurance-based investment products, OJ L 341, 20.12.2017, p. 8, most recently amended by Delegated Regulation (EU) 2021/1257, OJ L 277, 02.08.2021, p. 18, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 700 000 or up to double the amount of the gain arising from the breach, where this amount is able to be determined. (3) Any person who, as the person responsible (Article 9 VStG) of a PEPP distributor pursuant to Article 2 para. 1 nos. 4 or 5
3. breaches the organisational requirements pursuant to Article 29 para. 2 WAG 2018,
4. breaches the requirements pursuant to Articles 45 or 46 WAG 2018 on the avoidance of or disclosure of conflicts of interest,
5. breaches the obligation to act in the client's best interest pursuant to Article 47 paras. 1, 4 or 5 or Articles 48, 49, 50, 51 or 53 WAG 2018,
6. breaches the requirements on the suitability of investment advice and portfolio management services pursuant to Article 56 WAG 2018,
7. breaches the obligations on the documentation of the contractual parties’ rights and duties pursuant to Article 59 WAG 2018,
8. breaches the reporting obligation towards the clients pursuant to Article 60 WAG 2018,

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 10 / 18 commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 700 000 or up to double the amount of the gain arising from the breach, where this amount is able to be determined. (2) Any person who, as the person responsible (Article 9 VStG) of a PEPP provider or PEPP distributor pursuant to Article 2 para. 1 no. 1 lit. a, c, d or e as well as of a financial undertaking pursuant to Article 6 para. 1 lit. a, c, d, e, or f of Regulation (EU) 2019/1238, that offers or distributes PEPPs in Austria under the freedom to provide services or the freedom of establishment (Article 2 para. 1 nos. 2 and 3),

1. breaches the organisational requirements pursuant to Article 29 para. 2 WAG 2018,
2. breaches the requirements pursuant to Articles 45 or 46 WAG 2018 on the avoidance of or disclosure of conflicts of interest,
3. breaches the obligation to act in the client's best interest pursuant to Article 47 paras. 1, 4 or 5 or Articles 48, 49, 50, 51 or 53 WAG 2018,
4. breaches the obligations on the documentation of the contractual parties’ rights and duties pursuant to Article 59 WAG 2018,
5. breaches the reporting obligation towards the clients pursuant to Article 60 WAG 2018, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 700 000 or up to double the amount of the gain arising from the breach, where this amount is able to be determined. (5) Anyone, who as the person responsible (Article 9 VStG) of a PEPP provider pursuant to Article 2 para. 1 no. 1 lits. d or e breaches the obligation to appoint a depositary pursuant to Article 48 (1) of Regulation (EU) 2019/1238, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 700 000 or up to double the amount of the gain arising from the breach, where this amount is able to be determined. (6) Any person who, as the person responsible (Article 9 VStG) of a depositary, breaches
6. duties pursuant to Article 40 paras. 2 to 4 InvFG 2011, or
7. requirements pursuant to Article 41 para. 3 InvFG 2011, that apply to them based on an appointment pursuant to Article 48 (1) of Regulation (EU) 2019/1238, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 700 000 or up to double the amount of the gain arising from the breach, where this amount is able to be determined. (7) Anyone, who as the person responsible (Article 9 VStG) of a financial undertaking pursuant to Article 6 (1) (a) to (f) of Regulation (EU) 2019/1238 or anyone else who offers or distributes products with the necessary registration using the designation “ pan-European Personal Pension Product” or “PEPP”, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 700 000 or up to double the amount of the gain arising from the breach, where this amount is able to be determined. (8) The FMA may impose fines on legal persons if persons acting individually or as part of a body of a legal person and who have a managerial role within the legal person on the basis of:

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 11 / 18

1. a power of representation of the legal person,
2. a power to take decisions on behalf of the legal person, or
3. a power to exercise control within the legal person have breached the prohibitions or obligations listed in paras. 1 to 7. Legal persons may also be held responsible for breaches listed in paras. 1 to 7, if such breaches by a natural person acting for the legal person were made possible by a lack of supervision or control by one of the persons referred to in paras. 1 to 7. In the event of such an act being committed by a legal person, then this legal person shall be fined up to EUR 5 000 000 by the FMA, up to 10 % of the total annual turnover of the legal person in question on the basis of the most recent available financial statement that was approved by the management body, or up to double the amount of the gain arising from the breach, where this amount is able to be determined. (9) Where the legal person is a parent undertaking or a subsidiary of a parent undertaking, which is required to draw up a consolidated financial statement in accordance with Directive 2013/34/EU on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC, OJ L 182, 29.06.2013, p. 19, in the version amended by Directive 2014/102/EU OJ L 334, 21.11.2014, p. 86, then the authoritative total annual turnover is the total annual turnover of the relevant type of income according to the relevant accounting provisions under Union law, that was/were stated in the last available consolidated accounts adopted by the management body of the ultimate parent undertaking. (10) Any person who, as the person responsible (Article 9 VStG) of a PEPP provider or PEPP distributor pursuant to Article 2 para. 1 who breaches administrative decisions or Regulations issued by the FMA pursuant to Article 63 (1) of Regulation (EU) 2019/1238 or decisions issued by EIOPA pursuant to Article 65 (2) of Regulation (EU) 2019/1238, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 70 000. (11) Anyone who breaches Article 70a (1) of Regulation (EU) 2019/1238 by failing to submit the PEPP key information document stated in Article 26 (1) or Regulation (EU) 2019/1238 or failing to submit it to the FMA in the prescribed manner at the same time as the publication of this PEPP key information document, or which breaches Article 70a (2) of Regulation (EU) 2019/1238, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 60 000. FMA Measures Article 5. The FMA shall have the power to impose the following measures in the case of offences pursuant to Article 4 paras. 1 to 7 occurring:
4. public disclosure pursuant to Article 7 about the identity of the natural or legal person responsible for the breach, and the nature and character of the breach;
5. an order requiring the natural or legal person to cease the conduct constituting the infringement and to desist from a repetition of that conduct;

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 12 / 18 3. imposing a temporary ban on responsible members of the management, supervisory or administrative body of a legal entity pursuant to Article 2 para. 1 or other responsible natural persons in the financial undertaking pursuant to Article 6 (1) of Regulation (EU) 2019/1238 from performing managerial duties. Exercise of supervisory powers and powers to impose penalties Article 6. (1) When determining the manner and amount of the administrative penalties and other actions under administrative procedural law, the FMA shall take all relevant circumstances into consideration, including as applicable:

1. the significance, severity and duration of the infringement;
2. the degree of responsibility of the natural or legal person responsible for the infringement;
3. the financial strength of the natural or legal person responsible for the infringement as may in particular be deduced, for example, from the annual income and net assets of the responsible natural person, from the total turnover of the responsible legal person;
4. the amount of the gains made or losses avoided by the infringement by the natural or legal person responsible for the infringement, provided that these amounts are able be determined;
5. the losses sustained by third parties as result of the infringement, provided that these amounts can be determined;
6. the level of cooperation of the natural or legal person responsible for the infringement with the competent authorities, without prejudice to the need to ensure disgorgement of profits gained or losses avoided by that person;
7. previous breaches by the natural or legal person responsible for the breach; (2) In conducting the duties and powers listed in Articles 3, 4 and 5, the FMA shall cooperate closely with the competent authorities of other Member States, in order to ensure that the sanctions imposed under administrative procedural law and other measures under administrative procedural law ensure the compliance of Regulation (EU) 2019/1238. The FMA shall coordinate their actions with those of the competent authorities of other Member States in order to avoid duplication and overlaps when exercising their supervisory and investigative powers and when imposing administrative sanctions and other administrative measures in cross-border cases. Publication of decisions Article 7. (1) A decision imposing an administrative penalty or another measure under administrative procedural law for a breach against Regulation (EU) 2019/1238 shall be published by the FMA on its official Internet presence without delay, once the person subject to that decision has been informed of that decision. The disclosure shall be required to at least contain information about the type and character of the brief as well as the identity of the responsible natural or legal

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 13 / 18 persons. That obligation does not apply to decisions imposing measures that are of an investigatory nature. (2) Where the publication of the identity of the legal entities, or identity or personal data of natural persons, is considered by the FMA to be disproportionate, following a case-by-case assessment, or where such publication would jeopardise the stability of financial markets or an on-going investigation, then the FMA shall:

1. defer the publication of the decision to impose a penalty or a measure until the moment where the reasons for non-publication cease to exist;
2. publish the decision to impose a penalty or a measure on an anonymous basis in a manner that conforms with other statutory provisions, where such anonymous publication ensures an effective protection of the personal data concerned;
3. refrain from publishing the decision imposing a sanction or other measure, where it believes the options pursuant to no. 1 or 2 are not adequate, in order to ensure that: a. the stability of the financial markets is not endangered; b. the proportionality of the publication of such decisions is preserved in relation to non￾significant measures. In the case of a decision to publish a sanction or measure on an anonymous basis, as referred to in no. 2, the publication of the relevant data may be deferred for a reasonable period where it is foreseen that within that period the reasons for anonymous announcement shall cease to exist. (3) The FMA shall ensure that publications in accordance with this provision shall remain accessible on its official Internet presence for at least five years following publication. Personal data contained in the publication shall however only be allowed to remain visible on the FMA’s official Internet presence, for the period that is necessary in accordance with the applicable data protection provisions. Right of appeal Article 8. (1) The legal remedy of an appeal by default shall also exist in the event that the FMA fails to reach a decision on an application for registration of a PEPP within the time limit pursuant to Article 6 (4) of Regulation (EU) 2019/1238. (2) If an appeal is lodged with the courts or other authorities against the decision underlying a publication pursuant to Article 7 of this Federal Act or Article 63 (4) of Regulation (EU) 2019/1238, the FMA shall publish this immediately on its official Internet presence and shall also inform about the outcome of these proceedings there. Furthermore, every decision in which it is declared that an earlier decision to impose a sanction or measure is invalid, shall be published. (3) The party affected by the publication pursuant to Article 3 para. 2 no. 3 or Article 7 may file a request to the FMA to review the lawfulness of such a publication in a procedure concluded by means of an administrative decision. In this case, the FMA shall announce the initiation of such proceedings in an identical manner. If, in the course of this review, it is found that the publication was unlawful,

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 14 / 18 the FMA shall correct the publication or, at the request of the person subject to this publication either revoke it, or remove it from its Internet presence. Where suspensory effect is granted to an appeal against an administrative decision pursuant to this provision, the FMA shall announce this in the same way. The publication shall be corrected, or, upon request of the concerned party, revoked or removed from the Internet presence if the administrative decision is repealed. Reporting of penalties and administrative measures to EIOPA Article 9. (1) The FMA shall submit aggregated information to EIOPA on an annual basis about all administrative penalties and other measures imposed pursuant to Articles 3, 4 and 5. (2) Where the FMA has published administrative penalties or other measures under administrative procedural law, then it shall simultaneously report them to EIOPA. (3) The FMA shall inform EIOPA about all administrative penalties or other measures under administrative procedural law that have been imposed but not published in accordance with Article 7 para. 2 no. 3, including any appeals in relation thereto and the outcome of the appeal procedure. Publication of national provisions Article 10. Solely for the purposes of Article 12(3) of Regulation (EU) 2019/1238, the FMA shall publish and keep up to date on its official Internet presence the national laws and administrative provisions governing the specific conditions relating to the accumulation phase as defined in Article 47 of Regulation (EU) 2019/1238 and the specific conditions relating to the decumulation phase as defined in Article 57 of Regulation (EU) 2019/1238, including information on any additional national procedures put in place for applying for benefits and incentives, if any, created at national level. Distribution regime applicable for PEPP providers and PEPP distributors Article 11. (1) PEPP providers and PEPP distributors pursuant to Article 2 para. 1 no. 1 lit. b as well as financial undertakings pursuant to Article 6 (1) (b) of Regulation (EU) 2019/1238 that provide or distribute PEPPs in Austria under the freedom to provide services or the freedom of establishment (Article 2 para. 1 nos. 2 and 3), shall, in addition to the provisions of Regulation (EU) 2019/1238 and directly applicable Union law pursuant to Article 23(1)(a) of Regulation (EU) 2019/1238 and without prejudice to other sector-specific provisions applicable pursuant to Article 11 of that Regulation, the distribution of PEPPs, shall comply with the Chapter 6 of the Insurance Supervision Act of 2016 (VAG 2016; Versicherungsaufsichtgesetz 2016), including the provisions applicable to insurance-based investment products, but with the exception of Articles 128a, 129, 131, 132, 135b para. 1 and Article 135e VAG 2016. (2) PEPP distributors pursuant to Article 2 para. 1 nos. 4 and 5 shall, in addition to the provisions of Regulation (EU) 2019/1238, with the exception of Article 34 (4) of Regulation (EU) 2019/1238 and the

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 15 / 18 directly applicable Union law pursuant to Article 23 para. 1 lit. a of Regulation (EU) 2019/1238 and irrespective of other sector-specific rules pursuant to Article 11 of that Regulation when distributing PEPPs, also comply with Article 29 para. 2, Articles 45, 46, 47 paras. 1, 4 and 5, Articles 48, 49, 50, 51, 53, 56, 59 and 60 WAG 2018. (3) PEPP providers and PEPP distributors pursuant to Article 2 para. 1 no. 1 lit. a, c, d and e as well as financial undertakings pursuant to Article 6 (1) (a), (c), (d), (e) and (f) of Regulation (EU) 2019/1238 that provide or distribute PEPPs in Austria under the freedom to provide services or the freedom of establishment (Article 2 para. 1 nos. 2 and 3), shall, in addition to the provisions of Regulation (EU) 2019/1238 and directly applicable Union law pursuant to Article 23 (1) (a) of Regulation (EU) 2019/1238 and without prejudice to other sector-specific provisions applicable pursuant to Article 11 of that Regulation in the distribution of PEPPs, also comply with Article 29 para. 2, Articles 45, 46, 47 paras. 1, 4 and 5, Articles 48, 49, 50, 51, 53, 56, 59 and 60 WAG 2018. Knowledge and Competence for PEPP Advice Article 12. The FMA shall publish the criteria applied in assessing whether the natural persons entrusted with the PEPP advice pursuant to Article 34 of Regulation (EU) 2019/1238 have the knowledge and competences necessary to fulfil their duties under that Regulation, without prejudice to stricter sector-specific rules. The FMA may define the criteria by means of a Regulation taking into consideration European practices. Reporting Article 13. (1) PEPP providers pursuant to Article 2 para. 1 no. 1 shall draw up a supervisory report (PEPP Supervisory Report) for the financial year in which a PEPP is registered and thereafter following every material change in PEPP business or following every change in the PEPP, however at least every three years following the registration of a PEPP, that covers the following areas:

1. PEPP business;
2. investment strategy and investment performance;
3. risk management and risk-mitigation techniques;
4. the impact of the sector-specific supervisory law frameworks. The FMA may specify the format and content of the PEPP Supervisory Report in greater detail by means of a Regulation, where doing so is necessary in the interest of better comparability and transparency and of European consistency. (2) PEPP providers pursuant to Article 2 para. 1 no. 1 shall submit the PEPP Supervisory Report to the FMA at latest up to 18 weeks after the end of the financial year. (3) PEPP providers pursuant to Article 2 para. 1 no. 1 shall submit the annual quantitative reporting pursuant to Chapter I of Implementing Regulation (EU) 2021/897 to the FMA in accordance with the respective applicable sector-specific regulations for annual reporting, however at latest 16 weeks following the end of the financial year.

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 16 / 18 (4) The FMA shall submit the regular reporting pursuant to para. 2 and 3 to EIOPA within fours weeks following the expiry of the relevant period pursuant to para. 3. (5) The FMA may impose more frequent reporting obligations upon the PEPP provider pursuant to Article 2 para. 1 no. 1, provided that this is necessary in accordance with a risk-based approach, in order to ensure observance of Regulation (EU) 2019/1238 as well as delegated and implementing acts issued on the basis of this Regulation. (6) In the event of material changes pursuant to paras. 1 and 3 following their reporting to the FMA, PEPP providers shall submit updated information to the FMA without delay. (7) Other reporting obligations remain unaffected. Form of communication with the FMA - electronic transmission Article 14. The FMA may prescribe by way of a Regulation that the notifications and submissions pursuant to Article 2a para. 2, Article 13 paras. 2 and 3 and pursuant to Article 6, Article 8 (1) point a, Article 21 and Article 70a (1) of Regulation (EU) 2019/1238 shall be made exclusively in electronic form, and shall also be required to correspond to specific formats, technical minimum requirements and modes of submission. In so doing, the FMA shall observe the principles of economy and expediency, ensuring that the data is electronically available to the FMA at all times, and that supervisory interests are not compromised. The FMA shall ensure that appropriate arrangements are in place that the parties subject to reporting requirements or as applicable the individuals charged with submitting the reports are able to check the accuracy and completeness of the data in the system for a reasonable period of time that was reported by them or their submission officers. Making a complaint to the FMA Article 15. (1) The FMA shall be required to have effective mechanisms, that allow PEPP customers and other interested parties, including consumer associations, in the event of an infringement against, or the suspicion of an infringement against the regulations contained in this Federal Act, in Regulation (EU) 2019/1238, or in any delegated acts and implementing acts issued on the basis of this Regulation, to submit a complaint to the FMA. In all cases, complainants shall receive replies. (2) In cases, in which several Member States are affected, complainants resident in Austria may submit their complain to the FMA irrespective of where the infringement took place. Confidentiality Article 16. Article 14 para. 2 of the Financial Market Authority Act (FMABG; Finanzmarktaufsichtsbehördengesetz) published in Federal Law Gazette I 97/2001 shall apply to all persons who work for, or have worked for the FMA.

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 17 / 18 Professional secrecy Article 17. Valid provisions in accordance with other Federal Acts regarding the obligation to maintain professional secrecy shall not be affected by the provisions of this Federal Act. Special procedural provisions Article 18. (1) Fines imposed by the FMA pursuant to this Federal Act shall be passed on to the Federal Government. (2) For the enforcement of an administrative decision in accordance with this Federal Act, the amount of EUR 35 000 shall apply instead of the lower amount as stated in Article 5 para. 3 of the Administrative Enforcement Act 1991 (VVG; Verwaltungsvollstreckungsgesetz 1991). Costs Article 19. The costs of the FMA arising from its activity as the competent authority shall be assigned

1. to the respective accounting group pursuant to Article 19 of the Financial Market Authority Act (FMABG; Finanzmarktaufsichtsbehördengesetz), published in Federal Law Gazette I no. 97/2001;
2. to the appropriate sub-accounting group, where sub-accounting groups are to be established within the accounting group in accordance with the Federal Act; to which the performance of supervisory tasks are assigned in accordance with the relevant supervisory laws listed in Article 2 para. 1 no. 1 or no. 4 for the respective legal entity. With regard to their distribution activity pursuant to Article 11 para. 3 PEPP providers and PEPP distributors pursuant to Article 2 para. 1 no. 1 lits. d and e are entities liable to pay costs allocated to the sub￾accounting group for investment service providers as defined in Article 89 para. 1 WAG 2018. Gender-neutral use of language Article 20. Where expressions in this Federal Act relating to persons are given only in the masculine form, they shall refer equally to all genders. The respective gender-specific form shall be used when applied to specific persons. References Article 21. (1) Where references to other Federal Acts are made in this Federal Act, those acts are to be applied in their respective current versions. (2) Where references are made in this federal act to the following European Union legal acts, unless instructed otherwise, the following listed versions thereof shall apply:
3. Regulation (EU) 2019/1238 on a pan-European Personal Pension Product (PEPP), OJ L 198, 25.07.2019, p. 1 in the version of Regulation (EU) 2023/2869 amending certain regulations as

pan-European Personal Pension Product Enforcement Act (PEPP-Vollzugsgesetz) 18 / 18 regards the establishment and functioning of the European single access point, OJ L 2023/2869, 20.12.2023; 2. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 04.05.2016, p. 1, in the version of the corrigendum OJ L 74, 04.03.2021, p. 35; 3. Regulation (EU) 2023/2859 establishing a European single access point providing centralised access to publicly available information of relevance to financial services, capital markets and sustainability, OJ L 2023/2859, 20.12.2023, in the version of the Directive (EU) 2024/1760, OJ L 2024/1760, 05.07.2024. Entry into force Article 22. (1) This Federal Act shall enter into force on the following day after publication. (2) Article 16 including the heading in the version amended by the Act amending provisions in relation to the Freedom of Information Act (Informationsfreiheits-Anpassungsgesetz) as amended in Federal Law Gazette I 50/2025 shall enter into force on 01 September 2025. (3) Article 1, Article 2a including the heading, Article 3 para. 3, Article 4 para. 11, Article 14 and Article 21 in the version of the Federal Act published in Federal Law Gazette I No. 5/2026 shall enter into force on the following day after publication. The FMA shall inform the European Securities and Markets Authority (ESMA) by 9 January 2028 that it is the collection body as defined in Article 2 point 2 of Regulation (EU) 2023/2859 pursuant to Article 70a (3) of Regulation (EU) 2019/1238. The FMA shall inform ESMA by 9 January 2030 that it is the collection body pursuant Article 3 (2) of Regulation (EU) 2023/2859 for the collection of information on a voluntary basis listed in Regulation (EU) 2019/1238. Enforcement Article 23. The Federal Minister of Finance shall be responsible for enforcing this Federal Act.