Region

Jurisdiction

Regulator

2026-03-12

Added 2026-07-13 · Updated 2026-07-25

Commission Delegated Regulation (EU) 2026/544 on regulatory technical standards for external reviewers of European Green Bonds

The European Commission adopts regulatory technical standards specifying the criteria for assessing the appropriateness, adequacy, and effectiveness of systems, resources, and procedures employed by external reviewers of European Green Bonds. The regulation mandates that external reviewers maintain robust internal controls, independent compliance functions with sufficient resources and access to information, and sound administrative and ICT risk management frameworks. It further establishes detailed criteria for the quality and reliability of information used in reviews and defines the specific information, form, and content requirements for applications submitted to ESMA for the recognition of third-country external reviewers.

European Union

European Commission

EUR-Lex

Access to European Union law

This document is an excerpt from the EUR-Lex website

You are here

EUROPA

EUR-Lex home

Delegated regulation - EU - 2026/544 - EN - EUR-Lex

Help

Quick search

Use quotation marks to search for an "exact phrase". Append an asterisk ( * ) to a search term to find variations of it (transp * , 32019R * ). Use a question mark ( ? ) instead of a single character in your search term to find variations of it (ca ? e finds case, cane, care).

Search tips

Need more search options? Use the

Advanced search

Document 32026R0544

Help

Commission Delegated Regulation (EU) 2026/544 of 12 March 2026 supplementing Regulation (EU) 2023/2631 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for assessing the appropriateness, adequacy and effectiveness of the systems, resources and procedures of external reviewers, their compliance function, internal policies and procedures, assessment methodologies and information used for reviews, as well as the information and the form and content of applications for recognition of third-country external reviewers

C/2026/80

OJ L, 2026/544, 17.6.2026, ELI: http://data.europa.eu/eli/reg_del/2026/544/oj (BG, ES, CS, DA, DE, ET, EL, EN, FR, GA, HR, IT, LV, LT, HU, MT, NL, PL, PT, RO, SK, SL, FI, SV)

In force

ELI: http://data.europa.eu/eli/reg_del/2026/544/oj

Language 1

Language 2

Language 3

Official Journal of the European Union

L series

2026/544

17.6.2026

COMMISSION DELEGATED REGULATION (EU) 2026/544

of 12 March 2026

supplementing Regulation (EU) 2023/2631 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for assessing the appropriateness, adequacy and effectiveness of the systems, resources and procedures of external reviewers, their compliance function, internal policies and procedures, assessment methodologies and information used for reviews, as well as the information and the form and content of applications for recognition of third-country external reviewers

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2023/2631 of the European Parliament and of the Council of 22 November 2023 on European Green Bonds and optional disclosures for bonds marketed as environmentally sustainable and for sustainability-linked bonds ( 1 ) , and in particular Article 26(3), third subparagraph, Article 29(4), third subparagraph, Article 30(3), third subparagraph, Article 31(4), third subparagraph, and Article 42(9), third subparagraph, thereof,

Whereas:

(1)

To ensure the appropriateness, adequacy and effectiveness of their systems, resources and procedures, external reviewers should comprehensively consider their internal arrangements, from the robustness of information systems to the sufficiency of human, technical and material resources. External reviewers should develop a robust assessment framework as part of their procedures, which should encompass the minimum criteria to be applied for assessing the quality of information and the reliability of sources used in assessment activities.

(2)

For the same reason, any deficiencies of systems, resources and procedures identified when monitoring and evaluating their adequacy and effectiveness should be adequately recorded, remediated and reported, and members of the management body of the external reviewer should oversee corrective actions.

(3)

To enable the compliance function to have the authority to discharge its responsibilities properly and independently, external reviewers should have a board-approved compliance function policy or policies and the presence of the compliance function in relevant organisational structures of the external reviewer, including committees.

(4)

To guarantee the necessary resources of the compliance function and to enable the compliance function to effectively perform its monitoring tasks, external reviewers should dedicate sufficient technical and human resources to this function.

(5)

To establish the necessary expertise of the compliance function, external reviewers should ensure the collective and up-to-date skill and experience of persons carrying out the compliance function, including through verifying whether those persons have the requisite employment history and professional qualifications, and by providing sufficient high levels of in-house training.

(6)

To enable the compliance function to have access to all relevant information, external reviewers should ensure that the compliance function can obtain information from all sources it needs to adequately perform its tasks, including corporate and control function records, audit reports, whistleblowing reports and customer complaints. Given the need to ensure that third-party service providers and other business units adhere to the same standards as the external reviewer itself, the compliance function should also have access to information on any outsourced functions or other business lines of the external reviewer.

(7)

To ensure the soundness of their administrative and accounting procedures, external reviewers should maintain adequate records of relevant accounting events and comply with applicable accounting standards and rules.

(8)

To maintain sound internal control mechanisms, external reviewers should implement a comprehensive system of internal control focused on creating a strong and proportionate control environment, effectively managing risks, implementing necessary control activities, ensuring clear information flows and communication and continuously monitoring activities.

(9)

To guarantee the effectiveness of the control and safeguard arrangements for information processing systems, external reviewers should implement a control framework for ICT risk management that includes IT and information security assessments and the testing of backup ICT systems to ensure business continuity.

(10)

To ensure that their opinion is based on a thorough analysis of information that is of sufficient quality and from reliable sources, external reviewers should apply in their assessment methodologies specific criteria for assessing such information.

(11)

To evaluate the quality of the information used, external reviewers should ensure that such information is complete, relevant, timely and based on reasonable assumptions, including by ensuring that such information provides a comprehensive representation of the bond-funded project considering the type and sector of economic activities. For this reason, the information should have a direct connection with the bond’s characteristics, offer an accurate reflection of the funded project, be up-to-date and consider forecasting limitations and inherent uncertainties.

(12)

To evaluate the reliability of sources, external reviewers should ensure that those sources provide objective and substantiated information. Sources should be credible and accompanied by documentation outlining the steps for information collection and processing, the approach regarding the revision of historical data where applicable, and any limitations affecting the source. External reviewers should give due prominence to information stemming from regulatory requirements or to information subject to independent assurance or certification, and to relevant internationally recognised standards, where available.

(13)

To promote comparability of the information collected, external reviewers should apply the criteria for assessing the sufficient quality of information and the reliability of sources of information in a measurable way to every external review and to every source of information.

(14)

The European Securities and Markets Authority (ESMA) should be able to assess whether applicants for recognition as third-country external reviewers fulfil the conditions referred to in Articles 23(2) and 42(3) of Regulation (EU) 2023/2631, including the conditions laid down in Commission Delegated Regulation (EU) 2025/2180 ( 2 ) . For that reason, applicants should provide information that is up to date and that includes all relevant details in a clear and unambiguous format.

(15)

To safeguard security and enhance data management and usability, ESMA has adopted a digital means of registration specifying the information, form and content of the application for recognition as a third-country external reviewer of European Green Bonds. Any information submitted to ESMA in an application should therefore be machine-readable and in a durable medium.

(16)

To assist ESMA in identifying the documents that an applicant has submitted as part of the application for recognition as a third-country external reviewer, applicants should provide a unique reference number that corresponds to each document.

(17)

For assurance and accountability purposes, applicants that apply for recognition as a third-country external reviewer should complement that application with a letter signed by a member of their senior management, attesting that the submitted information is accurate and complete to the best of that member’s knowledge.

(18)

This Regulation respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union, and notably the right to protection of personal data. The processing of personal data for the purposes of this Regulation should be carried out in accordance with Union law on the protection of personal data. In that regard, any processing of personal data performed by ESMA in application of this Regulation should be carried out in accordance with Regulation (EU) 2018/1725 of the European Parliament and of the Council ( 3 ) . Any processing of personal data performed by entities applying for recognition as external reviewer within application of this Regulation should be carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council ( 4 ) and national requirements on the protection of natural persons with regard to the processing of personal data.

(19)

It is necessary to enable ESMA to assess whether an applicant that applies for recognition as a third-country external reviewer complies with the conditions for such recognition, while ensuring proper safeguards. For that reason, personal data relating to applicants for recognition as a third-country external reviewer should be kept by those external reviewers and ESMA for no longer than five years after that applicant has ceased to perform its function. For the same reasons, where ESMA has refused recognition as a third-country external reviewer or where the applicant has withdrawn its application for recognition as a third-country external reviewer, personal data relating to that applicant should be kept by ESMA no longer than five years after the refusal of the recognition of the applicant or after the withdrawal of the application.

(20)

The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered formal comments on 19 November 2025.

(21)

The regulatory technical standards to be adopted on the basis of the empowerments laid down in Article 26(3), third subparagraph, Article 29(4), third subparagraph, Article 30(3), third subparagraph, Article 31(4), third subparagraph, and Article 42(9), third subparagraph of Regulation (EU) 2023/2631 are closely linked to each other, since they all apply to external reviewers. To ensure coherence between those provisions and to facilitate a comprehensive view by prospective external reviewers of their obligations under Regulation (EU) 2023/2631, those regulatory technical standards should be bundled into a single Delegated Regulation.

(22)

This Regulation is based on the draft regulatory technical standards submitted by ESMA to the European Commission in accordance with Article 10 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council ( 5 ) .

(23)

ESMA has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the advice of the Securities and Markets Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1095/2010,

HAS ADOPTED THIS REGULATION:

Article 1

Criteria for assessing whether external reviewers employ the appropriate, adequate and effective systems, resources and procedures to comply with their obligations under Regulation (EU) 2023/2631

The criteria for assessing the appropriateness, adequacy and effectiveness of the systems, resources and procedures employed by external reviewers to comply with their obligations under Regulation (EU) 2023/2631, as referred to in Article 26(1) of that Regulation, shall be the following:

(a)

the systems that are in place safeguard the security, integrity and confidentiality of information and ensure the continuity and regularity in the performance of external reviews;

(b)

the human, technical and material resources deployed are sufficient to identify, manage, monitor and report the risks:

(i)

that an external reviewer is or might be exposed to;

(ii)

the risks that the external reviewer poses or might pose to others;

(c)

the procedures that are in place for the objective and consistent application of assessment methodologies comprise the following elements:

(i)

processes to collect quantitative and qualitative information for the assessment activities, including from the issuer or originator, public sources or third parties;

(ii)

measures to address potential shortcomings in the collection and assessment of information;

(iii)

processes governing the review and reporting of errors in assessment methodologies or in their application;

(iv)

techniques, methods and protocols for designing, periodically testing and reviewing assessment activities, key assumptions and measurement data.

Article 2

Criteria for assessing whether external reviewers monitor and evaluate the adequacy and effectiveness of their systems, resources and procedures

The criteria for assessing whether external reviewers monitor and evaluate the adequacy and effectiveness of their systems, resources and procedures, as referred to in Article 26(2) of Regulation (EU) 2023/2631, shall be the following:

(a)

the monitoring and evaluation is carried out by a function that is independent of the business lines;

(b)

measures to address deficiencies identified in the monitoring assessments include:

(i)

recording in an electronically stored medium breaches, errors, complaints, incidents and near misses;

(ii)

determining remediation actions for breaches, errors, complaints, incidents and near misses;

(iii)

attributing an entity or person responsible for addressing each deficiency;

(iv)

reporting to senior management, the supervisory body, or the management body the progress in addressing identified deficiencies;

(v)

ensuring that the management body oversees the timely implementation of corrective actions.

Article 3

Criteria for assessing whether the compliance function has the authority to discharge its responsibilities properly and independently

The criteria for assessing whether the compliance function of an external reviewer has the authority to discharge its responsibilities properly and independently, as referred to in Article 29(2), point (a), of Regulation (EU) 2023/2631, shall be the following:

(a)

the management body of the external reviewer has adopted policies that enable the compliance function to:

(i)

assess adherence to laws, regulations and internal policies and procedures;

(ii)

carry out compliance activities objectively and effectively without undue influence;

(b)

at least one member of the compliance function:

(i)

is of a level of seniority that enables it to have direct access to decision-makers and challenge business decisions;

(ii)

participates in the structures of the external reviewer tasked with overseeing risk management and regulatory compliance to ensure that compliance considerations are incorporated into the strategy and decision-making procedures of the external reviewer.

Article 4

Criteria for assessing whether the compliance function has the necessary resources and expertise

The criteria for assessing whether the compliance function of an external reviewer has the necessary resources and expertise, as referred to in Article 29(2), point (b), of Regulation (EU) 2023/2631, shall be the following:

(a)

the number of persons carrying out the compliance function is suitable for the nature, scale and complexity of the business of the external reviewer;

(b)

the persons carrying out the compliance function collectively possess the necessary skills and experience in risk management, audit, legal, or compliance;

(c)

the compliance function has systems enabling it to:

(i)

monitor and investigate the compliance of the external reviewer;

(ii)

record, report and remediate compliance findings.

Article 5

Criteria for assessing whether the compliance function has access to all relevant information

The criteria for assessing whether the compliance function of an external reviewer has access to all relevant information, as referred to in Article 29(2), point (b), of Regulation (EU) 2023/2631, shall be the following:

(a)

the compliance function has physical and digital access rights to all information necessary to always perform its tasks effectively, including:

(i)

information systems, databases, and books and records from corporate and control functions, including legal, finance, human resources and IT;

(ii)

meeting minutes of governance bodies;

(iii)

internal and external audit reports and other reports to senior management, the management body or the supervisory body;

(iv)

whistleblower reports;

(v)

customer complaints;

(vi)

information on functions outsourced to a third-party service provider;

(vii)

information on all business units of an external reviewer that provide services other than assessment activities;

(b)

the compliance function has physical access to the business premises and facilities of the external reviewer.

Article 6

Criteria for assessing whether the administrative and accounting procedures are sound

The criteria for assessing whether the administrative and accounting procedures of an external reviewer are sound, as referred to in Article 30(2) of Regulation (EU) 2023/2631, shall be the following:

(a)

the records kept by the external reviewer in accordance with Article 34 of Regulation (EU) 2023/2631 ensure that there is a clear audit trail of all relevant events;

(b)

the accounting system allows for a fair and precise reflection of the financial position of the external reviewer and is compliant with the applicable accounting standards and rules.

Article 7

Criteria for assessing whether the internal control mechanisms are sound

The criteria for assessing whether the internal control mechanisms of an external reviewer are sound, as referred to in Article 30(2) of Regulation (EU) 2023/2631, shall be the following:

(a)

the control mechanism is:

(i)

effective to safeguard the independence of internal control functions from the business lines;

(ii)

adequate for the nature, scale and complexity of the business of external reviews;

(b)

there is a risk management framework that establishes the external reviewer’s mechanisms for the effective identification, assessment, monitoring, mitigation and reporting of all risks that could materially impact an external reviewer’s ability to meet its obligations under Regulation (EU) 2023/2631;

(c)

there are preventive and detective control measures to address specific operational risks;

(d)

there are internal and external information and communication procedures that ensure the flow of relevant, timely and reliable information;

(e)

there are monitoring procedures that allow for the continuous evaluation of the adequacy and effectiveness of the internal control mechanisms.

Article 8

Criteria for assessing whether the control and safeguard arrangements for information processing systems are effective

The criteria for assessing whether the control and safeguard arrangements for information processing systems of an external reviewer are effective, as referred to in Article 30(2) of Regulation (EU) 2023/2631, shall be the following:

(a)

a control and safeguard structure is implemented which:

(i)

is appropriate to the nature, scale and complexity of the external reviewer;

(ii)

ensures an effective and prudent management of ICT risks;

(b)

there is an effective and prudent management of ICT risks which includes:

(i)

security assessments of ICT and information systems at least once every 24 months;

(ii)

maintenance and testing of redundant ICT capacities to ensure continuity of the business;

(iii)

risk assessments of third-party ICT integration, where applicable.

Article 9

Criteria for assessing whether the information used by external reviewers for their reviews is of sufficient quality

The criteria for assessing whether the information used by external reviewers for their reviews is of sufficient quality, as referred to in Article 31(3) of Regulation (EU) 2023/2631, shall be the following:

(a)

the information is complete and provides a comprehensive representation of the project funded by the bond, including sufficient details in relation to the type and sector of the economic activities concerned;

(b)

the information has a direct and clear relation with the characteristics of the bond and provides an accurate representation of the project funded;

(c)

the information is in line with the most up-to-date data available to the external reviewers when producing their review and, where available and required by their methodologies, contains historical data;

(d)

any related information, including computations, ratios and estimates, is based on reasonable assertions.

Article 10

Criteria for assessing whether the information used by external reviewers for their reviews comes from reliable sources

The criteria for assessing whether the information used by external reviewers for their reviews comes from reliable sources, as referred to in Article 31(3) of Regulation (EU) 2023/2631, shall be the following:

(a)

the source of information, when required, provides information that is objectively supported by evidence;

(b)

the source of information is able to demonstrate its credibility;

(c)

the source of information is accompanied by the following documents:

(i)

supporting documents covering the steps taken for the collection and processing of the information;

(ii)

a comprehensive set of documentation for the revision of historical data, where applicable;

(iii)

a document describing any limitations that may affect the use of the source of information, including potential data gaps and traceability issues;

(d)

the source of information privileges information that is subject to a disclosure requirement by law, audits, conformity assessments, independent assurance or recognised certifications or, where not available, information subject to applicable internationally recognised standards, including principles and best practices developed by credible international bodies that guide how sustainability-related information should be prepared, presented or evaluated, even if not legally required or subject to a statutory audit.

Article 11

Format to follow for the application for recognition as a third-country external reviewer

Applicants from third countries seeking recognition as external reviewers of European Green Bonds shall submit the information referred to in the Annexes to this Regulation in the format set out in those Annexes.
Applicants from third countries shall provide the application to ESMA in a machine-readable format which enables:

(a)

the information to remain accessible for a period of time adequate for the purposes of the application;

(b)

for the unchanged reproduction of the information stored.

Applicants shall provide a unique reference number to each document that they submit to ESMA. Applicants shall ensure that the information they submit clearly identifies which specific requirement laid down in Article 23(2) and 42(3) of Regulation (EU) 2023/2631 it refers to and in which document that information is provided. Applicants shall submit the table set out in Annex I to this Regulation as part of their application and shall clearly identify the document in which they have provided the information required.
An applicant that considers that a requirement of Regulation (EU) 2023/2631 does not apply to its application for recognition shall:

(a)

make a statement to that effect in the table concerned set out in Annex I to this Regulation;

(b)

explain why it considers that such requirement does not apply.

Applicants shall accompany their application for recognition as a third-country external reviewer with a letter signed by a member of the applicant’s senior management, attesting that the submitted information is accurate and complete to the best of that member’s knowledge, at the date of that submission.
External reviewers or ESMA shall keep the personal data relating to applicants for recognition as an external reviewer for as long as it is necessary for the assessment of the initial application and no longer than five years after that applicant has ceased to perform its function.
Where ESMA has refused the recognition of the applicant external reviewer or where the applicant withdraws its application, ESMA shall keep the personal data relating to that applicant within a period no longer than five years after the refusal of the recognition of the applicant or after the withdrawal of the application.

Article 12

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 12 March 2026.

For the Commission

The President

Ursula VON DER LEYEN

( 1 )

OJ L, 2023/2631, 30.11.2023, ELI: http://data.europa.eu/eli/reg/2023/2631/oj .

( 2 ) Commission Delegated Regulation (EU) 2025/2180 of 12 September 2025 supplementing Regulation (EU) 2023/2631 of the European Parliament and of the Council with regard to regulatory technical standards specifying the conditions for the registration of external reviewers, the criteria for assessing the sound and prudent management of external reviewers, the appropriateness of the knowledge, experience and training of the external reviewers’ employees, and the conditions under which external reviewers can outsource their assessment activities ( OJ L, 2025/2180, 30.12.2025, ELI: http://data.europa.eu/eli/reg_del/2025/2180/oj ).

( 3 ) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC ( OJ L 295, 21.11.2018, p. 39 , ELI: http://data.europa.eu/eli/reg/2018/1725/oj ).

( 4 ) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ L 119, 4.5.2016, p. 1 , ELI: http://data.europa.eu/eli/reg/2016/679/oj ).

( 5 ) Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC ( OJ L 331, 15.12.2010, p. 84 , ELI: http://data.europa.eu/eli/reg/2010/1095/oj ).

ANNEX I

DOCUMENT REFERENCES

Annex to this Regulation to which the information relates

(II-VIII)

Unique reference number of the document

Title of the document

Specific requirement of Regulation (EU) 2023/2631 to which the information relates

Chapter or section or page of the document where the information is provided or reason why the information is not provided

ANNEX II

GENERAL INFORMATION OF THE APPLICANT

Full name of the third-country applicant

Address of registered office

[Country, city, street address, postal code]

Website

Legal Entity Identifier (LEI)

[Where available]

Contact person(s)

Name

Title

Address

[Country, city, street address, postal code]

Email address

Telephone number

Legal form of the third-country applicant

Competent authority responsible for supervision of the third-country external reviewer seeking recognition in the third country

[Where applicable]

ANNEX III

OWNERSHIP STRUCTURE OF THE APPLICANT

Owner

Percentage of capital

Nature of the holding

Percentage of the voting rights

[Please specify whether legal or natural person]

[Direct or indirect]

ANNEX IV

MEMBERS OF SENIOR MANAGEMENT AND THE BOARD OF THE APPLICANT

Name

Board member

Member of senior management

Date of birth

Place of birth

Role

Submitted documents

Proof of the absence of criminal records relating to money laundering, terrorist financing, provision of financial services or data services, acts of fraud or embezzlement, notably through an official certificate, or, where such a certificate is not available in the relevant third-country jurisdiction, a self-declaration of good repute and the authorisation to ESMA to request such information from the relevant authorities on whether that member has been convicted of a criminal offence in connection with money laundering, terrorist financing, the provision of financial services or data services or in relation to acts of fraud or embezzlement

Declaration of fitness and propriety and conflicts of interest referred to in Article 1(2), point (b), of Delegated Regulation (EU) 2025/2180

[First name] [Last name]

[Yes/No]

[DD/MM/YYYY]

[City, Country]

[Unique reference number]

ANNEX V

ANALYTICAL RESOURCES OF THE APPLICANT

Information regarding analysts, employees and other persons directly involved in assessment activities

Name

Role

[Please select the appropriate column]

Years in role

Years in the industry

Temporary

Permanent

[For instance, number of years working in assessment activities similar to those tasks required of an external reviewer pursuant to Regulation (EU) 2023/2631]

[Unique reference number of the document]

Any information regarding the number of employees shall be provided on a full-time equivalent (FTE) basis calculated as the total hours worked divided by the maximum number of hours subject to compensation within a working year as defined by the relevant national law.

Information regarding the assessment activities

Estimated duration of an external review

[Number of days]

Expected number of assessments in the next 24 months

[Number]

Information on the evaluation of the applicant

Reasons that the applicant considers the number of analysts, employees and other persons directly involved in assessment activities and their roles to be appropriate

Reasons that the applicant considers the number and duration of external reviews to be appropriate

ANNEX VI

POLICIES AND PROCEDURES OF THE APPLICANT

Point

Topic

Reference number

Training and development plan for analysts, employees and other persons directly involved in assessment activities

Policies and procedures put in place to ensure:

(a)

the continuity and regularity in the performance of assessment activities;

(b)

the safeguarding of the confidentiality and security of records and documents on the services provided;

(c)

sound administrative and accounting procedures;

(d)

and the adequacy of information processing systems implemented to meet the obligations of an external reviewer.

Policies and procedures outlining the internal control framework

[ In case of a large number of documents, these should be grouped according to the relevant areas of the internal control framework ]

Policies and procedures to ensure the internal control framework complies with the criteria referred to in Article 5(2) of Delegated Regulation (EU) 2025/2180

Whistleblower policy ensuring that the anonymity of whistleblowers is safeguarded and reprisals are prohibited

Remuneration policy ensuring the independence of the employees subject to variable compensation arrangements

Procedures and methodologies implemented to issue reviews

Terms of reference of the governance bodies, including the board and, where established, its committees

Last meeting minutes of the board

Organisational chart, including the identification of reporting lines and job functions

Conflict of interest policy

Inventory of actual or potential conflicts of interest and proposed mitigation measures

Information on how potential conflicts of interest situations, including transactions with related parties, employee personal account dealing, outside business activities and the acceptance of gifts and hospitality are reviewed and approved consistently

Documents and information related to any existing or planned outsourcing arrangements for activities of the external reviewer covered by Regulation (EU) 2023/2631, including information on entities assuming outsourcing functions, and the evaluation of how the external reviewer ensures compliance with Article 33(1) of that Regulation

ANNEX VII

OTHER ACTIVITIES OF THE APPLICANT

Activity

Description

Offered through subsidiaries

[NACE code of the activity, where available]

[Yes/No: if Yes, please provide the name of the entity]

ANNEX VIII

LEGAL REPRESENTATIVE ESTABLISHED IN THE UNION

Full name

Address of the registered office within the Union

[EU Member State, city, street address, postal code]

Email address

Legal status

Deed of incorporation, articles of association or other constitutional documents

Website

Legal Entity Identifier (LEI)

[Where available]

ELI: http://data.europa.eu/eli/reg_del/2026/544/oj

ISSN 1977-0677 (electronic edition)

Top

Topics

esg