Guidelines on portability of information between securitisation repositories under the Securitisation Regulation

05/02/2021 | ESMA33-128-1001 EN Guidelines On portability of information between securitisation repositories under the Securitisation Regulation

1 Table of Contents I. Scope............................................................................................................................. 2 II. Legislative references, abbreviations and definitions...................................................... 2 III. Purpose ...................................................................................................................... 4 IV. Compliance and reporting obligations ......................................................................... 5 V. Guidelines on portability of information between securitisation repositories.................... 5 VI. Annex ......................................................................................................................... 9

2 I. Scope Who?

1. These guidelines apply to securitisation repositories. What?
2. These guidelines provide clarification on how to ensure compliance with the obligations in Articles 78(9)(c) and 79(3) of EMIR, as applied by Article 10(2) of the Securitisation Regulation. In particular, these guidelines provide clarification on: (a) the transfer of securitisation information by a securitisation repository from which registration has been withdrawn to other securitisation repositories; and (b) the content of the policies for the orderly transfer of data which a securitisation repository has to establish for the transfer of securitisation information to other securitisation repositories where requested by a reporting entity or where otherwise necessary.
3. These guidelines do not cover situations that do not require the transfer of information, such as when reporting entities have decided to report to two or more securitisation repositories at the same time. When?
4. These Guidelines will be translated into the official languages of the EU and published on ESMA’s website. ESMA will consider them for the purpose of its supervision as of 1 January 2021, except for the Guidelines relating to Article 78(9)(c) of EMIR, which ESMA will consider for the purpose of its supervision as of 18 June 2021. II. Legislative references, abbreviations and definitions Legislative references ESMA Regulation Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC1 1 OJ L 331, 15.12.2010, p. 84.

3 Securitisation Regulation Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation and creating a specific framework for simple, transparent and standardised securitisation, and amending Directives 2009/65/EC, 2009/138/EC and 2011/61/EU and Regulations (EC) No 1060/2009 and (EU) No 648/20122 EMIR Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories3 Securitisation Disclosure Requirements Delegated Regulation Commission Delegated Regulation (EU) 2020/1224 of 16 October 2019 supplementing Regulation (EU) 2017/2402 of the European Parliament and of the Council with regard to regulatory technical standards specifying the information and the details of a securitisation to be made available by the originator, sponsor and SSPE 4 Securitisation Disclosure Requirements Implementing Regulation Commission Implementing Regulation (EU) 2020/1225 of 29 October 2019 laying down implementing technical standards with regard to the format and standardised templates for making available the information and details of a securitisation by the originator, sponsor and SSPE 5 Securitisation Repository Operational Standards Delegated Regulation Commission Delegated Regulation (EU) 2020/1229 of 29 November 2019 supplementing Regulation (EU) 2017/2402 of the European Parliament and of the Council with regard to regulatory technical standards on securitisation repository operational standards for data collection, aggregation, comparison, access and verification of completeness and consistency 6 STS Notification Implementing Regulation Commission Implementing Regulation (EU) 2020/1227 of 12 November 2019 laying down implementing technical standards with regard to templates for the provision of information in accordance with the STS notification requirements 7 Securitisation Repository Application Delegated Regulation Commission Delegated Regulation (EU) 2020/1230 of 29 November 2019 supplementing Regulation (EU) 2017/2402 of the European Parliament and of the Council with regard to regulatory technical standards specifying the details of the application for registration of a securitisation repository and the details of the simplified application for an extension of registration of a trade repository 8 2 OJ L 347, 28.12.2017, p. 35. 3 OJ L 201, 27.7.2012, p. 1. 4 OJ L 289, 03.09.2020, p. 1. 5 OJ L 289, 03.09.2020, p. 217. 6 OJ L 289, 03.09.2020, p. 335. 7 OJ L 289, 03.09.2020, p. 315. 8 OJ L 289, 03.09.2020, p. 345.

4 Abbreviations ESMA European Securities and Markets Authority EU European Union XML eXtensible Markup Language Definitions old securitisation repository a securitisation repository to which a reporting entity ceased reporting securitisations in accordance with Article 7(2) of the Securitisation Regulation either due to a decision of that entity or the withdrawal of the registration of that securitisation repository new securitisation repository a securitisation repository to which a reporting entity who has ceased reporting securitisations to an old securitisation repository reports securitisations to in accordance with Article 7(2) of the Securitisation Regulation or has communicated in writing its intention to do so, even if it has not yet entered a contractual relationship III. Purpose 5. These guidelines are based on Article 16(1) of the ESMA Regulation. The objectives of these guidelines are to establish consistent, efficient and effective supervisory practices within the European System of Financial Supervision and to ensure the common, uniform and consistent application of the Securitisation Regulation. These Guidelines achieve these objectives by describing the content of policies for the transfer of data within the meaning of Articles 78(9)(c) and 79(3) of EMIR, as applied by Article 10(2) of the Securitisation Regulation, with a threefold purpose: (a) remove portability obstacles from the competitive securitisation repository environment underpinning the Securitisation Regulation, and ensure that market participants can benefit from a multi-securitisation repository environment; (b) ensure the quality of information available to investors, potential investors and public authorities, when a reporting entity changes the securitisation repository to which it reports, irrespective of the reason for such change; (c) ensure that there is a consistent and harmonised way to transfer records from one securitisation repository to another, supporting the continuity of reporting and reconciliation in all cases, including the withdrawal of registration of a securitisation repository. 6. The need to transfer information to another securitisation repository may arise for different reasons. The guidelines therefore address separately the situations where (i) the transfer

5 is done on a voluntary basis and under normal market conditions; and (ii) the transfer is due to withdrawal of registration of the securitisation repository. The incentives and motivations for the relevant parties in each of the two cases would be different and therefore there is a need for a specific approach in each particular situation. IV.Compliance and reporting obligations Status of the guidelines 7. In accordance with Article 16(3) of the ESMA Regulation, securitisation repositories must make every effort to comply with these guidelines. 8. ESMA will assess the application of these guidelines by securitisation repositories through its ongoing direct supervision. Reporting requirements 9. Securitisation repositories are not required to report whether they comply with these guidelines. V. Guidelines on portability of information between securitisation repositories 10. Only the old securitisation repository and the new securitisation repository should carry out the transfer of securitisation information. 11. The transfer of securitisation information should be carried out by the securitisation repositories in accordance with a mutually-agreed migration plan. The migration plan should be detailed. It should include a timeline and a description of the required controls in place to ensure the timely, complete and accurate transfer of designated securitisation information. Where the reason for a transfer of securitisation information is the withdrawal of registration, migration plans for the transfer of securitisation information should be included as part of the wind-down plan presented by the securitisation repository to ESMA. 12. All securitisation repositories involved should use a migration plan template mutually agreed between themselves. The migration plan template should include the content set out in paragraph 13. 13. The migration plan should contain the following information:

6 (a) the scope of the transfer of securitisation information, including the reporting entities whose securitisations are involved and the securitisations whose information is to be transferred; (b) the detailed roles and responsibilities of the involved entities; (c) the timeline and relevant milestones for the transfer; (d) the controls required to ensure the confidentiality of the transferred securitisation information, including the type of encryption used; (e) the controls required to ensure the integrity and accuracy of the transferred securitisation information, including cryptographic checksums and hashing algorithms; (f) the controls required to ensure continuity of operations and the inter-securitisation repository reconciliation status of the elements under transfer; (g) the cut-off time of the information to be transferred; (h) the subsequent availability of the information to the users listed in Article 17(1) of the Securitisation Regulation; and (i) any other information that will facilitate and secure the smooth transfer of the securitisation information. 14. Securitisation repositories should transfer information to each other by using the XML format and templates defined in accordance with the Securitisation Disclosure Requirements Implementing Regulation and the STS Notification Implementing Regulation. 15. The securitisation repositories should use secure machine-to-machine protocols, including the SSH File Transfer Protocol, to transfer information between each other. 16. The securitisation repositories should use advanced encryption protocols and should exchange the relevant public encryption keys with each other. To ensure seamless functioning, the securitisation repositories should test in advance that they are able to encrypt and decrypt each other’s securitisation information. 17. The old securitisation repository should identify the number of securitisations whose information is to be transferred and the number of corresponding files (by unique identifier, item code and submission timestamp) that will be transferred to the new securitisation repository. The old securitisation repository should request confirmation from the reporting entity of the files to be transferred to the new securitisation repository and should resolve all discrepancies at the earliest convenience and no later than in five working days. 18. For every file generated and transferred, the old securitisation repository should generate and include in the securitisation information transfer a cryptographic checksum according to a mutually-agreed hashing algorithm.

7 19. The transfer of securitisation information should be carried out on a non-working day. Exceptionally, the old and the new securitisation repositories may agree on carrying it out on a working day depending on the expected volume of the transfer. 20. As soon as the transfer of all relevant files relating to a securitisation whose information is to be transferred is confirmed by the new securitisation repository, the old securitisation repository should not accept further data submissions from reporting entities relating to that securitisation. 21. Until the transfer of all the relevant files of an identified securitisation is completed, the new securitisation repository should not accept data submissions from reporting entities relating to that securitisation. 22. Once the securitisation information transfer is complete, the new securitisation repository should treat the information in the same way as other information received directly from reporting entities. 23. Following the transfer of records of a reporting entity from the old securitisation repository to the new securitisation repository, the old securitisation repository should not charge any fees or require other compensation or remuneration for the recordkeeping of those records. 24. The scope of the securitisation information to be transferred should comprise at least: (a) in the case where a reporting entity decides to transfer its reporting to a new securitisation repository, all information set out in Article 7 of the Securitisation Regulation, as further specified in the Securitisation Disclosure Requirements Delegated Regulation, received by the old securitisation repository on the securitisations reported by that reporting entity; (b) in the case where the transfer is due to the withdrawal of registration of the old securitisation repository, all information set out in Article 7 of the Securitisation Regulation, as further specified in the Securitisation Disclosure Requirements Delegated Regulation, received by the old securitisation repository; and (c) the reporting log as set out in Article 8(1)(e) of the Securitisation Repository Operational Standards Delegated Regulation relating to each securitisation whose information is to be transferred. 25. The securitisation information should be transferred in a single instance. 26. By way of exception, in case all the securitisation information cannot be transferred in a single instance, the securitisation repositories should first transfer the information relating

8 to securitisations that have not matured as at the date of transfer and second the information relating to those that have already matured as at the date of transfer. 27. The information relating to those securitisations should be transferred in accordance with the following sequence: (a) the latest submission of the information set out in Annexes II to XV of the Securitisation Disclosure Requirements Delegated Regulation; (b) the latest submission of the available items referred to in Table 3 in Annex I in the Securitisation Disclosure Requirements Delegated Regulation, with the exception of the templates set out in the Securitisation Disclosure Requirements Delegated Regulation; (c) all other information received by the securitisation repository; and (d) the reporting log as set out in Article 8(1)(e) of the Securitisation Repository Operational Standards Delegated Regulation. 28. The old securitisation repository should provide ESMA with sufficient evidence that all transfers described in these Guidelines have been successful. 29. In the case of a pending withdrawal of registration of a securitisation repository, the old securitisation repository and the new securitisation repository should apply the procedure set out in Annex A. 30. In the case of a transfer of securitisation information requested by a reporting entity, the old securitisation repository and the new securitisation repository should apply the procedure set out in Annex B. The old securitisation repository should not reject a request for the transfer of securitisation information.

9 VI. Annex ANNEX A Procedure for transfer of securitisation information in case of withdrawal of registration

1. In the event of a voluntary withdrawal of registration (i.e. the old securitisation repository expressly renounces the registration pursuant to Article 15(1)(a) of the Securitisation Regulation), the old securitisation repository should notify ESMA in advance of the intended date of cessation of operations and should then notify without delay the affected reporting entities and registered users of the securitisation repositories. For securitisation repositories with more than 50 reporting entities or 100 registered users at the time of the decision of the repository to cease operations, notice should be given to ESMA at least nine months in advance of the intended cessation date. In other cases, notice should be given at least six months in advance.
2. In the event of a non-voluntary withdrawal of registration (i.e. all other cases indicated in Article 15(1) of the Securitisation Regulation), ESMA should inform the other registered securitisation repositories that they can expect to receive information that was originally reported to the old securitisation repository.
3. The old securitisation repository should prepare the migration plan and submit it to ESMA and the new securitisation repository. The old and new securitisation repositories should raise any potential objections or concerns and, after resolving them, they should consider the migration plan as agreed.
4. For each securitisation, the old securitisation repository should provide ESMA and the other new securitisation repositories with the following information regarding the elements subject to transfer to each new securitisation repository: (a) the total number of securitisations whose information is to be transferred; (b) the total number of items (using the codes set out in Table 3 in Annex I in the Securitisation Disclosure Requirements Delegated Regulation and the associated submission timestamps).
5. Once the number of securitisations whose information is to be transferred and the number of items are notified to ESMA, the old securitisation repository should proceed with preparing the relevant files for transfer in accordance with these Guidelines after receiving confirmation from ESMA. The old securitisation repository and the new securitisation repositories should execute the migration plan. The old securitisation repository should transfer the files generated to the new securitisation repository, which should acknowledge the file transfer. The sequence prioritisation set out in these Guidelines should be followed and securitisations to be transferred should be segmented per reporting entity.

10 6. The securitisation repositories should transfer the files within a predetermined weekend or, in case the volume of files does not allow the simultaneous transfer within the predetermined weekend, at the earliest opportunity within the next calendar week. 7. Any issues identified and progress made should be reported regularly to ESMA in a timely manner. 8. The new securitisation repositories should determine the following figures and information for the received records and should verify the completeness of the transfer: (a) the total number of securitisations whose information has been transferred; (b) the total number of items (using the codes set out in Table 3 in Annex I in the Securitisation Disclosure Requirements Delegated Regulation and the associated submission timestamps). 9. The new securitisation repositories should notify ESMA and the old securitisation repository of the result of the verification. In case of verification failure, the root cause should be investigated by both parties (old and new securitisation repositories) and the transfer process should be repeated until the securitisation information transfer is successful. 10. Once the transfer has been completed, the new securitisation repositories should notify the relevant reporting entities and the registered users by email of the successful conclusion of the transfer. 11. The old securitisation repository should isolate and keep safely the transferred securitisation information by applying the same recordkeeping policies, procedures and safeguards to the transferred information as to securitisation information reported to and made available by the securitisation repository until the date of the cessation of its operations as a securitisation repository and ensure the timely retrieval of information in no more than seven calendar days. 12. At the date of the actual cessation of its operations as a securitisation repository, the old securitisation repository should perform a secure destruction of the transferred securitisation information, in accordance with leading practices and the most reliable available techniques, with the aim of ensuring that information cannot be retrieved after that date.

11 ANNEX B Procedure for transfer of securitisation information at the request of a reporting entity

1. The old securitisation repository should determine and agree with the reporting entity the following aggregate information regarding the securitisations of the reporting entity subject to transfer: (a) the total number of securitisations; (b) the total number of items (using the codes set out in Table 3 in Annex I in the Securitisation Disclosure Requirements Delegated Regulation and the associated submission timestamps).
2. After signing the relevant contractual agreement with the reporting entity, the new securitisation repository should communicate the migration plan to and agree it with the old securitisation repository.
3. The securitisation repositories should agree the migration plan for the information transfer as soon as possible and no later than five working days after the request from the new securitisation repository is received by the old securitisation repository.
4. Once the number of securitisations and records are confirmed by the reporting entity, the old securitisation repository should proceed with preparing the relevant file(s) for transfer in accordance with these Guidelines. The old and new securitisation repositories should execute the migration plan. The old securitisation repository should transfer the files generated to the new securitisation repository, according to the following principles: (a) in case the volume of files is manageable, the old securitisation repository should transfer all files at the same time. (b) in case the volume of files does not allow the simultaneous transfer, the sequence set out in these Guidelines should be followed. (c) The files should be transferred within a predetermined weekend or, in case the volume of files does not allow the simultaneous transfer within the predetermined weekend, at the earliest opportunity within the next calendar week.
5. The new securitisation repository should notify ESMA by email about the transfer.
6. As soon as the elements for the securitisations of the reporting entity are transferred to the new securitisation repository, the new securitisation repository should confirm this, including the date of transfer completion, to the affected reporting entity, the old securitisation repository, and the users registered with the new securitisation repository. The old securitisation repository should confirm this, including the date of transfer completion, to the users registered with the old securitisation repository.

12 7. The new securitisation repository should determine the following figures and information for the received records: (a) the total number of securitisations; (b) the total number of items (using the codes set out in Table 3 in Annex I in the Securitisation Disclosure Requirements Delegated Regulation and the associated submission timestamps). 8. The new securitisation repository should request the reporting entity’s confirmation of the accuracy of the information above vis-à-vis the reporting entity’s own records. In case there is a mismatch, the two securitisation repositories should together try to reconcile the relevant numbers with the reporting entity until an agreement is achieved - the old securitisation repository should initiate and coordinate this process. 9. The new securitisation repository should notify its registered users (by email) that the reporting entity has switched to it. 10. The old securitisation repository should remove the migrated securitisations from any data aggregations or other reports produced as set out in Securitisation Repository Operational Standards Delegated Regulation9 . 11. The old securitisation repository should isolate and safely keep the transferred information, by applying the same recordkeeping policies, procedures and safeguards to the transferred information as to the rest of securitisation information reported to and made available by that securitisation repository, for as long as prescribed according to Article 8 in the Securitisation Repository Operational Standards Delegated Regulation and should ensure the retrieval of information in no more than seven calendar days. 9 In particular Article 2 and Article 4(9) of the Securitisation Repository Operational Standards Delegated Regulation