Guidelines on the submission of periodic information

14/04/2026 ESMA80-634726060-3085 ESMA - 201-203 rue de Bercy - CS 80910 - 75589 Paris Cedex 12 - France - Tel. +33 (0) 1 58 36 43 21 - www.esma.europa.eu 2 Guidelines on the submission of periodic information to ESMA by Benchmark Administrators, Credit Rating Agencies and Market Transparency Infrastructures

3 Table of Contents 1 Scope............................................................................................................................5 2 Legislative References, abbreviations and definitions ..................................................5 3 Purpose.........................................................................................................................7 4 Compliance and reporting obligations...........................................................................7 5 Guidelines on Periodic Information ...............................................................................8 5.1 Reporting Assignment............................................................................................8 5.2 Reporting Principles...............................................................................................9 5.2.1 Reporting Periods and Submission Deadlines ...............................................9 5.2.2 General Reporting Principles..........................................................................9 5.2.3 Scheduled Reporting ....................................................................................10 5.3 Cross sectoral periodic information......................................................................10 5.3.1 Board Documents and Internal Governance ................................................10 5.3.2 Internal Controls ...........................................................................................13 5.3.3 Information Technology and Information Security ........................................14 5.3.4 Audited Accounts..........................................................................................15 5.4 Sectoral Information – BMAs ...............................................................................15 5.4.1 Methodology .................................................................................................15 5.4.2 External audit................................................................................................16 5.4.3 FTE & Headcount .........................................................................................16 5.5 Sectoral Information – CRAs ...............................................................................16 5.5.1 Ratings and methodologies ..........................................................................16 5.5.2 Internal Controls ...........................................................................................17 5.5.3 Financials, FTE & Headcount .......................................................................17 5.6 Sectoral Information – DRSPs .............................................................................18 5.6.1 Data reporting...............................................................................................18

4 5.6.2 FTE & Headcount .........................................................................................19 5.7 Sectoral Information – SRs ..................................................................................19 5.7.1 Data reporting...............................................................................................19 5.7.2 FTE & Headcount .........................................................................................20 5.8 Sectoral Information – TRs ..................................................................................20 5.8.1 Data reporting...............................................................................................20 5.8.2 FTE & Headcount .........................................................................................21 5.9 Ad-Hoc Reporting Requirements .........................................................................21 5.9.1 Notifications of material changes to the conditions for initial registration .....21 5.9.2 Other Ad-Hoc Notifications ...........................................................................22 5.9.2.1 Cross-sectoral notifications ...................................................................22 5.9.2.2 BMAs .....................................................................................................24 5.9.2.3 CRAs .....................................................................................................24 5.9.2.4 DRSPs...................................................................................................25 5.9.2.5 SRs........................................................................................................25 5.9.2.6 TRs ........................................................................................................26 5.10 Reporting Calendars ............................................................................................27 5.10.1 BMAs ............................................................................................................27 5.10.2 CRAs ............................................................................................................30 5.10.3 DRSPs ..........................................................................................................33 5.10.4 SRs ...............................................................................................................36 5.10.5 TRs ...............................................................................................................39 5.11 Reporting Templates............................................................................................42

5 1 Scope Who?

1. These guidelines apply to third country Benchmark Administrators (BMAs) recognised in the EU, to EU administrators of critical benchmarks authorised under the BMR, Credit Rating Agencies (CRAs) registered in the EU, Data Reporting Services Providers (DRSPs) registered in the EU and supervised by ESMA, Securitisation Repositories (SRs) registered in the EU and Trade Repositories (TRs) registered in the EU (together “reporting entities”). These guidelines do not apply to certified CRAs. What?
2. These guidelines are based on Article 16 of Regulation (EU) No 1095/2010, Articles 8(7a) 8a(3), 8(6aa), 14(3), 21(5) of Regulation (EC) No 1060/2009, Articles 6(5), 7(4), 14(1), 14(2), 24(3), 26(2) and 34(2) of Regulation (EU) 2016/1011, Article 55(4) of Regulation (EU) No 648/2012; Articles 27c(3) of Regulation (EU) No 600/2014; Article 10(4) of Regulation (EU) 2017/2402; Article 5(4) of Regulation (EU) 2015/2365.
3. The final texts will be published on ESMA’s website together with all relevant templates and reporting calendars. In addition, and with a view to improving their visibility and integration within reporting entities’ internal processes, ESMA will also publish the reporting calendars and the templates as standalone items that can be downloaded from the ESMA’s website.
4. These guidelines will repeal and replace the Guidelines on the submission of periodic information to ESMA by Credit Rating Agencies – 2nd Edition, published by ESMA on 7 April 2021 (ESMA33-9-295) and the Guidelines on periodic information and notification of material changes to be submitted to ESMA by Trade Repositories published by ESMA on 23 March 2021 (ESMA74-362-249). When?
5. These guidelines will apply from 01/01/2026. 2 Legislative References, abbreviations and definitions Legislative references BMR Regulation (EU) 2016/1011 of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment

6 funds and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/2014 CRA Regulation Regulation (EC) No 1060/2009 of the European Parliament and of the Council of 16 September 2009 on credit ratings agencies EMIR Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories ESMA Regulation Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC MiFIR Regulation (EU) No 600/2014 on markets in financial instruments Securitisation Regulation Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation and creating a specific framework for simple, transparent and standardised securitisation, and amending Directives 2009/65/EC, 2009/138/EC and 2011/61/EU and Regulations (EC) No 1060/2009 and (EU) No 648/2012 SFTR Regulation (EU) 2015/2365 of the European Parliament and of the Council of 25 November 2015 on transparency of securities financing transactions and of reuse and amending Regulation (EU) No 648/2012 Abbreviations BMA Benchmark Administrator CP Consultation Paper

7 DRSP Data Reporting Services Provider ESMA European Securities and Markets Authority EU European Union CRA Credit Rating Agency registered with ESMA FTE Full Time Equivalent INED Independent Non-Executive Director RTS Regulatory Technical Standards SR Securitisation Repository TR Trade Repository 3 Purpose 6. The objectives of these guidelines are to establish consistent, efficient and effective supervisory practices within ESMA and to ensure common, uniform and consistent application of Union law. In particular, the guidelines set out the information that should be submitted by BMAs, CRAs, DRSPs, SRs and TRs to support ESMA’s ongoing supervisory activities. The guidelines also clarify the format and frequency of the different categories of information which ESMA expects to receive in its role as supervisor. 4 Compliance and reporting obligations 7. In accordance with Article 16(3) of the ESMA Regulation, financial market participants must make every effort to comply with these guidelines.

8 5 Guidelines on Periodic Information 8. These guidelines are split into eight parts: Section 5.1 – Reporting assignment. This section describes how reporting entities are assigned different reporting calendars by ESMA for the purpose of these guidelines. Section 5.2 – Reporting principles. This section explains the different reporting periods and submission deadlines that apply to the different reporting calendars. Section 5.3 – Cross sectoral periodic information. This section explains the information that should be reported by all reporting entities to ESMA. Section 5.4 – Sectoral periodic information. This section explains the information that should be reported by reporting entities to ESMA in accordance with sector-specific regulatory requirements. Section 5.5 – Ad-hoc reporting requirements. This section explains the information that should be reported by reporting entities when certain events materialise, in accordance with relevant regulatory requirements. Section 5.6 – Reporting for the purpose of supervisory fees. This section explains the information that should be reported by reporting entities in accordance with the relevant delegated acts on supervisory fees. Section 5.7 – Reporting calendars. This section includes the reporting calendars by sectoral requirements for the categories “Calendar A” and “Calendar B”. Section 5.8 – Reporting templates. This section includes the reporting templates to be used by reporting entities. 5.1 Reporting Assignment 9. ESMA applies a risk-based approach to supervision which has two key pillars: i) assessment of the importance of a firm relative to other reporting entities, and ii) assessment of key risk areas within each firm. The basis for ESMA’s risk assessment is the information available to ESMA. This information can come from a wide variety of sources i.e., (periodic) information reported by reporting entities, information communicated to ESMA by NCAs, supervisory activities or requests for information, information from market participants and third country regulators and information obtained through ESMA’s own market intelligence.

9 10. For the purposes of these guidelines each supervised entity will be assigned to a reporting calendar based on ESMA’s internal supervisory assessment. There will be two reporting calendars “Calendar A” and “Calendar B”. Reporting entities will be informed of the applicable reporting calendar via formal correspondence. Unless a change is communicated by ESMA, reporting entities should assume no change to their reporting calendar. 5.2 Reporting Principles 5.2.1 Reporting Periods and Submission Deadlines 11. Reporting entities should submit to ESMA information on a quarterly, semi-annual, annual, bi-annual or ad-hoc basis according to one of two calendars. The reporting periods and applicable deadlines for each category of entity are set out in Table 1. For scheduled reporting, reporting entities should submit the information within one month following the end of the reporting period concerned (submission deadline). For ad-hoc reporting, reporting entities should submit the information as soon as possible. 5.2.2 General Reporting Principles 12. Documents should be provided in an unlocked machine-readable format1 . Table 1 REPORTING FREQUENCIES AND SUBMISSION DEADLINES Reporting calendar Reporting Frequency Reporting Period Submission Deadline(s) following the end of the Reporting Period Calendar A Annual 1 July to 30 June or 1 January to 31 December 31 July or 31 May2 31 January3 1 Information shall only be considered machine readable where all of the following conditions are met: (a) it is in an electronic format designed to be directly and automatically read by a computer. The electronic format shall be specified by free, non￾proprietary and open standards. Electronic format shall include the type of files or messages, the rules to identify them, and the name and data type of the fields they contain; (b) it is stored in an IT architecture that enables automatic access; (c) it is robust enough to ensure continuity and regularity in the performance of the services provided and ensures adequate access in terms of speed; (d) it can be accessed, read, used and copied by computer software that is free of charge and publicly available. 2 The Template for Costs and Revenues should be reported on the basis of the previous financial year up by 31st May. 3 Depending on the item some annual reporting items under Calendar A should be provided by 31 Jan. These are typically those reporting items arising from the entity’s own internal control reporting structures, which are prepared on a calendar year cycle and

10 Calendar A Semi-Annual 1 January to 30 June 1 July to 31 December 31 July 31 January Calendar A Quarterly 31 March, 30 June, 30 Sept, 31 Dec 30 April, 31 July, 31 October, 31 Jan Calendar B Bi-Annual 1 July to 30 June of the second following year Or 1 July to 31 December of the following year 31 July 31 January Calendar B Annual 1 July to 30 June Or 1 January to 31 December 31 July or 31st May4 31 January 13. Should any of the requested information be provided under multiple items, reporting entities may indicate so and provide a clear reference to the item that contains the requested information, instead of submitting the related document(s) multiple times. 14. Concerning file transmission, each document under each reporting item and each reporting template should be transmitted according to the instructions referred to in Annex II. 5.2.3 Scheduled Reporting 15. Reporting of each item under this heading should occur in accordance with the Scheduled Reporting Calendars provided in section 5.10 of these guidelines. 5.3 Cross sectoral periodic information 5.3.1 Board Documents and Internal Governance Item 1. Board Documents 16. For reporting under this item, reporting entities should submit the following, covering the period starting from the previous submission: for which a 31 July reporting date would be unsuitable. Should these documents change between their submission in January and 31 July of that year, the updated document should be notified to ESMA by 31 July 4 The Template for Costs and Revenues should be reported on the basis of the previous financial year up by 31 st May.

11 • The minutes of their most recent board and/or management body and/or oversight function meetings, as applicable; • A copy of documents sent to the management body, supervisory board and oversight function members in advance of the respective board meetings, as well as additional documents discussed in the meeting (for instance, reports made by Compliance, Internal Audit, Risk, external audit, other functions such as internal review reports function for CRAs, oversight function reports for BMAs, information security and risk function, etc.), minutes of the Board meetings. Item 2. Organisational Charts 17. Reporting entities should submit their internal organisation charts to ESMA. The information included in the charts should include the information set out in the table below. Category Examples of Function(s) Coverage Scope Management Board or management body members (including INEDs for CRAs, oversight function for BMR) All Staff Supervised entity Executive Committee Members All Staff Supervised entity Senior Management All Staff Supervised entity Business / Operations Analytical or Operations management Last Manager Supervised entity Analytical or Operations support management (data management) Last Manager Supervised entity Methodology / criteria / model development, where applicable All Staff Supervised entity Methodology / criteria / model review / validation, where applicable All Staff Supervised entity Control Functions Compliance (all teams) All Staff Group Risk management All Staff Group Information Security All Staff Group

12 Internal Audit All Staff Group Other Internal Control Functions All Staff Group Support Functions Information Technology Last Manager Supervised entity Human Resources Last Manager Supervised entity Finance Last Manager Supervised entity Commercial staff and business relationship managers Last Manager Supervised entity Legal Last Manager Supervised entity 18. With regards to the section “Functions” each position in the organisational charts should include at least the following information: i) Name ii) Role iii) Location (country) iv) Seniority (managerial/non-managerial role, according the supervised entity￾specific grades) v) Reporting line with Function and Name (If an employee reports outside the EU, please provide the global reporting line) 19. With regards to the section “Coverage”: i) “Last manager” means that the organisational chart should include the full hierarchy down to the last managerial position (i.e. staff with no managerial duties could not be reported); ii) “All Staff” means that the organisational chart should include all employees allocated to a function, which are entirely or partially involved in the activities of the supervised entity.

13 20. With regards to the section “Scope”: i) “Group” means that the organisational chart should include staff at Group level, in case these are entirely or partially involved in the activities of the supervised entity. ii) “Supervised entity” means that the organisational chart should include only staff from the supervised entity. Item 3. New and Potential Conflicts of Interest 21. Reporting entities should submit according to the specific template on Conflicts of Interest any changes during the reporting period to the existing or potential conflicts of interest that were notified to ESMA during the supervised entity’s registration process. 22. The template should include the following information: i) A description of each actual or potential conflict of interest. Reporting entities should report all potential conflicts arising from the operation of the entity, including those arising from monitoring activities performed by internal control functions, and internal complaints; ii) The description should explain the circumstances surrounding the actual or potential conflict of interests, how it was identified and what impact it had; iii) A statement of the reasons why the actual or potential conflict of interests has arisen, identifying the root cause; iv) A statement of the actions undertaken to address the actual or potential conflict of interest and to prevent the recurrence of similar instances in future; v) An explanation of whether an internal investigation has been opened in relation to the actual or potential conflict of interest and whether the investigation is still ongoing at the date of reporting or has been completed. ESMA expects an internal investigation to have been completed within one month of the date the potential case of non-compliance was identified. 5.3.2 Internal Controls Item 4. Compliance Work Plan 23. Reporting entities should submit a copy of their Compliance Work Plan to ESMA. Item 5. Internal Audit Work Plan

14 24. Where a supervised entity has established an Internal Audit function or commissioned internal audits from an external party, the supervised entity should submit a copy of its annual Internal Audit work plan. This document should be reported on an individual basis, in addition to where it may have been included as part of any Board Pack. Item 6. Internal Control Monitoring: Assessments 25. Reporting entities should submit the template on [IC_CM & IA Overview] to provide information regarding their assessments of the adequacy and effectiveness of their systems, internal control mechanisms and arrangements established to ensure compliance with the relevant regulatory requirements. 26. The template should be completed with respect of internal control assessments that were completed during the reporting period, either at the request of ESMA or the internal control functions (e.g. compliance, risk management, internal control, internal audit, information security), as well as any remedial actions that were implemented following an assessment. 5.3.3 Information Technology and Information Security5 Item 7. ICT Risk Management Framework 27. Reporting entities should provide complete and updated information on their ICT risk management framework. The framework should provide an overview of the measures that reporting entities have put in place to implement their ICT and information security objectives, address ICT risk, detect and mitigate ICT-related incidents, and ensure high level of digital operational resilience. Item 8. ICT risk profile 28. Reporting entities should provide complete and updated information on their ICT risk profile (or outcome of the annual ICT risk assessment). The ICT risk profile should include information on the risk appetite, tolerance levels for ICT risk, and key risk metrics. Entities should provide information on the planned/ongoing ICT risk mitigation activities for all significant risks that fall outside the tolerance levels. Item 9. Review or audit report of the ICT risk management framework 29. Reporting entities should submit an annual or periodic review of the ICT risk management framework or report it as part of the audit report . The reports should include information on the improvements suggested to ICT risk management framework as a result of the review/audit. 5 For reporting entities subject to DORA, the requirements of this section shall be fulfilled by providing the documentation required by the relevant articles of the DORA regulation and of the related delegated regulation.

15 Item 10. Summary of findings from annual tests of ICT business continuity plans and the ICT response and recovery plans 30. Reporting entities should submit a summary of the results of the ICT business continuity tests and ICT response and recovery tests (Disaster Recovery). The information should contain a summary of the findings from the tests as well as information on remediation actions or plans. ESMA also requests to provide the outcome of the review, or to report it as part of regular and independent audits of the ICT business continuity plans and the ICT response and recovery plans. Item 11. Summary of findings from the digital operational resilience tests (including any relevant ICT audits) 31. Reporting entities should provide a summary of findings and remediation actions stemming from: • digital operational resilience testing, and • any relevant ICT audits. 5.3.4 Audited Accounts Item 12. Audited accounts 32. Reporting entities should report to ESMA their audited accounts6 . If the financial year does not correspond to the calendar year, the reporting entities should submit the breakdown of revenues and expenses certified by an independent auditor by the 30 September deadline. 5.4 Sectoral Information – BMAs 5.4.1 Methodology Item 13. Resourcing: Operations and Benchmarks 33. BMAs should indicate per business line or asset class the number of FTEs directly involved in the provision of the benchmarks in addition to the number of benchmarks as well as an estimate of the use of these benchmarks in the EU for which they are responsible. 6 Audited accounts should include all information relevant for the purpose of the calculation of supervisory fees, including breakdown of revenues from core and ancillary services, in accordance with the relevant sectoral regulatory framework. In case the reporting entity is not subject to audit obligations for its accounts, an equivalent statement certifying the required information for the calculation of supervisory fees could be provided.

16 Item 14. Resourcing: Methodologies 34. BMAs should indicate the number of staff assigned to the review, validation and development of the methodologies of the BMA as well as the implementation of these methodologies. This should be completed at the group level of the BMA. 5.4.2 External audit Item 15. External audit reports 35. Where a BMA conducts external audits on compliance with the BMR or with IOSCO Principles for financial benchmarks, such BMA should submit to ESMA copies of any reports or assessments conducted by the external audit or third parties during the reporting period or when requested by ESMA related to the benchmark’s activities. 5.4.3 FTE & Headcount Item 16. BMR Staff Numbers & Other Indicators 36. BMAs should submit the Template on [ BMR Staff Numbers and Other Indicators] providing information on total Full Time Employees (FTE) at supervised entity and group level, providing a breakdown of staff numbers according to the following areas: i) Operations ii) Information Technology iii)Information Security iv) Compliance v) Internal Audit vi) Risk Management 5.5 Sectoral Information – CRAs 5.5.1 Ratings and methodologies Item 17. Resourcing: Analysts and Credit Ratings 37. CRAs should submit the relevant template [Resource planning AF] in which they should indicate per business line the number of analysts employed by the CRA in addition to the

17 number of credit ratings for which they are responsible. This should be completed at the level of the EU group of CRAs. Item 18. Resourcing: Methodologies and Models 38. CRAs should submit the relevant template [Resource planning IRF] in which they should indicate the number of staff assigned to the review or validation of the methodologies and models of the CRA. This should be completed at the group level of the CRA. Item 19. Objective Reasons for endorsement 39. CRAs should submit the relevant template [Objective reasons] in which they should provide a description of the objective reasons for the elaboration of any credit rating on EU entities or instruments by the CRA outside of the EU7 . 5.5.2 Internal Controls Item 20. Attestation on Internal Controls 40. Where a CRA’s governing body attests on the effectiveness of its internal control environment and, without prejudice to confidentiality obligations laid down in other relevant legislative acts, CRAs should submit a copy of the attestation. 5.5.3 Financials, FTE & Headcount Item 21. Staff Numbers & Other Indicators 41. CRAs should submit the relevant template [Staff Numbers and Other Indicators] providing information on total FTE at EU and group level, providing a breakdown of staff numbers according to the following areas: i) Analytical ii) Information Technology iii) Information Security iv) Compliance 7 ESMA determines the location of an entity or instrument for the purposes of this item in accordance with the RTS on the European Rating Platform. As outlined in footnote 16 of ESMA’s November 2017 Guidelines on the application of the CRA endorsement regime “For the purposes of these Guidelines, the country of an entity or financial instrument follows Articles 4-6, as well as Field 10 of Table 1 of Part 2 of Annex I of the Commission delegated Regulation 2015/2 of 30 September 2014 with regard to regulatory technical standards for the presentation of the information that CRAs make available to ESMA.

18 v) Internal Audit vi)Risk Management 42. CRAs should submit Template 11 [Staff Numbers and Other Indicators] providing information on the number of IT rating applications in use and the on-going IT projects across the following areas: i) Rating Process ii) Methodology Development, validation and review iii) Commercial and Business Development Process Item 22. Revenues and Costs 43. CRAs should submit the relevant template [Financials], to provide a breakdown of the costs and revenues generated from credit ratings and other products or services (including ancillary services) for the preceding calendar year. For other products or services, CRAs should include a brief description of each type of product or service reported. Costs and revenues should be determined according to the same accounting principles used in preparation of the CRA’s financial statements. 44. For credit ratings, CRAs should report annual revenues broken down by following types of credit ratings: Corporate Non Financials; Corporate Financials; Corporate Insurance; Sovereign / Public Finance; Structured Finance; Covered Bonds. For other products or services, CRAs should report annual revenues broken down by each type of product or service offered. 45. For credit ratings, CRAs should report annual costs per type of credit rating, broken down by operating and non-operating costs. Operating Costs should be further disaggregated between compensation costs (e.g. payroll expenses) and other operating costs. For other products or services, CRAs should report annual costs per product, or service broken down by operating and non-operating costs in the same manner. Non-operating costs may include interest and tax charges. 5.6 Sectoral Information – DRSPs 5.6.1 Data reporting Item 23. Participants overview 46. DRSPs should submit the statistics and DRSP participants’ profile, in accordance with the designated template. The information to be submitted through the template includes,

19 among others: Number, home country and typology of investment firms to which, or on behalf of which, the DRSP provides services, split between ARM and APA. Item 24. Regulatory access status 47. DRSPs (ARMs only) should submit the template listing established connections between ARMs and NCAs. Item 25. Data volume 48. DRSPs should report, among others, the statistics on data volumes. The information to be submitted through the template includes quarterly data referring to outbound and inbound data flows. 5.6.2 FTE & Headcount Item 26. DRSP Staff Numbers & Other Indicators 49. DRSPs should submit the template providing information on total FTEs at supervised entity, providing a breakdown of staff numbers according to the following areas: i) Operations ii) Information Technology iii) Information Security iv) Compliance v) Internal Audit vi) Risk Management 5.7 Sectoral Information – SRs 5.7.1 Data reporting Item 27. Participants overview 50. SRs should submit the statistics and SR participants’ profile, in accordance with the designated template. The information to be submitted through the template includes, among others: Number, home country and typology of investment firms to which, or on behalf of which, the SR provides services.

20 Item 28. Regulatory access status 51. SRs should submit the list of regulatory authorities that have requested and those that have established access to the SR, including through TRACE, in accordance with the designated template. 5.7.2 FTE & Headcount Item 29. SR Staff Numbers & Other Indicators 52. SRs should submit the Template providing information on total FTEs at supervised entity, providing a breakdown of staff numbers according to the following areas: i) Operations ii) Information Technology iii) Information Security iv) Compliance v) Internal Audit vi) Risk Management 5.8 Sectoral Information – TRs 5.8.1 Data reporting Item 30. Participants overview 53. TRs should submit the statistics and TR participants’ profile, in accordance with the designated template. The information to be submitted through the template includes the Regulation under which they report, type of participant (e.g. financial / non-financial and information on the sector of activity), country, whether they are direct or indirect reporting entities, and their share. Item 31. Regulatory access status 54. TRs should submit the list of regulatory authorities that have requested and those that have established access to the TR, including through TRACE, in accordance with the designated template. Item 32. Data volume

21 55. TRs should report the statistics on (i) the total number of trades and reports received from the start of reporting for each Regulation and (ii) the number of derivatives and SFTs per each jurisdiction, entities participating in the reporting and Data Quality Category (for EMIR), in accordance with the designated template. Item 33. Reconciliation statistics 56. TRs should provide ESMA with the statistics on reconciliation of derivatives and SFTs in accordance with the designated templates. 5.8.2 FTE & Headcount Item 34. TR Staff Numbers & Other Indicators 57. TRs should submit the Template providing information on total FTEs at supervised entity, providing a breakdown of staff numbers according to the following areas: i) Operations ii) Information Technology iii) Information Security iv) Compliance v) Internal Audit vi) Risk Management 5.9 Ad-Hoc Reporting Requirements 58. Reporting under this heading should be conducted as soon as possible in accordance with the reporting calendar in Section 5.10. in particular, ESMA should be notified of any issue without undue delay, taking into account the urgency and significance of the matter. The initial notification should be followed up with a more substantial notification within one month in the event further information becomes available. 5.9.1 Notifications of material changes to the conditions for initial registration Item 35. Material changes to the conditions of initial registration 59. ESMA considers a “material change” to be any change that may affect the reporting entities initial conditions of registration, notably its compliance with the requirements of the sectoral

22 Regulation. In this regard, reporting entities should notify ESMA as soon as possible of any material changes to the conditions of its initial registration, including but not limited to the following matters referred in Section 5.7 [reporting calendars] for each mandate and based on the information to be provided in a registration application required by each sectoral regulation8 . Item 36. Change to Membership of Supervisory / Administrative Board 60. Reporting entities should use the relevant template on Board Members Details in order to notify ESMA of any changes to the membership of its Supervisory or Administrative Board. In the event of a new member, reporting entities should also submit an updated version of the template9 . 5.9.2 Other Ad-Hoc Notifications 5.9.2.1 Cross-sectoral notifications Item 37. ICT and Information security incidents notifications 61. Reporting entities should complete the relevant templates. For reporting entities subject to DORA, the notification of major ICT and Information security incidents shall be fulfilled by providing such information according to the corresponding template under DORA. Reporting entities not subject to DORA, notwithstanding the option to use voluntarily the DORA templates, shall provide information on major ICT and information security incidents using the preferred means of communication. 8 For BMR, please refer to the Commission Delegated Regulation (EU) 2018/1645 of 13 July 2018 on the form and content of the application for recognition as well as Commission Delegated Regulation (EU) 2018/1646 on the information to be provided in an application for authorisation and in an application for registration. These Delegated Regulations are subject to review as suggested by ESMA in the relevant final reports. For CRAs, please refer to the Commission Delegated Regulation (EU) No 449/2012 of 21 March 2012 supplementing Regulation (EC) No 1060/2009 of the European Parliament and of the Council with regard to regulatory technical standards on information for registration and certification of credit rating agencies. For TRs, in this respect, Article 55(4) of EMIR and Article 5(4) of SFTR require registered TRs to ‘comply at all times with the conditions for registration’, and to, ‘without undue delay, notify ESMA of any material changes to the conditions for registration’. For DRSPs, please refer to Article 1 of Commission Delegated Regulation (EU) 2017/571 of 2 June 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council with regard to regulatory technical standards on the authorisation, organisational requirements and the publication of transactions for data reporting services providers, requiring data reporting services provider to promptly inform the competent authority of its home Member State of any material change to the information provided at the time of the authorisation and thereafter. For SRs, please refer to Article 10 of Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation, requiring registered securitisation repository to comply at all times with the conditions for registration. A securitisation repository shall, without undue delay, notify ESMA of any material changes to the conditions for registration. 9 Any notification under this item is without prejudice to CRA’s requirements under Article 15 ‘Fitness and Appropriateness’ of Commission Delegated Regulation (EU) 449/2012, supplementing Regulation (EC) No 1060/2009.

23 Item 38. Potential and actual cases of non-compliance with the relevant sectoral regulation 62. For reporting under this item, reporting entities should complete the relevant template on Actual or Potential Breach to provide information regarding possible cases that may result in non-compliance with any of the initial conditions for registration, including: • A description of each case which may result in a possible non-compliance with the initial conditions for registration including cases resulting from activities performed by any control function; • A statement of the reasons why such case has arisen; • A statement of the actions undertaken by the supervised entity following the identification of the case concerned; • A statement of whether an internal investigation has been opened in relation to the case concerned and of whether such investigation is ongoing or closed; and where closed, furnish a copy of any consequent report made in respect of the investigation. 63. This notification should be provided in accordance with Section 5.3.3 of these guidelines. Item 39. Litigation 64. Reporting entities should submit to ESMA information on any existing, new or potential legal actions that have been or that the supervised entity is aware may be taken against the group, and which may adversely impact the continuity or quality of the product or service provided and/or materially impact the financial position of a supervised entity. 65. ESMA expects to receive a brief description of, and updated information on pending and current court proceedings, arbitration proceedings and any form of binding dispute resolution proceedings., and which may adversely impact the continuity or quality of the product or service provided and/or materially impact the financial position of a supervised entity. This description should include a summary of the proceedings and of the potential outcome of the proceedings in terms of liability. Item 40. Internal Complaints submitted to the Compliance Department 66. Following the receipt of a complaint within the scope of the relevant sectoral Regulation by its Compliance Department, reporting entities should complete the relevant template on Internal Complaints to notify ESMA of the following information: i) A description of the content of the complaint;

24 ii) The follow-up actions undertaken by the supervised entity; iii) Information on whether an internal investigation was opened as a consequence, including whether the investigation is ongoing or closed at the date of reporting; where the investigation has been closed, a copy of any consequent report made in respect of the investigation. 5.9.2.2 BMAs Item 41. Identification of errors in input data or determination of benchmarks 67. BMAs should provide information regarding errors in the input data and the determination of the benchmarks. Item 42. Notification of New / Material change to existing Methodology 68. BMAs should provide ESMA with information following the publication of any new methodology, or change to an existing methodology. This information should be submitted after the completion of any consultation conducted in respect of Article 13(1)(c) of the BMR. Item 43. External complaints submitted to the administrator 69. Following the receipt of a complaint made by external parties about the administrator's determination process, for instance on benchmark representativeness, on proposed changes to the benchmark methodology or application of the methodology, or any other decision related to the benchmark determination process. BMAs should notify ESMA of the following information: i) A description of the content of the complaint; ii) The follow-up actions undertaken by the BMA; iii) Information on whether an internal investigation was opened as a consequence, including whether the investigation is ongoing or closed at the date of reporting; where the investigation has been closed, a copy of any consequent report made in respect of the investigation. 5.9.2.3 CRAs Item 44. Identification of errors in methodologies/model processes

25 70. CRAs should complete Template 17 [Error] to provide information regarding errors in the CRAs’ methodologies or models, in accordance with ESMA’s Q&A on the identification of errors in methodologies or models 10 . Item 45. Sovereign Rating Calendar 71. CRAs should submit to ESMA the calendar for sovereign rating actions for the forthcoming year that is published on the CRA’s website. In cases where a CRA deviates from the calendar and the CRA publishes an amended calendar on their website, the CRA should provide this updated calendar to ESMA with a detailed explanation of the reasons for the deviation. Item 46. Notification of New / Change to existing Methodology 72. CRAs should complete Template 19 [Methodologies] in order to provide ESMA with information following the publication of any new methodology or change to an existing methodology or underlying model. This template should be submitted after the completion of any consultation conducted in respect of Article 8(5a) of the CRA Regulation and is without prejudice to CRA’s ongoing obligations under Article 14(3) of the CRA Regulation. Item 47. Endorsed Credit Ratings 73. CRAs should notify ESMA of the results of any internal review that was conducted by the CRA in accordance with Guideline 4.2 Line 17 of ESMA’s guidelines on the application of the endorsement regime. Such a notification should include an update on the appropriate steps taken by the CRA. 5.9.2.4 DRSPs Item 48. Cessation of business 74. The DRSPs should provide ESMA with a wind-down plan in the context of a withdrawal of registration foreseen under Article 27e(1) MiFIR using the designated template and in accordance with the relevant timeline indicated in the template. 5.9.2.5 SRs Item 49. Cessation of business 10 Questions and Answers on the CRA Regulation (Question 8)

26 75. The SRs should provide ESMA with a wind-down plan in the context of a withdrawal of registration foreseen under Article 15(1) of Securitisation Regulation using the designated template and in accordance with the relevant timeline indicated in the template. 5.9.2.6 TRs Item 50. Notification of a portability request 76. TRs should notify ESMA upon receipt of a portability request from a TR participant, in accordance with the designated template. Item 51. Cessation of business 77. The TRs should provide ESMA with a wind-down plan, in accordance with Article 79(3) EMIR and Article 5(2) SFTR in the context of a withdrawal of registration foreseen under Article 71(1) EMIR or Article 73(1)(d) EMIR and under Article 9(1) or Article 10(1) SFTR using the designated template and in accordance with the relevant timeline indicated in the template.

27 5.10Reporting Calendars 5.10.1 BMAs Scheduled Returns under Calendar A Return Name Return Frequency Reporting Deadline Template Available Item Board Documents and Internal Governance 1 Board documents Quarterly 31 Jan, 30 April, 31 July, 31 Oct No 2 Organisational Charts Annual 31 January No 3 New and Potential Conflicts of Interest Annual 31 January Yes Internal Controls 4 Compliance Work Plan Annual 31 January No 5 Internal Audit Work Plan Annual 31 January No 6 Internal Control Monitoring Assessments Annual 31 January Yes Information Technology Reporting 7 ICT Risk Management Framework Annual 31 January No 8 ICT Risk profile Annual 31 January No 9 Review or audit report of the ICT risk management framework Annual 31 January No 10 Summary of the findings of BCP testing activities Annual 31 January No 11 Summary of the findings of digital operational resilience testing activities Annual 31 January No Audited accounts 12 Audited accounts Annual 30 September No Benchmarks and Methodologies 13 Resourcing: Operations and benchmarks Annual 31 January No 14 Resourcing: Methodologies Annual 31 January No External audit 15 External audit reports Biennial 31 January No Staff Numbers & Other Indicators 16 Financials, FTE & Headcount Annual 31 January Yes

28 Scheduled Returns under Calendar B Return Name Return Frequency Reporting Deadline Template Available Item Board Documents and Internal Governance 1 Board documents Annual 31 January No 2 Organisational Charts Annual 31 January No 3 New and Potential Conflicts of Interest Annual 31 January Yes Internal Controls 4 Compliance Work Plan Biennial 31 January No 5 Internal Audit Work Plan Biennial 31 January No 6 Internal Control Monitoring Assessments Biennial 31 January Yes Information Technology Reporting 7 ICT Risk Management Framework Biennial 31 January No 8 ICT Risk profile Upon Demand No 9 Review or audit report of the ICT risk management framework Upon Demand No 10 Summary of the findings of BCP testing activities Upon Demand No 11 Summary of the findings of digital operational resilience testing activities Upon Demand No Audited accounts 12 Audited accounts Annual 30 September No Benchmarks and Methodologies 13 Resourcing: Operations and benchmarks Annual 31 January No 14 Resourcing: Methodologies Annual 31 January No External audit 15 External audit report Upon Demand No Staff Numbers & Other Indicators 16 Financials, FTE & Headcount Annual 31 January Yes

29 Ad-Hoc Reporting Requirements Applicable Calendar A and Calendar B Item Return Name RTS on authorisation RTS on recognition Return Frequency Template Available Notification of Material Changes to Conditions of Registration 35 Continuing Right to Exemptions NA Annex Section B.9(i) As soon as possible No 35 Outsourcing Arrangements Annex I.7 Annex Section A.6 As soon as possible No 35 Legal Form Annex I.1(c) Annex Section A.1(c) As soon as possible No 35 Business Structure Annex I.2(a) Annex Section A.3(a) As soon as possible No 35 Type of Business Activities Annex I.5(a) Annex Section B.9(e) /9(f) /9(g) As soon as possible No 35 Ownership Structure Annex I.1(i) Annex Section A.1(g) As soon as possible No 35 Control framework and oversight function Annex I.4(a)(iii) and 4(a)(iv) Annex Section A.5(a)(iii) and 5(a)(iv) As soon as possible No 35 Change to Procedures used to provide and review benchmarks Annex I.5(d), 5(e) and 6(b)(ii) Annex Section B.9(j), 9(k) and 10(b)(ii) As soon as possible No 35 IT Processes and Information Processing Systems Annex I.4(a)(i)Annex Section A.5(a)(i) As soon as possible No 36 Change to Membership of Supervisory / Administrative Board Annex 1.2 (a) Annex Section A.3 (a) As soon as possible Yes Other Notifications – Non-Material Changes 37 IT and Information security incidents notification As soon as possible Yes 38 Potential and actual cases of non￾compliance with the relevant sectoral regulation As soon as possible Yes 39 Litigations As soon as possible No 40 Internal Complaints Submitted to the Compliance Department As soon as Possible Yes 41 Identification of errors in methodologies process As soon as possible No 42 Notification of New/Change to Methodology As soon as possible No 43 External complaints submitted to the administrator As soon as possible No

30 5.10.2 CRAs Scheduled Returns under Calendar A Return Name Return Frequency Reporting Deadline Template Available Item Board Documents and Internal Governance 1 Board documents Quarterly 31 Jan, 30 April, 31 July, 31 Oct No 2 Organisational Charts Annual 31 January No 3 New and Potential Conflicts of Interest Annual 31 January Yes Internal Controls 4 Compliance Work Plan Annual 31 January No 5 Internal Audit Work Plan Annual 31 January No 6 Internal Control Monitoring Assessments Annual 31 January Yes 20 Attestation on Internal Controls Annual 30 April No Information Technology Reporting 7 ICT Risk Management Framework Annual 31 January No 8 ICT Risk profile Annual 31 January No 9 Review or audit report of the ICT risk management framework Annual 31 January No 10 Summary of the findings of BCP testing activities Annual 31 January No 11 Summary of the findings of digital operational resilience testing activities Annual 31 January No Audited Accounts 12 Audited accounts Annual 30 September No Ratings and Methodologies 17 Resourcing: Analysts Annual 31 January Yes 18 Resourcing: Methodologies & Models Annual 31 January Yes 19 Objective Reasons Annual 31 January Yes Staff Numbers & Other Indicators 21 Staff Numbers and Other Indicators Annual 31 January Yes 22 Revenues and Costs Annual 30 September Yes

31 Scheduled Returns under Calendar B Return Name Return Frequency Reporting Deadline Template Available Item Board Documents and Internal Governance 1 Board documents Annual 31 January No 2 Organisational Charts Annual 31 January No 3 New and Potential Conflicts of Interest Annual 31 January Yes Internal Controls 4 Compliance Work Plan Bi-Annual 31 January No 5 Internal Audit Work Plan Bi-Annual 31 January No 6 Internal Control Monitoring Assessments Bi-Annual 31 January Yes 20 Attestation on Internal Controls Upon Demand NA No Information Technology Reporting 7 ICT Risk Management Framework Bi-Annual 31 January No 8 ICT Risk profile Upon Demand NA No 9 Review or audit report of the ICT risk management framework Upon Demand NA No 10 Summary of the findings of BCP testing activities Upon Demand NA No 11 Summary of the findings of digital operational resilience testing activities Upon Demand NA No Audited Accounts 12 Audited accounts Annual 30 September No Ratings and Methodologies 17 Resourcing: Analysts Annual 31 January Yes 18 Resourcing: Methodologies & Models Annual 31 January Yes 19 Objective Reasons Annual 31 January Yes Staff Numbers & Other Indicators 21 Staff Numbers and Other Indicators Annual 31 January Yes 22 Revenues and Costs Annual 30 September Yes

32 Ad-Hoc Reporting Requirements Applicable Calendar A and Calendar B Item Return Name RTS on registration Return Frequency Template Available Notification of Material Changes to Conditions of Registration 35 Opening and Closing of Branches Art. 9 As soon as possible No 35 Use of Endorsement Art. 24 As soon as possible No 35 Continuing Right to Exemptions Art. 2 As soon as possible No 35 Outsourcing Arrangements Art. 25 As soon as possible No 35 Legal Form Art. 7 As soon as possible No 35 Business Structure Art. 7 As soon as possible No 35 Type of Business Activities Art. 7 As soon as possible No 35 Ownership Structure Art. 8 As soon as possible No 35 Compliance Function and Review Function Art. 23 As soon as possible No 35 Change to Procedures used to issue and review credit ratings Art. 16 As soon as possible No 35 Financial Resources Art. 13 As soon as possible No 35 IT Processes and Information Processing Systems Art. 11 As soon as possible No 36 Change to Membership of Supervisory / Administrative Board Art. 7 As soon as possible Yes Other Ad-Hoc Notifications 37 IT and Information security incidents notifications As soon as possible Yes 38 Potential and actual cases of non-compliance with the relevant sectoral regulation As soon as possible Yes 39 Litigations As soon as possible No 40 Internal Complaints Submitted to the Compliance Department As soon as Possible Yes 44 Identification of errors in methodologies/ model process As soon as possible Yes 45 Sovereign Rating Calendar As soon as possible No 46 Notification of New/Change to Methodology As soon as possible Yes 47 Outcome of Endorsement Review As soon as Possible No

33 5.10.3 DRSPs Scheduled Returns under Calendar A Return Name Return Frequency Reporting Deadline Template Available Item Board Documents and Internal Governance 1 Board documents Quarterly 31 Jan, 30 April, 31 July, 31 Oct No 2 Organisational Charts Annual 31 January No 3 New and Potential Conflicts of Interest Annual 31 January No Internal Controls 4 Compliance Work Plan Annual 31 January No 5 Internal Audit Work Plan Annual 31 January No 6 Internal Control Monitoring Assessments Annual 31 January Yes Information Technology Reporting 7 ICT Risk Management Framework Annual 31 January No 8 ICT Risk profile Annual 31 January No 9 Review or audit report of the ICT risk management framework Annual 31 January No 10 Summary of the findings of BCP testing activities Annual 31 January No 11 Summary of the findings of digital operational resilience testing activities Annual 31 January No Financial Reporting 12 Audited accounts Annual 30 September No Data Reporting 23 Participants Overview Semi-Annual 31 January, 31 July Yes 24 Regulatory access status Annual 31 January Yes 25 Data volume Quarterly 31st January, 30th April, 31st July and 31st October Yes Staff Numbers & Other Indicators 26 Staff Numbers and Other Indicators Annual 31 January Yes

34 Scheduled Returns under Calendar B Return Name Return Frequency Reporting Deadline Template Available Item Board Documents and Internal Governance 1 Board documents Annual 31 January No 2 Organisational Charts Annual 31 January No 3 New and Potential Conflicts of Interest Annual 31 January No Internal Controls 4 Compliance Work Plan Bi-Annual 31 January No 5 Internal Audit Work Plan Bi-Annual 31 January No 6 Internal Control Monitoring Assessments Bi-Annual 31 January Yes Information Technology Reporting 7 ICT Risk Management Framework Bi-Annual 31 January No 8 ICT Risk profile Upon Demand No 9 Review or audit report of the ICT risk management framework Upon Demand No 10 Summary of the findings of BCP testing activities Upon Demand No 11 Summary of the findings of digital operational resilience testing activities Upon Demand No Financial Reporting 12 Audited accounts Annual 30 September No Data Reporting 23 Participants Overview Annual 31 January Yes 24 Regulatory access status Annual 31 January Yes 25 Data volume Quarterly 31st January, 30th April, 31st July and 31st October Yes Staff Numbers & Other Indicators 26 Staff Numbers and Other Indicators Annual 31 January Yes

35 Ad-Hoc Reporting Requirements Applicable Calendar A and Calendar B Item Return Name Return Frequency Template Available Notification of Material Changes to Conditions of Registration 35 Key Staff As soon as possible Yes 35 Change to ownership structure As soon as possible Yes 35 Launch of new services (including ancillary or any other services) As soon as possible Yes 35 Change in the fee structure/ Pricing policy As soon as possible No 35 Establishment of subsidiaries and branches, reorganisation or restructuring of the DRSP activities or change to name, address, statutory documentation or legal status As soon as possible No 35 Copies of regulator templates As soon as possible No 35 Copies of DRSP participant contract templates As soon as possible No 35 Material changes in the outsourcing arrangements relative to core DRSP functions As soon as possible No 35 Any other material changes to the conditions of registration As soon as possible No 36 Membership of the supervisory/administrative board As soon as possible Yes Other Notifications – Non-Material Changes 37 IT and Information security incidents notifications As soon as possible Yes 38 Potential and actual cases of non-compliance with the relevant sectoral regulation As soon as possible Yes 39 Litigations As soon as possible No 40 Internal Complaints submitted to the Compliance Department As soon as possible Yes 48 Cessation of business As soon as possible Yes

36 5.10.4 SRs Scheduled Returns under Calendar A Return Name Return Frequency Reporting Deadline Template Available Item Board Documents and Internal Governance 1 Board documents Quarterly 31 Jan, 30 April, 31 July, 31 Oct No 2 Organisational Charts Annual 31 January No 3 New and Potential Conflicts of Interest Annual 31 January No Internal Controls 4 Compliance Work Plan Annual 31 January No 5 Internal Audit Work Plan Annual 31 January No 6 Internal Control Monitoring Assessments Annual 31 January Yes Information Technology Reporting 7 ICT Risk Management Framework Annual 31 January No 8 ICT Risk profile Annual 31 January No 9 Review or audit report of the ICT risk management framework Annual 31 January No 10 Summary of the findings of BCP testing activities Annual 31 January No 11 Summary of the findings of digital operational resilience testing activities Annual 31 January No Financial Reporting 12 Audited accounts Annual 30 September No Data Reporting 27 Participants Overview Semi-Annual 31 January, 31 July Yes 28 Regulatory access status Annual 31 January Yes Staff Numbers & Other Indicators 29 Staff Numbers and Other Indicators Annual 31 January Yes

37 Scheduled Returns under Calendar B Return Name Return Frequency Reporting Deadline Template Available Item Board Documents and Internal Governance 1 Board documents Annual 31 January No 2 Organisational Charts Annual 31 January No 3 New and Potential Conflicts of Interest Annual 31 January No Internal Controls 4 Compliance Work Plan Annual 31 January No 5 Internal Audit Work Plan Annual 31 January No 6 Internal Control Monitoring Assessments Annual 31 January Yes Information Technology Reporting 7 ICT Risk Management Framework Bi-Annual 31 January No 8 ICT Risk profile Upon Demand No 9 Review or audit report of the ICT risk management framework Upon Demand No 10 Summary of the findings of BCP testing activities Upon Demand No 11 Summary of the findings of digital operational resilience testing activities Upon Demand No Financial Reporting 12 Audited accounts Annual 30 September No Data Reporting 27 Participants Overview Annual 31 January Yes 28 Regulatory access status Annual 31 January Yes Staff Numbers & Other Indicators 29 Staff Numbers and Other Indicators Annual 31 January Yes

38 Ad-Hoc Reporting Requirements Applicable Calendar A and Calendar B Item Return Name Return Frequency Template Available Notification of Material Changes to Conditions of Registration 35 Key Staff As soon as possible Yes 35 Change to ownership structure As soon as possible Yes 35 Launch of new services (including ancillary or any other services) As soon as possible Yes 35 Change in the fee structure/ Pricing policy As soon as possible No 35 Establishment of subsidiaries and branches, reorganisation or restructuring of the SR activities or change to name, address, statutory documentation or legal status As soon as possible No 35 Material changes in the outsourcing arrangements relative to core SR functions As soon as possible No 35 Any other material changes to the conditions of registration As soon as possible No 36 Membership of the supervisory/administrative board As soon as possible Yes 40 Other Notifications – Non-Material Changes 37 IT and Information security incidents notifications As soon as possible Yes 38 Potential and actual cases of non-compliance with the relevant sectoral regulation As soon as possible Yes 39 Litigations As soon as possible No 40 Internal Complaints submitted to the Compliance Department As soon as possible Yes 49 Cessation of business As soon as possible Yes

39 5.10.5 TRs Scheduled Returns under Calendar A Return Name Return Frequency Reporting Deadline Template Available Applicable to Item Board Documents and Internal Governance 1 Board documents Quarterly 31 Jan, 30 April, 31 July, 31 Oct No EMIR and SFTR jointly 2 Organisational Charts Annual 31 January No EMIR and SFTR jointly 3 New and Potential Conflicts of Interest Annual 31 January No EMIR and SFTR jointly Internal Controls 4 Compliance Work Plan Annual 31 January No EMIR and SFTR separately 5 Internal Audit Work Plan Annual 31 January No EMIR and SFTR separately 6 Internal Control Monitoring Assessments Annual 31 January No EMIR and SFTR separately Information Technology Reporting 7 ICT Risk Management Framework Annual 31 January No EMIR and SFTR separately 8 ICT Risk profile Annual 31 January No EMIR and SFTR separately 9 Review or audit report of the ICT risk management framework Annual 31 January No EMIR and SFTR separately 10 Summary of the findings of BCP testing activities Annual 31 January No EMIR and SFTR separately 11 Summary of the findings of digital operational resilience testing activities Annual 31 January No EMIR and SFTR separately Financial Reporting 12 Audited accounts Annual 30 September No EMIR and SFTR jointly Data Reporting 29 Participants overview Semi-Annually 31 January, 31 July Yes EMIR and SFTR separately 30 Regulatory access status Quarterly 31st January, 30th April, 31st July and 31st October Yes EMIR and SFTR separately 31 Data volume Quarterly 31st January, 30th April, 31st July and 31st October Yes EMIR and SFTR separately 32 Reconciliation statistics Monthly By the 15th of the following month Yes EMIR and SFTR separately Staff Numbers and Other Indicators 33 Staff Numbers and Other Indicators Annual 31 January Yes EMIR and SFTR separately

40 Scheduled Returns under Calendar B Return Name Return Frequency Reporting Deadline Template Available Applicable to Item Board Documents and Internal Governance 1 Board documents Annual 31 January No EMIR and SFTR jointly 2 Organisational Charts Annual 31 January No EMIR and SFTR jointly 3 New and Potential Conflicts of Interest Annual 31 January No EMIR and SFTR jointly Internal Controls 4 Compliance Work Plan Bi-Annual 31 January No EMIR and SFTR separately 5 Internal Audit Work Plan Bi-Annual 31 January No EMIR and SFTR separately 6 Internal Control Monitoring Assessments Bi-Annual 31 January Yes EMIR and SFTR separately Information Technology Reporting 7 ICT Risk Management Framework Bi-Annual 31 January No EMIR and SFTR separately 8 ICT Risk profile Upon Demand No EMIR and SFTR separately 9 Review or audit report of the ICT risk management framework Upon Demand No EMIR and SFTR separately 10 Summary of the findings of BCP testing activities Upon Demand No EMIR and SFTR separately 11 Summary of the findings of digital operational resilience testing activities Upon Demand No EMIR and SFTR separately Financial Reporting 12 Audited accounts Annual 30 September No EMIR and SFTR jointly Data Reporting 30 Participants Overview Annual 31 January Yes EMIR and SFTR separately 31 Regulatory access status Quarterly 31 January, 30 April, 31 July and 31 October Yes EMIR and SFTR separately 32 Data volume Quarterly 31 January, 30 April, 31 July and 31 October Yes EMIR and SFTR separately 33 Reconciliation statistics Monthly By the 15th of the following month Yes EMIR and SFTR separately Staff Numbers and Other Indicators 34 Staff Numbers and Other Indicators Annual 31 January Yes EMIR and SFTR separately

41 Ad-Hoc Reporting Requirements Applicable Calendar A and Calendar B Item Return Name Return Frequency Template Available Notification of Material Changes to Conditions of Registration 35 Key Staff As soon as possible Yes EMIR and SFTR separately 35 Change to ownership structure As soon as possible Yes EMIR and SFTR jointly 35 Establishment of subsidiaries and branches, reorganisation or restructuring of the TR activities or change to name, address, statutory documentation or legal status As soon as possible No EMIR and SFTR jointly 35 Copies of regulator templates As soon as possible No EMIR and SFTR separately 35 Copies of TR participant contract templates As soon as possible No EMIR and SFTR separately 35 Changes to the Internal Audit Charter and Methodology As soon as possible No EMIR and SFTR separately 35 Material changes in the outsourcing arrangements relative to core TR functions As soon as possible No EMIR and SFTR separately 35 Launch of new services (including ancillary or any other services) As soon as possible Yes EMIR and SFTR separately 35 Change in the fee structure/ Pricing policy As soon as possible No EMIR and SFTR separately 35 Quality Assurance of IA As soon as possible No EMIR and SFTR jointly 35 Any other material changes to the conditions of registration As soon as possible No EMIR and SFTR separately 36 Membership of the supervisory/administrative board As soon as possible Yes EMIR and SFTR jointly Other Notifications – Non-Material Changes 37 IT and Information security incidents notifications As soon as possible Yes EMIR and SFTR separately 38 Potential and actual cases of non-compliance with the relevant sectoral regulation As soon as possible Yes EMIR and SFTR separately 39 Litigations As soon as possible No EMIR and SFTR jointly 40 Internal Complaints submitted to the Compliance Department As soon as possible Yes EMIR and SFTR separately 50 Notification of a portability request As soon as possible Yes EMIR and SFTR separately 51 Cessation of business As soon as possible Yes EMIR and SFTR separately

42 5.11Reporting Templates 78. The most recent version of reporting templates will be made available for download on ESMA’s website. The files include high level description of the fields as well as more detailed instructions in terms of expected content at field level. 79. ESMA may require reporting entities to transmit certain templates through different reporting channels, for example, through web-based applications managed by ESMA.