Instruction (Historical) No. 7/2021

Instruction No. 7/2021 BO No. 4/2021 • 2021/04/15 .................................................................................................................................................................................................. Topics Supervision :: Registration Mod. 99999911/T – 01/14

Index Text of the Instruction ANNEX I - AMENDMENT OF INSTRUCTION 23/2018 - DECLARATION FOR COMPLIANCE WITH THE DUTY TO INFORM (PORTUGUESE VERSION) ANNEX I - AMENDMENT OF INSTRUCTION 23/2018 - DECLARATION FOR COMPLIANCE WITH THE DUTY TO INFORM (ENGLISH VERSION) ANNEX II – TRUTH DECLARATION OF THE PERSON FOR WHOM AUTHORIZATION TO EXERCISE FUNCTIONS IS REQUESTED (PORTUGUESE VERSION) ANNEX II – TRUTH DECLARATION OF THE PERSON FOR WHOM AUTHORIZATION TO EXERCISE FUNCTIONS IS REQUESTED (ENGLISH VERSION) ANNEX III – DECLARATION OF THE INSTITUTION SUBMITTING THE AUTHORIZATION REQUEST (PORTUGUESE VERSION) ANNEX III – DECLARATION OF THE INSTITUTION SUBMITTING THE AUTHORIZATION REQUEST (ENGLISH VERSION)

Text of the Instruction Subject: Incorporates into the domestic legal order the ECB’s Information Management System Portal and amends the declaration for compliance with the duty to inform regarding the processing of personal data

This Instruction partially amends Bank of Portugal Instruction No. 7/2016 of 20 May (hereinafter identified as “Instruction No. 7/2016”), in the part relating to the submission of authorization requests for the exercise of functions by members of administrative and supervisory bodies, holders of key control functions, and managers of branches established in countries that are not Member States of the European Union of institutions subject to the supervision of the European Central Bank (hereinafter identified as “ECB”) within the Single Supervisory Mechanism, as well as Bank of Portugal Instruction No. 23/2018 of 5 November (hereinafter identified as “Instruction No. 23/2018”), in the part relating to its scope of application, in order to incorporate into the domestic legal order, in a binding manner, the ECB’s Information Management System Portal (designated as Information Management System for the SSM, hereinafter identified only as ‘IMAS Portal’).

Instruction No. 7/2016 created the “Authorization Requests and Registration” (PAR) service, a service within the so-called BPnet System, which made it possible for various institutions subject to the supervision of the Bank of Portugal and the ECB to address the Bank of Portugal, in a fully electronic manner, applications, notifications, and communications, for different purposes, including the

Instruction No. 7/2021 BO No. 4/2021 • 2021/04/15 Topics Supervision :: Registration .................................................................................................................................................................................................. Mod. 99999911/T – 01/14 submission of authorization requests for the exercise of functions by members of administrative and supervisory bodies, the elements to be presented by the institutions and the manner of their presentation being regulated through Instruction No. 23/2018.

With the Single Supervisory Mechanism, some national credit institutions began to be supervised directly or indirectly by the ECB in certain areas, notably regarding authorization for the exercise of functions as a member of administrative and supervisory bodies.

In this context, and as mentioned above, the object of this Instruction is to implement the IMAS Portal, which is intended exclusively for use by institutions directly supervised by the ECB (Significant Institutions classified according to ECB Regulation (EU) No 468/2014 of 16 April 20141).

This Portal is an online platform, made available and managed directly by the ECB, which allows the submission, consultation, and exchange of information, electronically and with guarantees of the authenticity of the interlocutors' identities by appropriate means, between supervisory authorities and supervised entities within the procedures under the competence of the ECB, with the ECB being the entity responsible for the management of the Portal, the definition of the terms of use of this service, and the guarantee of its operation.

The main objective of the IMAS Portal is to promote the harmonization of assessment conditions within the Single Supervisory Mechanism, without prejudice to the applicability of the national material regime applicable to each concrete case. To this end, this Portal was developed in such a way as to guarantee: (i) the simplification of the processing of authorization requests for the exercise of functions by members of administrative and supervisory bodies of institutions, contributing to the speed in the treatment of their respective processes, (ii) transparency with supervised entities regarding the phases in which their respective processes are located.

At this stage, the use of the IMAS Portal is limited to authorization requests for the exercise of functions by members of administrative and supervisory bodies and for the exercise of key control functions of Significant Institutions classified according to ECB Regulation (EU) No 468/2014 of 16 April 2014. To this extent, other processes or communications not covered by the aforementioned Portal must continue to be submitted through the currently in force channels,

1 The list of significant institutions is periodically updated by the ECB and can be found at the following electronic address: https://www.bankingsupervision.europa.eu/banking/list/who/html/index.pt.html

Instruction No. 7/2021 BO No. 4/2021 • 2021/04/15 Topics Supervision :: Registration .................................................................................................................................................................................................. Mod. 99999911/T – 01/14 through the “Authorization Requests and Registration” (PAR) service, as provided for in Instruction No. 7/2016.

Thus, authorization requests for the exercise of functions by members of administrative and supervisory bodies, holders of key control functions, and managers of branches established in countries that are not Member States of the European Union, in accordance with Articles 30 et seq. of the General Regime of Credit Institutions and Financial Companies, approved by Decree-Law No. 298/92 of 31 December (hereinafter identified as “RGICSF”), whose decision-making competence belongs to the ECB, shall be submitted, by the institutions covered, through the aforementioned IMAS Portal.

With the implementation of the IMAS Portal, the information necessary to comply with the regime established in Articles 30 et seq. of the RGICSF, regulated by Instruction No. 23/2018, is now entered by the candidates and the supervised entities in that Portal through structured fields provided in an online form. To this extent, the questionnaire currently contained in the annex to the aforementioned Instruction No. 23/2018 is adapted, by this Instruction, to the characteristics of the Portal, maintaining the specifics of national law. The declarations regarding the candidate and the institution have been adapted and harmonized, and all documents will be made available in Portuguese and English versions.

Finally, having identified opportunities for improvement in the content of the declaration for compliance with the duty to inform of the Bank of Portugal, which is currently in point 2 of the questionnaire on suitability, professional qualification, independence, and availability, annexed to Instruction No. 23/2018, the aforementioned declaration is also reviewed, with a view to full compliance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

The draft of this Instruction was subject to public consultation, in accordance with the law.

Therefore,

The Bank of Portugal, using the powers conferred upon it by Article 17 of its Organic Law, approved by Law No. 5/98 of 31 January, and by the provisions of paragraph 8 of Article 30 and point f) of paragraph 1 of Article 116 of the RGICSF, approves the following Instruction:

Instruction No. 7/2021 BO No. 4/2021 • 2021/04/15 Topics Supervision :: Registration .................................................................................................................................................................................................. Mod. 99999911/T – 01/14

Article 1. Object

1. This Instruction: a) Partially amends Bank of Portugal Instruction No. 7/2016 (“Instruction No. 7/2016”), in the part relating to the manner of submission of authorization requests for the exercise of functions by members of administrative and supervisory bodies, holders of key control functions, and managers of branches, established in countries that are not Member States of the Union of institutions subject to direct supervision by the ECB; b) Partially amends Bank of Portugal Instruction No. 23/2018 (“Instruction No. 23/2018”), in the part relating to its scope of application; c) Also partially amends Annex I of Instruction No. 23/2018, in the part relating to the declaration for compliance with the duty to inform regarding the processing of personal data by the Bank of Portugal; d) Establishes the obligation to submit, through the IMAS Portal service, authorization requests for the exercise of functions by members of administrative and supervisory bodies, holders of key control functions, as well as managers of branches, established in countries that are not Member States of the European Union, of institutions with headquarters in Portugal, through the IMAS Portal service, by institutions subject to direct supervision by the ECB and defines the elements that must accompany the aforementioned authorization requests.

2. Institutions subject to direct supervision by the ECB are Significant Institutions classified according to ECB Regulation (EU) No 468/2014 of 16 April 2014.

Article 2. Amendments to Instruction No. 7/2016

1. Paragraph 3 is added to Article 3 of Instruction No. 7/2016 with the following wording: “3 – Point c) of paragraph 1 of this article is not applicable to institutions subject to direct supervision by the ECB, in accordance with ECB Regulation (EU) No 468/2014 of 16 April 2014.”

2. Paragraph 4 is also added to Article 3 of Instruction No. 7/2016 with the following wording: “4 – Point j) of paragraph 1 of this article is not applicable to independent authorization requests for the exercise of functions by managers of branches established in countries that are not Member States of the European Union of credit institutions with headquarters in Portugal that are subject to direct supervision by the ECB, in accordance with ECB Regulation (EU) No 468/2014 of 16 April 2014.”

Article 3. Amendments to Instruction No. 23/2018

1. Point a) of paragraph 1 of Article 1 of Instruction No. 23/2018 is amended, which shall have the following wording: “a) Full and alternate member of an administrative and supervisory body of institutions subject to the supervision of the Bank of Portugal (hereinafter designated as “Institutions” or “Institution”);”

2. Paragraph 2 of Article 3 of Instruction No. 23/2018 is amended, which shall have the following wording: “2 - The Questionnaire is made available in the Portuguese language and in the English language.”

3. Paragraph 1 of Article 4 of Instruction No. 23/2018 is amended, which shall have the following wording: “1 - The Matrix for Collective Assessment of administrative and supervisory bodies is made available in the Portuguese language and in the English language.”

4. The declaration for compliance with the duty to inform regarding the processing of personal data by the Bank of Portugal, which corresponds to point 2 of the questionnaire on suitability, professional qualification, availability, independence, and conflicts of interests, annexed to Instruction No. 23/2018, is amended, which shall have the wording contained in Annex I to this Instruction.

Article 4. Applicable Regime

The provisions of Instruction No. 23/2018, with the specifics resulting from the provisions of the following articles, are applicable to authorization requests for the exercise of functions by members of administrative and supervisory bodies, holders of key control functions submitted by institutions subject to direct supervision by the ECB, and managers of branches, established in countries that are not Member States of the European Union, of institutions with headquarters in Portugal that are subject to direct supervision by the ECB.

Article 5. Scope of Application and Obligation to Submit via the IMAS Portal

1. Institutions subject to direct supervision by the ECB, within the Single Supervisory Mechanism, must submit authorization requests for the exercise of functions by members of administrative and supervisory bodies, holders of key control functions, and managers of branches established in countries that are not Member States of the European Union through the IMAS Portal.

2. Processes with a purpose other than that provided for in paragraph 1 of this article are not covered by the IMAS Portal, namely the following: a) Communication regarding supervening facts, in accordance with the provisions of Articles 32 et seq. of the RGICSF and paragraphs 3 to 5 of Article 3 of Instruction No. 23/2018; b) Special registration or alteration thereof, in accordance with the provisions of Articles 66 to 69 of the RGICSF; c) Prior communication for the purposes of opposition or non-opposition to the accumulation of offices in accordance with the provisions of Article 33 of the RGICSF.

Article 6. Elements of Processing within the IMAS Portal

1. Authorization requests for the exercise of functions covered by the obligation provided for in paragraph 1 of the previous article are processed with the elements identified in points b) to f) of paragraph 1, in paragraphs 2 and 3 of Article 2 of Instruction No. 23/2018, which must be submitted together with the completion of the online form available on the IMAS Portal (hereinafter identified as “Questionnaire”).

2. The requests referred to in the previous number must also be submitted in the IMAS Portal with the following attachments: a) Declaration of the person for whom authorization to exercise functions is requested, according to the model annexed to this Instruction as Annex I; b) Declaration of the Institution submitting the Authorization Request, according to the model annexed to this Instruction as Annex II; c) Declaration of compliance with the duty to inform regarding the processing of personal data collected by the Bank of Portugal, which corresponds to the declaration contained in point 2 of the questionnaire on suitability, professional qualification, availability, independence, and conflicts of interests, annexed to Instruction No. 23/20182.

2 The privacy policy regarding the processing of personal data by the ECB is available at the following electronic address https://www.bankingsupervision.europa.eu/home/data-protection/privacy-statements/FAP/index.en.html.

Instruction No. 7/2021 BO No. 4/2021 • 2021/04/15 Topics Supervision :: Registration .................................................................................................................................................................................................. Mod. 99999911/T – 01/14

Article 7. Questionnaire

1. The Questionnaire is made available on the IMAS Portal in the Portuguese and English languages, and institutions subject to direct supervision by the ECB that have established a linguistic agreement in this regard must submit the Questionnaires in the English language.

2. In cases where institutions subject to direct supervision by the ECB intend to submit new parts of the Questionnaire, for the purposes of processing other applications, notifications, and communications, namely for the communication of supervening facts capable of affecting the suitability requirements, the corresponding part of the questionnaire contained in Annex I to Instruction No. 23/2018 must be submitted on the electronic platform made available by the Bank of Portugal.

Article 8. Repealing Clause

Points c) and j) of paragraph 1 of Article 3 of Instruction No. 7/2016 are partially repealed insofar as they refer, respectively, to significant institutions supervised directly by the ECB and to the authorization for the exercise of functions by managers of branches of those institutions when these branches are established in countries that are not Member States of the European Union.

Article 9. Entry into Force and Transitional Regime

1. This Instruction enters into force the day following the date of its publication.

2. With the entry into force of this Instruction, it is no longer possible for institutions subject to direct supervision by the ECB to submit authorization requests for the exercise of functions by members of administrative and supervisory bodies, holders of key control functions, and managers of branches established in countries that are not Member States of the European Union through the “Authorization Requests and Registration” (PAR) service, regulated through Instruction No. 7/2016.

3. This Instruction is only applicable to processes that begin after its entry into force, with processes that are pending on that date continuing to be processed through the PAR service.

Annex to Instruction No. 7/2021 BO No. 4/2021 • 2021/04/15 Topics Supervision :: Registration .................................................................................................................................................................................................. Mod. 99999911/T – 01/14

ANNEX I - AMENDMENT OF INSTRUCTION 23/2018 - DECLARATION FOR COMPLIANCE WITH THE DUTY TO INFORM (PORTUGUESE VERSION)

2. COMPLIANCE WITH THE DUTY TO INFORM REGARDING THE PROCESSING OF PERSONAL DATA

This document explains the reasons for the collection and processing of your personal data, how they are used, and how you can exercise your rights regarding your personal data.

a) Controller, basis, and purpose

Personal data are processed by the Bank of Portugal, a public law legal entity with tax ID No. 500 792 771 and headquarters at Rua do Comércio, No. 148, 1100-150, Lisbon, in compliance with the General Data Protection Regulation3 (GDPR) and other applicable data protection legislation, for the exercise of public interest functions and the public authority powers vested in the Bank of Portugal, in compliance with the provisions of its Organic Law4 and other applicable legislation and as established in Article 6(1)(c) and (e) of the GDPR.

GDPR Organic Law of the Bank of Portugal

The aforementioned data processing has the purpose of assessing the suitability for the exercise of functions by members of administrative or supervisory bodies, managers of branches or representative offices, or holders of key control functions by the Bank of Portugal and/or the European Central Bank (ECB), in accordance with the provisions of Articles 30 et seq. of the General Regime of Credit Institutions and Financial Companies5 (RGICSF) and other applicable legislation.

For more information regarding the suitability requirements assessed, the procedure, the competences, and the applicable legislation, please consult here6.

Personal data are also processed by the Bank of Portugal for the exercise of its prudential supervision and investigation and sanctioning powers, namely for the following purposes:

– Registration with the Bank of Portugal Cfr. Articles 65 to 72 of the RGICSF and Article 35 of the Legal Regime of Payment Services and Electronic Money, approved by Decree-Law No. 91/2018 of 12 November (“RJSPME”)

– Revocation of authorization for the exercise of functions Cfr. Article 30-C of the RGICSF

– Application of sanctioning measures See, among others, Articles 201 et seq. of the RGICSF

– Publication of identification of members of administrative and supervisory bodies on the Bank of Portugal website

3 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. 4 Approved by Law No. 5/98 of 31 January. 5 Approved by Decree-Law No. 298/92 of 31 December, in the version in force. 6 Information available at https://www.bportugal.pt/page/adequacao-dos-membros-dos-orgaos-de-administracao-e-fiscalizacao-e-dos-titulares-de-funcoes

Instruction No. 7/2021 BO No. 4/2021 • 2021/04/15 Topics Supervision :: Registration .................................................................................................................................................................................................. Mod. 99999911/T – 01/14

Cfr. Articles 65 to 72 and point f) of Article 93-A, all of the RGICSF, Article 35 of the RJSPME, and Articles 5 and 14 of the Code of Administrative Procedure.

– Monitoring and surveillance of compliance with applicable legislation, namely the RGICSF, Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013, and other applicable legislation, namely for risk assessment, issuance of recommendations, specific determinations or corrective measures, as well as for the assessment of credit granting to related parties, assessment of the capacity to comply with the duties established in applicable legislation, etc. See, among others, Article 116 of the RGICSF.

– Disclosure of information in compliance with legal obligation Cfr., among others, Articles 20 and 21 of Regulation (EU) No 468/2014 of the European Central Bank of 16 April (SSM Framework Regulation), Articles 4 and 6 of Regulation (EU) No 1024/2013 of the Council of 15 October (SSM Regulation), paragraphs 7 and 8 of Article 30-D of the RGICSF, and paragraph 2 of Article 65 of the RGICSF.

– Archiving in the public interest Cfr. General Regime of Archives and Archival Heritage, approved by Decree-Law No. 16/93 of 23 January.

In the case of assessment of suitability for the exercise of functions in significant institutions, the ECB, with headquarters at Sonnemannstrasse 20, D-60314 Frankfurt-am-Main, Germany, also processes personal data for the fulfillment of the aforementioned purpose and is responsible for the processing, in accordance with paragraph 8 of Article 3 of Regulation (EU) No 2018/1725. The ECB’s declaration for compliance with the duty to inform can be consulted here7.

b) Categories of personal data and respective origin

The following categories of personal data are processed: (i) Personal data provided by the person: a. Identification and contact data (name, address, e-mail, telephone contact, etc.); b. Data related to the assessment of suitability (such as information contained in the criminal record certificate, information about administrative, criminal, or civil proceedings, including insolvency, recovery, or liquidation processes,

---