Instruction No. 2015-I-19 of Oct 2, 2015 on electronic signature of documents transmitted to ACPR (Banking Sector), amended by Instruction No. 2017-I-13 of Jun 26, 2017 (Consolidated Version) (Repealed)

AUTORITÉ DE CONTRÔLE PRUDENTIEL ET DE RÉSOLUTION

Instruction No. 2015-I-19 on the electronic signature of documents transmitted to the ACPR amended by Instruction No. 2017-I-13 of June 26, 2017 (Banking Sector)

Having regard to the Monetary and Financial Code, in particular Articles L. 511-13, L. 511-30, L. 511-31, L. 532-2, L. 522-6 and L. 522-9, L. 612-2 and L. 612-24;

Having regard to Law No. 78-17 of January 6, 1978 relating to data processing, files and freedoms, in particular its Article 32;

Having regard to Ordinance No. 2005-1516 of December 8, 2005 relating to electronic exchanges between users and administrative authorities and between administrative authorities;

Having regard to Regulation (EU) No 910/2014 of July 23, 2014 on electronic identification and trust services for electronic transactions in the internal market, known as the 'eIDAS Regulation';

Having regard to the opinions of the Prudential Affairs Consultative Commission of September 18, 2015 and June 1, 2017;

Having regard to the opinion of the Consultative Commission for the Fight against Money Laundering and Terrorist Financing of June 9, 2017.

DECIDES:

Article 1 This instruction applies to the establishments referred to in all ACPR instructions referencing electronic signature.

Article 2 For the purposes of electronic signature, teletransmitted collection statements are electronically signed using an electronic signature certificate that meets, according to its date of issuance, the following conditions:

1. Certificates issued before July 1, 2017 must be issued: 1.1 By a qualified electronic certification service provider at the 'Two stars' security level or the 'Three stars' security level, within the meaning of the General Security Reference in version 1.0 'Trust Service Signature' provided for by Ordinance No. 2005-1516 or in version 2.0 according to the Order of June 13, 2014 approving the general security reference and specifying the procedures for the validation of certificates.

Or

1.2 By an electronic certification service provider declared compliant with the Common Acceptance Policy (PAC) of the French Centre for Banking Organization and Standardization (CFONB) for signature at level 2 or level 3.

Or

1.3 By an electronic certification service provider certified compliant with the European standard of the European Telecommunications Standards Institute (ETSI) ETSI TS 101 456 QCP Public + SSCD.

Or

1.4 According to one of the modalities provided for in 2.1 and 2.2 below.

2. Certificates issued after July 1, 2017 must be issued: 2.1 By an electronic certification service provider certified compliant with the European eIDAS Regulation for the 'qualified certificates' level (EU Qualified Certificates).

Or

2.2 By the 'strong signature' Certification Authority of the Bank of France.

Article 3 (deleted)

Article 4 Any establishment implementing electronic signature declares to the ACPR, by means of a single document, the identity of the electronic certification service provider it uses, the type of certificate used, as well as, for each person it authorizes to sign on its behalf, their identity and their functions within the establishment.

Unless otherwise indicated or specified in the relevant instructions, the persons authorized to sign are the persons ensuring the effective management of the company within the meaning of the second paragraph of Article L. 511-13, paragraph 4 of Article L. 532-2, paragraph II of Article L. 522-6 and paragraph 4 of Article L. 526-9 of the Monetary and Financial Code (hereinafter the Effective Managers). Persons having the competence and position in the establishment allowing them to commit on the quality and reliability of the information they are called upon to sign may also be duly authorized by these managers.

The aforementioned managers may also delegate signature authority to the financial holding company, the mixed financial holding company, a credit institution or another company or person mentioned in point 2 of A of I of Article L. 612-2 of the Monetary and Financial Code established in France and belonging to the same group subject to consolidated or sub-consolidated supervision within the meaning of European Union Regulation 575/2013 of June 26, 2013 and the Order of November 3, 2014 relating to prudential supervision on a consolidated basis. In this case, the managers of the delegate establishment as well as the persons designated by them under the aforementioned provisions are authorized to sign.

The managers of an establishment affiliated with a central body within the meaning of Articles L. 511-30 and L. 511-31 of the Monetary and Financial Code may delegate to this central body for the purpose of electronically signing those of their documents to which electronic signature applies in accordance with this instruction. To this end, the central body declares to the ACPR by means of a single document, the persons it authorizes to sign, specifying for each their identity, their functions within the central body as well as the affiliated establishments and the documents for which they are authorized to sign.

In the event of delegation of signature by the effective managers under the aforementioned conditions, the types of collections concerned by the delegation are specified.

Regardless of the delegations granted, the aforementioned effective managers remain responsible for the quality and reliability of the information transmitted on their behalf and are able to proceed under their own electronic signature to the transmission of information.

The declarations provided for by this article are communicated to the ACPR at least one month before the deadline for the first electronically signed submission. Similarly, each modification made to these declarations is communicated to the ACPR at least one month before the relevant deadline.

Establishments take the necessary measures to communicate to the persons they declare the information provided for in Article 32 of Law No. 78-17 of January 6, 1978 relating to data processing, files and freedoms.

Article 5 The ACPR may oppose at any time the use of a certificate by an entity that does not or no longer meets the requirements of Article 2 above.

Article 6 The electronic signature of teletransmitted statements is implemented under the conditions provided for by the signature policy in Annex 1 to this instruction.

Article 7 Instruction No. 2007-01 of January 18, 2007, as amended by Instructions No. 2007-03 of March 26, 2007, No. 2008-03 of January 28, 2008, No. 2008-05 of June 20, 2008 and No. 2009-02 of June 19, 2009, is repealed.

References to Instruction No. 2007-01 in the instructions listed in Annex 2 are replaced by references to this instruction.

Article 8 This instruction enters into force as of January 1, 2016. The modifications of Instruction No. 2015-I-19 contained in Instruction No. 2017-I-13 of June 26, 2017 enter into force as of July 1, 2017.