Instruction No. 7/2021

Instruction No. 7/2021 BO No. 4/2021 • 2021/04/15 .................................................................................................................................................................................................. Topics Supervision :: Registration Mod. 99999911/T – 01/14

Index Text of the Instruction Annex I - Amendment of Instruction 23/2018 - Declaration for compliance with the duty of information (Portuguese version) Annex I - Amendment of Instruction 23/2018 - Declaration for compliance with the duty of information (English version) Annex II – Truth declaration by the person for whom authorization to exercise functions is requested (Portuguese version) - Repealed Annex II – Truth declaration by the person for whom authorization to exercise functions is requested (English version) - Repealed Annex III – Declaration by the Institution submitting the authorization request (Portuguese version) - Repealed Annex III – Declaration by the Institution submitting the authorization request (English version) - Repealed Annex IV – Questionnaire (Portuguese version) Annex IV – Questionnaire (English version)

Text of the Instruction Subject: Incorporates the ECB's Information Management System Portal into the domestic legal order and amends the declaration for compliance with the duty of information regarding the processing of personal data

This Instruction partially amends Bank of Portugal Instruction No. 7/2016 of 20 May (hereinafter identified as "Instruction No. 7/2016"), in the part relating to the submission of authorization requests for the exercise of functions by members of administrative and supervisory bodies, holders of key control functions, and managers of branches established in countries that are not Member States of the European Union of institutions subject to the supervision of the European Central Bank (hereinafter identified as "ECB") within the Single Supervisory Mechanism, as well as Bank of Portugal Instruction No. 23/2018 of 5 November (hereinafter identified as "Instruction No. 23/2018"), in the part relating to its scope of application, in order to incorporate into the domestic legal order, in a binding manner, the ECB's Information Management System Portal (designated as Information Management System for the SSM, hereinafter identified only as 'IMAS Portal').

Instruction No. 7/2016 created the "Authorization and Registration Requests" (PAR) service, a service within the so-called BPnet System, which made it possible for the various institutions subject to the supervision of the Bank of Portugal and the ECB to address the Bank of Portugal, in a fully electronic manner, applications, notifications, and communications, for different purposes, including the submission of authorization requests for the exercise of functions by members of administrative and supervisory bodies, the elements of which to be presented by the institutions and the manner of presentation thereof are regulated through Instruction No. 23/2018.

With the Single Supervisory Mechanism, some national credit institutions began to be supervised directly or indirectly by the ECB in certain areas, namely regarding authorization for the exercise of functions as a member of administrative and supervisory bodies.

In this context, and as mentioned above, the object of this Instruction is to implement the IMAS Portal, which is intended exclusively for use by institutions directly supervised by the ECB (Significant Institutions classified according to ECB Regulation (EU) No 468/2014 of 16 April 20141).

This Portal is an online platform, made available and managed directly by the ECB, which allows the submission, consultation, and exchange of information, electronically and with guarantees of the authenticity of the interlocutors' identities by appropriate means, between supervisory authorities and supervised entities within the procedures under the competence of the ECB, with the ECB being the entity responsible for managing the Portal, defining the terms of use of this service, and guaranteeing its operation.

The main objective of the IMAS Portal is to promote the harmonization of assessment conditions within the Single Supervisory Mechanism, without prejudice to the applicability of the national substantive regime applicable to each specific case. To this end, this Portal was developed in such a way as to guarantee: (i) the simplification of the processing of authorization requests for the exercise of functions by members of administrative and supervisory bodies of institutions, contributing to the speed in the treatment of their respective processes, (ii) transparency with supervised entities regarding the phases in which their respective processes are located.

At this stage, the use of the IMAS Portal is limited to authorization requests for the exercise of functions by members of administrative and supervisory bodies and for the exercise of key control functions of Significant Institutions classified according to ECB Regulation (EU) No 468/2014 of 16 April 2014. To this extent, other processes or communications not covered by the aforementioned Portal must continue to be submitted through the currently in force channels, through the "Authorization and Registration Requests" (PAR) service, as provided for in Instruction No. 7/2016.

Thus, authorization requests for the exercise of functions by members of administrative and supervisory bodies, holders of key control functions, and managers of branches established in countries that are not Member States of the European Union, in accordance with Articles 30 et seq. of the General Regime of Credit Institutions and Financial Companies, approved by Decree-Law No. 298/92 of 31 December (hereinafter identified as "RGICSF"), whose decision-making competence belongs to the ECB, shall be submitted, by the institutions covered, through the aforementioned IMAS Portal.

With the implementation of the IMAS Portal, the information necessary to comply with the regime established in Articles 30 et seq. of the RGICSF, regulated by Instruction No. 23/2018, is now entered by the candidates and the supervised entities in that Portal through structured fields made available in an online form. To this extent, the questionnaire currently annexed to the aforementioned Instruction No. 23/2018 is adapted, by this Instruction, to the characteristics of the Portal, maintaining the specifics of national law. The declarations regarding the candidate and the institution have been adapted and harmonized, and all documents will be made available in Portuguese and English versions.

Finally, having identified opportunities for improvement in the content of the declaration for compliance with the duty of information of the Bank of Portugal, which is currently in point 2 of the questionnaire on suitability, professional qualification, independence, and availability, annexed to Instruction No. 23/2018, the aforementioned declaration is also reviewed, with a view to fully complying with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

The draft of this Instruction was subject to public consultation, in accordance with the law.

Therefore,

The Bank of Portugal, using the powers conferred upon it by Article 17 of its Organic Law, approved by Law No. 5/98 of 31 January, and by Article 30(8) and Article 116(1)(f) of the RGICSF, approves the following Instruction:

Article 1. Object

1. This Instruction: a) Partially amends Bank of Portugal Instruction No. 7/2016 (“Instruction No. 7/2016”), in the part relating to the manner of submission of authorization requests for the exercise of functions by members of administrative and supervisory bodies, holders of key control functions, and managers of branches, established in countries that are not Member States of the Union of institutions subject to direct supervision by the ECB; b) Partially amends Bank of Portugal Instruction No. 23/2018 (“Instruction No. 23/2018”), in the part relating to its scope of application; c) Also partially amends Annex I of Instruction No. 23/2018, in the part relating to the declaration for compliance with the duty of information regarding the processing of personal data by the Bank of Portugal; d) [Repealed]. Repealed by Instruction No. 2/2026, published in BO No. 3/2026 Supplement, of 26 March.

2. [Repealed]. Repealed by Instruction No. 2/2026, published in BO No. 3/2026 Supplement, of 26 March.

Article 2. Additions to Instruction No. 7/2016

1. Paragraph 3 is added to Article 3 of Instruction No. 7/2016 with the following wording: “3 – Subparagraph c) of paragraph 1 of this article is not applicable to institutions subject to direct supervision by the ECB, in accordance with ECB Regulation (EU) No 468/2014 of 16 April 2014.”

2. Paragraph 4 is also added to Article 3 of Instruction No. 7/2016 with the following wording: “4 – Subparagraph j) of paragraph 1 of this article is not applicable to independent authorization requests for the exercise of functions of managers of branches established in countries that are not Member States of the European Union of credit institutions with headquarters in Portugal that are subject to direct supervision by the ECB, in accordance with ECB Regulation (EU) No 468/2014 of 16 April 2014.”

Article 3. Amendments to Instruction No. 23/2018

1. Subparagraph a) of paragraph 1 of Article 1 of Instruction No. 23/2018 is amended, which shall henceforth read: “a) Full and alternate member of an administrative and supervisory body of institutions subject to the supervision of the Bank of Portugal (hereinafter designated as “Institutions” or “Institution”);”

2. Paragraph 2 of Article 3 of Instruction No. 23/2018 is amended, which shall henceforth read: “2 - The Questionnaire is made available in the Portuguese language and in the English language.”

3. Paragraph 1 of Article 4 of Instruction No. 23/2018 is amended, which shall henceforth read: “1- The Matrix for Collective Assessment of administrative and supervisory bodies is made available in the Portuguese language and in the English language.”

4. The declaration for compliance with the duty of information regarding the processing of personal data by the Bank of Portugal, which corresponds to point 2 of the questionnaire on suitability, professional qualification, availability, independence, and conflicts of interest, annexed to Instruction No. 23/2018, is amended, which shall henceforth have the wording contained in Annex I to this Instruction.

Article 4. (Repealed.)

Article 5. (Repealed.)

Article 6. (Repealed.)

Article 7. (Repealed.)

Article 8. Repealing Clause

Subparagraphs c) and j) of paragraph 1 of Article 3 of Instruction No. 7/2016 are partially repealed insofar as they refer, respectively, to Significant Institutions supervised directly by the ECB and to the authorization for the exercise of functions of managers of branches of those institutions when such branches are established in countries that are not Member States of the European Union.

Article 9. Entry into force and transitional regime

1. This Instruction enters into force the day following the date of its publication.

2. With the entry into force of this Instruction, it ceases to be possible for institutions subject to direct supervision by the ECB to submit authorization requests for the exercise of functions by members of administrative and supervisory bodies, holders of key control functions, and managers of branches established in countries that are not Member States of the European Union through the "Authorization and Registration Requests" (PAR) service, regulated through Instruction No. 7/2016.

3. This Instruction is only applicable to processes that begin after its entry into force, with processes that are pending on that date continuing to be processed through the PAR service.

Annex to Instruction No. 7/2021 BO No. 4/2021 • 2021/04/15 Topics Supervision :: Registration .................................................................................................................................................................................................. Mod. 99999911/T – 01/14

Annex I - Amendment of Instruction 23/2018 - Declaration for compliance with the duty of information (Portuguese version)

2. COMPLIANCE WITH THE DUTY OF INFORMATION REGARDING THE PROCESSING OF PERSONAL DATA

This document explains the reasons for the collection and processing of your personal data, how they are used, and how you can exercise your rights regarding your personal data.

a) Responsible party, basis, and purpose

Personal data is processed by the Bank of Portugal, a public law legal entity with tax ID No. 500 792 771 and headquarters at Rua do Comércio, No. 148, 1100-150, Lisbon, in compliance with the General Data Protection Regulation2 (GDPR) and other applicable data protection legislation, for the exercise of public interest functions and the public authority powers vested in the Bank of Portugal, in compliance with the provisions of its Organic Law 3 and other applicable legislation and as established in Article 6(1)(c) and (e) of the GDPR.

GDPR Organic Law of the Bank of Portugal

The aforementioned data processing has as its purpose the assessment of suitability for the exercise of functions by members of administrative or supervisory bodies, managers of branches or representative offices, or holders of key functions by the Bank of Portugal and/or the European Central Bank (ECB), in accordance with the provisions of Articles 30 et seq. of the General Regime of Credit Institutions and Financial Companies4 (RGICSF) and other applicable legislation.

To obtain more information regarding the suitability requirements assessed, the procedure, the competences, and the applicable legislation, please consult here5.

Personal data is also processed by the Bank of Portugal for the exercise of its prudential supervision powers and investigation and sanctioning powers, namely for the following purposes:

– Registration with the Bank of Portugal Cfr. Articles 65 to 72 of the RGICSF and Article 35 of the Legal Regime of Payment Services and Electronic Money, approved by Decree-Law No. 91/2018 of 12 November (“RJSPME”)

– Revocation of authorization for the exercise of functions Cfr. Article 30-C of the RGICSF

– Application of sanctioning measures See, inter alia, Articles 201 et seq. of the RGICSF

2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. 3 Approved by Law No. 5/98 of 31 January. 4 Approved by Decree-Law No. 298/92 of 31 December, in the wording in force. 5 Information available at https://www.bportugal.pt/page/adequacao-dos-membros-dos-orgaos-de-administracao-e-fiscalizacao-e-dos-titulares-de-funcoes

– Publication of identification of members of administrative and supervisory bodies on the Bank of Portugal website Cfr. Articles 65 to 72 and subparagraph f) of Article 93-A, all of the RGICSF, Article 35 of the RJSPME, and Articles 5 and 14 of the Code of Administrative Procedure.

– Monitoring and surveillance of compliance with applicable legislation, namely the RGICSF, Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013, and other applicable legislation, namely for risk assessment, issuance of recommendations, specific determinations or corrective measures, as well as for assessment of credit granting to related parties, assessment of the ability to comply with duties established in applicable legislation, etc. See, inter alia, Article 116 of the RGICSF.

– Disclosure of information in compliance with legal obligation Cfr., inter alia, see Articles 20 and 21 of ECB Regulation (EU) No 468/2014 of 16 April (SSM Framework Regulation), Articles 4 and 6 of Council Regulation (EU) No 1024/2013 of 15 October (SSM Regulation), paragraphs 7 and 8 of Article 30-D of the RGICSF, and paragraph 2 of Article 65 of the RGICSF.

– Archiving in the public interest Cfr. General Regime of Archives and Archival Heritage, approved by Decree-Law No. 16/93 of 23 January.

In the case of assessment of suitability for the exercise of functions in Significant Institutions, the ECB, with headquarters at Sonnemannstrasse 20, D-60314 Frankfurt-am-Main, Germany, also processes personal data for the fulfillment of the aforementioned purpose and is responsible for the processing, in accordance with Article 3(8) of Regulation (EU) No 2018/1725. The ECB's declaration for compliance with the duty of information can be consulted here6.

b) Categories of personal data and respective origin

The following categories of personal data are processed: (i) Personal data provided by the person: a. Identification and contact data (name, address, e-mail, telephone contact, etc.); b. Data related to the assessment of suitability (such as information contained in the criminal record certificate, information on administrative, criminal, or civil proceedings, including insolvency, recovery, or liquidation proceedings of entities, dismissal proceedings, prohibition of exercise of functions, mentions of defaults in the credit responsibility center); c. Data related to the assessment of professional qualification (such as information on academic background and professional experience, including skills acquired in held positions and training); d. Data related to the assessment of independence (information on personal, professional, financial, political conflicts of interest, including information on family relationships, loans, guarantees, and other obligations); e. Data related to the assessment of availability (such as the hours expected to dedicate to the exercise of functions). (ii) Personal data provided by the supervised entity (such as in individual and collective assessment reports) related to the categories indicated above; (iii) Personal data that have come to the knowledge of the supervisor by other means (such as those communicated by the ECB, by the Portuguese Securities Market Commission (CMVM), by the Insurance and Pension Funds Supervisory Authority (ASF), by the European Banking Authority (EBA), by similar authorities, by judicial authorities, or data accessible in open sources available to the public); (iv) Personal data of persons related to the person/entity to be supervised (for example: of workers, clients, or family members) provided within the framework of the aforementioned communications; (v) Personal data obtained internally at the Bank of Portugal (such as data contained in the Credit Responsibilities Center regarding possible defaults).

For a more detailed identification, please consult this Instruction, as well as Instruction No. 7/2021. For additional information, please contact us through encarregado.protecao.dados@bportugal.pt

c) Obligation

The provision of data necessary for these purposes is mandatory.

d) Retention

The data will be retained for the time corresponding to the limitation period of the applicable criminal or regulatory offense procedure for offenses related to the activity. In legally permitted cases, the data may also be retained for purposes of archiving in the public interest and/or historical.

e) Recipients

The data processed by the Bank of Portugal is intended for internal use, particularly by the Prudential Supervision Department and the Investigation and Sanctioning Department, always respecting the principle of need-to-know access by Bank employees, including subcontractors acting under the instructions and on behalf of the Bank of Portugal (such as specialist legal consultants), all of whom are bound by a duty of confidentiality.

The information will not be shared with third parties, except in situations where the law requires it.

Indeed, to fulfill its functions, the Bank of Portugal may share personal data with a limited number of persons: (i) From the Bank of Portugal and the ECB, in the exercise of their functions; and (ii) From other Union institutions, similar authorities, and national entities (such as the EBA, the CMVM, the ASF, as well as judicial authorities), within the framework of cooperation powers with these authorities.

f) Automated individual decision-making

The processing of data does not entail automated individual decision-making.

g) Transfer of personal data

The collected personal data may be communicated to similar authorities, international organizations, and other entities from third countries, within the framework of cooperation powers with these authorities. In the absence of an adequacy decision, personal data will only be transferred to a third country or international organization upon the provision of adequate guarantees, in compliance with Article 46 of the GDPR and Article 48 of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 (Regulation (EU) 2018/1725). In exceptional situations, transfers of personal data may be carried out in compliance with Article 49 of the GDPR and Article 50 of Regulation (EU) 2018/1725.

6 The declaration is available at https://www.bankingsupervision.europa.eu/home/data-protection/privacy-statements/FAP/index.en.html