Joint ESAs Guidelines on the system for the exchange of information relevant to fit and proper assessments

1 JC/GL 2024 88 20 November 2024 Joint Guidelines on the system established by the European Supervisory Authorities for the exchange of information relevant to the assessment of the fitness and propriety of holders of qualifying holdings, directors and key function holders of financial institutions and financial market participants by competent authorities

2 Joint Guidelines on the system established by the European Supervisory Authorities for the exchange of information relevant to the assessment of the fitness and propriety of holders of qualifying holdings, directors and key function holders of financial institutions and financial market participants by competent authorities Status of these joint Guidelines This document contains joint Guidelines to be issued pursuant to Articles 16 of Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority); of Regulation (EU) No 1094/2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority); and of Regulation (EU) No 1095/2010 establishing a European Supervisory Authority (European Securities and Markets Authority) (collectively referred to as the ‘Founding Regulations’). The adoption of the Guidelines is to be done in accordance with Articles 56, second subparagraph of the Founding Regulations. In accordance with Articles 16(3) of the Founding Regulations, competent authorities must make every effort to comply with the Guidelines. The joint Guidelines aim at establishing consistent, efficient and effective supervisory practices within the European System of Financial Supervision (ESFS), and at ensuring the common, uniform and consistent application of Union law with regard to the use of the system established by the ESAs for the exchange by competent authorities of information relevant to the assessment of the fitness and propriety of holders of qualifying holdings, directors and key function holders of financial institutions and financial market participants in accordance with the legal acts referred to in Articles 1(2) of the Founding Regulations.

3 Competent authorities to which the joint Guidelines apply should comply by incorporating them into their supervisory practices or regulatory framework as appropriate (e.g. by amending their legal framework or their supervisory processes). Reporting requirements The expected date of application of these joint Guidelines is the day of the publication of translations in all official EU languages on 17/02/2025. In addition, competent authorities are expected to comply with parts of the joint Guidelines at a later stage (a different time when provisions concern legal or natural persons), taking into account the time necessary to feed historical data into the ESAs Information system before using the ESAs Information system. In accordance with Articles 16(3) of the Founding Regulations, competent authorities must notify the respective ESA whether they comply or intend to comply with the joint Guidelines, or otherwise with reasons for non-compliance, by 22/04/2025 (two months after the publication of translations of the final joint Guidelines in all official EU languages). In the absence of any notification by this deadline, competent authorities will be considered by the respective ESA to be non-compliant. Notifications should be sent to [compliance@eba.europa.eu, compliance@eiopa.europa.eu and compliance.fpsguidelines@esma.europa.eu] with the reference ‘JC/GL/2024 88’. A template for notifications is available on the ESAs’ websites. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Notifications will be published on the ESAs’ websites in line with Articles 16(3) of the Founding Regulations. The joint Guidelines will be applicable during the comply and explain procedure, having already been extensively consulted upon with competent authorities. Additionally, two public consultations took place, ending on 2 May 2023 and 15 January 2024, respectively. The ESAs have also liaised with the European Data Protection Supervisor, whose informal opinion was taken into account. These joint Guidelines are necessary for the implementation of Articles 31a of the ESAs Regulations and are addressed only to competent authorities.

4 Title I – Subject matter, scope and definitions Subject matter

1. These Guidelines clarify the use of the ESAs Information System by competent authorities and the exchange of information relevant to the assessment of the fitness and propriety of holders of qualifying holdings, directors and key function holders in accordance with the legal acts referred to in Article 1(2) of Regulation (EU) 1093/2010, Article 1(2) of Regulation (EU) 1094/2010 and Article 1(2) of Regulation (EU) 1095/2010 on the basis of Articles 31a thereof. Addressees
2. These Guidelines are addressed to competent authorities referred to in Articles 4(2) of Regulation (EU) No 1093/2010 and Regulation (EU) No 1094/2010 and in Article 4(3) of Regulation (EU) No 1095/2010. Definitions
3. Terms used and defined in legal acts referred to in Article 1(2) of Regulation (EU) 1093/2010, Article 1(2) of Regulation (EU) 1094/2010 and Article 1(2) of Regulation (EU) 1095/2010 on the basis of Articles 31a of the Founding Regulations have the same meaning in these Guidelines. Assessment means a final decision of a competent authority on the suitability of a person of interest in accordance with Union sectoral provisions, which would be either an approval, including a tacit approval, or rejection, including a tacit rejection, including at the point of authorisation. ESAs Information System means a digital platform established jointly by the EBA, EIOPA and ESMA in accordance with Articles 31a of Regulation (EU) No 1093/2010, Regulation (EU) No 1094/2010 and Regulation (EU) No 1095/2010. ESAs Information System operating rules means the set of rules, specifications, arrangements, processes and procedures for the use of the ESAs Information System by competent authorities, including but not limited to technical specifications, language arrangements, access rights and their management.

5 Competent authorities means authorities as defined in Articles 4(2) of Regulation (EU) No 1093/2010 and Regulation (EU) No 1094/2010 and in Article 4(3) of Regulation (EU) No 1095/2010. Financial institution and financial market participant means a financial institution referred to in Articles 4(1) of Regulation (EU) No 1093/2010 and Regulation (EU) No 1094/2010 and a financial market participant referred to in Article 4(1) of Regulation (EU) No 1095/2010. Union sectoral provisions mean provisions of the legal acts referred to in Articles 1(2) of Regulation (EU) No 1093/2010, Regulation (EU) No 1094/2010 and Regulation (EU) No 1095/2010 on the exchange of information relevant to the assessment of the fitness and propriety of persons of interest. Request for information means a request for information relevant to the assessment of the fitness and propriety of a holder of (a) qualifying holding(s), director or key function holder of a financial institution and a financial market participant in accordance with the Union sectoral provisions submitted through the ESAs Information System by an assessing authority consistent with these Guidelines. Requesting authority means a competent authority submitting a request for information. Requested authority means a competent authority receiving a request for information. Person of interest means a natural or legal person assessed or to be assessed for the fitness and propriety of a holder of (a) qualifying holding(s), a director or a key function holder of financial institutions and financial market participants in accordance with Union sectoral provisions.

6 Withdrawal of application means the retraction by the applicant of any explicit or tacit application or notification for an assessment process before a decision has been taken by the competent authority. Title II – Use of the ESAs Information System Using the ESAs Information System 4. For the purpose of the assessments of the fitness and propriety of persons of interest in accordance with Union sectoral provisions, competent authorities should use the ESAs Information System, thereby submitting, searching and requesting information relevant to the assessment of fitness and propriety in line with these Guidelines. Data input into the ESAs Information System 5. Competent authorities that make an assessment of the fitness and propriety of a person of interest should include the data referred to in paragraph 7 of these Guidelines in the ESAs Information System within two weeks after the receipt of a notification or application for an assessment of fitness and propriety (date of entry). 6. Where there is an additional or a new assessment of an already assessed person of interest, a new entry in the ESAs Information System should be created. 7. The data to be supplied to the ESAs Information System should include with regard to the person of interest: 7.1. natural person: a. first name(s); b. surname/family name; c. date of birth; d. place of birth; e. where available, other names (including, where available, birth name) used by the person (AKA names); 7.2. legal person: a. the legal name of the legal person or entity (including abbreviation of legal form);

7 b. AKA names of the legal person; c. the legal entity identifier (LEI); d. where the LEI is not available, the registration number, such as from a central register, commercial register, companies register or similar public register; and e. country of incorporation (headquarters); and with regard to the assessing competent authority: 7.3. for a natural person and legal person: a. data as set out below: i. for data added after the establishment of the ESAs Information System: the date of entry as per paragraph 5; ii. for historical data added to the ESAs Information System: relevant date available to the competent authority (e.g. date of application or notification, decision, entry into function, etc.); b. legal act referred to in Articles 1(2) of the Founding Regulations under which the assessment was performed; and c. where available, reference number of the record held by the competent authority. 8. The information entered in the ESAs Information System under paragraph 7 will be kept in the ESAs Information System for a maximum period of 15 years from the date of entry by a competent authority and then automatically deleted from the ESAs Information System. Competent authorities may apply shorter retention periods. Where shorter retention periods have been applied in line with applicable Union or national law, the competent authority should remove the data from the ESAs Information System accordingly after such periods end. In addition to the expiration of the retention period, information could also be deleted by competent authorities upon receiving notification that the person of interest is deceased. The above is without prejudice to the right of access, rectification or erasure by the concerned data subjects as provided for in Articles 17, 18 and 19 of Regulation (EU) 2028/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies. 9. Competent authorities should designate contact points for receiving and responding to requests and make this information available in the ESAs Information System. The contact point details should include the functional e-mail address used in the process of fitness and propriety assessments, a phone number of the unit/department dealing with the fit and proper assessments (optionally) and, for relevant staff members, the given name(s) / family name, position, professional e-mail address and phone number.

8 10.Competent authorities should keep the lists of contact points, including functional e-mail addresses, up to date and review them at least annually. Data searches within the ESAs Information System 11.Before a competent authority makes an assessment of the fitness and propriety of a person of interest in accordance with Union sectoral provisions, the competent authority should look up in the ESAs Information System if there is any other competent authority that holds information on this person of interest. Title III – Information exchange and cooperation between the competent authorities using the ESAs Information System Sending requests for information 12.Where the ESAs Information System search indicates that relevant information for the purpose of an assessment is available, the competent authority should, before making the assessment, submit a request for information through the ESAs Information System to the competent authorities identified in line with paragraph 11 that hold relevant information on the person of interest. 13.The requesting authority should set out the reason for the request, the information requested and the Union sectoral provisions on the basis of which the assessment is being made. 14. The requesting authority should provide the requested authority with any document or supporting material deemed necessary to support the request using bilateral means of communication outside of the ESAs Information System. Competent authorities may facilitate the exchange of information by way of cooperation arrangements1 . Processing and responding to requests for information 15.The actual exchange of underlying information that is relevant for the assessment of the fitness and propriety of a person of interest will be made bilaterally, between the requesting and requested authorities outside the ESAs Information System. 16.The requested authority should, in accordance with the principle of sincere cooperation set out in Article 4(3) of the Treaty on European Union (TEU) and reflected in Articles 2(4) of the Founding Regulations, and taking into account Union sectoral provisions and any other applicable legal acts related to sectoral provisions, respond to the request within two weeks from receipt of the request and provide the information or explain why the information can only be provided at a later date and specify that date. In the case of a negative assessment or a withdrawal of the application for an assessment, available information about the reasons for the negative assessment or the withdrawal should also be provided. 1 E.g. ESMA Multilateral Memorandum of Understanding on Cooperation Arrangements and Exchange of Information

9 17.The requested authority should not provide the information requested where confidentiality or personal data protection requirements set out in Union sectoral provisions or in any other applicable legal provisions prevent it from doing so or where the requested authority cannot, for objective reasons, provide the information requested. 18.Where the exchange of information is impossible in accordance with paragraph 17, the requested authority should, as soon as possible but at the latest within two weeks from receipt of the request, inform the requesting authority and explain the reasons for this. If it is partially impossible to provide all the requested information, the requested authority should provide the requesting authority with the part of the information whose provision is permitted and explain the reasons for withholding other parts of the information. 19.The requested authority may ask for clarifications from the requesting authority regarding the request received. The requesting authority should respond to any such clarification requests without undue delay. If clarifications are sought, the time period under paragraphs 16 and 18 should start after the clarifications are provided by the requesting authority. Confidentiality 20.Competent authorities should treat all information received in accordance with these Guidelines as confidential and treat it in line with professional secrecy and personal data protection requirements set out in Union legislation and applicable national law.

10 Title IV – Final provisions and implementation 21.These Guidelines apply from 17/02/2025, with the exception of: a. paragraphs 4, 11, 12, 13, 14, 15, 16, 17, 18, 19, which will apply from 15 May 2025 for assessments of natural persons, and from 30 April 2026 for assessments of legal persons; b. paragraph 7.2 (a-e), which will apply from 30 January 2026. 22.Competent authorities should include available historical data on natural persons for the last five years, calculated from the date of application of these Guidelines, in the ESAs Information System by 15 May 2025. 23.When single data points for the natural person, e.g. date or place of birth, specified under paragraph 7.1 are not available, the requesting and requested authorities should ensure by other means that the information that should be provided is relevant to the assessment of the person of interest. 24.Competent authorities should include available historical data on legal persons for the last two years calculated from 30 January 2026 in the ESAs Information System by 30 April 2026. In the absence of an LEI for legal persons, other registration numbers (e.g. from a central register, commercial register, companies register or similar public register) and in addition the country of incorporation should be inputted into the ESAs Information System.