Memorandum of Understanding on Cooperation Between NYDFS and EBA on Stablecoin Activity

1 EBA Regular Use Memorandum of Understanding on cooperation, exchange of information and coordination between The New York State Department of Financial Services on the one part, and The European Banking Authority, Collectively the “Authorities” and individually an “Authority”.

2 EBA Regular Use Preamble (1) The European Banking Authority (“EBA”) is a European Supervisory Authority established by Regulation (EU) No 1093/20101 . (2) Regulation (EU) 2023/1114 on markets in crypto-assets2 (the “Markets in Crypto-Assets Regulation” or “MiCA”) establishes a comprehensive regulatory and supervisory framework for crypto-assets within the European Union (“EU”), including stablecoins termed as asset-referenced tokens (“ARTs”) and electronic money tokens (“EMTs”). (3) MiCA confers on the EBA supervisory responsibilities and tasks over issuers of ARTs and EMTs that are classified as significant, where they meet specific criteria set out in MiCA. (4) In order to carry out such supervisory responsibilities under Article 117 of MiCA, Article 126 of MiCA allows the EBA to conclude administrative agreements on the exchange of information with the supervisory authorities of third countries. (5) The New York State Department of Financial Services (“NYDFS”) supervises and regulates the activities of banking and other financial institutions with the goal of ensuring that the regulation of financial services in New York State keeps pace with the rapid and dynamic evolution of these industries, to guard against financial crises, and to protect consumers and markets from fraud. (6) NYDFS is the Authority in New York State responsible for regulating and supervising virtual currency and virtual currency business activities. Stablecoins are, under NYDFS’s regulatory regime, a form of virtual currency. Entities engaged in virtual currency business activities are regulated and supervised pursuant to the New York Financial Services Law3 (the “Financial Services Law”), the New York Banking Law4 (the “Banking Law”), NYDFS’s BitLicense regulation (23 NYCRR Part 200), and other regulations and guidance. (7) Effective cooperation relies on the possibility to share information freely and safely among the Authorities, and this is facilitated by robust provisions on professional secrecy and data protection. The confidentiality and professional secrecy regimes applicable to the NYDFS have been assessed by the EBA to be equivalent to those set out in MiCA. (8) The Authorities intend to ensure an effective level of cooperation and exchange of information for the performance of their supervisory tasks under their respective legal frameworks and for this purpose have decided to enter into this Memorandum of Understanding (“MoU”). 1 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331 of 15.12.2010, p.12). 2 Regulation (EU) No 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EEU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (OJ L 150 of 09.06.2023, p.1). 3 Chapter 18-A of the New York Consolidated Laws. 4 Chapter 2 of the New York Consolidated Laws.

3 EBA Regular Use Article 1 Definitions For the purposes of this MoU: a) “Authority/ies” means a signatory/ies to this MoU or any successor thereto. b) “Crypto-asset” means a digital representation of a value or of a right that is able to be transferred and stored electronically using distributed ledger technology or similar technology. c) “Information and Communication Technology (ICT)” means all technologies used for the gathering, storing, transmitting, retrieving, or processing of information (e.g. microelectronics, printed circuit boards, computing systems, software, signal processors, mobile telephony, satellite communications, and networks). d) “ICT-related security incident” means a single event or series of linked events unplanned by the supervised entity or person that compromises the security of the network and information systems, and have an adverse impact on: a. The confidentiality, authenticity, integrity, or availability of the supervised entity or person's ICT; b. The information the supervised entity or person gathers, stores, transmits, retrieves, or otherwise processes; or c. The safety and security of the supervised entity or person's operations. e) “Providing Authority” means the Authority that has provided information under this MoU. f) “Qualifying holding” means any direct or indirect holding in a supervised entity which represents at least 10 % of the capital or of the voting rights, or which makes it possible to exercise a significant influence over the management of the supervised entity in which that holding subsists. g) “Receiving Authority” means the Authority that has received information under this MoU. h) “Requested Authority” means the Authority to whom a request for exchange of information, participation in or assistance with the conduct of investigations or on-site inspections in the other Authority’s jurisdiction is made. i) “Requesting Authority” means the Authority making a request for exchange of information, or addressing a request to participate in or assist with the conduct of investigations or on-site inspections in the other Authority’s jurisdiction. j) “Stablecoin” means a type of crypto-asset that purports to maintain a stable value by referencing the value of one official currency, or by referencing another value or right or a combination thereof, including one or more official currencies. k) “Supervisory college” means a supervisory college established or led by either of the Authorities to act as a vehicle for the coordination of supervisory activities among its members over the relevant supervised entities or persons. l) “Supervised entity or person” means i) an issuer of stablecoins or another entity or person engaged in stablecoin-related activities within the supervisory remit of both of the Authorities or ii) an issuer of stablecoins or another entity or person engaged in stablecoin-related activities within the supervisory remit of either of the Authorities, provided that the relevant stablecoins are simultaneously issued in both Authorities’ jurisdictions.

4 EBA Regular Use m) “Supervisory tasks” means any activities or actions conducted by the Authorities in order to carry out their supervisory responsibilities over supervised entities or persons under their respective legal frameworks. Article 2 Purpose and scope of cooperation

1. This MoU lays down the principles, the rules, and the content for cooperation, exchange of information, and coordination between the Authorities, inclusive of emergency situations, with regard to supervised entities or persons whose activities may affect stablecoin holders or market participants, the stablecoin markets or the broader financial markets in either or both of the Authorities’ jurisdictions, in particular with a view to: a) enhancing the supervision of entities and persons engaged in stablecoin activities, the assessment of related risks as well as promoting the safety and soundness of the supervised entities or persons; b) fostering effective monitoring of the global market and regulatory developments for stablecoins; and c) contributing to the orderly functioning and integrity of the market in stablecoins.
2. This MoU relates only to the stablecoin-related activities of supervised entities or persons, and not to other activities that supervised entities or persons may undertake. Article 3 General principles for cooperation and exchange of information
3. Each Authority will endeavour to provide the other Authority, on a timely basis upon request or on its own initiative, where appropriate and insofar as legally possible and operationally feasible, with any information that is necessary for the exercise of the other Authority’s supervisory tasks.
4. Where needed, the Authorities will assist each other in the exercise of their respective supervisory tasks and in the interpretation of information which enables the requesting Authority to assess compliance with the laws or regulations to which the supervised entities or persons are subject.
5. Where relevant, an Authority may invite the other Authority to participate in supervisory colleges in accordance with the terms of the written agreement establishing and describing the functioning of the college.
6. The working language between the Authorities will be English.

5 EBA Regular Use Article 4 Areas of exchange of information

1. The Authorities will endeavour to exchange information related to supervised entities and persons, within the scope and objectives of Article 2, upon request or own initiative and where such information is available, including information related to: a) modification of the authorisation of supervised entities and persons, or refusal to grant authorisation and the grounds of the refusal; b) the stablecoin issued, and the total volume in circulation including the number of holders, in custodial and unhosted wallets, in the relevant jurisdiction; c) fitness and propriety and other relevant findings and observations about the management body, shareholders, including prospective acquirers of a qualifying holding; d) risk analyses, compliance assessments with the applicable law and supervisory measures, including related to the reserve of assets, own funds, liquidity management, liquidity and solvency stress tests, intra-group and outsourcing arrangements, changes to the business model and any other aspect related to the governance, information and communication technology (‘ICT’) systems and security arrangements, conduct and business operations; e) practical, legal or supervisory impediments to the rebalancing of the reserve of assets between the relevant supervised entities or persons in the Authorities’ jurisdictions, including under stress; f) results of external and internal audits, or similar assessments and certifications; g) the regulatory standing of specific products and services; h) modification of the business model; i) planned expansion of activities within the home jurisdiction or in a third country jurisdiction; j) suspicion of irregularities or alleged infringements as set out in Article 6 of this MoU; k) supervisory sanctions or other measures; l) civil or criminal investigations or proceedings, or other measures imposed, as well as appeals against these administrative supervisory measures or sanctions before relevant courts or administrative bodies; m) discontinuation of the business activity, including any recovery, redemption or resolution plan; n) annual supervisory plans and related updates;

6 EBA Regular Use o) any other matter relevant for the performance of the Authorities’ supervisory responsibilities. 2. The Authorities acknowledge that certain categories of information falling within the scope of this MoU are deemed necessary for recurrent exchanges on a quarterly basis without prior request, and agree to establish such exchanges in accordance with the applicable legal and regulatory frameworks, including information related to, where available: a) the value and composition of the reserve of assets constituted by the supervised entities or persons and respective maturities of such assets, the entities or persons receiving the assets constituted as reserve, the financial instruments and other assets in which the reserve of assets is invested and the issuers thereof; b) the holders of a qualifying holding in a supervised entity or person; c) the group structure of the supervised entity in each jurisdiction and any related changes; d) the number and volume of stablecoins exchanged in each relevant crypto-asset exchange or trading platforms in each jurisdiction. Article 5 Procedure for the transmission of information

1. The exchange of information on own initiative or upon request between the Authorities will be conducted in writing via secure electronic communication channels. In urgent circumstances, the exchange of information may be made orally (i.e. in person, by telephone or other on-line communication means), provided that it is subsequently confirmed in writing within ten (10) working days.
2. Both the request for exchange of information and the communication of information will be addressed between the Authorities primarily through the designated contact persons as set forth in Appendix A.
3. A request for exchange of information should specify at least the following: a) the information sought by the Requesting Authority, including description of its nature and indication of the time period concerned; b) a concise description of the facts underlying the request; c) the purpose for which the information is sought, including indication of the legal provisions setting out the supervisory tasks for which the requested information is deemed relevant; d) the reasons why the information is relevant for the proper performance of the Requesting Authority’s supervisory tasks, in light of the laws and regulations applicable to the activity;

7 EBA Regular Use e) the desired time period within which the information is to be provided and, where appropriate, the urgency thereof; f) to whom, if anyone, including any governmental entity onward disclosure of information is likely to be necessary and the reasons for any such disclosure. 4. Where the exchange of information is not fulfilled, the Requested Authority should explain as far as possible the reasons for not sharing the information. Article 6 Procedures for participation and assistance in the conduct of general investigations and on-site inspections

1. An Authority may participate upon request or invitation, in general investigations or on-site inspections conducted by the other Authority at the business premises of supervised entities and persons under its supervision located in that other Authority’s jurisdiction.
2. An Authority may also request the assistance of the other Authority to conduct general investigations or on-site inspections at business premises of the supervised entities and persons under the supervision of the Requesting Authority located in that other Authority’s jurisdiction.
3. The participation in or the provision of assistance with the conduct of investigations or on￾site inspections referred to in paragraphs 1 and 2 will be subject to the following conditions: a) the participation or assistance is deemed necessary to allow the Requesting or invited Authority to carry out its supervisory duties; and b) the Requesting Authority has officially and duly notified the other Authority and the latter has raised no objection thereto, or the invited Authority has officially and duly notified the other Authority its acceptance to participate in the investigation or on-site inspection, as applicable; and c) the Requesting Authority ensures that officials or other individuals who are authorised or appointed by that Authority to participate in the general investigation or on-site inspection, are subject to the professional secrecy requirements applicable to the Requesting Authority.
4. The Authority intending to conduct the investigations or on-site inspections should notify the other Authority with at least: a) the name and other relevant information of the supervised entity or person to be investigated or inspected and the business premises to be investigated or inspected; b) the legal basis, including if applicable the relevant decision ordering the inspection;

8 EBA Regular Use c) the subject matter and purpose of the investigation or on-site inspection; d) the expected starting and ending dates of the investigation or on-site inspection; e) the expected participation or assistance from the other Authority. 5. When the Authority intending to conduct the on-site inspection or investigation notifies the other Authority, the Authorities will endeavour to coordinate and agree on their respective roles and responsibilities. The Authorities will act in accordance with the following procedure before conducting the on-site inspection or general investigation: a) The Authority notifying the conduct of the on-site inspection or investigation, which notification will take place at least forty-five (45) days in advance of the intended on-site inspection or investigation, will consult the other Authority on the intended timeframe for and the subject matter and purpose of the on-site inspection or general investigation. Where the referred prior notification of at least forty-five (45) days is not possible due to an emergency or crisis situation, or if it would lead to a situation where the on-site inspection or investigation would no longer be effective, the notification will take place as soon as possible before the initiation of the on-site inspection or investigation. b) When establishing the subject matter of any proposed on-site inspection or general investigation, the Authority notifying the conduct of the on-site inspection or investigation will consider the other’s monitoring or supervisory activities and any information or documentation that was made available or is capable of being made available. c) The non-objection or acceptance referred to in paragraph 3b) will be transmitted in writing to the notifying Authority referred to in paragraph 3b) as soon as possible and no later than thirty (30) days following the notification of intention to conduct a general investigation or an on-site inspection. Failure to communicate a response to the notification within thirty (30) days, would be considered as a consent to the general investigation or on-site inspection or in case of an invitation as referred to in paragraph 1, a lack of interest to participate in the general investigation or on-site inspection. In emergency or crisis situations, the non-objection or acceptance referred in the first sentence will be transmitted as soon as possible and in any event within three (3) working days following receipt of the notification of intention to conduct the on-site inspection or general investigation. d) Upon request, the Authorities will assist each other in reviewing the contents of public or non-public books and records and obtaining information from management and staff of the entity or person subject to the on-site inspection or investigation. 6. Subject to the fulfilment of the conditions set out in paragraph 3 of this Article, the Authorities will communicate to each other the names and contact details of the designated individuals who will take part or assist in the investigation or on-site inspection. 7. On conclusion of the on-site inspection or general investigation, the Authority conducting the investigation or on-site inspection should present the other Authority with the relevant

9 EBA Regular Use findings within a reasonable timeframe. This information will be given insofar as possible and subject to applicable laws and regulations, and in line with the principles set out in this MoU. 8. Exchange of information and communications under this Article take place in accordance with paragraphs 1 and 2 of Article 5. Article 7 Mechanisms for the notification in cases of infringement of requirements

1. If the Authorities become aware of a case where a supervised entity or person is deemed to have materially infringed the requirements to which it is obliged to adhere pursuant to the applicable law and may affect stablecoin holders or market participants located or established in the other Authority’s jurisdiction, the stablecoin or the broader financial markets of that other Authority’s jurisdiction, where possible they will notify each other in writing as soon as there are clear and demonstrable grounds of an alleged infringement, containing at least the following elements: a) the nature of the alleged infringement; b) whether the Authority plans to initiate an infringement procedure and impose administrative penalties or other measures on the supervised entity or person; c) whether the supervised entity or person has the possibility to exercise its right to be heard and the period of time granted to it to provide its allegations; d) any previous corrective measures taken by the supervised entity or person in relation to the infringement and implementation timetable for those, where applicable; e) any remedial plans endorsed by the supervised entity or person in connection with the infringement, where applicable; f) any other relevant information in connection with the infringement.
2. For the purposes of paragraph 1, a material infringement is deemed to have occurred if the infringement has at least led or is likely to lead to the imposition of an administrative fine or criminal penalty on the supervised entity or person, to the suspension or exclusion of any member of the management body of the supervised entity or person from exercising management functions, or to the suspension or withdrawal of the authorisation of the supervised entity or person.
3. The Authorities should also inform each other of any failure of the supervised entity or person to cooperate effectively with any public authority or apply reasonable diligence, including lack of cooperation or lack of application of reasonable diligence towards the Authorities.
4. Where after providing a written notification in accordance with paragraph 1, the communicating Authority becomes aware of the submission by the supervised entity or person of the activation of a recovery, redemption or resolution plan, decides to impose an

10 EBA Regular Use administrative penalty or adopt any other enforcement, regulatory or supervisory measure with regard to the supervised entity or person, that Authority will share that plan with or inform the other Authority, as soon as practicable. 5. Exchange of information under this Article takes place in accordance with Article 5. The Authorities may organise regular meetings in order to facilitate such exchange of information. Article 8 Cooperation in relation to emergency situations

1. In case of an emergency situation, such as, but not limited to, serious operational or financial difficulties of supervised entities and persons or a major ICT-related security incident which might have an adverse impact on entities or persons established in the other Authority’s jurisdiction, the Authorities will endeavour to inform each other promptly after they become aware of the situation or incident.
2. To the extent possible, the Authorities will endeavour to seek coordinated responses to any crisis emerging in their respective jurisdictions, in accordance with the applicable legislation and without prejudice to their respective involvement in the relevant cross-border cooperation fora. Article 9 Legal nature
3. This MoU is a statement of intent to consult, exchange information, and cooperate in connection with the Authorities’ supervisory competences.
4. This MoU should be interpreted and applied in a manner that is permitted by and consistent with, the laws and other legal or regulatory requirements applicable to each Authority.
5. This MoU does not constitute a legally binding and/or legally enforceable agreement. In particular, it does not: (a) create any rights or obligations for either of the Authorities or third parties; (b) modify or supersede any laws, regulations and requirements in force or applying to the Authorities; (c) affect any arrangement under other MoUs; (d) represent a waiver to the immunity or the submission to the jurisdiction of any court.
6. This MoU is not intended to limit or condition the discretion of the Authorities in any way in the discharge of their regulatory or supervisory responsibilities or to prejudice or affect in any way their individual responsibilities, competencies or autonomy.
7. The Authorities should, within the framework of this MoU, endeavour to provide each other with the fullest cooperation permissible and appropriate under their laws and regulations. Following consultation, cooperation may be denied for the following or other reasons: a) where the cooperation would require an Authority to act in a manner that would violate laws and regulations applicable to it; or

11 EBA Regular Use b) where a request for assistance is not made in accordance with the terms of this MoU; or c) on the grounds of New York State’s public interest for the NYDFS or of European public interest for the EBA. 6. To facilitate communication and cooperation under this MoU, the Authorities hereby designate contact persons as set forth in the Appendix A. Any modifications to the details of contact persons should be communicated without undue delay to the other Authority. Article 10 Confidentiality and permissible uses of information

1. The Authorities acknowledge that all information exchanged on the basis of this MoU shall be used exclusively for supervisory purposes and shall be treated as confidential unless specified otherwise. Confidential information shall be disclosed to third parties for the reasons provided for in the MoU and pursuant to a legally enforceable demand.
2. Except as provided in paragraph 3 or 4, before the Receiving Authority discloses any confidential information received under this MoU to a third party, the Receiving Authority will request and obtain prior written express agreement, which will not be unreasonably withheld from the Providing Authority. Such information should only be disclosed for the purposes for which the Providing Authority gave its agreement or where such disclosure is necessary for judicial proceedings. Before disclosing the confidential information to such a third party (including where possible in a situation provided for in paragraph 3), the Receiving Authority will obtain a commitment from that party that the information will be kept confidential. During an emergency situation, express agreement may be obtained in any form, including orally, provided such communication is confirmed in writing as promptly as possible and not later than one (1) week following notification.
3. If the Receiving Authority is required by statute or legal process to disclose confidential information received under this MoU to a third party, it will, to the extent permitted by law, inform the Providing Authority about such possible onward sharing. If the Providing Authority does not consent to such disclosure, then the Receiving Authority will take all available and appropriate steps to resist disclosure, including by employing legal means to challenge the order and by advising the third party requiring such information of the possible negative consequences that such disclosure might have on the future exchange of confidential information between the Authorities.
4. Subject to the conditions set out in Annex II, where a Receiving Authority transmits information to an Onward Sharing Authority (as defined in paragraph 1 of Annex II) or to courts where the information requested by them is needed for court investigations or proceedings in respect of infringements subject to criminal penalties, it will notify the Providing Authority, preferably before the transmission of the information and, at the latest, within thirty (30) days from such transmission.

12 EBA Regular Use 5. The Authorities intend that the sharing or disclosure of confidential information, including deliberative and consultative materials, pursuant to the terms of this MoU, will not constitute a waiver of privilege or confidentiality of such information. 6. Each Authority will ensure that all persons that deal with or have access to confidential information provided by the other Authority (including any of its staff, members of its governance bodies, external providers and any persons who perform tasks on behalf of such Authority that have access to confidential information) are bound by the obligations of confidentiality and professional secrecy in compliance with the applicable legal framework, including after the termination of their duties. 7. The Authorities represent and acknowledge that under the terms of this MoU: a) the NYDFS processes confidential information in accordance with the relevant provisions of the Financial Services Law and the Banking Law and internal requirements on confidentiality and professional secrecy; b) the EBA processes confidential information in accordance with the relevant provisions of the EBA Regulation and internal requirements on confidentiality and professional secrecy. Article 11 Personal data To the extent any personal data is exchanged by the Authorities under this MoU, such an exchange shall be processed in line with the laws and regulations applicable in their respective jurisdictions5 . Article 12 Successor authorities

1. Where the relevant functions of an Authority are transferred or assigned to another authority or authorities, the terms of the MoU shall apply to the successor authority or authorities performing those relevant functions, such successor authority or authorities shall become a signatory or signatories to this MoU without the need for any further amendment to this MoU, and notice will be provided to the other Authority.
2. Paragraph 1 will not affect the right of any Authority to give written notice as provided in Article 14 (2) that it no longer wishes to be a signatory to this MoU if it wishes to do so. Article 13 Amendments 5 The EBA shall process the personal data in line with Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

13 EBA Regular Use

1. The Authorities intend to periodically review the functioning and effectiveness of this MoU, including in case of changes in the regulatory status or supervisory scope, in particular in relation to stablecoin or the broader financial markets.
2. This MoU may be amended with the written consent of both Authorities. Amendments to the relevant contact persons listed in Appendix A can be made by each Authority giving written notice to the other Authority. Article 14 Termination
3. This MoU will remain operative for an unlimited period of time.
4. If an Authority wishes to no longer be a signatory to this MoU, it shall provide thirty (30) calendar days prior written notice to the other Authority.
5. If an Authority gives such notice, the parties will consult concerning the disposition of any pending requests for information or assistance. If an agreement cannot be reached through consultation, the Authorities will endeavour to cooperate with respect to all requests for information or assistance that were made under the MoU before the expiration of the thirty (30)-day period until all requests are fulfilled or the Requesting Authority withdraws such request(s).
6. In the event of termination of this MoU, any confidential information obtained under this MoU will continue to be treated in the manner described under Article 10. Article 15 Publication This MoU may be made publicly available in full or in part by any of the Authorities at any time and in any manner, excluding the list of contact persons in the Appendix. Article 16 Entry into effect This MoU will come into effect at the latest of the dates on which this MoU is signed by the Authorities.

14 EBA Regular Use Executed by the Authorities. For the European Banking Authority [SIGNED] François-Louis Michaud EBA Chair Date: 13/05/2026 New York State Department of Financial Services [SIGNED] Kaitlin Asrow Acting Superintendent Date: 27/04/2026

15 EBA Regular Use Appendix A Contact Persons (redacted)

16 EBA Regular Use Annex II Onward Sharing Authorities

1. List of Onward Sharing Authorities For the purposes of Article 10 paragraph 4 of the MoU, ‘Onward Sharing Authority’ means any of the authorities listed below, when fulfilling the conditions which are set out in paragraph 2 of this Annex: a) For the NYDFS: the authorities set forth in Annex III hereto. The NYDFS may unilaterally amend and add authorities to Annex III provided that the EBA has been notified of the NYDFS’s intention to amend this Annex and the EBA has informed the NYDFS that these authorities have been assessed as equivalent to the EBA in terms of professional secrecy requirements. b) For the EBA: the authorities set forth in Annex IV hereto. The EBA, after providing fifteen (15) days’ notice to the NYDFS, may unilaterally amend and add authorities to Annex IV provided that they fall under Article 4(2) and 35a (12) of Regulation (EU) 1093/2013 or 93 of MiCA.
2. Conditions For the purposes of Article 10 paragraph 4 of the MoU, an authority listed in paragraph 1 of this Annex shall be considered as an Onward Sharing Authority under the following conditions: a) confidential information is transmitted only where necessary for the performance of the authorities’ lawful supervisory, recovery or resolution tasks over supervised entities or persons, or the administration of deposit-guarantee schemes; b) confidential information is needed for the discharge of the supervisory, recovery or resolution functions of the Onward Sharing Authority or the administration of deposit guarantee schemes; c) the information received shall in any event be subject, in accordance with applicable law, to professional secrecy requirements at least equivalent to those applicable to the Providing Authority; d) in addition to such professional secrecy requirements as may be required by law, confidential information will not be further disclosed by the Onward Sharing Authority, except to other authorities listed in paragraph 1 of this Annex, and subject to the obligation to notify the Providing Authority in accordance with Article 10 paragraph 4 of the MoU.

17 EBA Regular Use Annex III Annex III contains the list of Onward Sharing Authorities for the NYDFS, as referenced in paragraph 1(a) of Annex II: (1) the Board of Governors of the Federal Reserve System (the ‘Board of Governors’), (2) the Office of the Comptroller of the Currency (the ‘OCC’), (3) the Federal Deposit Insurance Corporation (the ‘FDIC’).

18 EBA Regular Use Annex IV The table below and items (7) to (11) in Annex IV, contain the list of Onward Sharing Authorities for the EBA, as referenced in paragraph 1(b) of Annex II: (1) competent authorities responsible for carrying out the functions and duties provided for in MICA and designated in accordance with Article 93 thereof (‘MICA authorities’); (2) competent authorities as referred to in Article 4(2), point (vi) of Regulation (EU) No 1093/2010 with regard to Directive 2009/110/EC6 (‘electronic money directive authorities’); (3) competent authorities as referred to in Articles 4(2), point (i) and 35a(12), point (g) of Regulation (EU) No 1093/2010 (‘prudential supervisory authorities’); (4) competent authorities as referred to in Articles 4(2), point (v) and 35a(12), point (i) of Regulation (EU) No 1093/2010 (‘resolution authorities’); (5) competent authorities as referred to in Article 4(2), point (iv) of Regulation (EU) No 1093/2010 (‘deposit guarantee schemes’); (6) competent authorities (financial supervisors) for anti-money laundering and counter￾terrorist financing, as referred to in Article 35a(12), point (k) of Regulation (EU) No 1093/2010 (‘AML/CFT authorities’); Member State National competent authorities for onward sharing Scope of supervisory responsibilities Austria Österreichische Finanzmarktaufsichtsbehörde (FMA) (1) (2) (3) (4) (5) (6) Belgium National Bank of Belgium Autoriteit voor Financiële Diensten en Markten / Autorité des services et marchés financiers Deposit Guarantee Scheme (2) (3) (4) (6) (3) (6) (5) Bulgaria Bulgarian National Bank Bulgarian Financial Supervision Commission (FSC) Bulgarian Deposit Insurance Fund FID SANS (FIU) (1) (2) (3) (4) (5) (6) (1) (3)(4) (6) (5) (6) Croatia Hrvatska Narodna Banka (HNB) Hrvatska agencija za nadzor financijskih usluga (HANFA) (1) (2) (3) (4) (5) (6) (1) (3) (6) 6 Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC.

19 EBA Regular Use Državna Agencija za Osiguranje Štednih Uloga i Sanaciju Banaka (State Agency for Deposit Insurance and Bank Resolution) Ministry of Finance, Financial Inspectorate (4) (5) (6) Cyprus Central Bank of Cyprus (CBC) Cyprus Securities and Exchange Commission (CySEC) Management Committee of the Deposit Guarantee and Resolution of Credit and Other Institutions Scheme administered by the Central Bank of Cyprus Insurance Companies Control Service (ICCS) (1) (2) (3) (4) (5) (6) (1) (3) (6) (4) (5) (6) Czech Republic Česká národní banka (CNB) Financial Market Guarantee System Financial Analytical Office of the Czech Republic (1) (2) (3) (4) (5) (6) (5) (6) Denmark Finanstilsynet (DK FSA) Finansiel Stabilitet (Financial Stability Company) (1) (2) (3) (4) (5) (6) (4) (5) Estonia Finantsinspektsioon (FSA) Tagastisfond (Guarantee Fund) Estonian FIU (1) (2) (3) (4) (5) (6) (5) (6) Finland Finanssivalvonta (FIN-FSA) Rahoitusvakausvirasto (Financial Stability Authority) Lupa- ja valvontarivasto (Finnish Supervisory Agency) (1) (2) (3) (6) (4) (5) (6) France Autorité de Contrôle Prudentiel (ACPR) Autorité des Marchés Financiers (AMF) (1) (2) (3) (4) (5) (6) (1) Germany Bundesanstalt für Finanzdienstleistungsaufsicht (‘BaFin’, Federal Financial Supervisory Authority) Die Deutsche Bundesbank (in their supporting role to BaFin) (1) (2) (3) (4) (5) (6) (1) (3) Greece Τράπεζα της Ελλάδος (Bank of Greece) Hellenic Capital Markets Commission (HCMC) Ministry of Finance (DGS) (1) (2) (3) (4) (6) (1) (3) (4) (6) (5)

20 EBA Regular Use Ministry of Economy and Development / General Secretariat for Commerce and Consumer Affairs) (2) Hungary Magyar Nemzeti Bank (Central Bank of Hungary) National Deposit Insurance Fund of Hungary (1) (2) (3) (4) (6) (4) (5) Ireland Central Bank of Ireland (CBoI) (1) (2) (3) (4) (5) (6) Italy Banca d’Italia Commissione Nazionale per le Società e la Borsa (CONSOB) Institute for Insurance Supervision (IVASS) Organismo degli Agenti e dei Mediatori (OAM) (1) (2) (3) (4) (5) (6) (1) (6) (6) Latvia Latvijas Banka (1) (2) (3) (4) (5) (6) Lithuania Lietuvos Bankas (LB) Indėlių ir investicijų draudimas IDF (DGS) Financial Crime Investigation Service under The Ministry of the Interior of the Republic of Lithuania (FIU) (1) (2) (3) (4) (5) (6) (5) (6) Luxembourg Commission de Surveillance du Secteur Financier (CSSF) Commissariat aux Assurances (CAA) (1) (2) (3) (4) (5) (6) (6) Malta Malta Financial Services Authority (MFSA) Depositor and Investor Compensation Scheme Financial Intelligence Analysis Unit (FIAU) (1) (2) (3) (4) (5) (5) (6) The Netherlands De Nederlansche Bank (DNB) Autoriteit Financiële Markten (AFM) (1) (2) (3) (4) (5) (6) (1) (6) Poland Komisja Nadzoru Finansowego (KNF) Bankowy Fundusz Gwarancyjny (Bank Guarantee Fund) Generalny Inspektor Informacji Finansowej (FIU) (1) (2) (3) (6) (4) (5) (6) Portugal Banco de Portugal (Bank of Portugal) Comissão do Mercado de Valores Mobiliários (CMVM) Autoridade de Supervisão de Seguros e Fundos de Pensões (ASF) (2) (3) (4) (5) (6) (3) (6) (6) Romania Banca Naţională a României (National Bank of Romania) (2) (3) (4) (5) (6)

21 EBA Regular Use Bank Deposit Guarantee Fund Autoritatea de Supraveghere Financiara (ASF) National Office for Prevention and Control of Money Laundering, from the structure of the Ministry of Public Finance (NOPCML) (FIU) (5) (3) (4) (5) (6) (6) Slovakia Národná Banka Slovenska (NBS) Rada pre riešenie krízových situácií (Resolution Council) Deposit Protection Fund Finančná spravodajská jednotka (FIU) (1) (2) (3) (6) (4) (5) (6) Slovenia Banka Slovenije Agencija za trg Vrednostnih Papirjev (ATVP)/ The Securities Market Agency Office for Money Laundering Prevention Insurance Supervision Agency (AZN) (1) (2) (3) (4) (5) (6) (1) (6) (6) (6) Spain Banco de España (Bank of Spain) Comisión Nacional del Mercado de Valores (CNMV) FROB (Spanish Executive Resolution Authority) – contact authority Fondo de Garantia de Depositos de Entidades de Credito (FGD) Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias (SEPBLAC) (FIU) (1) (2) (3) (4) (5) (1) (3) (4) (4) (5) (6) Sweden Finansinspektionen (FI) Riksgälden (Swedish National Debt Office) (1) (2) (3) (6) (4) (5) Iceland Central Bank of Iceland (Seðlabankinn) Depositors and Investors’ Guarantee Fund (1) (2) (3) (4) (6) (5) Liechtenstein Finanzmarktaufsicht Liecthenstein (FMA) (1) (2) (3) (4) (5) (6) Norway Finanstilsynet Bank’s Guarantee Fund (1) (2) (3) (4) (6) (5)

22 EBA Regular Use (7) the European Central Bank as part of the Single Supervisory Mechanism, as referred to in Articles 4(2), point (i) and 35a(12), point (g) of Regulation (EU) No 1093/2010; (8) the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), as referred to in Article 35a(12), point (j) of Regulation (EU) No 1093/2010; (9) the European Insurance and Occupational Pensions Authority (EIOPA), as referred to in Article 35a(12), point (b) of Regulation (EU) No 1093/2010; (10) the European Securities and Markets Authority (ESMA), as referred to in Article 35a(12), point (c) of Regulation (EU) No 1093/2010; (11) the Single Resolution Board (SRB), as referred to in Articles 4(2), point (v) and 35a(12), point (h) of Regulation (EU) No 1093/2010.