Principles for the assessment of confidentiality and professional secrecy

5 May 2022
Principles for the assessment of confidentiality and professional secrecy The EBA will assess the professional secrecy and confidentiality regimes of third countries on the basis of the satisfactory presence of factors corresponding to the elements of the EU confidentiality regime as defined in the following EU directives:

• the Capital Requirements Directive (CRD) 1
• the Payment Services Directive (PSD2) 2
• the Anti-Money Laundering Directive (AMLD) 3
• the Bank Recovery and Resolution Directive (BRRD) 4
  The four key assessment principles and the objectives that they seek to achieve are summarised below. 1 DIRECTIVE 2013/36/EU: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32013L0036&from=EN 2 DIRECTIVE (EU) 2015/2366: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32015L2366&from=EN 3 DIRECTIVE (EU) 2015/849 : https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02015L0849- 20210630&from=EN 4 DIRECTIVE 2014/59/EU: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32014L0059&from=EN

Principle 1 – Definition of confidential information Objective: to establish a definition of confidential information that allowsthe identification of information that should enjoy legal protection as confidential. Articles: the CRD, PSD2, AMLD and BRRD do not explicitly require Member States to define confidential information in their legislation. However, the characteristics of confidential information could be implied having regard to the following articles:

• Article 53 (1) CRD
• Article 24 PSD2
• Article 57a (1) AMLD
• Article 84 (3) BRRD
  Indicators Standard required
  Legal requirements Provisions in national law that protect certain information as confidential should include a clear assessment or allow a clear understanding of what type of information is to be regarded as ‘confidential’ and subject to adequate protection. Nature of information Information which:
• has been received in the course of a person’s work for, or
  on behalf of, the competent authority;
• is not in the public domain; and
• is not in summary or aggregate form so that the individual
  credit institutions cannot be identified.
  Are there any rules or provisions setting out when confidential information ceases to be considered as such?

Principle 2 – Existence of a professional secrecy obligation Objective: to establish an ongoing obligation of professional secrecy which is imposed on i) all persons who work, or have worked for and ii) all auditors or experts acting, or who have acted, on behalf of the competent authority in respect of information received in the course of their work for, or on behalf of, the competent authority. Articles: the CRD, PSD2, AMLD and BRRD clearly identify the persons that must be subject to a professional secrecy obligation when working for, or on behalf of, a certain authority. Such an obligation is set out in the following articles:

• Article 53 (1) and 54a CRD
• Article 24 (1) PSD2
• Article 57a (1) AMLD
• Article 84 (1-3) BRRD
  Indicators Standard required
  Legal requirements Specific professional secrecy provisions in national law or in other laws and regulations that are applied to the competent authority/authorities and other related persons. Applicability – persons Professional secrecy obligations must apply to all persons:
• working, or who have worked, for the competent
  authority/authorities; and
• acting, or who have acted, on behalf of the competent
  authority/authorities (including all auditors and experts) 5 . Duration of obligation Professional secrecy obligation are applicable:
• at all times whilst working for, or acting on behalf of, the
  competent authority; and
• on an ongoing basis thereafter 6
  .
  Article 84(1)(l) BRRD also states that the requirements of professional secrecy shall be binding for ‘any other persons
  who provide or have provided services directly or indirectly, permanently or occasionally, to persons referred to in points (a) to (k)’ of the same Article (e.g. resolution authorities, competent authorities/ministries, auditors).
  Article 84(1)(m) BRRD also specifies that the requirements of professional secrecy shall be binding for senior
  management, members of the management body and employees of the bodies or entities referred in points (a) to (k) of the same Article before, during and after their appointment.

Nature of information Professional secrecy obligation applicable:
to confidential information received in the course of their work for, or on behalf of, the competent authority. Ensuring confidentiality of information (Article 84(2) BRRD) The authorities in points (a), (b), (c), (g), (h), (j) and (k) of Article 84(1) BRRD should ensure that there are internal rules in place to ensure compliance with confidentiality requirements, including rules to secure secrecy of information between persons directly involved in the resolution process. Civil liability (Article 84(3) BRRD) In the resolution process, the persons subject to the professional secrecy obligation shall be subject to civil liability in the event of an infringement of such obligation. Exceptions for legal proceedings (Article 53(1) and 54a CRD,
Article 57a(1) AMLD,
Article 84(6) BRRD,
Article 24(1) PSD2)
The obligation of confidentiality is without prejudice to:

• cases covered by criminal law and the powers of
  investigation conferred on the European Parliament (CRD);
• cases covered by criminal law (AMLD and PSD2);
• national law concerning the disclosure of information
  for the purpose of legal proceedings in criminal or civil cases (BRRD)

Principle 3 – Use of confidential information Objective: to establish that confidential information is used only for specific purposes. Articles: the CRD, PSD2, AMLD and BRRD identify the use that competent authorities directly, or other authorities and bodies, can make of the information that should be regarded as confidential. The admissible use of confidential information can be found in the following provisions:

• Article 54, 56, 57, 58, 58a and 59 CRD
• Article 24(3) PSD2 7
• Article 84(3), 84(5)(a),(c) BRRD
• Article 57a(3)(a), 57b(2) and 57b(3) AMLD
  Indicators Standard required
  Legal requirements Existence of provisions that explicitly or implicitly define the purposes for which a competent authority can use confidential information in its domain. Performance of supervisory tasks (Article 54 CRD) Confidential information received by the competent authority should be used in the course of its duties and only:
• to ensure compliance with conditions pertaining to the
  establishment and ongoing business of a credit institution;
• to impose penalties.
  Oversight/ legal supervision (Article 56, 57 CRD, Article 84(5)(c) BRRD)
• supervision of other financial sector entities or
  financial markets;
• maintenance of financial stability;
• liquidation, bankruptcy or similar procedures with
  respect to credit institutions;
• carrying out statutory audits of the accounts of credit
  institutions and other financial institutions.
  Article 24(3) PSD2 refers to CRD provision in stating that ‘Member States may apply this Article taking into account,
  mutatis mutandis, Articles 53 to 61 of CRD’

Administration of deposit guarantee scheme (Article 56, 57 CRD) Ensure proper administration of the national deposit guarantee scheme if one exists. Detection/investigation of breaches of company law (Article 57 (3-6) CRD) Detection/investigation of breaches of company law with the aim of strengthening the stability and integrity of the financial system. Statutory tasks of a monetary authority (Article 58(1)(a) CRD) The exercise of statutory tasks of a monetary authority/central bank, including the conduct of monetary policy and related liquidity provision, oversight of payments, clearing and settlement systems and the safeguarding of the financial system. Payment systems oversight (Article 58(1)(c) CRD; Article 84(5)(c) BRRD) Ensure proper oversight of the payments system. Tasks performed by international bodies (Article 58a(1) CRD)

• for the purposes of assessments for the Financial
  Sector Assessment Program carried out by the IMF and WB
• for the purposes of quantitative impact studies carried
  out by the BIS
• for the purposes of surveillance functions of the
  Financial Stability Board
  Prudential supervision, prevention and resolution of failing institutions (Article 59(1)) CRD) Certain information may be disclosed to other departments of their central government’s administrations responsible for the law on the supervision of institutions for the purpose of prudential supervision, and prevention and resolution of failing institutions. Investigation/scrutiny of authorities responsible for the supervision of institutions (Article 59(2)) CRD & Article 57b(3) AMLD) Certain information may be disclosed to parliamentary enquiry committees in their Member State, courts of auditors in their Member State and other entities in charge of enquiries for the purpose of investigating or scrutinising the actions of supervisory authorities (CRD).

Certain information may be disclosed to parliamentary inquiry committees, courts of auditors and other entities in charge of enquiries in their Member State for the purpose of investigating or scrutinising the actions of authorities responsible for the supervision of credit institutions in compliance with AML/CFT laws (AMLD). Exercise of resolution functions under the BRRD (Article 84(3) BRRD) The persons subject to the duty of confidentiality referred to in Article 84(1) BRRD shall comply with such duty unless it is in the exercise of their functions under the BRRD. Planning and carrying out a resolution action (Article 84 (5)(a) BRRD) Exchange of information is possible with any other person where necessary for planning or carrying out a resolution action. Carry out AML/CFT duties (Article 56(g) CRD, Article 57a (3)(a) and 57b(2) AMLD) Confidential information shall be used for:

• the discharge of supervisory duties under AML/CFT
  legislation (AMLD or other relevant acts) or under prudential regulations;
• carrying out the supervision of credit and financial
  institutions, including sanctioning;
• carrying out the supervision of financial markets;
• complying with designated responsibilities in the field of
  combating or investigating money laundering and also the associated predicate offences and terrorist financing. Use in court proceedings and appeals (Article54(c, d) CRD, Article 57a(3b, 3c) AMLD Confidential information may be used in:
• administrative appeals against a decision of the
  competent authority, including court proceedings;
• court proceedings initiated pursuant to special
  provisions provided for in Union law adopted in the field of credit institutions; (CRD)
• court proceedings initiated pursuant to special
  provisions provided for in Union law adopted in the field of AML/CFT or in the field of the prudential regulation and supervision of credit and financial institutions (AMLD).

Principle 4 – Restrictions on the disclosure of confidential information Objective: to establish that confidential information received by a competent authority in the performance of its duties may only be disclosed to a specific set of subjects, in restricted and clearly defined circumstances, except in cases covered by criminal law. Articles: the CRD, PSD2, AMLD and BRRD identify the subjects to which authorities may disclose confidential information they have acquired in the course of their duties, and clarify the circumstances under which such disclosure is possible. These requirements can be found in the following provisions:

• Articles 56-61 of the CRD

• Article 24 PSD2

• Article 84, 98 BRRD

• Articles 57a and 57b of AMLD
  Indicators Standard required
  Legal requirements Legal provisions establishing that confidential information cannot be divulged, except in certain clearly delineated circumstances with clear conditions for the disclosure that need to be met. Authorities or bodies to which information may be disclosed under the CRD (Article 56-61 CRD) and PSD2 (Article 24 PSD2) In fulfilling their supervisory functions, competent authorities may disclose confidential information to the following subjects:

• other competent authorities within the Union;

• authorities entrusted with the public duty of supervising
  other financial institutions, insurance companies and the financial markets;

• authorities or bodies charged with responsibility for
  maintaining the stability of the financial system;

• contractual or institutional protection schemes;

• bodies involved in the liquidation and bankruptcy of credit
  institutions or other similar procedures;

• persons responsible for carrying out statutory audits of the
  accounts of credit institutions and other financial institutions;

• authorities responsible for AML/CFT supervision and
  financial intelligence units;

• competent authorities or bodies responsible for the
  application of rules on structural separation within a banking group;

• bodies responsible for the administration of deposit
  guarantee schemes in so far as the information is required for the exercise of their functions;

• authorities or bodies responsible under law for the
  detection and investigation of breaches of company law;

• ECSB central banks and other bodies with a similar function
  in their capacity as monetary authorities;

• public authorities responsible for overseeing payment
  systems;

• the ESRB, EIOPA and ESMA; and

• authorities responsible for overseeing persons charged
  with carrying out statutory audits of the accounts of insurance undertakings, credit institutions, investment firms and other financial institutions. In fulfilling their supervisory functionsfor the reasons of prudential control, competent authorities may also disclose confidential information to:

• other departments of their central government
  administrations responsible for the law on the supervision of institutions, financial institutions and insurance undertakings and to inspectors acting on behalf of those departments 8 ;

• parliamentary enquiry committees in their Member State,
  courts of auditors in their Member State and other entities in charge of enquiries in their Member State; and

• to a clearing house or similar body recognised under
  national law for the provision of clearing and settlement services. This disclosure shall be made to ensure the proper functioning of those bodies charged with the provision of Except for information obtained by means of an on-the-spot check or inspection

clearing or settlement services in relation to defaults or potential defaults by market participants. Authorities to which information may be disclosed under the PSD2 (Article 26(2) as referenced by Article 24 PSD2) The competent authorities of other Member States responsible for the authorisation and supervision of payment institutions Authorities or bodies to which information may be disclosed under the BRRD (Article 84(4)(b), 84(5)(c) BRRD) In fulfilling their functions, resolution authorities may disclose confidential information to the following subjects:

• other Union resolution authorities;

• other Union competent authorities;

• competent ministries in the Union;

• central banks;

• deposit guarantee schemes;

• investor compensation schemes;

• authorities responsible for normal insolvency proceedings;

• authorities responsible for maintaining the stability of the
  financial system in Member States through the use of macroprudential rules;

• persons charged with carrying out statutory audits of
  accounts;

• third-country authorities that carry out equivalent
  functions to resolution authorities;

• to a potential acquirer for the purposes of planning or
  carrying out a resolution action (subject to strict confidentiality requirements);

• authorities responsible for overseeing payment systems;

• the authorities entrusted with the public duty of
  supervising other financial sector entities; and

• the authorities responsible for the supervision of financial
  markets and insurance undertakings and inspectors acting on their behalf. Authorities or bodies to which information can be disclosed under the AMLD (Article 57a(2), 57a(3), 57a(5), 57b(1- 3)) In fulfilling their functions, competent authorities for AML/CFT supervision may disclose confidential information to the following subjects:

• competent authorities responsible for supervising credit
  and financial institutions for their compliance with AML/CFT laws or other legislative acts within a, or in another, Member State;

• authorities entrusted with the supervision of financial
  sector entities and natural or legal persons acting in the exercise of their professional activities as referred to in point (3) of Article 2(1) of AMLD (e.g. notaries, external accountant, auditors and tax advisors);

• authorities responsible by law for the supervision of
  financial markets;

• national authorities with responsibilities in the field of
  combating or investigating money laundering, the associated predicate offences and terrorist financing;

• parliamentary inquiry committees, courts of auditors and
  other entities in charge of enquiries; and

• courts of law (e.g. in appeals proceedings or other
  proceedings initiated by virtue of special provisions). Transmission of information to international bodies (Article 58a CRD) Certain information may be shared with:

• the International Monetary Fund and the World Bank, for
  the purposes of assessments for the Financial Sector Assessment Program;

• the Bank for International Settlements, for the purposes of
  quantitative impact studies; and

• the Financial Stability Board, for the purposes of its
  surveillance function.

Conditions on disclosure (Article 56, 57, 58 and 59 CRD;
Article 84(3) BRRD;
Article 57b (1,2,3)
AMLD)

• The purpose of the disclosure of the confidential information is
  essential and shall be used solely for the performance of the receiving authority’s duties; and the confidential information itself is subject to conditions of professional secrecy.

• For resolution processes, the possible effects of disclosing
  information must be assessed on the basis of:

• the public interest as regards financial, monetary or
  economic policy;

• the commercial interests of natural and legal persons;

• the purpose of inspections;

• investigations and

• audits.
  For the resolution process, the procedure for checking the effects of disclosing information shall include a specific assessment of the effects of any disclosure of the contents and details of the recovery and resolution plan.

• In cases of disclosure to parliamentary enquiry committees,
  courts of auditors and other entities in charge of enquiries:

• the entities have a precise mandate under national law to
  investigate or scrutinise the actions of authorities;

• the information is strictly necessary for fulfilling their
  mandate;

• the confidential information itself is subject to conditions of
  professional secrecy.
  Conditions on disclosure for the transmission of information to international bodies (Article 58a CRD)

• the request is duly justified in light of the specific tasks performed
  by the requesting body in accordance with its statutory mandate;

• the request is sufficiently precise as to the nature, scope and
  format of the required information, and the means of its disclosure or transmission;

• the requested information is strictly necessary for the
  performance of the specific tasks of the requesting body and does not go beyond its statutory tasks;

• the information is transmitted or disclosed exclusively to the
  persons directly involved in the performance of the specific task;

• the persons having access to the information are subject to
  professional secrecy requirements at least equivalent to those referred to in Article 53(1) CRD;

• competent authorities may only transmit aggregate or
  anonymised information and may only share other information at the premises of the competent authority. Express consent for onward disclosure (Article 57, 59 CRD;
  Article 84(3) BRRD;
  Article 57b(3) AMLD)
  CRD
  Where the confidential information has originated in another Member State, and it is proposed to make onward disclosure to a body falling under (a)-(e) below, the competent authorities that originally disclosed the information must give express agreement to its disclosure and, where appropriate, the information may only be used for the purposes for which the authorities give their consent. (a) Authorities responsible for overseeing those bodies involved in the liquidation and bankruptcy of credit institutions and other similar procedures; (b) authorities responsible for overseeing contractual or institutional protection schemes; (c) authorities responsible for overseeing persons charged with carrying out statutory audits of the accounts of insurance undertakings, and financial institutions; (d) authorities or bodies responsible for detecting and investigating breaches of company law; (e) parliamentary enquiry committees in their Member State, courts of auditors in their Member State and other entities in charge of enquiries in their Member State. AMLD Where the confidential information has originated in another Member State, and Member States authorise onward disclosure to parliamentary enquiry committees in their Member State, courts of auditors in their Member State and other entities in charge of enquiries in their Member State, it shall not be disclosed

without the express consent of the competent authorities which have disclosed it, and solely for the purposes for which those authorities gave their consent. BRRD Disclosure of confidential information received during the course of professional activities or from a competent authority or resolution authority in connection with its functions under the BRRD, to any person or authority, is prohibited, unless it is in the exercise of their functions under the BRRD or in summary or collective form or with the express and prior consent of the authority or the institution or the entity which provided the information. Specific cooperation arrangements and exchange of information with third countries (Article 55 CRD, Article 57a(5) AMLD, Articles 97 and 98 BRRD) CRD Member States and the EBA may conclude cooperation agreements, providing for exchanges of information, with the supervisory authorities of third countries or with authorities or bodies of third countries if:

• the information disclosed is subject to a guarantee that
  professional secrecy requirements are at least equivalent;
• such exchange of information shall be for the purpose of
  performing the supervisory tasks of those authorities or bodies;
• where the information originates in another Member
  State, it shall only be disclosed with the express agreement of the authorities that have disclosed it and, where appropriate, solely for the purposes for which those authorities gave their agreement. AMLD Member States may authorise their national competent authorities to conclude cooperation agreements providing for collaboration and exchanges of confidential information with the competent authorities of 3 rd countries that constitute counterparts of those national competent authorities. Such cooperation agreements must be concluded on the basis of

reciprocity and only if the information disclosed is subject to equivalent professional secrecy requirements. Confidential information exchanged according to these cooperation agreements must be used for the purpose of performing the supervisory tasks of those authorities. Where the confidential information has originated in another Member State, it may be exchanged with a 3 rd country authority only upon receiving the express consent of the CA which shared it, and such information may be used exclusively for the purposes for which that CA has consented. BRRD Cooperation agreements with third country authorities are concluded in accordance with Article 97 BRRD and the exchange of confidential information must be compliant with Article 98 BRRD. The exchange of information is allowed only if third country authorities are subject to equivalent confidentiality provisions and if the information is necessary for the performance of their resolution function. Where the confidential information originates in another Member State, the disclosure to third country authorities is only permitted where:

• the express consent to the disclosure of the information by
  the competent authority from which the information originated is obtained by the competent/national authority;
• it is for the purposes for which the originating authority has
  given its consent.

Additional important information to be taken into account: breach of professional secrecy and disclosure requirements relating to confidential information Objective: to establish that the disclosure of confidential information in breach of the obligation of professional secrecy by any person bound by the obligation is unlawful and subject to sanctions.
Article: the consequences of a breach of professional secrecy are not described in the CRD,
although Article 53 of the CRD implies their existence. Article 84(3) of the BRRD also states that ‘any person or entity referred to in paragraph 1 shall be subject to civil liability in the event of an infringement of this Article, in accordance with national law.’ Indicators Standard required Legal requirements Provisions in national law in respect of the breach of professional secrecy obligation, comprising:

• offences
• penalties
  Contractual arrangements may also include enforceable professional secrecy obligations. Enforcement process A provision in the national law or contractual arrangements relating to enforcement procedures and powers in respect of the breach/threatened breach of the professional secrecy obligation. Evidence of previous relevant and successful enforcement action.