November 2024 Regulatory Roundup

DIGITAL OPERATIONAL RESILIENCE ACT (DORA)

ESAs respond to the European Commission’s rejection of the technical standards on registers of information under DORA and call for swift adoption
On 15 October 2024, the Joint Committee of the ESAs published an opinion on the European Commission’s amendments to the draft ITS on registers of information (RoIs) under DORA.

The ESAs raise concerns over the impacts and practicalities of the proposed European Commission changes to the draft ITS on the RoIs in relation to financial entities’ contractual arrangements with ICT third-party service providers.

The draft ITS proposed by the ESAs were rejected by the European Commission on the grounds that it is necessary to allow financial entities the choice of identifying their Information and Communication Technology (ICT) third-party service providers registered in the EU either by using the Legal Entity Identifier (LEI) or by using the European Unique Identifier (EUID). In the ESAs’ view, the European Commission’s proposal of adding an additional identifier, allowing EU-based companies to use the EUID, will cause unnecessary complexity and could have negative impacts on the implementation of DORA by financial entities, competent authorities and the ESAs.

The ESAs highlight that, although the EUID is available free of charge to EU-registered companies, its introduction in the RoIs would entail unforeseen implementation and maintenance efforts for the financial entities.

In addition, the coexistence of two identifiers could bring additional complexity that would negatively impact the quality of data used, and risk delays in the designation of critical ICT third-party service providers by the ESAs.

The ESAs call for the final decision on the use of identifiers and the swift adoption of the draft ITS by the European Commission.

European Commission adopts ITS and RTS on notification of major ICT-incidents and cyber threats under DORA
On 23 October 2024, the European Commission adopted the following legislation supplementing DORA:

• Commission Delegated Regulation containing RTS specifying the content and time limits for the initial notification of, and intermediate and final report on, major Information and Communication Technology (ICT-related incidents, and the content of the voluntary notification for significant cyber threats; and
• Commission Implementing Regulation laying down ITS with regard to the standard forms, templates, and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat.

The Council and the European Parliament will now scrutinise the Delegated Regulation. If neither object, it will be published in the Official Journal. The Implementing Regulation will be published in the Official Journal without further scrutiny. Both Regulations will enter into force 20 days after publication in the Official Journal. DORA will apply as of 17 January 2025.

European Commission adopts RTS on conduct of oversight activities under DORA
On 24 October 2024, the European Commission adopted Commission Delegated Regulation supplementing DORA with regard to RTS on harmonisation of conditions enabling the conduct of the oversight activities.

The draft RTS cover:

• the information to be provided by an Information and Communication Technology (ICT) third-party service provider in the application for a voluntary request to be designated as critical;
• the information to be submitted by the ICT third–party service providers that is necessary for the Lead Overseer to carry out its duties; and
• the details of the competent authorities’ assessment of the measures taken by critical third party providers based on the recommendations of the Lead Overseer.

Separate RTS will be adopted focusing on the criteria for determining the composition of the joint examination team, their designation, tasks, and working arrangements.

The Delegated Regulation shall enter into force 20 days after publication in the Official Journal.  DORA will apply as of 17 January 2025.

AIFMD

ESMA updates its Q&A on AIFMD

On 11 October 2024, ESMA updated the following Q&A on AIFMD:

• Crystallisation of performance fees in case of the creation of a new UCITS/compartment/share class in the course of the financial year(966)
• ESMA’s guidelines on performance fees in UCITS and certain types of AIFs (1033)

Sustainable Finance Disclosure Regulation (SFDR)

ESAs publish 2024 Joint Report on principal adverse impacts disclosures under SFDR

On 30 October 2024, the European Supervisory Authorities (EBA, EIOPA and ESMA – ESAs)  published their third annual Report on disclosures of principal adverse impacts under SFDR.

The Report assesses both entity and product-level Principal Adverse Impact (PAI) disclosures under the SFDR. These disclosures aim at showing the negative impact of financial institutions’ investments on the environment and people and the actions taken by asset managers, insurers, investment firms, banks and pension funds to mitigate them. 

The findings show that financial institutions have improved the accessibility of their PAI disclosures. There has also been positive progress regarding the quality of the information disclosed by financial products, and, in general, in the quality of the PAI statements. A few National Competent Authorities (NCAs) also reported slight improvements in the compliance with the SFDR disclosures in their national markets. 

Looking forward, the Report includes recommendations to NCAs to ensure convergent supervision of financial market participants’ practices, and to the European Commission for their comprehensive assessment on the SFDR. 

The ESAs have also developed an overview of good practices related to the location, clarity, complexity of the disclosures based on a survey of NCAs.

Glasgow Financial Alliance for Net Zero (GFANZ)

GFANZ consults on guidance on nature in net-zero transition plans and index guidance to support real-economy decarbonisation

On 29 October 2024, the Glasgow Financial Alliance for Net Zero (GFANZ) published a consultation paper on nature in net-zero transition plans, which supplements the guidance provided in its November 2022 financial institution net-zero transition plans report.

The proposed guidance covers opportunities to reduce nature emissions or increase nature sinks (natural climate mitigation), as well as opportunities to support emissions reductions and sequestration through nature-related activities (natural climate enablers). GFANZ explains that collectively, these nature-related levers expand the toolkit for financial institutions to achieve their net-zero commitments and may identify more potential net-zero financing opportunities.

GFANZ notes that general impacts on nature from climate change are beyond the scope of the proposed guidance but are discussed in the consultation paper as an area for ongoing consideration, which may lead to integrated transition planning in the future.

The deadline for comments is 27 January 2025. GFANZ expects to publish the final supplemental guidance in Q1 2025.

Index guidance: GFANZ also published a consultation on index guidance to support real-economy decarbonisation. The proposed guidance provides index providers, data providers, stock exchanges, asset managers, asset owners and other investors with voluntary guidance for “transition-informed” indices that may help facilitate real-economy decarbonisation. The paper does not prescribe a specific course of action but offers information and options to help index participants in developing and adopting “transition-informed” indices. The paper also links to a newly published set of case studies on transition finance and decarbonisation contribution methodologies, which aims to provide context and examples of how financial institutions are scaling finance and engagement across the GFANZ four key transition financing strategies. The deadline for comments on index guidance is 9 January 2025, GFANZ expects to publish the final guidance in Q1 2025.

ESG ratings activities Regulation

European Parliament corrigendum to proposed Regulation on ESG rating activities

On 8 October 2024, the European Parliament published a corrigendum to its proposed Regulation on the transparency and integrity of ESG rating activities.

The amendments are largely clarificatory or textual, with a limited number of more substantive amendments. These include a revised prohibition on the purchase of securities by those involved in providing ESG ratings—the proposed Regulation now prohibits those directly involved in the determination of an individual rating from buying or selling financial instruments issued or guaranteed by an entity that is rated within their area of analytical responsibility, whereas senior management of ESG rating providers cannot buy or sell any financial instruments issued or otherwise supported by any entity rated by the ESG rating provider.

Once the European Parliament has confirmed the revised text under the corrigendum procedure, the Council is expected to formally adopt the finalised text. The Regulation will enter into force 20 days after its publication in the Official Journal and will apply 18 months after it enters into force.

EU Carbon Markets

ESMA publishes its first annual report on EU Carbon Markets

On 7 October 2024, ESMA published the 2024 EU Carbon Markets report.

This first edition of the report is providing details and insights into the functioning of the EU Emissions Trading System (EU ETS) market. The report builds on ESMA’s 2022 report on the trading of emission allowances, mandated in the context of rising energy prices and a three-fold increase of emission allowances’ prices in 2021. The 2024 EU Carbon Markets report was drafted in line with ESMA’s mandate under the EU ETS Directive that is establishing a system for greenhouse gas emission allowance trading in the EU.

The key findings are:

• Prices and volatility: Prices in the EU ETS have declined since the beginning of 2023. This was due to a combination of lower demand for emission allowances from weak industrial activity, falling natural gas prices and decarbonisation of the European energy sector, along with increased supply following the decision to auction additional allowances to finance the REPowerEU plan;
• Auctions: Emission allowance auctions remain significantly concentrated, with 10 participants buying 90% of auctioned volumes, reflecting a preference by most EU ETS operators to source allowances from financial intermediaries; and
• Trading and positions: The vast majority of emission allowance trading in secondary markets takes place through derivatives, reflecting the annual EU ETS compliance cycle where non-financial sector firms hold long positions (for compliance purposes) while banks and investment firms hold short positions.

ESMA’s analysis has not unveiled any significant issue in the functioning of EU carbon markets. However, ESMA notes that the reporting of prices for transactions combining the simultaneous purchase and sale of financial instruments under MIFIR transaction reporting (RTS 22) could be improved, which would help with the identification of trading strategies.

The ESMA carbon markets report will be produced annually as per ESMA’s mandate.

Sustainable Finance

On 30 October 2024, ESMA published an updated version of its Sustainable Finance – implementation timeline including SFDR, CSRD (Corporate Sustainability Reporting Directive) and Taxonomy Regulation and European Green Bond Regulations.

The Joint Committee of the European Supervisory Authorities

Joint Committee of the ESAs Work Programme for 2025 – focus on sustainability disclosures and digital resilience

On 7 October 2024, the Joint Committee of the European Supervisory Authorities (EBA, EIOPA and ESMA – the ESAs) published its Work Programme for 2025, placing particular emphasis on ongoing collaboration to tackle cross-sectoral risks, promoting sustainability in the EU financial system and strengthening financial entities’ digital resilience.

More specifically, in addition to fostering regulatory consistency, adequate risk assessment, financial stability as well as the protection of consumers and investors, the ESAs will undertake joint work in 2025 to:

• provide further guidance on sustainability disclosures,
• make progress on financial entities’ digital operational resilience by, among others, launching the oversight of critical information and communication technology (ICT) third-party providers and implementing the major ICT-related incident coordination framework in accordance with the Digital Operational Resilience Act (DORA),
• monitor financial conglomerates,
• promote coordination and cooperation among national innovation facilitators with a view to facilitating the scaling up of innovative solutions in the financial sector, and
• address other cross-sectoral matters such as retail financial services, investment products and securitisation.

ESMA

ESMA publishes first consolidated report on sanctions

On 11 October 2024, ESMA published its first consolidated report on sanctions and measures imposed by the National Competent Authorities (NCAs) in Member States in 2023.

The report provides an overview of the sanctions and measures imposed in Member States under the CSDR (Central Securities Depositories Regulation), MICAR (Markets in Crypto Assets Regulation), EMIR, MIFID II, MIFIR, MAR, BMR (Benchmark Regulation), Prospectus Regulation, UCITS Directive, AIFMD, ECSPR (Regulation on European Crowdfunding Service Providers for business) and SFTR

(Securities Financing Transactions Regulation). 

In 2023, more than 970 administrative sanctions and measures were imposed across EU Member States in financial sectors under ESMA’s remit. The aggregated value of administrative fines amounted to more than 71 million EUR. The highest amounts of administrative fines were imposed under the Market Abuse Regulation (MAR) and the Markets in Financial Instruments Directive II (MIFID II). Overall, the report highlights that there is still room for more convergence between NCAs in the exercise of their sanctioning powers.

The use of sanctions is only one of multiple tools in the NCA’s supervisory toolkit, and supervisory effectiveness cannot be measured solely based on the number or value of the sanctions imposed in a Member State. The consolidated report does not provide a full picture of national enforcement activities; for example, these may also include more informal actions, and not all criminal sanctions are included in the scope of the report.

The data on the use of sanctions included in this report was reported to ESMA by the NCAs. In line with the ESMA Strategy 2023-2028, the consolidated report contributes to supervisory and enforcement convergence and facilitates greater transparency on sanctions.

Building on this report, ESMA will further foster the effective and consistent implementation of capital markets rules and ensure similar breaches lead to similar enforcement outcomes across the EU.

Financial Stability Board (FSB)

FSB report on lessons from the March 2023 banking turmoil

On 23 October 2024, The Financial Stability Board (FSB) published a report on depositor behaviour and interest rate and liquidity risks in the financial system, drawing on lessons from the March 2023 banking turmoil.

This report summarises the main findings from FSB work over the past year to assess vulnerabilities in the global financial system related to solvency and liquidity risks amid rising interest rates, the influence of technology and social media on depositor behaviour during bank runs, and how the use of technologies may affect the planning and execution of a resolution.

The analysis identifies life insurers, non-bank real estate investors – comprising real estate investment trusts, real estate funds, and other nonbank mortgage lenders – as well as a weak tail of banks as most vulnerable to solvency and liquidity risks at the current juncture. These entity types typically have a high proportion of interest rate-sensitive assets and liabilities and are affected by higher rates through various solvency and liquidity risk channels.

Some of the deposit runs that took place in March 2023 unfolded at an unprecedented speed. The three fastest deposit runs had outflows of around 20-30% per day, which was faster than the highest peak one-day outflow of past deposit runs reported by FSB members. The scale of deposit runs, as a share of pre-run deposits, was in the upper range of outflows seen in past runs. Banks experiencing the runs tended to have an unusually high reliance on uninsured deposits, while the concentration of the deposit base likely played a role in the large outflows.

There is some evidence that social media had an influence on some of the recent bank runs, though the depositor categories at the centre of those runs are likely to have had access to other information sources. Technological advancements have facilitated an easier and faster transfer of deposits in recent years, which may have made depositors more willing to move funds between banks.

The findings in the report raise issues that are relevant for bank managers, supervisors, regulators, resolution authorities and policy makers. The speed of the recent runs means that banks and authorities may need to be able to react much more quickly to deposit outflows than in the past; find ways to address the liquidity and solvency vulnerabilities that gave rise to such extreme outflows; and consider whether monitoring of social media could be helpful as an early warning tool to flag potential stress at a bank or wider turmoil that might affect banks.

Consideration could also be given to collecting and publishing additional information on bank deposits and on unrealised losses on bank securities portfolios to fill identified data gaps.

The possibility of further rapid deposit runs in the future also raises challenges for authorities’ ability to execute a resolution. Authorities and banks should enhance their operational readiness for resolution and incorporate effective communication strategies to ensure coordinated and consistent messaging.

Circular C662: Adoption of the European Banking Authority (the ‘EBA’) Guidelines on the application of the group capital test for investment firm groups in accordance with Article 8 of Regulation (EU) 2033/2019 (the ‘IFR’)

On 22 October 2024, CySEC issued Circular C662, with which it informed CIFs of the adoption of EBA Guidelines issued on 28 July 2021. These Guidelines, incorporated into CySEC’s regulatory practices, cover the application of the group capital test for investment firm groups as per Article 8 of IFR. They detail conditions for granting permissions for group capital tests and holding lower own funds amounts.

The Guidelines apply from 1 January 2025 and outline specific reporting requirements and criteria for assessing group simplicity and risk levels. In case a CIF, which falls under consolidated supervision by CySEC, wishes to implement Article 8(1) and Article 8(4) of IFR or to hold a lower amount of own funds than the amount calculated under Article 8(3) of IFR it should submit a relevant request including the information outlined in section “4.6 Information to be assessed” of the Guidelines via CySEC’s portal under “IFR group capital test permission”.

Press Release: CySEC Will Not Accept New Applications for CASPs; Transitional Period Ahead of MiCAR Implementation

On 17 October 2024, CySEC announced it will stop accepting new applications for Crypto-Asset Service Providers (CASPs) registration under National Rules, ahead of the Markets in Crypto-Assets Regulation (MiCAR) coming into effect on 30 December 2024. The Regulation already applies to Asset Reference Tokens (ARTs) and E-Money Tokens (EMTs) as of 30 June 2024. CASPs registered before 30 December 2024 can operate until 1 July 2026 or until they are granted or refused an authorisation pursuant to Article 63, whichever is sooner.

CySEC will release application documents once the European Commission finalises relevant standards. Entities planning to offer crypto-asset services under EU law should prepare using ESMA’s draft standards. From 30 October 2024, CySEC will also stop accepting cross-border service notifications from EEA entities. Successful notifications submitted by this date will remain valid during the transitional period, and updates must be provided if authorisation status changes. For full details, see CySEC’s announcement.