title: Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection (Text with EEA relevance)

text:
               23.12.2008

               EN

               Official Journal of the European Union

               L 345/75

      COUNCIL DIRECTIVE 2008/114/EC
   of 8 December 2008
   on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection
   (Text with EEA relevance)
   THE COUNCIL OF THE EUROPEAN UNION,
   Having regard to the Treaty establishing the European Community, and in particular Article 308 thereof,
   Having regard to the proposal from the Commission,
   Having regard to the opinion of the European Parliament (1),
   Having regard to the opinion of the European Central Bank (2),
   Whereas:

               (1)

               In June 2004 the European Council asked for the preparation of an overall strategy to protect critical infrastructures. In response, on 20 October 2004, the Commission adopted a Communication on critical infrastructure protection in the fight against terrorism which put forward suggestions as to what would enhance European prevention of, preparedness for and response to terrorist attacks involving critical infrastructures.

               (2)

               On 17 November 2005 the Commission adopted a Green Paper on a European programme for critical infrastructure protection which provided policy options on the establishment of the programme and the Critical Infrastructure Warning Information Network. The responses received to the Green Paper emphasised the added value of a Community framework concerning critical infrastructure protection. The need to increase the critical infrastructure protection capability in Europe and to help reduce vulnerabilities concerning critical infrastructures was acknowledged. The importance of the key principles of subsidiarity, proportionality and complementarity, as well as of stakeholder dialogue was emphasised.

               (3)

               In December 2005 the Justice and Home Affairs Council called upon the Commission to make a proposal for a European programme for critical infrastructure protection (‘EPCIP’) and decided that it should be based on an all-hazards approach while countering threats from terrorism as a priority. Under this approach, man-made, technological threats and natural disasters should be taken into account in the critical infrastructure protection process, but the threat of terrorism should be given priority.

               (4)

               In April 2007 the Council adopted conclusions on the EPCIP in which it reiterated that it was the ultimate responsibility of the Member States to manage arrangements for the protection of critical infrastructures within their national borders while welcoming the efforts of the Commission to develop a European procedure for the identification and designation of European critical infrastructures (‘ECIs’) and the assessment of the need to improve their protection.

               (5)

               This Directive constitutes a first step in a step-by-step approach to identify and designate ECIs and assess the need to improve their protection. As such, this Directive concentrates on the energy and transport sectors and should be reviewed with a view to assessing its impact and the need to include other sectors within its scope, inter alia, the information and communication technology (‘ICT’) sector.

               (6)

               The primary and ultimate responsibility for protecting ECIs falls on the Member States and the owners/operators of such infrastructures.

               (7)

               There are a certain number of critical infrastructures in the Community, the disruption or destruction of which would have significant cross-border impacts. This may include transboundary cross-sector effects resulting from interdependencies between interconnected infrastructures. Such ECIs should be identified and designated by means of a common procedure. The evaluation of security requirements for such infrastructures should be done under a common minimum approach. Bilateral schemes for cooperation between Member States in the field of critical infrastructure protection constitute a well-established and efficient means of dealing with transboundary critical infrastructures. EPCIP should build on such cooperation. Information pertaining to the designation of a particular infrastructure as an ECI should be classified at an appropriate level in accordance with existing Community and Member State legislation.

               (8)

               Since various sectors have particular experience, expertise and requirements concerning critical infrastructure protection, a Community approach to critical infrastructure protection should be developed and implemented taking into account sector specificities and existing sector based measures including those already existing at Community, national or regional level, and where relevant cross-border mutual aid agreements between owners/operators of critical infrastructures already in place. Given the very significant private sector involvement in overseeing and managing risks, business continuity planning and post-disaster recovery, a Community approach needs to encourage full private sector involvement.

               (9)

               In terms of the energy sector and in particular the methods of electricity generation and transmission (in respect of supply of electricity), it is understood that where deemed appropriate, electricity generation may include electricity transmission parts of nuclear power plants, but exclude the specifically nuclear elements covered by relevant nuclear legislation including treaties and Community law.

               (10)

               This Directive complements existing sectoral measures at Community level and in the Member States. Where Community mechanisms are already in place, they should continue to be used and will contribute to the overall implementation of this Directive. Duplication of, or contradiction between, different acts or provisions should be avoided.

               (11)

               Operator security plans (‘OSPs’) or equivalent measures comprising an identification of important assets, a risk assessment and the identification, selection and prioritisation of counter measures and procedures should be in place in all designated ECIs. With a view to avoiding unnecessary work and duplication, each Member State should first assess whether the owners/operators of designated ECIs possess relevant OSPs or similar measures. Where such plans do not exist, each Member State should take the necessary steps to make sure that appropriate measures are put in place. It is up to each Member State to decide on the most appropriate form of action with regard to the establishment of OSPs.

               (12)

               Measures, principles, guidelines, including Community measures as well as bilateral and/or multilateral cooperation schemes that provide for a plan similar or equivalent to an OSP or provide for a Security Liaison Officer or equivalent, should be deemed to satisfy the requirements of this Directive in relation to the OSP or the Security Liaison Officer respectively.

               (13)

               Security Liaison Officers should be identified for all designated ECIs in order to facilitate cooperation and communication with relevant national critical infrastructure protection authorities. With a view to avoiding unnecessary work and duplication, each Member State should first assess whether the owners/operators of designated ECIs already possess a Security Liaison Officer or equivalent. Where such a Security Liaison Officer does not exist, each Member State should take the necessary steps to make sure that appropriate measures are put in place. It is up to each Member State to decide on the most appropriate form of action with regard to the designation of Security Liaison Officers.

               (14)

               The efficient identification of risks, threats and vulnerabilities in the particular sectors requires communication both between owners/operators of ECIs and the Member States, and between the Member States and the Commission. Each Member State should collect information concerning ECIs located within its territory. The Commission should receive generic information from the Member States concerning risks, threats and vulnerabilities in sectors where ECIs were identified, including where relevant information on possible improvements in the ECIs and cross-sector dependencies, which could be the basis for the development of specific proposals by the Commission on improving the protection of ECIs, where necessary.

               (15)

               In order to facilitate improvements in the protection of ECIs, common methodologies may be developed for the identification and classification of risks, threats and vulnerabilities to infrastructure assets.

               (16)

               Owners/operators of ECIs should be given access primarily through relevant Member State authorities to best practices and methodologies concerning critical infrastructure protection.

               (17)

               Effective protection of ECIs requires communication, coordination, and cooperation at national and Community level. This is best achieved through the nomination of European critical infrastructure protection contact points (‘ECIP contact points’) in each Member State, who should coordinate European critical infrastructure protection issues internally, as well as with other Member States and the Commission.

               (18)

               In order to develop European critical infrastructure protection activities in areas which require a degree of confidentiality, it is appropriate to ensure a coherent and secure information exchange in the framework of this Directive. It is important that the rules of confidentiality according to applicable national law or Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (3) are observed with regard to specific facts about critical infrastructure assets, which could be used to plan and act with a view to causing unacceptable consequences for critical infrastructure installations. Classified information should be protected in accordance with relevant Community and Member State legislation. Each Member State and the Commission should respect the relevant security classification given by the originator of a document.

               (19)

               Information sharing regarding ECIs should take place in an environment of trust and security. The sharing of information requires a relationship of trust such that companies and organisations know that their sensitive and confidential data will be sufficiently protected.

               (20)

               Since the objectives of this Directive, namely the creation of a procedure for the identification and designation of ECIs, and a common approach to the assessment of the need to improve the protection of such infrastructures, cannot be sufficiently achieved by the Member States and can therefore, by reason of the scale of the action, be better achieved at Community level, the Community may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve those objectives.

               (21)

               This Directive respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union,

         HAS ADOPTED THIS DIRECTIVE:
   Article 1
   Subject matter
   This Directive establishes a procedure for the identification and designation of European critical infrastructures (‘ECIs’), and a common approach to the assessment of the need to improve the protection of such infrastructures in order to contribute to the protection of people.
   Article 2
   Definitions
   For the purpose of this Directive:

               (a)

               ‘critical infrastructure’ means an asset, system or part thereof located in Member States which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in a Member State as a result of the failure to maintain those functions;

               (b)

               ‘European critical infrastructure’ or ‘ECI’ means critical infrastructure located in Member States the disruption or destruction of which would have a significant impact on at least two Member States. The significance of the impact shall be assessed in terms of cross-cutting criteria. This includes effects resulting from cross-sector dependencies on other types of infrastructure;

               (c)

               ‘risk analysis’ means consideration of relevant threat scenarios, in order to assess the vulnerability and the potential impact of disruption or destruction of critical infrastructure;

               (d)

               ‘sensitive critical infrastructure protection related information’ means facts about a critical infrastructure, which if disclosed could be used to plan and act with a view to causing disruption or destruction of critical infrastructure installations;

               (e)

               ‘protection’ means all activities aimed at ensuring the functionality, continuity and integrity of critical infrastructures in order to deter, mitigate and neutralise a threat, risk or vulnerability;

               (f)

               ‘owners/operators of ECIs’ means those entities responsible for investments in, and/or day-to-day operation of, a particular asset, system or part thereof designated as an ECI under this Directive.

         Article 3
   Identification of ECIs
   1.   Pursuant to the procedure provided in Annex III, each Member State shall identify potential ECIs which both satisfy the cross-cutting and sectoral criteria and meet the definitions set out in Article 2(a) and (b).
   The Commission may assist Member States at their request to identify potential ECIs.
   The Commission may draw the attention of the relevant Member States to the existence of potential critical infrastructures which may be deemed to satisfy the requirements for designation as an ECI.
   Each Member State and the Commission shall continue on an ongoing basis the process of identifying potential ECIs.
   2.   The cross-cutting criteria referred to in paragraph 1 shall comprise the following:

               (a)

               casualties criterion (assessed in terms of the potential number of fatalities or injuries);

               (b)

               economic effects criterion (assessed in terms of the significance of economic loss and/or degradation of products or services; including potential environmental effects);

               (c)

               public effects criterion (assessed in terms of the impact on public confidence, physical suffering and disruption of daily life; including the loss of essential services).

         The cross-cutting criteria thresholds shall be based on the severity of the impact of the disruption or destruction of a particular infrastructure. The precise thresholds applicable to the cross-cutting criteria shall be determined on a case-by-case basis by the Member States concerned by a particular critical infrastructure. Each Member State shall inform the Commission on an annual basis of the number of infrastructures per sector for which discussions were held concerning the cross-cutting criteria thresholds.
   The sectoral criteria shall take into account the characteristics of individual ECI sectors.
   The Commission together with the Member States shall develop guidelines for the application of the cross-cutting and sectoral criteria and approximate thresholds to be used to identify ECIs. The criteria shall be classified. The use of such guidelines shall be optional for the Member States.
   3.   The sectors to be used for the purposes of implementing this Directive shall be the energy and transport sectors. The subsectors are identified in Annex I.
   If deemed appropriate and in conjunction with the review of this Directive as laid down in Article 11, subsequent sectors to be used for the purpose of implementing this Directive may be identified. Priority shall be given to the ICT sector.
   Article 4
   Designation of ECIs
   1.   Each Member State shall inform the other Member States which may be significantly affected by a potential ECI about its identity and the reasons for designating it as a potential ECI.
   2.   Each Member State on whose territory a potential ECI is located shall engage in bilateral and/or multilateral discussions with the other Member States which may be significantly affected by the potential ECI. The Commission may participate in these discussions but shall not have access to detailed information which would allow for the unequivocal identification of a particular infrastructure.
   A Member State that has reason to believe that it may be significantly affected by the potential ECI, but has not been identified as such by the Member State on whose territory the potential ECI is located, may inform the Commission about its wish to be engaged in bilateral and/or multilateral discussions on this issue. The Commission shall without delay communicate this wish to the Member State on whose territory the potential ECI is located and endeavour to facilitate agreement between the parties.
   3.   The Member State on whose territory a potential ECI is located shall designate it as an ECI following an agreement between that Member State and those Member States that may be significantly affected.
   The acceptance of the Member State on whose territory the infrastructure to be designated as an ECI is located, shall be required.
   4.   The Member State on whose territory a designated ECI is located shall inform the Commission on an annual basis of the number of designated ECIs per sector and of the number of Member States dependent on each designated ECI. Only those Member States that may be significantly affected by an ECI shall know its identity.
   5.   The Member States on whose territory an ECI is located shall inform the owner/operator of the infrastructure concerning its designation as an ECI. Information concerning the designation of an infrastructure as an ECI shall be classified at an appropriate level.
   6.   The process of identifying and designating ECIs pursuant to Article 3 and this Article shall be completed by 12 January 2011 and reviewed on a regular basis.
   Article 5
   Operator security plans
   1.   The operator security plan (‘OSP’) procedure shall identify the critical infrastructure assets of the ECI and which security solutions exist or are being implemented for their protection. The minimum content to be addressed by an ECI OSP procedure is set out in Annex II.
   2.   Each Member State shall assess whether each designated ECI located on its territory possesses an OSP or has in place equivalent measures addressing the issues identified in Annex II. If a Member State finds that such an OSP or equivalent exists and is updated regularly, no further implementation action shall be necessary.
   3.   If a Member State finds that such an OSP or equivalent has not been prepared, it shall ensure by any measures deemed appropriate, that the OSP or equivalent is prepared addressing the issues identified in Annex II.
   Each Member State shall ensure that the OSP or equivalent is in place and is reviewed regularly within one year following designation of the critical infrastructure as an ECI. This period may be extended in exceptional circumstances, by agreement with the Member State authority and with a notification to the Commission.
   4.   In a case where supervisory or oversight arrangements already exist in relation to an ECI such arrangements are not affected by this Article and the relevant Member State authority referred to in this Article shall be the supervisor under those existing arrangements.
   5.   Compliance with measures including Community measures which in a particular sector require, or refer to a need to have, a plan similar or equivalent to an OSP and oversight by the relevant authority of such a plan, is deemed to satisfy all the requirements of Member States under, or adopted pursuant to, this Article. The guidelines for application referred to in Article 3(2) shall contain an indicative list of such measures.
   Article 6
   Security Liaison Officers
   1.   The Security Liaison Officer shall function as the point of contact for security related issues between the owner/operator of the ECI and the relevant Member State authority.
   2.   Each Member State shall assess whether each designated ECI located on its territory possesses a Security Liaison Officer or equivalent. If a Member State finds that such a Security Liaison Officer is in place or an equivalent exists, no further implementation action shall be necessary.
   3.   If a Member State finds that a Security Liaison Officer or equivalent does not exist in relation to a designated ECI, it shall ensure by any measures deemed appropriate, that such a Security Liaison Officer or equivalent is designated.
   4.   Each Member State shall implement an appropriate communication mechanism between the relevant Member State authority and the Security Liaison Officer or equivalent with the objective of exchanging relevant information concerning identified risks and threats in relation to the ECI concerned. This communication mechanism shall be without prejudice to national requirements concerning access to sensitive and classified information.
   5.   Compliance with measures including Community measures which in a particular sector require, or refer to a need to have, a Security Liaison Officer or equivalent, is deemed to satisfy all the requirements of Member States in, or adopted pursuant to, this Article. The guidelines for application referred to in Article 3(2) shall contain an indicative list of such measures.
   Article 7
   Reporting
   1.   Each Member State shall conduct a threat assessment in relation to ECI subsectors within one year following the designation of critical infrastructure on its territory as an ECI within those subsectors.
   2.   Each Member State shall report every two years to the Commission generic data on a summary basis on the types of risks, threats and vulnerabilities encountered per ECI sector in which an ECI has been designated pursuant to Article 4 and is located on its territory.
   A common template for these reports may be developed by the Commission in cooperation with the Member States.
   Each report shall be classified at an appropriate level as deemed necessary by the originating Member State.
   3.   Based on the reports referred to in paragraph 2, the Commission and the Member States shall assess on a sectoral basis whether further protection measures at Community level should be considered for ECIs. This process shall be undertaken in conjunction with the review of this Directive as laid down in Article 11.
   4.   Common methodological guidelines for carrying out risk analyses in respect of ECIs may be developed by the Commission in cooperation with the Member States. The use of such guidelines shall be optional for the Member States.
   Article 8
   Commission support for ECIs
   The Commission shall support, through the relevant Member State authority, the owners/operators of designated ECIs by providing access to available best practices and methodologies as well as support training and the exchange of information on new technical developments related to critical infrastructure protection.
   Article 9
   Sensitive European critical infrastructure protection-related information
   1.   Any person handling classified information pursuant to this Directive on behalf of a Member State or the Commission shall have an appropriate level of security vetting.
   Member States, the Commission and relevant supervisory bodies shall ensure that sensitive European critical infrastructure protection-related information submitted to the Member States or to the Commission is not used for any purpose other than the protection of critical infrastructures.
   2.   This Article shall also apply to non-written information exchanged during meetings at which sensitive subjects are discussed.
   Article 10
   European critical infrastructure protection contact points
   1.   Each Member State shall appoint a European critical infrastructure protection contact point (‘ECIP contact point’).
   2.   ECIP contact points shall coordinate European critical infrastructure protection issues within the Member State, with other Member States and with the Commission. The appointment of an ECIP contact point does not preclude other authorities in a Member State from being involved in European critical infrastructure protection issues.
   Article 11
   Review
   A review of this Directive shall begin on 12 January 2012.
   Article 12
   Implementation
   Member States shall take the necessary measures to comply with this Directive by 12 January 2011. They shall forthwith inform the Commission thereof and communicate the text of those measures and their correlation with this Directive.
   When they are adopted by Member States, these measures shall contain a reference to this Directive or shall be accompanied by such reference on the occasion of their official publication. The methods of making such reference shall be laid down by Member States.
   Article 13
   Entry into force
   This Directive shall enter into force on the 20th day following its publication in the Official Journal of the European Union.
   Article 14
   Addressees
   This Directive is addressed to the Member States.

      Done at Brussels, 8 December 2008.

            For the Council

            The President

         B. KOUCHNER

      (1)  Opinion of 10 July 2007 (not yet published in the Official Journal).

      (2)  OJ C 116, 26.5.2007, p. 1.

      (3)  OJ L 145, 31.5.2001, p. 43.

      ANNEX I
      List of ECI sectors

                  Sector

                  Subsector

                              I

                              Energy

                              1.

                              Electricity

                  Infrastructures and facilities for generation and transmission of electricity in respect of supply electricity

                              2.

                              Oil

                  Oil production, refining, treatment, storage and transmission by pipelines

                              3.

                              Gas

                  Gas production, refining, treatment, storage and transmission by pipelines
                  LNG terminals

                              II

                              Transport

                              4.

                              Road transport

                              5.

                              Rail transport

                              6.

                              Air transport

                              7.

                              Inland waterways transport

                              8.

                              Ocean and short-sea shipping and ports

            The identification by the Member States of critical infrastructures which may be designated as ECIs is undertaken pursuant to Article 3. Therefore the list of ECI sectors in itself does not generate a generic obligation to designate an ECI in each sector.

      ANNEX II
      ECI OSP PROCEDURE
      The OSP will identify critical infrastructure assets and which security solutions exist or are being implemented for their protection. The ECI OSP procedure will cover at least:

                  1.

                  identification of important assets;

                  2.

                  conducting a risk analysis based on major threat scenarios, vulnerability of each asset, and potential impact; and

                  3.

                  identification, selection and prioritisation of counter-measures and procedures with a distinction between:

                              —

                              permanent security measures, which identify indispensable security investments and means which are relevant to be employed at all times. This heading will include information concerning general measures such as technical measures (including installation of detection, access control, protection and prevention means); organisational measures (including procedures for alerts and crisis management); control and verification measures; communication; awareness raising and training; and security of information systems,

                              —

                              graduated security measures, which can be activated according to varying risk and threat levels.

      ANNEX III
      Procedure for the identification by the Member States of critical infrastructures which may be designated as an ECI pursuant to Article 3
      Article 3 requires each Member State to identify the critical infrastructures which may be designated as an ECI. This procedure shall be implemented by each Member State through the following series of consecutive steps.
      A potential ECI which does not satisfy the requirements of one of the following sequential steps is considered to be ‘non-ECI’ and is excluded from the procedure. A potential ECI which does satisfy the requirements shall be subjected to the next steps of this procedure.
      Step 1
      Each Member State shall apply the sectoral criteria in order to make a first selection of critical infrastructures within a sector.
      Step 2
      Each Member State shall apply the definition of critical infrastructure pursuant to Article 2(a) to the potential ECI identified under step 1.
      The significance of the impact will be determined either by using national methods for identifying critical infrastructures or with reference to the cross-cutting criteria, at an appropriate national level. For infrastructure providing an essential service, the availability of alternatives, and the duration of disruption/recovery will be taken into account.
      Step 3
      Each Member State shall apply the transboundary element of the definition of ECI pursuant to Article 2(b) to the potential ECI that has passed the first two steps of this procedure. A potential ECI which does satisfy the definition will follow the next step of the procedure. For infrastructure providing an essential service, the availability of alternatives, and the duration of disruption/recovery will be taken into account.
      Step 4
      Each Member State shall apply the cross-cutting criteria to the remaining potential ECIs. The cross-cutting criteria shall take into account: the severity of impact; and, for infrastructure providing an essential service, the availability of alternatives; and the duration of disruption/recovery. A potential ECI which does not satisfy the cross-cutting criteria will not be considered to be an ECI.
      A potential ECI which has passed through this procedure shall only be communicated to the Member States which may be significantly affected by the potential ECI.


Avis juridique important

|

32003L0041

Directive 2003/41/EC of the European Parliament and of the Council of 3 June 2003 on the activities and supervision of institutions for occupational retirement provision

Official Journal L 235 , 23/09/2003 P. 0010 - 0021

Directive 2003/41/EC of the European Parliament and of the Councilof 3 June 2003on the activities and supervision of institutions for occupational retirement provisionTHE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,Having regard to the Treaty establishing the European Community, and in particular Article 47(2), Article 55 and Article 95(1) thereof,Having regard to the proposal from the Commission(1),Having regard to the opinion of the European Economic and Social Committee(2),Acting in accordance with the procedure laid down in Article 251 of the Treaty(3),Whereas:(1) A genuine internal market for financial services is crucial for economic growth and job creation in the Community.(2) Major achievements have already been made in the establishment of this internal market, allowing financial institutions to operate in other Member States and ensuring a high level of protection for the consumers of financial services.(3) The communication from the Commission "Implementing the framework for financial markets: action plan" identifies a series of actions that are needed in order to complete the internal market for financial services, and the European Council, at its meeting in Lisbon on 23 and 24 March 2000, called for the implementation of this action plan by 2005.(4) The action plan for financial services stresses as an urgent priority the need to draw up a directive on the prudential supervision of institutions for occupational retirement provision, as these institutions are major financial institutions which have a key role to play in ensuring the integration, efficiency and liquidity of the financial markets, but they are not subject to a coherent Community legislative framework allowing them to benefit fully from the advantages of the internal market.(5) Since social-security systems are coming under increasing pressure, occupational retirement pensions will increasingly be relied on as a complement in future. Occupational retirement pensions should therefore be developed, without, however, calling into question the importance of social-security pension systems in terms of secure, durable and effective social protection, which should guarantee a decent standard of living in old age and should therefore be at the centre of the objective of strengthening the European social model.(6) This Directive thus represents a first step on the way to an internal market for occupational retirement provision organised on a European scale. By setting the "prudent person" rule as the underlying principle for capital investment and making it possible for institutions to operate across borders, the redirection of savings into the sector of occupational retirement provision is encouraged, thus contributing to economic and social progress.(7) The prudential rules laid down in this Directive are intended both to guarantee a high degree of security for future pensioners through the imposition of stringent supervisory standards, and to clear the way for the efficient management of occupational pension schemes.(8) Institutions which are completely separated from any sponsoring undertaking and which operate on a funded basis for the sole purpose of providing retirement benefits should have freedom to provide services and freedom of investment, subject only to coordinated prudential requirements, regardless of whether these institutions are considered as legal entities.(9) In accordance with the principle of subsidiarity, Member States should retain full responsibility for the organisation of their pension systems as well as for the decision on the role of each of the three "pillars" of the retirement system in individual Member States. In the context of the second pillar, they should also retain full responsibility for the role and functions of the various institutions providing occupational retirement benefits, such as industry-wide pension funds, company pension funds and life-assurance companies. This Directive is not intended to call this prerogative into question.(10) National rules concerning the participation of self-employed persons in institutions for occupational retirement provision differ. In some Member States, institutions for occupational retirement provision can operate on the basis of agreements with trade or trade groups whose members act in a self-employed capacity or directly with self-employed and employed persons. In some Member States a self-employed person can also become a member of an institution when the self-employed person acts as employer or provides his professional services to an undertaking. In some Member States self-employed persons cannot join an institution for occupational retirement provision unless certain requirements, including those imposed by social and labour law, are met.(11) Institutions managing social-security schemes, which are already coordinated at Community level, should be excluded from the scope of this Directive. Account should nevertheless be taken of the specificity of institutions which, in a single Member State, manage both social-security schemes and occupational pension schemes.(12) Financial institutions which already benefit from a Community legislative framework should in general be excluded from the scope of this Directive. However, as these institutions may also in some cases offer occupational pension services, it is important to ensure that this Directive does not lead to distortions of competition. Such distortions may be avoided by applying the prudential requirements of this Directive to the occupational pension business of life-assurance companies. The Commission should also carefully monitor the situation in the occupational pensions market and assess the possibility of extending the optional application of this Directive to other regulated financial institutions.(13) When aiming at ensuring financial security in retirement, the benefits paid by institutions for occupational retirement provision should generally provide for the payment of a lifelong pension. Payments for a temporary period or a lump sum should also be possible.(14) It is important to ensure that older and disabled people are not placed at risk of poverty and can enjoy a decent standard of living. Appropriate cover for biometrical risks in occupational pension arrangements is an important aspect of the fight against poverty and insecurity among elderly people. When setting up a pension scheme, employers and employees, or their respective representatives, should consider the possibility of the pension scheme including provisions for the coverage of the longevity risk and occupational disability risks as well as provision for surviving dependants.(15) Giving Member States the possibility to exclude from the scope of national implementing legislation institutions managing schemes which together have less than 100 members in total can facilitate supervision in some Member States, without undermining the proper functioning of the internal market in this field. However, this should not undermine the right of such institutions to appoint for the management of their investment portfolio and the custody of their assets investment managers and custodians established in another Member State and duly authorised.(16) Institutions such as "Unterstützungskassen" in Germany, where the members have no legal rights to benefits of a certain amount and where their interests are protected by a compulsory statutory insolvency insurance, should be excluded from the scope of the Directive.(17) In order to protect members and beneficiaries, institutions for occupational retirement provision should limit their activities to the activities, and those arising therefrom, referred to in this Directive.(18) In the event of the bankruptcy of a sponsoring undertaking, a member faces the risk of losing both his/her job and his/her acquired pension rights. This makes it necessary to ensure that there is a clear separation between that undertaking and the institution and that minimum prudential standards are laid down to protect members.(19) Institutions for occupational retirement provision operate and are supervised with significant differences in Member States. In some Member States, supervision can be exercised not only over the institution itself but also over the entities or companies which are authorised to manage these institutions. Member States should be able to take such specificity into account as long as all the requirements laid down in this Directive are effectively met. Member States should also be able to allow insurance entities and other financial entities to manage institutions for occupational retirement provision.(20) Institutions for occupational retirement provision are financial service providers which bear a heavy responsibility for the provision of occupational retirement benefits and therefore should meet certain minimum prudential standards with respect to their activities and conditions of operation.(21) The huge number of institutions in certain Member States means a pragmatic solution is necessary as regards prior authorisation of institutions. However, if an institution wishes to manage a scheme in another Member State, a prior authorisation granted by the competent authority of the home Member State should be required.(22) Each Member State should require that every institution located in its territory draw up annual accounts and annual reports taking into account each pension scheme operated by the institution and, where applicable, annual accounts and annual reports for each pension scheme. The annual accounts and annual reports, reflecting a true and fair view of the institution's assets, liabilities and financial position, taking into account each pension scheme operated by an institution, and duly approved by an authorised person, are an essential source of information for members and beneficiaries of a scheme and the competent authorities. In particular, they enable the competent authorities to monitor the financial soundness of an institution and assess whether the institution is able to meet all its contractual obligations.(23) Proper information for members and beneficiaries of a pension scheme is crucial. This is of particular relevance for requests for information concerning the financial soundness of the institution, the contractual rules, the benefits and the actual financing of accrued pension entitlements, the investment policy and the management of risks and costs.(24) The investment policy of an institution is a decisive factor for both security and affordability of occupational pensions. The institutions should therefore draw up and, at least every three years, review a statement of investment principles. It should be made available to the competent authorities and on request also to members and beneficiaries of each pension scheme.(25) To fulfil their statutory function, the competent authorities should be provided with adequate rights to information and powers of intervention with respect to institutions and the persons who effectively run them. Where an institution for occupational retirement provision has transferred functions of material importance such as investment management, information technology or accounting to other companies (outsourcing), it should be possible for the rights to information and powers of intervention to be enlarged so as to cover these outsourced functions in order to check whether those activities are carried out in accordance with the supervisory rules.(26) A prudent calculation of technical provisions is an essential condition to ensure that obligations to pay retirement benefits can be met. Technical provisions should be calculated on the basis of recognised actuarial methods and certified by qualified persons. The maximum interest rates should be chosen prudently according to any relevant national rules. The minimum amount of technical provisions should both be sufficient for benefits already in payment to beneficiaries to continue to be paid and reflect the commitments that arise out of members' accrued pension rights.(27) Risks covered by institutions vary significantly from one Member State to another. Home Member States should therefore have the possibility of making the calculation of technical provisions subject to additional and more detailed rules than those laid down in this Directive.(28) Sufficient and appropriate assets to cover the technical provisions protect the interests of members and beneficiaries of the pension scheme if the sponsoring undertaking becomes insolvent. In particular in cases of cross-border activity, the mutual recognition of supervisory principles applied in Member States requires that the technical provisions be fully funded at all times.(29) If the institution does not work on a cross-border basis, Member States should be able to permit underfunding provided that a proper plan is established to restore full funding and without prejudice to the requirements of Council Directive 80/987/EEC of 20 October 1980 on the approximation of the laws of the Member States relating to the protection of employees in the event of the insolvency of their employer(4).(30) In many cases, it could be the sponsoring undertaking and not the institution itself that either covers any biometric risk or guarantees certain benefits or investment performance. However, in some cases, it is the institution itself which provides such cover or guarantees and the sponsor's obligations are generally exhausted by paying the necessary contributions. In these circumstances, the products offered are similar to those of life-assurance companies and the institutions concerned should hold at least the same additional own funds as life-assurance companies.(31) Institutions are very long-term investors. Redemption of the assets held by these institutions cannot, in general, be made for any purpose other than providing retirement benefits. Furthermore, in order to protect adequately the rights of members and beneficiaries, institutions should be able to opt for an asset allocation that suits the precise nature and duration of their liabilities. These aspects call for efficient supervision and an approach towards investment rules allowing institutions sufficient flexibility to decide on the most secure and efficient investment policy and obliging them to act prudently. Compliance with the "prudent person" rule therefore requires an investment policy geared to the membership structure of the individual institution for occupational retirement provision.(32) Supervisory methods and practices vary among Member States. Therefore, Member States should be given some discretion on the precise investment rules that they wish to impose on the institutions located in their territories. However, these rules must not restrict the free movement of capital, unless justified on prudential grounds.(33) As very long-term investors with low liquidity risks, institutions for occupational retirement provision are in a position to invest in non-liquid assets such as shares as well as in risk capital markets within prudent limits. They can also benefit from the advantages of international diversification. Investments in shares, risk capital markets and currencies other than those of the liabilities should therefore not be restricted except on prudential grounds.(34) However, if the institution works on a cross-border basis, it may be asked by the competent authorities of the host Member State to apply limits for investment in shares and similar assets not admitted to trading on a regulated market, in shares and other instruments issued by the same undertaking or in assets denominated in non-matching currencies provided such rules also apply to institutions located in the host Member State.(35) Restrictions regarding the free choice by institutions of approved asset managers and custodians limit competition in the internal market and should therefore be eliminated.(36) Without prejudice to national social and labour legislation on the organisation of pension systems, including compulsory membership and the outcomes of collective bargaining agreements, institutions should have the possibility of providing their services in other Member States. They should be allowed to accept sponsorship from undertakings located in other Member States and to operate pension schemes with members in more than one Member State. This would potentially lead to significant economies of scale for these institutions, improve the competitiveness of the Community industry and facilitate labour mobility. This requires mutual recognition of prudential standards. Proper enforcement of these prudential standards should be supervised by the competent authorities of the home Member State, unless specified otherwise.(37) The exercise of the right of an institution in one Member State to manage an occupational pension scheme contracted in another Member State should fully respect the provisions of the social and labour law in force in the host Member State insofar as it is relevant to occupational pensions, for example the definition and payment of retirement benefits and the conditions for transferability of pension rights.(38) When a scheme is ring-fenced, the provisions of this Directive apply individually to that scheme.(39) It is important to make provision for cooperation between the competent authorities of the Member States for supervisory purposes and between those authorities and the Commission for other purposes. For the purposes of carrying out their duties and of contributing to the consistent and timely implementation of this Directive, competent authorities should provide each other with the information necessary to apply the provisions of the Directive. The Commission has indicated its intention to set up a committee of supervisors in order to encourage cooperation, coordination and exchanges of views between national competent authorities, and to promote the consistent implementation of this Directive.(40) Since the objective of the proposed action, namely to create a Community legal framework covering institutions for occupational retirement provision, cannot be sufficiently achieved by the Member States and can therefore, by reason of the scale and effects of the action, be better achieved by the Community, the Community may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty. In accordance with the principle of proportionality as set out in that Article, this Directive does not go beyond what is necessary in order to achieve that objective,HAVE ADOPTED THE FOLLOWING DIRECTIVE:Article 1SubjectThis Directive lays down rules for the taking-up and pursuit of activities carried out by institutions for occupational retirement provision.Article 2Scope1. This Directive shall apply to institutions for occupational retirement provision. Where, in accordance with national law, institutions for occupational retirement provision do not have legal personality, Member States shall apply this Directive either to those institutions or, subject to paragraph 2, to those authorised entities responsible for managing them and acting on their behalf.2. This Directive shall not apply to:(a) institutions managing social-security schemes which are covered by Regulation (EEC) No 1408/71(5) and Regulation (EEC) No 574/72(6);(b) institutions which are covered by Directive 73/239/EEC(7), Directive 85/611/EEC(8), Directive 93/22/EEC(9), Directive 2000/12/EC(10) and Directive 2002/83/EC(11);(c) institutions which operate on a pay-as-you-go basis;(d) institutions where employees of the sponsoring undertakings have no legal rights to benefits and where the sponsoring undertaking can redeem the assets at any time and not necessarily meet its obligations for payment of retirement benefits;(e) companies using book-reserve schemes with a view to paying out retirement benefits to their employees.Article 3Application to institutions operating social-security schemesInstitutions for occupational retirement provision which also operate compulsory employment-related pension schemes which are considered to be social-security schemes covered by Regulations (EEC) No 1408/71 and (EEC) No 574/72 shall be covered by this Directive in respect of their non-compulsory occupational retirement provision business. In that case, the liabilities and the corresponding assets shall be ring-fenced and it shall not be possible to transfer them to the compulsory pension schemes which are considered as social-security schemes or vice versa.Article 4Optional application to institutions covered by Directive 2002/83/ECHome Member States may choose to apply the provisions of Articles 9 to 16 and Articles 18 to 20 of this Directive to the occupational-retirement-provision business of insurance undertakings which are covered by Directive 2002/83/EC. In that case, all assets and liabilities corresponding to the said business shall be ring-fenced, managed and organised separately from the other activities of the insurance undertakings, without any possibility of transfer.In such case, and only as far as their occupational retirement provision business is concerned, insurance undertakings shall not be subject to Articles 20 to 26, 31 and 36 of Directive 2002/83/EC.The home Member State shall ensure that either the competent authorities, or the authorities responsible for supervision of insurance undertakings covered by Directive 2002/83/EC, as part of their supervisory work, verify the strict separation of the relevant occupational retirement provision business.Article 5Small pension institutions and statutory schemesWith the exception of Article 19, Member States may choose not to apply this Directive, in whole or in part, to any institution located in their territories which operates pension schemes which together have less than 100 members in total. Subject to Article 2(2), such institutions should nevertheless be given the right to apply this Directive on a voluntary basis. Article 20 may be applied only if all the other provisions of this Directive apply.Member States may choose not to apply Articles 9 to 17 to institutions where occupational retirement provision is made under statute, pursuant to legislation, and is guaranteed by a public authority. Article 20 may be applied only if all the other provisions of this Directive apply.Article 6DefinitionsFor the purposes of this Directive:(a) "institution for occupational retirement provision", or "institution", means an institution, irrespective of its legal form, operating on a funded basis, established separately from any sponsoring undertaking or trade for the purpose of providing retirement benefits in the context of an occupational activity on the basis of an agreement or a contract agreed:- individually or collectively between the employer(s) and the employee(s) or their respective representatives, or- with self-employed persons, in compliance with the legislation of the home and host Member States,and which carries out activities directly arising therefrom;(b) "pension scheme" means a contract, an agreement, a trust deed or rules stipulating which retirement benefits are granted and under which conditions;(c) "sponsoring undertaking" means any undertaking or other body, regardless of whether it includes or consists of one or more legal or natural persons, which acts as an employer or in a self-employed capacity or any combination thereof and which pays contributions into an institution for occupational retirement provision;(d) "retirement benefits" means benefits paid by reference to reaching, or the expectation of reaching, retirement or, where they are supplementary to those benefits and provided on an ancillary basis, in the form of payments on death, disability, or cessation of employment or in the form of support payments or services in case of sickness, indigence or death. In order to facilitate financial security in retirement, these benefits usually take the form of payments for life. They may, however, also be payments made for a temporary period or as a lump sum.(e) "member" means a person whose occupational activities entitle or will entitle him/her to retirement benefits in accordance with the provisions of a pension scheme;(f) "beneficiary" means a person receiving retirement benefits;(g) "competent authorities" means the national authorities designated to carry out the duties provided for in this Directive;(h) "biometrical risks" mean risks linked to death, disability and longevity;(i) "home Member State" means the Member State in which the institution has its registered office and its main administration or, if it does not have a registered office, its main administration;(j) "host Member State" means the Member State whose social and labour law relevant to the field of occupational pension schemes is applicable to the relationship between the sponsoring undertaking and members.Article 7Activities of an institutionEach Member State shall require institutions located within its territory to limit their activities to retirement-benefit related operations and activities arising therefrom.When, in accordance with Article 4, an insurance undertaking manages its occupational retirement provision business by ring-fencing its assets and liabilities, the ring-fenced assets and liabilities shall be restricted to retirement-benefit related operations and activities directly arising therefrom.Article 8Legal separation between sponsoring undertakings and institutions for occupational retirement provisionEach Member State shall ensure that there is a legal separation between a sponsoring undertaking and an institution for occupational retirement provision in order that the assets of the institution are safeguarded in the interests of members and beneficiaries in the event of bankruptcy of the sponsoring undertaking.Article 9Conditions of operation1. Each Member State shall, in respect of every institution located in its territory, ensure that:(a) the institution is registered in a national register by the competent supervisory authority or authorised; in the case of cross-border activities referred to in Article 20, the register shall also indicate the Member States in which the institution is operating;(b) the institution is effectively run by persons of good repute who must themselves have appropriate professional qualifications and experience or employ advisers with appropriate professional qualifications and experience;(c) properly constituted rules regarding the functioning of any pension scheme operated by the institution have been implemented and members have been adequately informed of these rules;(d) all technical provisions are computed and certified by an actuary or, if not by an actuary, by another specialist in this field, including an auditor, according to national legislation, on the basis of actuarial methods recognised by the competent authorities of the home Member State;(e) where the sponsoring undertaking guarantees the payment of the retirement benefits, it is committed to regular financing;(f) the members are sufficiently informed of the conditions of the pension scheme, in particular concerning:(i) the rights and obligations of the parties involved in the pension scheme;(ii) the financial, technical and other risks associated with the pension scheme;(iii) the nature and distribution of those risks.2. In accordance with the principle of subsidiarity and taking due account of the scale of pension benefits offered by the social-security regimes, Member States may provide that the option of longevity and disability cover, provision for surviving dependants and a guarantee of repayment of contributions as additional benefits be offered to members if employers and employees, or their respective representatives, so agree.3. A Member State may make the conditions of operation of an institution located in its territory subject to other requirements, with a view to ensuring that the interests of members and beneficiaries are adequately protected.4. A Member State may permit or require institutions located in its territory to entrust management of these institutions, in whole or in part, to other entities operating on behalf of those institutions.5. In the case of cross-border activity as referred to in Article 20, the conditions of operation of the institution shall be subject to a prior authorisation by the competent authorities of the home Member State.Article 10Annual accounts and annual reportsEach Member State shall require that every institution located in its territory draw up annual accounts and annual reports taking into account each pension scheme operated by the institution and, where applicable, annual accounts and annual reports for each pension scheme. The annual accounts and the annual reports shall give a true and fair view of the institution's assets, liabilities and financial position. The annual accounts and information in the reports shall be consistent, comprehensive, fairly presented and duly approved by authorised persons, according to national law.Article 11Information to be given to the members and beneficiaries1. Depending on the nature of the pension scheme established, each Member State shall ensure that every institution located in its territory provides at least the information set out in this Article.2. Members and beneficiaries and/or, where applicable, their representatives shall receive:(a) on request, the annual accounts and the annual reports referred to in Article 10, and, where an institution is responsible for more than one scheme, those relating to their particular pension scheme;(b) within a reasonable time, any relevant information regarding changes to the pension-scheme rules.3. The statement of investment policy principles, referred to in Article 12, shall be made available to members and beneficiaries and/or, where applicable, to their representatives on request.4. Each member shall also receive, on request, detailed and substantial information on:(a) the target level of the retirement benefits, if applicable;(b) the level of benefits in case of cessation of employment;(c) where the member bears the investment risk, the range of investment options, if applicable, and the actual investment portfolio as well as information on risk exposure and costs related to the investments;(d) the arrangements relating to the transfer of pension rights to another institution for occupational retirement provision in the event of termination of the employment relationship.Members shall receive every year brief particulars of the situation of the institution as well as the current level of financing of their accrued individual entitlements.5. Each beneficiary shall receive, on retirement or when other benefits become due, the appropriate information on the benefits which are due and the corresponding payment options.Article 12Statement of investment policy principlesEach Member State shall ensure that every institution located in its territory prepares and, at least every three years, reviews a written statement of investment-policy principles. This statement is to be revised without delay after any significant change in the investment policy. Member States shall provide that this statement contains, at least, such matters as the investment risk measurement methods, the risk-management processes implemented and the strategic asset allocation with respect to the nature and duration of pension liabilities.Article 13Information to be provided to the competent authoritiesEach Member State shall ensure that the competent authorities, in respect of any institution located in its territory, have the necessary powers and means:(a) to require the institution, the members of its board of directors and other managers or directors or persons controlling the institution to supply information about all business matters or forward all business documents;(b) to supervise relationships between the institution and other companies or between institutions, when institutions transfer functions to those other companies or institutions (outsourcing), influencing the financial situation of the institution or being in a material way relevant for effective supervision;(c) to obtain regularly the statement of investment-policy principles, the annual accounts and the annual reports, and all the documents necessary for the purposes of supervision. These may include documents such as:(i) internal interim reports;(ii) actuarial valuations and detailed assumptions;(iii) asset-liability studies;(iv) evidence of consistency with the investment-policy principles;(v) evidence that contributions have been paid in as planned;(vi) reports by the persons responsible for auditing the annual accounts referred to in Article 10;(d) to carry out on-site inspections at the institution's premises and, where appropriate, on outsourced functions to check if activities are carried out in accordance with the supervisory rules.Article 14Powers of intervention and duties of the competent authorities1. The competent authorities shall require every institution located in their territories to have sound administrative and accounting procedures and adequate internal control mechanisms.2. The competent authorities shall have the power to take any measures including, where appropriate, those of an administrative or financial nature, either with regard to any institution located in their territories or against the persons running the institution, which are appropriate and necessary to prevent or remedy any irregularities prejudicial to the interests of the members and beneficiaries.They may also restrict or prohibit the free disposal of the institution's assets when, in particular:(a) the institution has failed to establish sufficient technical provisions in respect of the entire business or has insufficient assets to cover the technical provisions;(b) the institution has failed to hold the regulatory own funds.3. In order to safeguard the interests of members and beneficiaries, the competent authorities may transfer the powers which the persons running an institution located in their territories hold in accordance with the law of the home Member State wholly or partly to a special representative who is fit to exercise these powers.4. The competent authorities may prohibit or restrict the activities of an institution located in their territories in particular if:(a) the institution fails to protect adequately the interests of members and beneficiaries;(b) the institution no longer fulfils the conditions of operation;(c) the institution fails seriously in its obligations under the rules to which it is subject;(d) in the case of cross-border activity, the institution does not respect the requirements of social and labour law of the host Member State relevant to the field of occupational pensions.Any decision to prohibit the activities of an institution shall be supported by precise reasons and notified to the institution in question.5. Member States shall ensure that decisions taken in respect of an institution under laws, regulations and administrative provisions adopted in accordance with this Directive are subject to the right to apply to the courts.Article 15Technical provisions1. The home Member State shall ensure that institutions operating occupational pension schemes establish at all times in respect of the total range of their pension schemes an adequate amount of liabilities corresponding to the financial commitments which arise out of their portfolio of existing pension contracts.2. The home Member State shall ensure that institutions operating occupational pension schemes, where they provide cover against biometric risks and/or guarantee either an investment performance or a given level of benefits, establish sufficient technical provisions in respect of the total range of these schemes.3. The calculation of technical provisions shall take place every year. However, the home Member State may allow a calculation once every three years if the institution provides members and/or the competent authorities with a certification or a report of adjustments for the intervening years. The certification or the report shall reflect the adjusted development of the technical provisions and changes in risks covered.4. The calculation of the technical provisions shall be executed and certified by an actuary or, if not by an actuary, by another specialist in this field, including an auditor, according to national legislation, on the basis of actuarial methods recognised by the competent authorities of the home Member State, according to the following principles:(a) the minimum amount of the technical provisions shall be calculated by a sufficiently prudent actuarial valuation, taking account of all commitments for benefits and for contributions in accordance with the pension arrangements of the institution. It must be sufficient both for pensions and benefits already in payment to beneficiaries to continue to be paid, and to reflect the commitments which arise out of members' accrued pension rights. The economic and actuarial assumptions chosen for the valuation of the liabilities shall also be chosen prudently taking account, if applicable, of an appropriate margin for adverse deviation;(b) the maximum rates of interest used shall be chosen prudently and determined in accordance with any relevant rules of the home Member State. These prudent rates of interest shall be determined by taking into account:- the yield on the corresponding assets held by the institution and the future investment returns and/or- the market yields of high-quality or government bonds;(c) the biometric tables used for the calculation of technical provisions shall be based on prudent principles, having regard to the main characteristics of the group of members and the pension schemes, in particular the expected changes in the relevant risks;(d) the method and basis of calculation of technical provisions shall in general remain constant from one financial year to another. However, discontinuities may be justified by a change of legal, demographic or economic circumstances underlying the assumptions.5. The home Member State may make the calculation of technical provisions subject to additional and more detailed requirements, with a view to ensuring that the interests of members and beneficiaries are adequately protected.6. With a view to further harmonisation of the rules regarding the calculation of technical provisions which may be justified - in particular the interest rates and other assumptions influencing the level of technical provisions - the Commission shall, every two years or at the request of a Member State, issue a report on the situation concerning the development in cross-border activities.The Commission shall propose any necessary measures to prevent possible distortions caused by different levels of interest rates and to protect the interest of beneficiaries and members of any scheme.Article 16Funding of technical provisions1. The home Member State shall require every institution to have at all times sufficient and appropriate assets to cover the technical provisions in respect of the total range of pension schemes operated.2. The home Member State may allow an institution, for a limited period of time, to have insufficient assets to cover the technical provisions. In this case the competent authorities shall require the institution to adopt a concrete and realisable recovery plan in order to ensure that the requirements of paragraph 1 are met again. The plan shall be subject to the following conditions:(a) the institution shall set up a concrete and realisable plan to re-establish the required amount of assets to cover fully the technical provisions in due time. The plan shall be made available to members or, where applicable, to their representatives and/or shall be subject to approval by the competent authorities of the home Member State;(b) in drawing up the plan, account shall be taken of the specific situation of the institution, in particular the asset/liability structure, risk profile, liquidity plan, the age profile of the members entitled to receive retirement benefits, start-up schemes and schemes changing from non-funding or partial funding to full funding;(c) in the event of termination of a pension scheme during the period referred to above in this paragraph, the institution shall inform the competent authorities of the home Member State. The institution shall establish a procedure in order to transfer the assets and the corresponding liabilities to another financial institution or a similar body. This procedure shall be disclosed to the competent authorities of the home Member State and a general outline of the procedure shall be made available to members or, where applicable, to their representatives in accordance with the principle of confidentiality.3. In the event of cross-border activity as referred to in Article 20, the technical provisions shall at all times be fully funded in respect of the total range of pension schemes operated. If these conditions are not met, the competent authorities of the home Member State shall intervene in accordance with Article 14. To comply with this requirement the home Member State may require ring-fencing of the assets and liabilities.Article 17Regulatory own funds1. The home Member State shall ensure that institutions operating pension schemes, where the institution itself, and not the sponsoring undertaking, underwrites the liability to cover against biometric risk, or guarantees a given investment performance or a given level of benefits, hold on a permanent basis additional assets above the technical provisions to serve as a buffer. The amount thereof shall reflect the type of risk and asset base in respect of the total range of schemes operated. These assets shall be free of all foreseeable liabilities and serve as a safety capital to absorb discrepancies between the anticipated and the actual expenses and profits.2. For the purposes of calculating the minimum amount of the additional assets, the rules laid down in Articles 27 and 28 of Directive 2002/83/EC shall apply.3. Paragraph 1 shall, however, not prevent Member States from requiring institutions located in their territory to hold regulatory own funds or from laying down more detailed rules provided that they are prudentially justified.Article 18Investment rules1. Member States shall require institutions located in their territories to invest in accordance with the "prudent person" rule and in particular in accordance with the following rules:(a) the assets shall be invested in the best interests of members and beneficiaries. In the case of a potential conflict of interest, the institution, or the entity which manages its portfolio, shall ensure that the investment is made in the sole interest of members and beneficiaries;(b) the assets shall be invested in such a manner as to ensure the security, quality, liquidity and profitability of the portfolio as a whole.Assets held to cover the technical provisions shall also be invested in a manner appropriate to the nature and duration of the expected future retirement benefits;(c) the assets shall be predominantly invested on regulated markets. Investment in assets which are not admitted to trading on a regulated financial market must in any event be kept to prudent levels;(d) investment in derivative instruments shall be possible insofar as they contribute to a reduction of investment risks or facilitate efficient portfolio management. They must be valued on a prudent basis, taking into account the underlying asset, and included in the valuation of the institution's assets. The institution shall also avoid excessive risk exposure to a single counterparty and to other derivative operations;(e) the assets shall be properly diversified in such a way as to avoid excessive reliance on any particular asset, issuer or group of undertakings and accumulations of risk in the portfolio as a whole.Investments in assets issued by the same issuer or by issuers belonging to the same group shall not expose the institution to excessive risk concentration;(f) investment in the sponsoring undertaking shall be no more than 5 % of the portfolio as a whole and, when the sponsoring undertaking belongs to a group, investment in the undertakings belonging to the same group as the sponsoring undertaking shall not be more than 10 % of the portfolio.When the institution is sponsored by a number of undertakings, investment in these sponsoring undertakings shall be made prudently, taking into account the need for proper diversification.Member States may decide not to apply the requirements referred to in points (e) and (f) to investment in government bonds.2. The home Member State shall prohibit the institution from borrowing or acting as a guarantor on behalf of third parties. However, Member States may authorise institutions to carry out some borrowing only for liquidity purposes and on a temporary basis.3. Member States shall not require institutions located in their territory to invest in particular categories of assets.4. Without prejudice to Article 12, Member States shall not subject the investment decisions of an institution located in their territory or its investment manager to any kind of prior approval or systematic notification requirements.5. In accordance with the provisions of paragraphs 1 to 4, Member States may, for the institutions located in their territories, lay down more detailed rules, including quantitative rules, provided they are prudentially justified, to reflect the total range of pension schemes operated by these institutions.In particular, Member States may apply investment provisions similar to those of Directive 2002/83/EC.However, Member States shall not prevent institutions from:(a) investing up to 70 % of the assets covering the technical provisions or of the whole portfolio for schemes in which the members bear the investment risks in shares, negotiable securities treated as shares and corporate bonds admitted to trading on regulated markets and deciding on the relative weight of these securities in their investment portfolio. Provided it is prudentially justified, Member States may, however, apply a lower limit to institutions which provide retirement products with a long-term interest rate guarantee, bear the investment risk and themselves provide for the guarantee;(b) investing up to 30 % of the assets covering technical provisions in assets denominated in currencies other than those in which the liabilities are expressed;(c) investing in risk capital markets.6. Paragraph 5 shall not preclude the right for Member States to require the application to institutions located in their territory of more stringent investment rules also on an individual basis provided they are prudentially justified, in particular in the light of the liabilities entered into by the institution.7. In the event of cross-border activity as referred in Article 20, the competent authorities of each host Member State may require that the rules set out in the second subparagraph apply to the institution in the home Member State. In such case, these rules shall apply only to the part of the assets of the institution that corresponds to the activities carried out in the particular host Member State. Furthermore, they shall only be applied if the same or stricter rules also apply to institutions located in the host Member State.The rules referred to in the first subparagraph are as follows:(a) the institution shall not invest more than 30 % of these assets in shares, other securities treated as shares and debt securities which are not admitted to trading on a regulated market, or the institution shall invest at least 70 % of these assets in shares, other securities treated as shares, and debt securities which are admitted to trading on a regulated market;(b) the institution shall invest no more than 5 % of these assets in shares and other securities treated as shares, bonds, debt securities and other money and capital-market instruments issued by the same undertaking and no more than 10 % of these assets in shares and other securities treated as shares, bonds, debt securities and other money and capital market instruments issued by undertakings belonging to a single group;(c) the institution shall not invest more than 30 % of these assets in assets denominated in currencies other than those in which the liabilities are expressed.To comply with these requirements, the home Member State may require ring-fencing of the assets.Article 19Management and custody1. Member States shall not restrict institutions from appointing, for the management of the investment portfolio, investment managers established in another Member State and duly authorised for this activity, in accordance with Directives 85/611/EEC, 93/22/EEC, 2000/12/EC and 2002/83/EC, as well as those referred to in Article 2(1) of this Directive.2. Member States shall not restrict institutions from appointing, for the custody of their assets, custodians established in another Member State and duly authorised in accordance with Directive 93/22/EEC or Directive 2000/12/EC, or accepted as a depositary for the purposes of Directive 85/611/EEC.The provision referred to in this paragraph shall not prevent the home Member State from making the appointment of a depositary or a custodian compulsory.3. Each Member State shall take the necessary steps to enable it under its national law to prohibit, in accordance with Article 14, the free disposal of assets held by a depositary or custodian located within its territory at the request of the institution's home Member State.Article 20Cross-border activities1. Without prejudice to national social and labour legislation on the organisation of pension systems, including compulsory membership and the outcomes of collective bargaining agreements, Member States shall allow undertakings located within their territories to sponsor institutions for occupational retirement provision authorised in other Member States. They shall also allow institutions for occupational retirement provision authorised in their territories to accept sponsorship by undertakings located within the territories of other Member States.2. An institution wishing to accept sponsorship from a sponsoring undertaking located within the territory of another Member State shall be subject to a prior authorisation by the competent authorities of its home Member State, as referred to in Article 9(5). It shall notify its intention to accept sponsorship from a sponsoring undertaking located within the territory of another Member State to the competent authorities of the home Member State where it is authorised.3. Member States shall require institutions located within their territories and proposing to be sponsored by an undertaking located in the territory of another Member State to provide the following information when effecting a notification under paragraph 2:(a) the host Member State(s);(b) the name of the sponsoring undertaking;(c) the main characteristics of the pension scheme to be operated for the sponsoring undertaking.4. Where a competent authority of the home Member State is notified under paragraph 2, and unless it has reason to doubt that the administrative structure or the financial situation of the institution or the good repute and professional qualifications or experience of the persons running the institution are compatible with the operations proposed in the host Member State, it shall within three months of receiving all the information referred to in paragraph 3 communicate that information to the competent authorities of the host Member State and inform the institution accordingly.5. Before the institution starts to operate a pension scheme for a sponsoring undertaking in another Member State, the competent authorities of the host Member State shall, within two months of receiving the information referred to in paragraph 3, inform the competent authorities of the home Member State, if appropriate, of the requirements of social and labour law relevant to the field of occupational pensions under which the pension scheme sponsored by an undertaking in the host Member State must be operated and any rules that are to be applied in accordance with Article 18(7) and with paragraph 7 of this Article. The competent authorities of the home Member State shall communicate this information to the institution.6. On receiving the communication referred to in paragraph 5, or if no communication is received from the competent authorities of the home Member State on expiry of the period provided for in paragraph 5, the institution may start to operate the pension scheme sponsored by an undertaking in the host Member State in accordance with the host Member State's requirements of social and labour law relevant to the field of occupational pensions, and any rules that are to be applied in accordance with Article 18(7) and with paragraph 7 of this Article.7. In particular, an institution sponsored by an undertaking located in another Member State shall also be subject, in respect of the corresponding members, to any information requirements imposed by the competent authorities of the host Member State on institutions located in that Member State, in accordance with Article 11.8. The competent authorities of the host Member State shall inform the competent authorities of the home Member State of any significant change in the host Member State's requirements of social and labour law relevant to the field of occupational pension schemes which may affect the characteristics of the pension scheme insofar as it concerns the operation of the pension scheme sponsored by an undertaking in the host Member State and in any rules that have to be applied in accordance with Article 18(7) and with paragraph 7 of this Article.9. The institution shall be subject to ongoing supervision by the competent authorities of the host Member State as to the compliance of its activities with the host Member State's requirements of labour and social law relevant to the field of occupational pension schemes referred to in paragraph 5 and with the information requirements referred to in paragraph 7. Should this supervision bring irregularities to light, the competent authorities of the host Member State shall inform the competent authorities of the home Member State immediately. The competent authorities of the home Member State shall, in coordination with the competent authorities of the host Member State, take the necessary measures to ensure that the institution puts a stop to the detected breach of social and labour law.10. If, despite the measures taken by the competent authorities of the home Member State or because appropriate measures are lacking in the home Member State, the institution persists in breaching the applicable provisions of the host Member State's requirements of social and labour law relevant to the field of occupational pension schemes, the competent authorities of the host Member State may, after informing the competent authorities of the home Member State, take appropriate measures to prevent or penalise further irregularities, including, insofar as is strictly necessary, preventing the institution from operating in the host Member State for the sponsoring undertaking.Article 21Cooperation between Member States and the Commission1. Member States shall ensure, in an appropriate manner, the uniform application of this Directive through regular exchanges of information and experience with a view to developing best practices in this sphere and closer cooperation, and by so doing, preventing distortions of competition and creating the conditions required for unproblematic cross-border membership.2. The Commission and the competent authorities of the Member States shall collaborate closely with a view to facilitating supervision of the operations of institutions for occupational retirement provision.3. Each Member State shall inform the Commission of any major difficulties to which the application of this Directive gives rise.The Commission and the competent authorities of the Member States concerned shall examine such difficulties as quickly as possible in order to find an appropriate solution.4. Four years after the entry into force of this Directive, the Commission shall issue a report reviewing:(a) the application of Article 18 and the progress achieved in the adaptation of national supervisory systems, and(b) the application of the second subparagraph of Article 19(2), in particular the situation prevailing in Member States regarding the use of depositaries and the role played by them where appropriate.5. The competent authorities of the host Member State may ask the competent authorities of the home Member State to decide on the ring-fencing of the institution's assets and liabilities, as provided for in Article 16(3) and Article 18(7).Article 22Implementation1. Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive before 23 September 2005. They shall forthwith inform the Commission thereof.When Member States adopt these measures, they shall contain a reference to this Directive or shall be accompanied by such reference on the occasion of their official publication. The methods of making such reference shall be laid down by Member States.2. Member States shall communicate to the Commission the text of the main provisions of national law which they adopt in the field governed by this Directive.3. Member States may postpone until 23 September 2010 the application of Article 17(1) and (2) to institutions located in their territory which at the date specified in paragraph 1 of this Article do not have the minimum level of regulatory own funds required pursuant to Article 17(1) and (2). However, institutions wishing to operate pension schemes on a cross-border basis, within the meaning of Article 20, may not do so until they comply with the rules of this Directive.4. Member States may postpone until 23 September 2010 the application of Article 18(1)(f) to institutions located in their territory. However, institutions wishing to operate pension schemes on a cross-border basis, within the meaning of Article 20, may not do so until they comply with the rules of this Directive.Article 23Entry in forceThis Directive shall enter into force on the day of its publication in the Official Journal of the European Union.Article 24AddresseesThis Directive is addressed to the Member States.Done at Luxembourg, 3 June 2003.For the European ParliamentThe PresidentP. CoxFor the CouncilThe PresidentN. Christodoulakis(1) OJ C 96 E, 27.3.2001, p. 136.(2) OJ C 155, 29.5.2001, p. 26.(3) Opinion of the European Parliament of 4 July 2001 (OJ C 65 E, 14.3.2002, p. 135), Council common position of 5 November 2002 (not yet published in the Official Journal) and decision of the European Parliament of 12 March 2003 (not yet published in the Official Journal) and decision of the Council of 13 May 2003.(4) OJ L 283, 28.10.1980, p. 23. Directive as last amended by Directive 2002/74/EC of the European Parliament and of the Council (OJ L 270, 8.10.2002, p. 10).(5) Council Regulation (EEC) No 1408/71 of 14 June 1971 on the application of social-security schemes to employed persons, to self-employed persons and to members of their families moving within the Community (OJ L 149, 5.7.1971, p. 2). Regulation as last amended by Regulation (EC) No 1386/2001 of the European Parliament and of the Council (OJ L 187, 10.7.2001, p. 1).(6) Council Regulation (EEC) No 574/72 of 21 March 1972 fixing the procedure for implementing Regulation (EEC) No 1408/71 on the application of social-security schemes to employed persons, to self-employed persons and to members of their families moving within the Community (OJ L 74, 27.3.1972, p. 1). Regulation as last amended by Commission Regulation (EC) No 410/2002 (OJ L 62, 5.3.2002, p. 17).(7) First Council Directive 73/239/EEC of 24 July 1973 on the coordination of laws, regulations and administrative provisions relating to the taking-up and pursuit of the business of direct insurance other than life assurance (OJ L 228, 16.8.1973, p. 3). Directive as last amended by Directive 2002/13/EC of the European Parliament and of the Council (OJ L 77, 20.3.2002, p. 17).(8) Council Directive 85/611/EEC of 20 December 1985 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS) (OJ L 375, 31.12.1985, p. 3). Directive as last amended by Directive 2001/108/EC of the European Parliament and of the Council (OJ L 41, 13.2.2002, p. 35).(9) Council Directive 93/22/EEC of 10 May 1993 on investment services in the securities field (OJ L 141, 11.6.1993, p. 27). Directive as last amended by Directive 2000/64/EC of the European Parliament and of the Council (OJ L 290, 17.11.2000, p. 27).(10) Directive 2000/12/EC of the European Parliament and of the Council of 20 March 2000 relating to the taking-up and pursuit of the business of credit institutions (OJ L 126, 26.5.2000, p. 1). Directive as amended by Directive 2000/28/EC (OJ L 275, 27.10.2000, p. 37).(11) Directive 2002/83/EC of the European Parliament and of the Council of 5 November 2002 concerning life assurance (OJ L 345, 19.12.2002, p. 1).