title: Recommendation of the European Systemic Risk Board of 2 December 2021 on a pan-European systemic cyber incident coordination framework for relevant authorities (ESRB/2021/17) 2022/C 134/01

text:
               25.3.2022

               EN

               Official Journal of the European Union

               C 134/1

      RECOMMENDATION OF THE EUROPEAN SYSTEMIC RISK BOARD
      of 2 December 2021
      on a pan-European systemic cyber incident coordination framework for relevant authorities
      (ESRB/2021/17)
      (2022/C 134/01)
      THE GENERAL BOARD OF THE EUROPEAN SYSTEMIC RISK BOARD,
      Having regard to the Treaty on the Functioning of the European Union,
      Having regard to the Agreement on the European Economic Area (1), in particular Annex IX thereof,
      Having regard to Regulation (EU) No 1092/2010 of the European Parliament and of the Council of 24 November 2010 on European Union macro-prudential oversight of the financial system and establishing a European Systemic Risk Board (2), and in particular Article 3(2)(b) and (d) and Articles 16 and 18 thereof,
      Having regard to Decision ESRB/2011/1 of the European Systemic Risk Board of 20 January 2011 adopting the Rules of Procedure of the European Systemic Risk Board (3), and in particular Articles 18 to 20 thereof,
      Whereas:

                  (1)

                  As noted in recital 4 of Recommendation ESRB/2013/1 of the European Systemic Risk Board (4), the ultimate objective of macroprudential policy is to contribute to safeguarding the stability of the financial system as a whole, including by strengthening the resilience of the financial system and decreasing the build-up of systemic risks, thereby ensuring a sustainable contribution of the financial sector to economic growth. The European Systemic Risk Board (ESRB) is responsible for the macroprudential oversight of the financial system within the Union. In fulfilling its mandate, the ESRB should contribute to the prevention and mitigation of systemic risks to financial stability, including those related to cyber incidents, and propose how these risks might be mitigated.

                  (2)

                  Major cyber incidents may pose a systemic risk to the financial system given their potential to disrupt critical financial services and operations. The amplification of an initial shock can either occur through operational or financial contagion or through an erosion of confidence in the financial system. If the financial system is unable to absorb these shocks, financial stability will be at risk and this situation can result in a systemic cyber crisis (5).

                  (3)

                  The constantly evolving cyber threat landscape and recent increase of major cyber incidents are indicators of greater risk to financial stability in the Union. The COVID-19 pandemic has highlighted the importance of the role technology plays in allowing the financial system to operate. Relevant authorities and institutions needed to adapt their technical infrastructure and risk management frameworks to a sudden increase in remote working, which has increased the overall exposure of the financial system to cyber threats and allowed criminals both to devise new modi operandi and to adapt existing ones to exploit the situation (6). Against this background, the number of cyber incidents reported to ECB Banking Supervision in 2020 increased by 54 % compared with 2019 (7).

                  (4)

                  A major cyber incident’s potentially large scale, speed and rate of propagation call for an effective response from the relevant authorities to mitigate the potential negative effects on financial stability. Swift coordination and communication among relevant authorities at Union level can assist in early assessment of a major cyber incident’s impact on financial stability, maintaining confidence in the financial system and limiting contagion to other financial institutions and thus contribute to preventing a major cyber incident from becoming a risk to financial stability.

                  (5)

                  The underlying shock originates in a novel way compared to the traditional financial and liquidity crises relevant authorities usually face. Aside from financial aspects, the overall risk assessment must include the scale and impact of operational disruptions as these might influence the choice of macroprudential tools. Likewise, financial stability might also influence the choice of operational mitigants by cyber experts. This calls for close and swift coordination and open communication to, inter alia, build situational awareness.

                  (6)

                  The risk of a coordination failure by authorities exists and needs to be addressed. Relevant authorities in the Union will need to coordinate among themselves and with other authorities such as the European Union Agency for Network and Information Security (ENISA) with which they might not usually interact. As a significant number of Union financial institutions operate globally, a major cyber incident will likely not be limited to the Union or might be triggered outside the Union and might require global response coordination.

                  (7)

                  The relevant authorities need to be prepared for these interactions. Otherwise, they might risk taking inconsistent actions that contradict or jeopardise other authorities’ responses. Such a coordination failure could amplify the shock for the financial system by leading to an erosion of confidence in the functioning of the financial system which, in the worst-case scenario, would pose a risk to financial stability (8).Thus, the necessary steps should be taken to address the risk to financial stability stemming from a coordination failure in the event of a major cyber incident.

                  (8)

                  The ESRB (2021) report Mitigating systemic cyber risk (9) identifies the need to establish a pan-European systemic cyber incident coordination framework (EU-SCICF) for relevant authorities in the Union. The objective of the EU-SCICF would be to increase relevant authorities’ level of preparedness to facilitate a coordinated response to a potentially major cyber incident. The ESRB (2021) report Mitigating systemic cyber risk provides the ESRB’s assessment on the framework characteristics that would be needed, prima facie, in order to address the risk of a coordination failure.

                  (9)

                  The key objective of this Recommendation is to build on one of the envisaged roles of the European Supervisory Authorities (ESAs) under the proposal for a Regulation of the European Parliament and of the Council on digital operational resilience for the financial sector (10) (hereinafter ‘DORA’) of gradually enabling an effective Union-level coordinated response in the event of a major cross-border information and communication technologies (ICT) related incident or related threat having a systemic impact on the Union’s financial sector as a whole. This process will lead to the creation of the EU-SCICF for relevant authorities.

                  (10)

                  The EU-SCICF should not aim to replace existing frameworks but to bridge any coordination and communication gaps between the relevant authorities themselves and with other authorities in the Union and other key actors at international level. In this respect, the positioning of the EU-SCICF in the existing financial crisis framework and Union cyber incident framework landscape should be considered. Regarding coordination among the relevant authorities themselves, consideration should be given, but not be limited to, the roles and activities of the Network and Information Systems (NIS) Cooperation Group for financial entities under Directive (EU) 2016/1148 of the European Parliament and of the Council (11), and the coordination mechanisms envisaged through the establishment of the Joint Cyber Unit alongside the involvement of ENISA.

                  (11)

                  In particular, the proposal to launch the preparation of the EU-SCICF aims to endorse the potential roles of the ESAs, as envisaged by the DORA proposal. DORA proposes that ‘the ESAs, through the Joint Committee and in collaboration with competent authorities, the European Central Bank (ECB) and the ESRB, may establish mechanisms to enable the sharing of effective practices across financial sectors to enhance situational awareness and identify common cyber vulnerabilities and risks across-sectors’ and ‘may develop crisis-management and contingency exercises involving cyberattack scenarios with a view to develop communication channels and gradually enable an effective EU-level coordinated response in the event of a major cross-border ICT-related incident or related threat having a systemic impact on the Union’s financial sector as a whole’ (12). A pan-European framework such as the EU-SCICF does not yet exist and should be established and developed in the context of DORA.

                  (12)

                  Given the risk to financial stability in the Union stemming from cyber risk, preparatory work for the gradual establishment of the EU-SCICF should, to the extent feasible, start even before the required legal and policy framework for its establishment is fully applicable. This legal and policy framework would be completed fully and finalised once the relevant provisions of DORA and of its delegated acts become applicable.

                  (13)

                  Effective communication contributes to situational awareness among relevant authorities and is thus an indispensable prerequisite for Union-wide coordination during major cyber incidents. In this respect, the communication infrastructure needed to coordinate on a response to a major cyber incident should be defined. This would imply specifying the type of information that needs to be shared, the regular channels to be used to share such information and the contact points with which information should be shared. Information sharing must respect existing legal requirements. In addition, a clear action plan and the protocols to be followed may need to be defined by the relevant authorities to ensure proper coordination among the authorities involved in planning a coordinated response to a major cyber incident.

                  (14)

                  A systemic cyber crisis will require the setting in motion of full cooperation at national and Union level. Therefore, the designation of points of contact for the ESAs, the ECB and each Member State from among its relevant national authorities, which should be communicated to the ESAs, may be envisaged to establish the main interlocutors in the coordination scheme of the EU-SCICF to be informed in case of a major cyber incident. The need to designate points of contact should be assessed during the development of the EU-SCICF, taking into account the designated single point of contact under Directive (EU) 2016/1148 that Member States have established on the security of network and information systems to ensure cross-border cooperation with other Member States and with the NIS Cooperation Group (13).

                  (15)

                  The conduct of crisis management and contingency exercises could facilitate the implementation of the EU-SCICF and allow authorities to evaluate their readiness and preparedness for a systemic cyber crisis at Union level. Such exercises would provide authorities with lessons learnt and would enable continuous improvement and evolution of the EU-SCICF.

                  (16)

                  For the development of the EU-SCICF it is essential that the ESAs jointly carry out relevant preparatory work to consider the potential key elements of the framework and the required resources and needs to proceed with its development. After this, the ESAs could start work on a preliminary analysis of any impediments that could hinder the ESAs and relevant authorities’ abilities to establish the EU-SCICF and to share relevant information through communication channels in case of a major cyber incident. Such analysis would be an important step informing any further action, either of legislative nature or other supporting initiatives that the European Commission may take in the post-DORA implementation stage,

            HAS ADOPTED THIS RECOMMENDATION:
      SECTION 1

         RECOMMENDATIONS

         Recommendation A – Establishment of a pan-European systemic cyber incident coordination framework (EU-SCICF)

                  1.

                  It is recommended that, as envisaged in the Commission’s proposal for a Regulation of the European Parliament and of the Council on digital operational resilience for the financial sector (hereinafter ‘DORA’), the European Supervisory Authorities (ESAs), jointly through the Joint Committee, and together with the European Central Bank (ECB), the European Systemic Risk Board (ESRB) and relevant national authorities, start preparing for the gradual development of an effective Union-level coordinated response in the event of a cross-border major cyber incident or related threat that could have a systemic impact on the Union’s financial sector. Preparatory work towards a Union-level coordinated response should entail the gradual development of EU-SCICF for the ESAs, the ECB, the ESRB and relevant national authorities. This also should include an assessment of the resource requirements for the effective development of the EU-SCICF.

                  2.

                  It is recommended that the ESAs undertake, in view of sub-Recommendation A(1), in consultation with the ECB and the ESRB, a mapping and subsequent analysis of current impediments, legal and other operational barriers for the effective development of the EU-SCICF.

         Recommendation B – Establishment of points of contact of the EU-SCICF

      It is recommended that the ESAs, the ECB and each Member State among their relevant national authorities should designate a main point of contact which should be communicated to the ESAs. This contact list will facilitate the development of the framework and, once the EU-SCICF is in place, the points of contact and the ESRB should be informed in case of a major cyber incident. Co-ordination should also be envisaged between the EU-SCICF and the designated single point of contact under Directive (EU) 2016/1148 that Member States have established on the security of network and information systems to ensure cross-border cooperation with other Member States and with the Network and Information Systems Cooperation Group.

         Recommendation C – Appropriate measures at Union level

      It is recommended that, based on the result of the analyses carried out in accordance with Recommendation A, the Commission should consider the appropriate measures needed to ensure effective coordination of responses to systemic cyber incidents.
      SECTION 2

         IMPLEMENTATION

      1.   Definitions

      For the purposes of this Recommendation the following definitions apply:

                  (a)

                  ‘cyber’ means relating to, within, or through the medium of the interconnected information infrastructure of interactions among persons, processes, data, and information systems (14);

                  (b)

                  ‘major cyber incident’ means an ICT-related incident with a potentially high adverse impact on the network and information systems that support critical functions of financial entities (15);

                  (c)

                  ‘systemic cyber crisis’ means a major cyber incident that causes a level of disruption in the Union financial system potentially entailing serious negative consequences for the smooth operation of the internal market and the functioning of the real economy. Such a crisis could result from a major cyber incident causing shocks in a number of channels, including operational, confidence and financial;

                  (d)

                  ‘European Supervisory Authorities’ or the ‘ESAs’ means the European Supervisory Authority (European Banking Authority) established by Regulation (EU) No 1093/2010 of the European Parliament and of the Council (16), together with the European Supervisory Authority (European Insurance and Occupational Pensions Authority) established by Regulation (EU) No 1094/2010 of the European Parliament and of the Council (17) and the European Supervisory Authority (European Securities and Markets Authority) established by Regulation (EU) No 1095/2010 of the European Parliament and of the Council (18);

                  (e)

                  ‘Joint Committee’ means the Joint Committee of the European Supervisory Authorities established in Article 54 of Regulation (EU) No 1093/2010, of Regulation (EU) No 1094/2010 and of Regulation (EU) No 1095/2010;

                  (f)

                  ‘relevant national authority’ means:

                              (1)

                              a competent or supervisory authority in a Member State as specified in the Union acts referred to in Article 1(2) of Regulation (EU) No 1093/2010, of Regulation (EU) No 1094/2010 and of Regulation (EU) No 1095/2010 and any other national competent authority as specified in Union acts that confer tasks on the ESAs;

                              (2)

                              a competent authority in a Member State designated in accordance with:

                                          (i)

                                          Article 4 of Directive 2013/36/EU of the European Parliament and of the Council (19), without prejudice to the specific tasks conferred on the ECB by Council Regulation (EU) No 1024/2013 (20);

                                          (ii)

                                          Article 22 of Directive (EU) 2015/2366 of the European Parliament and of the Council (21);

                                          (iii)

                                          Article 37 of Directive 2009/110/EC of the European Parliament and of the Council (22);

                                          (iv)

                                          Article 4 of Directive (EU) 2019/2034 of the European Parliament and of the Council (23);

                                          (v)

                                          the first indent of point (ee) of Article 3(1) of the proposal for a Regulation of the European Parliament and of the Council on Markets in Crypto-assets, and amending Directive (EU) 2019/1937 (24);

                                          (vi)

                                          Article 11 of Regulation (EU) No 909/2014 of the European Parliament and of the Council (25);

                                          (vii)

                                          Article 22 of Regulation (EU) No 648/2012 of the European Parliament and of the Council (26);

                                          (viii)

                                          Article 67 of Directive 2014/65/EU of the European Parliament and of the Council (27);

                                          (ix)

                                          Article 22 of Regulation (EU) No 648/2012;

                                          (x)

                                          Article 44 of Directive 2011/61/EU of the European Parliament and of the Council (28);

                                          (xi)

                                          Article 97 of Directive 2009/65/EC of the European Parliament and of the Council (29);

                                          (xii)

                                          Article 30 of Directive 2009/138/EC of the European Parliament and of the Council (30);

                                          (xiii)

                                          Article 12 of Directive (EU) 2016/97 of the European Parliament and of the Council (31);

                                          (xiv)

                                          Article 47 of Directive (EU) 2016/2341 of the European Parliament and of the Council (32);

                                          (xv)

                                          Article 22 of Regulation (EC) No 1060/2009 of the European Parliament and of the Council (33);

                                          (xvi)

                                          Article 3(2) and Article 32 of Directive 2006/43/EC of the European Parliament and of the Council (34);

                                          (xvii)

                                          Article 40 of Regulation (EU) 2016/1011 of the European Parliament and of the Council (35);

                                          (xviii)

                                          Article 29 of Regulation (EU) 2020/1503 of the European Parliament and of the Council (36);

                              (3)

                              an authority entrusted with the adoption and/or activation of macroprudential policy measures or with other financial stability tasks, such as related supporting analysis, including but not limited to:

                                          (i)

                                          a designated authority pursuant to Chapter 4 of Title VII of Directive 2013/36/EU or Article 458(1) of Regulation (EU) No 575/2013 of the European Parliament and of the Council (37);

                                          (ii)

                                          a macroprudential authority with the objectives, arrangements, tasks, powers, instruments, accountability requirements and other characteristics set out in Recommendation ESRB/2011/3 of the European Systemic Risk Board (38);

                  (g)

                  ‘relevant authority’ means:

                              (1)

                              an ESA;

                              (2)

                              the ECB for the tasks conferred to it in accordance with Articles 4(1) and (2) and Article 5(2) of Regulation (EU) No 1024/2013;

                              (3)

                              a relevant national authority.

            2.   Criteria for implementation

      The following criteria apply to the implementation of this Recommendation:

                  (a)

                  due regard should be paid to the need-to-know principle and the principle of proportionality, taking into account the objective and the content of each Recommendation;

                  (b)

                  the specific compliance criteria set out in the Annex in relation to each Recommendation should be met.

            3.   Timeline for the follow-up

      In accordance with Article 17(1) of Regulation (EU) No 1092/2010 addressees must communicate to the European Parliament, the Council, the Commission and to the ESRB the actions undertaken in response to this Recommendation or substantiate any inaction. Addressees are requested to submit such communication in compliance with the following timelines:

                  1.

                  Recommendation A

                              (a)

                              By 30 June 2023 but no earlier than six months after DORA enters into force, the ESAs are requested to deliver to the European Parliament, the Council, the Commission and to the ESRB an interim report on the implementation of sub-Recommendation A(1).

                              (b)

                              By 30 June 2024 but no earlier than 18 months after DORA enters into force, the ESAs are requested to deliver to the European Parliament, the Council, the Commission and to the ESRB a final report on the implementation of sub-Recommendation A(1).

                              (c)

                              By 30 June 2025 but no earlier than 30 months after DORA enters into force, the ESAs are requested to deliver to the European Parliament, the Council, the Commission and to the ESRB a report on the implementation of sub-Recommendation A(2).

                  2.

                  Recommendation B
                  By 30 June 2023 but no earlier than six months after DORA enters into force, the ESAs, the ECB and Member States are requested to deliver to the European Parliament, the Council, the Commission and to the ESRB a report on the implementation of Recommendation B.

                  3.

                  Recommendation C

                              (a)

                              By 31 December 2023 but no earlier than 12 months after DORA enters into force, the Commission is requested to deliver to the European Parliament, the Council, and to the ESRB a report on the implementation of Recommendation C in view of the interim report of the ESAs in accordance with sub-Recommendation A(1).

                              (b)

                              By 31 December 2025 but no earlier than 36 months after DORA enters into force, the Commission is requested to deliver to the European Parliament, the Council, and to the ESRB a report on the implementation of Recommendation C in view of the reports of the ESAs in accordance with Recommendation A.

            4.   Monitoring and assessment

                  1.

                  The ESRB Secretariat will:

                              (a)

                              assist the addressees, ensuring the coordination of reporting and the provision of relevant templates, and detailing where necessary the procedure and the timeline for the follow-up;

                              (b)

                              verify the follow-up by the addressees, provide assistance at their request, and submit follow-up reports to the General Board. The assessments will be initiated as follows:

                                          (i)

                                          within 12 months after the entry into force of DORA, regarding the implementation of Recommendation A and B;

                                          (ii)

                                          within 18 months after the entry into force of DORA, regarding the implementation of Recommendation C;

                                          (iii)

                                          within 24 months after the entry into force of DORA, regarding the implementation of Recommendation A;

                                          (iv)

                                          within 36 months after the entry into force of DORA, regarding the implementation of Recommendation A;

                                          (v)

                                          within 42 months after the entry into force of DORA, regarding the implementation of Recommendation C;

                  2.

                  The General Board will assess the actions and justifications communicated by the addressees and, where appropriate, may decide that this Recommendation has not been followed and that an addressee has failed to provide adequate justification for its inaction.

         Done at Frankfurt am Main, 2 December 2021.

               The Head of the ESRB Secretariat,

               on behalf of the General Board of the ESRB

            Francesco MAZZAFERRO

         (1)  OJ L 1, 3.1.1994, p. 3.

         (2)  OJ L 331, 15.12.2010, p. 1.

         (3)  OJ C 58, 24.2.2011, p. 4.

         (4)  Recommendation ESRB/2013/1 of the European Systemic Risk Board of 4 April 2013 on intermediate objectives and instruments of macro-prudential policy (OJ C 170, 15.6.2013, p. 1).

         (5)  See Systemic cyber risk, ESRB, February 2020, available on the ESRB website at www.esrb.europa.eu

         (6)  See Internet Organised Crime Threat Assessment, Europol, 2020, available on the Europol website at www.europol.europa.eu

         (7)  See IT and cyber risk: a constant challenge, ECB, 2021, available on the ECB Banking Supervision website at www.bankingsupervision.europa.eu

         (8)  See Systemic cyber risk, ESRB, February 2020, available on the ESRB website at www.esrb.europa.eu

         (9)  See Mitigating systemic cyber risk, ESRB, 2021, (forthcoming).

         (10)  COM/2020/595 final.

         (11)  Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

         (12)  See draft Article 43 of the proposal for DORA.

         (13)  See European Commission, NIS Cooperation Group, available on the European Commission website at ec.europa.eu

         (14)  See Cyber Lexicon, FSB, 12 November 2018, available on the FSB website at www.fsb.org

         (15)  See point (7) of draft Article 3 of the proposal for DORA.

         (16)  Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).

         (17)  Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Investment and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48).

         (18)  Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84).

         (19)  Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).

         (20)  Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63).

         (21)  Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35).

         (22)  Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC (OJ L 267, 10.10.2009, p. 7).

         (23)  Directive (EU) 2019/2034 of the European Parliament and of the Council of 27 November 2019 on the prudential supervision of investment firms and amending Directives 2002/87/EC, 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU (OJ L 314, 5.12.2019, p. 64).

         (24)  COM/2020/593 final.

         (25)  Regulation (EU) No 909/2014 of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives 98/26/EC and 2014/65/EU and Regulation (EU) No 236/2012 (OJ L 257, 28.8.2014, p. 1).

         (26)  Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories (OJ L 201, 27.7.2012, p. 1).

         (27)  Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).

         (28)  Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010 (OJ L 174, 1.7.2011, p. 1).

         (29)  Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS) (OJ L 302, 17.11.2009, p. 32).

         (30)  Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (OJ L 335, 17.12.2009, p. 1).

         (31)  Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution (OJ L 26, 2.2.2016, p. 19).

         (32)  Directive (EU) 2016/2341 of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (OJ L 354, 23.12.2016, p. 37).

         (33)  Regulation (EC) No 1060/2009 of the European Parliament and of the Council of 16 September 2009 on credit rating agencies (OJ L 302, 17.11.2009, p. 1).

         (34)  Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC (OJ L 157, 9.6.2006, p. 87).

         (35)  Regulation (EU) 2016/1011 of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/2014 (OJ L 171, 29 June 2016, p. 1).

         (36)  Regulation (EU) 2020/1503 of the European Parliament and of the Council of 7 October 2020 on European crowdfunding service providers for business and amending Regulation (EU) 2017/1129 and Directive (EU) 2019/1937 (OJ L 347, 20.10.2020, p. 1).

         (37)  Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1).

         (38)  Recommendation ESRB/2011/3 of the European Systemic Risk Board of 22 December 2011 on the macro-prudential mandate of national authorities (OJ C 41, 14.2.2012, p. 1).

         ANNEX
         SPECIFICATION OF THE COMPLIANCE CRITERIA APPLICABLE TO THE RECOMMENDATIONS

            Recommendation A – Establishment of a pan-European systemic cyber incident coordination framework (EU-SCICF)

         For sub-Recommendation A(1), the following compliance criteria are specified.

                     1.

                     When preparing for an effective Union-level coordinated response which should entail the gradual development of the EU-SCICF by exercising the power envisaged in the future Regulation of the European Parliament and of the Council on digital operational resilience for the financial sector (hereinafter ‘DORA’), the European Supervisory Authorities (ESAs), acting through the Joint Committee, and together with the European Central Bank (ECB), the European Systemic Risk Board (ESRB) and relevant national authorities, and in consultation with the European Union Agency for Network and Information Security and the Commission where considered necessary, should consider including in the envisaged preparation for the EU-SCICF at least the following aspects:

                                 (a)

                                 analysis of the resource requirements for effective development of the EU-SCICF;

                                 (b)

                                 developing crisis management and contingency exercises involving cyberattack scenarios with a view to developing communication channels;

                                 (c)

                                 development of a common vocabulary;

                                 (d)

                                 development of a coherent cyber incident classification;

                                 (e)

                                 establishment of secure and reliable information sharing channels, including back-up systems;

                                 (f)

                                 establishment of points of contact;

                                 (g)

                                 address confidentiality in information sharing;

                                 (h)

                                 collaboration and information sharing initiatives with financial sector cyber intelligence;

                                 (i)

                                 development of effective activation and escalation processes through situational awareness;

                                 (j)

                                 clarification of the responsibilities of framework participants;

                                 (k)

                                 development of interfaces for cross-sectoral and, where relevant, third country coordination;

                                 (l)

                                 ensuring coherent communication by relevant authorities with the public to preserve confidence;

                                 (m)

                                 establishment of predefined communication lines for timely communication;

                                 (n)

                                 performance of appropriate framework testing exercises, including cross-jurisdictional testing and third country coordination, and assessments which result in lessons learned and framework evolution;

                                 (o)

                                 ensuring effective communication and countermeasures against disinformation.

            Recommendation B – Establishment of points of contact of the EU-SCICF

         For Recommendation B, the following compliance criteria are specified.

                     1.

                     The ESAs, the ECB and each Member State among their relevant national authorities should agree on a common approach to sharing and keeping updated the list of designated points of contact of the EU-SCICF.

                     2.

                     The designation of the point of contact should be assessed taking into account the designated single point of contact under Directive (EU) 2016/1148 that Member States have established in respect of the security of network and information systems to ensure cross-border cooperation with other Member States and with the Network and Information Systems Cooperation Group.

            Recommendation C – Changes to the Union legal framework

         For Recommendation C, the following compliance criterion is specified.
         The Commission should consider whether any measures, including changes to relevant Union legislation, are needed as a result of the analysis carried out in accordance with Recommendation A to ensure that the ESAs, through the Joint Committee and together with the ECB, the ESRB and relevant national authorities, can develop the EU-SCICF in accordance with sub-Recommendation A(1) and to ensure that the ESAs, the ECB, the ESRB and the relevant national authorities, as well as other authorities can engage in coordination actions and exchange of information that is sufficiently detailed and consistent to support an effective EU-SCICF.


title: Recommendation of the European Central Bank of 25 March 2022 amending Recommendation ECB/2017/10 on common specifications for the exercise of some options and discretions available in Union law by national competent authorities in relation to less significant institutions (ECB/2022/13) 2022/C 142/01

text:
                  30.3.2022

                  EN

                  Official Journal of the European Union

                  C 142/1

         RECOMMENDATION OF THE EUROPEAN CENTRAL BANK
         of 25 March 2022
         amending Recommendation ECB/2017/10 on common specifications for the exercise of some options and discretions available in Union law by national competent authorities in relation to less significant institutions
         (ECB/2022/13)
         (2022/C 142/01)
         THE GOVERNING COUNCIL OF THE EUROPEAN CENTRAL BANK,
         Having regard to the Treaty on the Functioning of the European Union,
         Having regard to Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (1), and in particular Article 4(3) and Article 6(1) and (5)(c) thereof,
         Whereas:

                     (1)

                     On 4 April 2017 the European Central Bank (ECB) adopted Recommendation ECB/2017/10 of the European Central Bank (2) (hereinafter the ‘O&D Recommendation’), in which it established common specifications for the exercise of certain options and discretions available in Union law by national competent authorities (NCAs) in relation to less significant institutions. Legislation introduced since the adoption of the O&D Recommendation has amended or deleted some of the options and discretions provided in Union law that were included in the O&D Recommendation, and the ECB Guide on options and discretions available in Union law of November 2016 (hereinafter the ‘ECB Guide’) has also been updated. Therefore, certain consequential amendments to the O&D Recommendation are necessary.

                     (2)

                     With respect to the options and discretions related to consolidated supervision and waivers of prudential requirements, in line with the specifications contained in Chapter 1 of Section II of the ECB Guide, NCAs should be encouraged to adopt a prudent approach when granting such waivers on an individual basis. Rules on the identification of the consolidating supervisor and the methods and scope of consolidation and sub-consolidation should also be applied in a manner consistent with the ECB Guide.

                     (3)

                     With regard to liquidity waivers at the cross-border level, the ECB recommends a specific approach for less significant institutions given that not all the specifications for the assessment of applications included in the ECB Guide are relevant for these institutions.

                     (4)

                     The ECB recommends a consistent and prudent approach with respect to options and discretions related to own funds requirements, in line with the specifications contained in Chapter 2 of Section II of the ECB Guide. To reflect specificities of less significant institutions in relation to the excess capital margin requirement for reductions of own funds, certain adjustments of those specifications are necessary.

                     (5)

                     The ECB recommends a consistent and prudent approach with respect to the options and discretions related to liquidity requirements, which should follow the specifications set out in Chapter 6 of Section II of the ECB Guide, as these options and discretions have an impact on the calculation of liquidity coverage ratio requirements, for example by specifying the treatment of specific inflows and outflows.

                     (6)

                     As regards outflows from trade finance off-balance-sheet related products, specifications have been added to the ECB Guide to take account of the new ECB policy which allows additional flexibility in the determination of outflow rates. Therefore, to ensure consistency in the application of outflow rates to trade finance off-balance-sheet exposures amongst significant and less significant institutions, NCAs should follow the specifications included in the ECB Guide.

                     (7)

                     As regards the outflow rates to be applied to stable retail deposits, certain factors have impeded the practical application of the discretion addressed in Article 13 of Regulation (EU) 2016/445 of the European Central Bank (ECB/2016/4) (3) whereby competent authorities may authorise institutions to apply a 3 % outflow rate to stable retail deposits covered by a deposit guarantee scheme (DGS), subject to the prior approval of the European Commission in accordance with Article 24(4) and (5) of Commission Delegated Regulation (EU) 2015/61 (4). Further evidence and analysis are necessary in order to demonstrate that the run-off rates for stable retail deposits covered by a DGS as referred to in Article 24(5) of Delegated Regulation (EU) 2015/61 would be below 3 % during any stress period experienced consistent with the scenarios referred to in Article 5 of Delegated Regulation (EU) 2015/61. In the absence of such evidence and analysis, the general specification of a 3 % outflow rate has been removed from Guideline ECB/2017/9 of the European Central Bank (5) concerning the exercise of options and discretions available in Union law by national competent authorities in relation to less significant institutions. The ECB’s position towards this option has been set out in Section III of the ECB Guide. To ensure consistency in the exercise of options and discretions in relation to significant and less significant institutions, NCAs should adopt the same position.

                     (8)

                     With respect to the options and discretions related to the leverage ratio, the ECB recommends a consistent and prudent approach, in common with the specifications set out in Chapter 3 of Section I of the ECB Guide and Chapter 7 of Section II thereof.

                     (9)

                     With respect to the options and discretions related to intermediate parent undertakings and the possibility for competent authorities to allow two or more institutions in the Union which are part of the same third-country group to have two intermediate EU parent undertakings pursuant to Article 21b(2) of Directive 2013/36/EU of the European Parliament and of the Council (6), and to the relevance of such possibility in the case of less significant institutions, the ECB recommends that NCAs adopt an approach consistent with that set out in Chapter 9 of Section II of the ECB Guide, in order to ensure a level playing field.

                     (10)

                     With respect to the options and discretions related to reporting requirements for institutions, in particular concerning valuation of assets and off-balance-sheet items and concerning reporting waivers, the ECB recommends that NCAs follow the approach set out in Chapter 8 of Section II of the ECB Guide, so as to ensure both a consistent application of policy standards across the Single Supervisory Mechanism and a level playing field.

                     (11)

                     With respect to the options and discretions related to governance, the O&D Recommendation should be amended to reflect legislative changes concerning the supervisory treatment of (mixed) financial holding companies.

                     (12)

                     Therefore, Recommendation ECB/2017/10 should be amended accordingly,

               HAS ADOPTED THIS RECOMMENDATION:

            PART ONE

            Amendments

         Recommendation ECB/2017/10 is amended as follows:

                     1.

                     in Part One, paragraph 2 in Section I is replaced by:

                                 ‘2.

                                 Definitions
                                 For the purposes of this Recommendation, the definitions set out in Regulation (EU) No 1024/2013, Regulation (EU) No 468/2014 (ECB/2014/17), Regulation (EU) No 575/2013, Directive 2013/36/EU, Commission Delegated Regulation (EU) 2015/61 (*1) and Directive 2014/59/EU of the European Parliament and of the Council (*2) apply.

                        (*1)  Commission Delegated Regulation (EU) 2015/61 of 10 October 2014 to supplement Regulation (EU) No 575/2013 of the European Parliament and the Council with regard to liquidity coverage requirement for credit institutions (OJ L 11, 17.1.2015, p. 1)."

                        (*2)  Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012 of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190).’;"

                     2.

                     in Part Two, the following Section IIa is inserted:
                     ‘IIa.

                        Own funds requirements

                                 1.

                                 Article 78(1)(b) of Regulation (EU) No 575/2013: reduction of own funds: excess capital margin requirement

                                             1.1

                                             An NCA should determine the excess margin required pursuant to Article 78(1)(b) of Regulation (EU) No 575/2013 for the purpose of a reduction of own funds, provided that the conditions of Article 78(1) are met and after assessing all of the following factors:

                                                         (a)

                                                         whether the credit institution taking any of the actions referred to in Article 77(1) of Regulation (EU) No 575/2013 would continue to exceed, over a three-year horizon, the overall capital requirements set out in the most recent applicable supervisory review and evaluation process (SREP) decision by at least the guidance on additional own funds set out in the same SREP decision;

                                                         (b)

                                                         whether the credit institution taking any of the actions referred to in Article 77(1) of Regulation (EU) No 575/2013 would continue to exceed, over a three-year horizon, the requirements laid down in Directive 2014/59/EU by at least the margin which the National Resolution Authority or the Single Resolution Board, in agreement with the NCA, would consider necessary to fulfil the condition set out in Article 78a of Regulation (EU) No 575/2013;

                                                         (c)

                                                         the impact of the planned reduction on the relevant tier of own funds;

                                                         (d)

                                                         whether the credit institution taking any of the actions referred to in Article 77(1) of Regulation (EU) No 575/2013 would continue to exceed, over a three-year horizon, the leverage ratio requirement laid down in Article 92(1)(d) of that Regulation, and the additional own funds requirement to address the risk of excessive leverage set out in the most recent applicable SREP decision, by at least the guidance on additional own funds to address the risk of excessive leverage set out in that SREP decision.

                                             1.2

                                             Applications to reduce own funds received from credit institutions that do not adhere to the margins set out above should still be approved on a case-by-case basis where they are duly justified by well-founded prudential arguments. Where the margin under point (b) of paragraph 1.1 is not adhered to, the NCA should seek the opinion of the National Resolution Authority or the Single Resolution Board on whether the own funds reduction may jeopardise the fulfilment of the requirements for own funds and eligible liabilities laid down in Directive 2014/59/EU.

                                             1.3

                                             Where for the purposes of point (a) or (d) of paragraph 1.1 the credit institution is not subject to guidance on additional own funds, the margin must be determined on a case-by-case basis, having regard to the specific circumstances of the credit institution.

                                 2.

                                 Second subparagraph of Article 78(1) of Regulation (EU) No 575/2013: reduction of own funds: general prior permission
                                 An NCA should grant the general prior permission provided for in the second subparagraph of Article 78(1) of Regulation (EU) No 575/2013 where the conditions set out therein and in Commission Delegated Regulation (EU) No 241/2014 (*3) are met. An NCA should determine the margin specified in the second subparagraph of Article 78(1) of Regulation (EU) No 575/2013, after assessing all of the factors set out in paragraph 1 of Section IIa of this Recommendation.

                                 3.

                                 In Part Two, Section V is deleted;

                                 4.

                                 The Annex is replaced by the Annex to this Recommendation.

            PART TWO

            Addressees

         This Recommendation is addressed to the NCAs of participating Member States.
         NCAs are recommended to apply this Recommendation as of the date of its adoption.

            Done at Frankfurt am Main, 25 March 2022.

                  The President of the ECB

               Christine LAGARDE

            (1)  OJ L 287, 29.10.2013, p.63.

            (2)  Recommendation of the European Central Bank of 4 April 2017 on common specifications for the exercise of some options and discretions available in Union law by national competent authorities in relation to less significant institutions (ECB/2017/10) (OJ C 120, 13.4.2017, p. 2).

            (3)  Regulation (EU) 2016/445 of the European Central Bank of 14 March 2016 on the exercise of options and discretions available in Union law (ECB/2016/4) (OJ L 78, 24.3.2016, p. 60).

            (4)  Commission Delegated Regulation (EU) 2015/61 of 10 October 2014 to supplement Regulation (EU) No 575/2013 of the European Parliament and the Council with regard to liquidity coverage requirement for Credit Institutions (OJ L 11, 17.1.2015, p. 1).

            (5)  Guideline (EU) 2017/697 of the European Central Bank of 4 April 2017 on the exercise of the options and discretions available in Union law by national competent authorities in relation to less significant institutions (ECB/2017/9) (OJ L 101, 13.4.2017, p. 156).

            (6)  Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).

            ANNEX
            The Annex to Recommendation ECB/2017/10 is replaced by the following:

                     ‘ANNEX

                                 Legal basis of the option and/or discretion

                                 Approach recommended: consistency with the policy on options and discretions for significant institutions

                                       Consolidated supervision and waivers of prudential requirements

                                 Article 7(1) to (3) of Regulation (EU) No 575/2013: capital waivers

                                 Section II, Chapter 1 paragraph 3 of the ECB Guide

                                 Article 8(1) and (2) of Regulation (EU) No 575/2013: liquidity waivers

                                 Section II, Chapter 1 paragraph 4 of the ECB Guide

                                 Article 9 of Regulation (EU) No 575/2013: individual consolidation method

                                 Section II, Chapter 1 paragraph 5 of the ECB Guide

                                 Article 10(1) and (2) of Regulation (EU) No 575/2013: waivers for credit institutions permanently affiliated to a central body

                                 Section II, Chapter 1 paragraph 6 of the ECB Guide

                                 Article 18(3) of Regulation (EU) No 575/2013: methods for consolidation in the case of undertakings related within the meaning of Article 22(7) of Directive 2013/34/EU

                                 Section III, Chapter 1 paragraph 1 of the ECB Guide

                                 Article 18(5) of Regulation (EU) No 575/2013: methods for consolidation in the case of participations or capital ties other than those referred to in Article 18(1) and (4)

                                 Section III, Chapter 1 paragraph 2 of the ECB Guide

                                 Article 18(6) of Regulation (EU) No 575/2013: consolidation in the cases of significant influence and common management

                                 Section III, Chapter 1 paragraph 3 of the ECB Guide

                                 Article 18(7) of Regulation (EU) No 575/2013: consolidation

                                 Section II, Chapter 1 paragraph 8 of the ECB Guide

                                 Article 18(8) of Regulation (EU) No 575/2013: consolidation

                                 Section III, Chapter 1 paragraph 4 of the ECB Guide

                                 Article 19(2) of Regulation (EU) No 575/2013: exclusion of consolidation

                                 Section II, Chapter 1 paragraph 9 of the ECB Guide

                                 Article 24(2) of Regulation (EU) No 575/2013: valuation of assets and off-balance sheet items – use of International Financial Reporting Standards for prudential purposes

                                 Section II, Chapter 1 paragraph 10 of the ECB Guide

                                       Own funds

                                 Article 26(3) of Regulation (EU) No 575/2013: classification as CET1 instruments of subsequent issuances

                                 Section II, Chapter 2 paragraph 3 of the ECB Guide

                                 Article 49(1) of Regulation (EU) No 575/2013: deduction of insurance holdings

                                 Section II, Chapter 2 paragraph 5 of the ECB Guide

                                 Article 49(2) of Regulation (EU) No 575/2013: deduction of holdings of financial sector entities

                                 Section II, Chapter 2 paragraph 6 of the ECB Guide

                                 Article 54(1)(e) of Regulation (EU) No 575/2013: calculation of the trigger for additional Tier 1 instruments issued by subsidiary undertakings established in third countries

                                 Section II, Chapter 2 paragraph 7 of the ECB Guide

                                 Article 78(3) of Regulation (EU) No 575/2013: reduction of own funds – mutuals, savings and cooperatives

                                 Section II, Chapter 2 paragraph 10 of the ECB Guide

                                 Article 78(4) of Regulation (EU) No 575/2013: reduction of additional Tier 1 or Tier 2 instruments

                                 Section II, Chapter 2 paragraph 11 of the ECB Guide

                                 Article 79(1) of Regulation (EU) No 575/2013: reduction of additional Tier 1 or Tier 2 instruments

                                 Section II, Chapter 2 paragraph 12 of the ECB Guide

                                 Article 83(1) of Regulation (EU) No 575/2013: waiver for additional Tier 1 and Tier 2 instruments issued by a special purpose entity

                                 Section II, Chapter 2 paragraph 13 of the ECB Guide

                                 Article 84(5) of Regulation (EU) No 575/2013: minority interests included in consolidated Common Equity Tier 1 capital

                                 Section II, Chapter 2 paragraph 14 of the ECB Guide

                                 Article 142(1) of Directive 2013/36/EU: failure to meet combined buffer requirement or leverage ratio buffer requirement

                                 Section II, Chapter 11 paragraph 12 of the ECB Guide

                                       Capital requirements

                                 Article 113(6) of Regulation (EU) No 575/2013: calculation of risk weighted exposure amounts – intra-group exposures

                                 Section II, Chapter 3 paragraph 3 of the ECB Guide

                                 Article 162(1) of Regulation (EU) No 575/2013: maturity of exposures

                                 Section II, Chapter 3 paragraph 5 of the ECB Guide

                                 Article 225(2) of Regulation (EU) No 575/2013: own estimates of volatility adjustments

                                 Section II, Chapter 3 paragraph 6 of the ECB Guide

                                 Article 244(2) and the second subparagraph of Article 245(2) of Regulation (EU) No 575/2013: significant risk transfer

                                 Section II, Chapter 3 paragraph 9 of the ECB Guide

                                 Article 283(3) of Regulation (EU) No 575/2013: implementation of the internal model method

                                 Section II, Chapter 3 paragraph 8 of the ECB Guide

                                 Article 284(4) and (9) of Regulation (EU) No 575/2013: calculation of the exposure value for counterparty credit risk

                                 Section II, Chapter 3 paragraph 9 of the ECB Guide

                                 Article 366(4) of Regulation (EU) No 575/2013: calculation of the value-at-risk number

                                 Section II, Chapter 3 paragraph 13 of the ECB Guide

                                       Institutional protection schemes

                                 Article 8(4) of Regulation (EU) No 575/2013: liquidity waiver for members of institutional protection schemes

                                 Section II, Chapter 4 paragraph 3 of the ECB Guide

                                       Large exposures

                                 Article 396(1) of Regulation (EU) No 575/2013: compliance with large exposures requirements

                                 Section II, Chapter 5 paragraph 3 of the ECB Guide

                                 Article 400(2)(c) of Regulation (EU) No 575/2013: compliance with large exposures requirements

                                 Section II, Chapter 5 paragraph 4 of the ECB Guide

                                       Liquidity

                                 Article 414 of Regulation (EU) No 575/2013: compliance with liquidity requirements

                                 Section II, Chapter 6 paragraph 3 of the ECB Guide

                                 Article 422(8) of Regulation (EU) No 575/2013 and Article 29 of Delegated Regulation (EU) 2015/61: intragroup liquidity outflows

                                 Section II, Chapter 6 paragraph 10 of the ECB Guide

                                 Article 425(4) of Regulation (EU) No 575/2013 and Article 34 of Delegated Regulation (EU) 2015/61: intragroup liquidity inflows

                                 Section II, Chapter 6, paragraph 14 of the ECB Guide

                                 Article 8(1) of Delegated Regulation (EU) 2015/61: diversification of holdings of liquid assets

                                 Section II, Chapter 6 paragraph 5 of the ECB Guide

                                 Article 8(3)(c) of Delegated Regulation (EU) 2015/61: management of liquid assets

                                 Section II, Chapter 6 paragraph 6 of the ECB Guide

                                 Article 8(6) of Delegated Regulation (EU) 2015/61: currency mismatches

                                 Section II, Chapter 6 paragraph 4 of the ECB Guide

                                 Article 17(4) of Delegated Regulation (EU) 2015/61: waiver of the unwind mechanism

                                 Section I, Chapter 3 paragraph 1 of the ECB Guide

                                 Article 23(2) of Delegated Regulation (EU) 2015/61: outflows from other products and services

                                 Section II, Chapter 6 paragraph 7 of the ECB Guide

                                 Article 24(4) and (5) of Delegated Regulation (EU) 2015/61 outflows from stable retail deposits

                                 Section III, Chapter 3 paragraph 1 of the ECB Guide

                                 Article 24(6) of Delegated Regulation (EU) 2015/61: multiplier for retail deposits covered by a deposit guarantee scheme

                                 Section III, Chapter 3 paragraph 3 of the ECB Guide

                                 Article 25(3) of Delegated Regulation (EU) 2015/61: higher outflow rates

                                 Section II, Chapter 6 paragraph 8 of the ECB Guide

                                 Article 26 of Delegated Regulation (EU) 2015/61: outflows with inter-dependent inflows

                                 Section II, Chapter 6 paragraph 9 of the ECB Guide

                                 Article 29 of Delegated Regulation (EU) 2015/61: preferential treatment within a group or an institutional protection scheme (IPS)

                                 Section II, Chapter 6 paragraph 10 of the ECB Guide

                                 Article 30(2) of Delegated Regulation (EU) 2015/61: additional collateral outflows from downgrade triggers

                                 Section II, Chapter 6 paragraph 11 of the ECB Guide

                                 Article 33(2) of Delegated Regulation (EU) 2015/61: cap on inflows

                                 Section II, Chapter 6 paragraph 12 of the ECB Guide

                                 Article 33(3) to (5) of Delegated Regulation (EU) 2015/61: specialised credit institutions

                                 Section II, Chapter 6 paragraph 13 of the ECB Guide

                                 Article 34 of Delegated Regulation (EU) 2015/61: inflows within a group or an institutional protection scheme

                                 Section II, Chapter 6 paragraph 14 of the ECB Guide

                                 Article 428b(5) of Regulation (EU) No 575/2013: net stable funding requirement (NSFR) - restriction of currency mismatches

                                 Section II, Chapter 6 paragraph 15 of the ECB Guide

                                 Article 428f(1) of Regulation (EU) No 575/2013: NSFR - interdependent assets and liabilities

                                 Section II, Chapter 6 paragraph 16 of the ECB Guide

                                 Article 428h of Regulation (EU) No 575/2013: NSFR - Preferential treatment within a group or an IPS

                                 Section II, Chapter 6 paragraph 17 of the ECB Guide.

                                 Article 428p(7) of Regulation (EU) No 575/2013: NSFR - treatment of non-standard central bank operations

                                 Section I, Chapter 3 paragraph 1 of the ECB Guide

                                 Article 428ai of Regulation (EU) No 575/2013: NSFR - application of the simplified net stable funding requirement (sNSFR)

                                 Section II, Chapter 6 paragraph 18 of the ECB Guide

                                 Article 428aq(7) of Regulation (EU) No 575/2013 - NSFR - treatment of non-standard central bank operations (sNSFR)

                                 Section I, Chapter 3 paragraph 1 of the ECB Guide

                                 Article 8 of Regulation (EU) No 575/2013: liquidity waivers

                                 Section II, Chapter 4 paragraph 3 of the ECB Guide

                                       Leverage

                                 Article 429a(2) of Regulation (EU) No 575/2013: preferential treatment in favour of public development banks

                                 Section II, Chapter 7 paragraph 3 of the ECB Guide

                                 Article 429a(5) of Regulation (EU) No 575/2013: exemption of central bank reserves from calculation of leverage ratio

                                 Section I, Chapter 3 paragraph 1 of the ECB Guide

                                 Article 429b(3) of Regulation (EU) No 575/2013: preferential treatment for notional cash pooling arrangements

                                 Section II, Chapter 7 paragraph 4 of the ECB Guide

                                       Reporting requirements

                                 Article 430(11) of Regulation (EU) No 575/2013: reporting on prudential requirements and financial information

                                 Section II, Chapter 8 paragraph 1 of the ECB Guide

                                       General requirements for access to the activity of credit institutions

                                 Article 21(1) of Directive 2013/36/EU: waiver for credit institutions permanently affiliated to a central body

                                 Section II, Chapter 9 paragraph 1 of the ECB Guide

                                 Article 21b(2) of Directive 2013/36/EU: intermediate parent undertaking

                                 Section II, Chapter 9 paragraph 2 of the ECB Guide

                                       Governance arrangements and prudential supervision

                                 Article 88(1)(e) of Directive 2013/36/EU: combining the functions of the chairman and CEO

                                 Section II, Chapter 11 paragraph 4 of the ECB Guide

                                 Article 91(6) of Directive 2013/36/EU: additional non-executive directorship

                                 Section II, Chapter 11 paragraph 5 of the ECB Guide

                                 Article 108(1) of Directive 2013/36/EU: internal capital adequacy assessment process for credit institutions permanently affiliated to a central body

                                 Section II, Chapter 11 paragraph 6 of the ECB Guide

                                 Articles 117 and 118 of Directive 2013/36/EU: cooperation obligations

                                 Section II, Chapter 11 paragraph 9 of the ECB Guide

                                 Article 142 of Directive 2013/36/EU: capital conservation plans

                                 Section II, Chapter 11 paragraph 12 of the ECB Guide

               ’


title: Commission Recommendation (EU) 2022/553 of 5 April 2022 on monitoring the presence of Alternaria toxins in food

text:
               6.4.2022

               EN

               Official Journal of the European Union

               L 107/90

      COMMISSION RECOMMENDATION (EU) 2022/553
      of 5 April 2022
      on monitoring the presence of Alternaria toxins in food
      THE EUROPEAN COMMISSION,
      Having regard to the Treaty on the Functioning of the European Union, and in particular Article 292 thereof,
      Whereas:

                  (1)

                  The European Food Safety Authority (EFSA) Panel on Contaminants in the Food Chain (CONTAM) adopted a scientific opinion in 2011 on the risks that the presence of Alternaria in food poses to animal and public health (1).

                  (2)

                  EFSA also published more recently a scientific report on the dietary exposure assessment of Alternaria toxins in the European population (2). It concluded that the estimated chronic dietary exposure to the Alternaria toxins alternariol, alternariol monomethyl ether and tenuazonic acid exceeds the relevant threshold of toxicological concern, indicating a need for additional compound-specific toxicity data.

                  (3)

                  EFSA recommended that more occurrence data should be gathered on the presence of Alternaria toxins in relevant foodstuffs (fruit and fruit products, tomatoes and tomato-based products, and cereal-based food for infants and young children, among others). EFSA also recommended that more sensitive analytical methods be used in order to reduce the uncertainty about the exposure to the various Alternaria toxins due to the high proportion of data reported as ‘below the limit of quantification (LOQ)’ in the currently available dataset as the analytical methods used were not always sufficiently sensitive.

                  (4)

                  Good agricultural practices, good storage and transport conditions and good manufacturing practices can reduce or prevent the presence of Alternaria toxins in food. More information must however be gathered on the factors that lead to relatively high levels of Alternaria toxins in certain foodstuffs in order to be able to identify the measures to be taken to avoid or reduce the presence of these Alternaria toxins in these foodstuffs.

                  (5)

                  To provide orientation on when it would be appropriate to identify the factors that lead to relatively high levels or even significant levels of Alternaria toxins in foodstuffs, it is necessary to establish indicative values for foods based on the data available in EFSA’s database. Indicative levels have only been set for the foodstuffs for which sufficient occurrence data are available.

                  (6)

                  It is therefore appropriate to recommend the monitoring of Alternaria toxins in food and the identification of the factors resulting in their high levels in certain food,

            HAS ADOPTED THIS RECOMMENDATION:

                  (1)

                  Member States, in close cooperation with the food business operators should monitor the Alternaria toxins alternariol, alternariol monomethyl ether and tenuazonic acid in food, in particular in processed tomato products, paprika powder, sesame seeds, sunflower seeds, sunflower oil, tree nuts, dried figs and cereal-based foods for infants and young children. If possible, other Alternaria toxins should also be analysed and the results reported to the European Food Safety Authority.

                  (2)

                  To ensure that the samples are representative, Member States should follow the relevant sampling procedures laid down in Commission Regulation (EC) No 401/2006 of 23 February 2006 (3). For processed tomato products, the sampling procedure should be performed in accordance with the rules set out in Part H (liquid products) or Part I (solid products) of Annex I to Regulation (EC) No 401/2006. Where the sampling procedure applied by the food business operator deviates from the procedure set out in Regulation (EC) No 401/2006, it should remain representative for the lot.

                  (3)

                  For the determination of alternariol and alternariol monomethyl ether, the LOQ should not be higher than 2 μg/kg in cereal-based foods for infants and young children and 4 μg/kg in other foods, and for the determination of tenuazonic acid, the LOQ should not be higher than 20 μg/kg in all foods.

                  (4)

                  Member States, with the active involvement of the food business operators, should carry out investigations to identify the factors resulting in these levels above the indicative levels and on the effects of processing on the level of these Alternaria toxins, provided in Annex to this Recommendation.

                  (5)

                  Member States and food business operators should provide to EFSA, by 30 June of each year, the data for the previous year for compilation into one database in line with the requirements of EFSA’s Guidance on Standard Sample Description (SSD) for Food and Feed and EFSA’s additional specific reporting requirements (4).

         Done at Brussels, 5 April 2022.

               For the Commission

            Stella KYRIAKIDES

               Member of the Commission

         (1)  EFSA on Contaminants in the Food Chain (CONTAM); Scientific Opinion on the risks for animal and public health related to the presence of Alternaria toxins in feed and food. EFSA Journal 2011;9(10):2407. [97 pp.] doi:10.2903/j.efsa.2011.2407. Available at: www.efsa.europa.eu/efsajournal

         (2)  EFSA, Arcella D, Eskola M and Gómez Ruiz JA, 2016. Scientiﬁc report on the dietary exposure assessment to Alternaria toxins in the European population. EFSA Journal 2016;14(12):4654, 32 pp. doi:10.2903/j.efsa.2016.4654.

         (3)  Commission Regulation (EC) No 401/2006 of 23 February 2006 laying down methods of sampling and analysis for the official control of mycotoxins in foodstuffs (OJ L 70, 9.3.2006, p. 12).

         (4)  https://www.efsa.europa.eu/en/call/call-continuous-collection-chemical-contaminants-occurrence-data-0

         ANNEX
         Indicative level for alternariol, alternariol monomethyl ether and tenuazonic acid in certain foods, based on the available data in the EFSA database, above which investigations should be performed, on the factors leading to the presence of Alternaria toxins or on the effect of food processing. The indicative levels are not food safety levels.

                     Food

                     Alternariol (AOH)
                     (μg/kg)

                     Alternariol monomethyl ether (AME)
                     (μg/kg)

                     Tenuazonic acid (TeA)
                     (μg/kg)

                     Processed tomato products

                     10

                     5

                     500

                     Paprika powder

                     -

                     -

                     10 000

                     Sesame seeds

                     30

                     30

                     100

                     Sunflower seeds

                     30

                     30

                     1 000

                     Sunflower oil

                     10

                     10

                     100

                     Tree nuts

                     -

                     -

                     100

                     Dried figs

                     -

                     -

                     1 000

                     Cereal based foods for infants and young children

                     2

                     2

                     500