title: Opinion of the European Central Bank of 2 May 2019 on the security of network and information systems (CON/2019/17)

text: OPINION OF THE EUROPEAN CENTRAL BANK of 2 May 2019 on the security of network and information systems (

text: ) Introduction and legal basis

text: On 4 March 2019 the European Central Bank (ECB) received a request from the Αρχή Ψηφιακής Ασφάλειας (DSA, Digital Security Authority) of the Republic of Cyprus for an opinion on certain draft legislative provisions (hereinafter the ‘draft legislative provisions’) which will form part of a draft law on the establishment, tasks and operation of the DSA (hereinafter the ‘draft law’), which will replace Law 17 (I) of 2018 on the security of network and information systems (hereinafter the ‘existing law’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the third, fifth and sixth indents of

text: Article 2(1) of Council Decision 98/415/EC

text: , as the draft legislative provisions relate to the Central Bank of Cyprus (CBC), payment and settlement systems, rules applicable to financial institutions insofar as they materially influence the stability of financial institutions and markets, and the tasks conferred upon the ECB concerning the prudential supervision of credit institutions pursuant to Article 127(6) of the Treaty. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

text: 1. Purpose of the draft law and the draft legal provisions

text: 1.1 The purpose of the draft law is to more closely align the Cypriot legal framework with

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council . The draft law will replace the existing law which implemented

text: Directive (EU) 2016/1148

text: in 2018. 1.2 The draft law establishes the DSA, creates the national computer security incident response team and ensures the security, integrity and resilience of electronic communications networks and services . As part of its powers and tasks , the DSA may (a) ensure that operators of essential services and operators of critical information infrastructures take appropriate and proportionate technical and organisational measures to manage the security risks of the network and information

text: Ο περί Ασφάλειας Δικτύων και Συστημάτων Πληροφοριών Νόμος του 2018 (Ν. 17(I)/2018).

text: Council Decision 98/415/EC of 29 June 1998

text: on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42).

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

text: 4 The draft law also transposes Directive

text: of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) (OJ L 108, 24.4.2002, p. 33). systems used in their activities and the appropriate measures to prevent and minimise the impact of incidents affecting the security of the network and information systems used in the provision of such services, (b) impose administrative fines and other sanctions, (c) request for the purposes of its activities any relevant technical, financial and legal information from operators of essential services and operators of critical information infrastructures, (d) summon and compel the presence of witnesses in investigations, and (e) carry out on-site inspections . 1.3 The draft law provides that where a sector-specific Union legal act requires operators of essential services or digital service providers either to ensure the security of their network and information systems or to notify incidents, provided that such requirements are at least equivalent in effect to the obligations laid down in the draft law, those provisions of that sector-specific Union legal act as applied in the national legal order shall apply, in accordance with

text: Article 1(7) of Directive (EU) 2016/1148

text: . 1.4 The draft law does not identify the operators of essential services or the operators of critical information infrastructures, but empowers the DSA to do so by way of issuing a decree. In the explanatory memorandum which accompanies the request for an opinion, it is noted that in the context of determining the relevant critical information infrastructures, the financial sector indicated in

text: Directive (EU) 2016/1148

text: will be considered . In this regard, it is further noted that where there is no lex specialis, the draft law may capture sectors which fall under the responsibility of the CBC, such as systems and infrastructures of the CBC, systems which the CBC oversees but does not administer, and financial institutions supervised by the CBC. 1.5 The draft legislative provisions add to the powers and tasks of the DSA under the draft law concerning (a) the monitoring of compliance with the draft law, in the interest of which the DSA is empowered to request the assistance of persons subject to supervision under other legislation and of the relevant supervisory authorities and national authorities involved in supervision when such supervision is exercised by supranational authorities , and (b) the power to enter into memoranda of understanding with operators that are governed by the draft law or other authorities, organisations, companies or supervisory authorities that cooperate with the DSA. In addition, in cases where the CBC has been designated as an operator of critical infrastructures or otherwise pursuant to the draft law, such designation may be governed by a memorandum of understanding between the DSA and the CBC. Without prejudice to Union law, any information provided by the CBC to the DSA in the context of such cooperation does not constitute a breach of the CBC’s professional secrecy obligation.

text: 2. General observations

text: 2.1 According to

text: Article 3 of Directive (EU) 2016/1148

text: Directive (EU) 2016/1148

text: is a minimum harmonisation directive, meaning that Member States may adopt or maintain provisions with a view to achieving a higher level of security of network and information systems than provided for under

text: 5 See Articles 17, 19 and 20 of the draft law.

text: 7 See

text: Article 17

text: (hh) of the draft law. the Directive. The draft law goes beyond

text: Directive (EU) 2016/1148

text: by covering critical infrastructures and foreseeing the designation of operators of critical infrastructures. This opinion does not address whether the draft law, if adopted as proposed, would represent an effective means of implementing

text: Directive (EU) 2016/1148

text: into Cypriot law. 2.2 As previously noted by the ECB , the ECB supports the aim of

text: Directive (EU) 2016/1148

text: of ensuring a high common level of network and information security (NIS) across the Union and of achieving a consistency of approach in this field across business sectors and Member States. It is important to ensure that the internal market is a safe place to do business and that all Member States have a certain minimum level of preparedness for cybersecurity incidents. Concurrently, it should be ensured that the provisions of the national legislation transposing

text: Directive (EU) 2016/1148

text: are coordinated with the Eurosystem’s competences (see paragraphs 3 to 4) and respect the principle of central bank independence enshrined in Article 130 of the Treaty. Indeed, and in line with the ECB’s recommendation,

text: recital 14

text: of

text: Directive (EU) 2016/1148

text: states that the Directive does not affect the Eurosystem’s oversight of payment and settlement systems . On the other hand, NIS benefits from synergies and economies of scale. In particular, dedicated national DSAs have the potential to become repositories of considerable resources and expertise which the Eurosystem may draw upon in the area of NIS. Moreover, recognition of the ECB and its decisionmaking bodies’ independence does not have the consequence of separating the Eurosystem entirely from the Union and exempting it from every rule of Union law . The national implementing measures of

text: Directive (EU) 2016/1148

text: are not prima facie precluded from applying to the Eurosystem. 2.3 Against this background, the ECB welcomes the establishment of cooperation arrangements between the DSA and the CBC. The ECB suggests that, in the context of such cooperation, effective information-sharing mechanisms are put in place in order to enable the CBC to fulfil its tasks under the Treaty and under national law. Such information-sharing arrangements will also ensure that the DSA and the CBC exchange information on actual and potential cyber incidents or threats in the financial sector’s systems and infrastructures and on planned and adopted measures in an effective and timely manner . 2.4 In addition, the ECB stands ready to cooperate with the DSA in relation to the systems and infrastructures which the Eurosystem oversees or operates, such as payment systems, instruments and schemes, and the prudential supervision of credit institutions, with a view to ensuring that best practices with regard to NIS are established and followed . The ECB has previously called for establishing such effective cooperation and information-sharing arrangements between the national

text: 8 See paragraph 2.1 of Opinion

text: , paragraph 2.1 of Opinion

text: , paragraph 2.2 of Opinion

text: and paragraph 2.2 of Opinion

text: . All ECB opinions are published on the ECB’s website at www.ecb.europa.eu.

text: 9 See also paragraph 2.2 of Opinion

text: ; paragraph 3.1.1 of Opinion

text: ; and paragraph 2.2 of Opinion

text: 10 See paragraph 3.1 of Opinion

text: and paragraph 3.5 of Opinion

text: 11 See judgment of the Court of Justice of 10 July 2003, Commission v ECB,

text: , ECLI:EU:C:2003:395, paragraphs 134 to 136.

text: 12 See paragraphs 3.2.4 and 3.4.3 of Opinion

text: and paragraph 4.4 of Opinion

text: 13 See paragraph 6.3 of Opinion

text: . competent authorities, including the DSA, and the other national competent authorities, including national central banks (NCBs), and, through the NCBs, the ECB . Additionally the ECB suggests ensuring that the DSA shares relevant information, through the CBC, with the ECB in a timely and efficient manner within the framework of their respective responsibilities .

text: 3. Impact of the draft law on payment and securities settlement systems

text: 3.1 Impact of the draft law on systemically important payments systems (SIPS) 3.1.1 The ECB has in its oversight role, on the basis of Articles

text: and

text: and the first indent of Article 34.1 of the Statute of the ESCB, adopted

text: Regulation (EU) No 795/2014

text: (ECB/2014/28) .

text: Regulation (EU) No 795/2014

text: (ECB/2014/28) implements the Principles for financial market infrastructures (PFMIs) issued by the Committee on Payment and Settlement Systems (CPSS) and the International Organization of Securities Commissions (IOSCO) which are legally binding and cover both large-value and retail payment systems of systemic importance, operated either by a Eurosystem central bank or a private entity. 3.1.2 Thus, SIPS are subject to regular assessment against the requirements of

text: Regulation (EU) No 795/2014

text: (ECB/2014/28) related to operational risk , which allows the competent Eurosystem central bank, as competent authority, to verify that the systems are in compliance. In cases of noncompliance, the competent Eurosystem central bank has the power to impose sanctions or corrective measures to ensure compliance . The amended

text: Regulation (EU) No 795/2014

text: (ECB/2014/28) recently introduced a number of new requirements for SIPS operators addressing new risks, including those related to operational and security risks, such as cyber resilience , taking into account, inter alia, the Guidance on cyber resilience for financial market infrastructures which was published in 2016 by the Committee on Payments and Market Infrastructures (CPMI) and IOSCO . 3.1.3 Furthermore, in line with the requirements set out in

text: Directive (EU) 2016/1148

text: Regulation (EU) No 795/2014

text: (ECB/2014/28) already provides competent Eurosystem central banks with the power to obtain information concerning, inter alia, major and minor incidents, the nature and type of the

text: 14 See paragraphs 2.3 and 6.2 of Opinion

text: 15 See paragraph 4.3 of Opinion

text: and paragraph 6.2 of Opinion

text: Regulation (EU) No 795/2014

text: of the European Central Bank of 3 July 2014 on oversight requirements for systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16).

text: 17 Available on the Bank for International Settlements’ website at www.bis.org.

text: 18 See

text: Article 15 of Regulation (EU) No 795/2014

text: (ECB/2014/28), which imposes an obligation on SIPS operators to take steps such as: (a) establish comprehensive physical and information security policies that adequately identify, assess and manage all potential vulnerabilities and threats, (b) to ensure that critical information technology systems can resume operations within specified timeframes where an event poses a significant risk of disrupting the SIPS’ operations etc.

text: 19 See paragraph 3.4 of Opinion

text: 20 See

text: Articles 15

text: (1a) and (4a), which imposes an obligation on SIPS operators to take the following steps: (i) review, audit and test systems, operational policies, procedures and controls periodically and after significant changes; (ii) establish an effective cyber resilience framework with appropriate governance measures in place; (iii) identify their critical operations and supporting assets, and have appropriate measures in place to protect them from, detect, respond to and recover from cyber-attacks; (iv) regularly test the established measures; and (v) have a sound level of situational awareness of cyber threats, including through a process of continuous learning.

text: 21 Available on the Bank for International Settlements’ website. incidents, their seriousness and their duration . The amended

text: Regulation (EU) No 795/2014

text: (ECB/2014/28) further enhanced competent Eurosystem central banks’ powers to conduct on-site inspections and request independent reviews of and investigations into the functioning of the systems. 3.1.4 The ECB understands that the DSA may, by virtue of a decree, capture within the scope of the draft law services which are provided using information systems operated by the Eurosystem or operated by the CBC and overseen by the Eurosystem. 3.1.5 Among listed SIPS, TARGET2 plays a distinct role, as it is owned and operated by the Eurosystem and subject to strict regulation and oversight. The ECB understands that the Cypriot component of TARGET2, TARGET2-CY for which the CBC acts as the operator, could potentially fall within the scope of the draft law. TARGET2 has been identified, pursuant to Decision ECB/2014/35 of the European Central Bank , as a SIPS and is overseen by the ECB as a competent authority under

text: Regulation (EU) No 795/2014

text: (ECB/2014/28). 3.1.6 While SIPS may fall within the scope of the draft law, the ECB understands that the draft law should be without prejudice to the oversight of SIPS given that such oversight is performed on the basis of ECB regulations. As noted in paragraph 2.3, the ECB suggests that effective informationsharing and cooperation arrangements are put in place to ensure that the DSA shares information with the CBC about actual and potential cyber incidents, as well as planned or adopted measures which may affect SIPS and TARGET2 in a timely and efficient manner in order to enable the CBC to fulfil its tasks under the Treaty and national law. The ECB also suggests that respective cooperation and information-sharing arrangements are established between the DSA and the ECB, through the CBC. 3.2 Impact of the draft law on non-SIPS 3.2.1 Non-SIPS include non-systemically important large-value payment systems (LVPS) and nonsystemically important retail payment systems (non-SIRPS). Under the revised oversight framework for retail payment systems , non-SIRPS have been divided into two distinct groups: prominently important retail payments systems (PIRPS) and other retail payments systems (ORPS). The Cypriot local retail payment systems, JCC Payment Card System, Cyprus Clearing House for cheques and JCC SDD, have been classified as PIRPS or ORPS and the ECB understands that their services could be included in the list of essential services pursuant to the draft law and that the operators of those systems or some of those systems might be designated as operators of essential services.

text: 22 See

text: Article 21

text: (1a) of Regulation (EU) No 795/795/2014 (ECB/2014/28).

text: 23 See

text: Articles 21

text: (1b) and (1c) of

text: Regulation (EU) No 795/2014

text: 24 See paragraph 3.1 of Opinion

text: 25 Decision ECB/2014/35 of the European Central Bank of 13 August 2014 on the identification of TARGET2 as a systemically important payment system pursuant to

text: Regulation (EU) No 795/2014

text: on oversight requirements for systemically important payment systems (OJ L 245, 20.8.2014, p. 5). 26 See the Eurosystem’s ‘Revised oversight framework for retail payment systems’ (February 2016), available on the ECB’s website. 27 See the Eurosystem’s ‘Overview of payment systems’, available on the ECB’s website. 3.2.2 Under the Eurosystem’s oversight policy framework, non-systemically important LVPS and non- SIRPS must follow the CPSS-IOSCO PFMIs and non-SIRPS must additionally follow the Oversight expectations for links between retail payment systems (OELRPS) . Both the CPSS-IOSCO PFMIs and the OELRPS are soft law instruments, meaning that non-systemically important LVPS, PIRPS and ORPS are subject to oversight standards (which are comparable to the standards under

text: Regulation (EU) No 795/2014

text: (ECB/2014/28)); however there is, strictly speaking, no Union legislation regulating the oversight or supervision of these systems . The CBC is given supervisory and oversight competence over non-SIPS pursuant primarily to section 48 of the Law on the 30 31 CBC , which in this particular respect does not implement Union ‘laws’ as described above . 3.2.3 The revised oversight framework for retail payment systems specifies that all retail payment systems are an integral part of the payment and settlement landscape of the euro area and thus fall within the scope of oversight. Hence, the Eurosystem has an interest in ensuring that the oversight framework and standards applicable to such systems are not prejudiced through the implementation of

text: Directive (EU) 2016/1148

text: or when introducing other NIS-related laws . 3.2.4 If the intention is for non-SIPS to be captured under the scope of the draft law, the ECB suggests that, the same clarifications and effective information-sharing and cooperation framework as mentioned in paragraph 3.1.6 are established in relation to and between the CBC and the DSA, and if necessary, with the ECB through the CBC. 3.3 Impact of the draft law on critical service providers 3.3.1 The revised Eurosystem oversight policy framework covers critical service providers such as the Society for Worldwide Interbank Financial Telecommunication (SWIFT). SWIFT is a limited liability cooperative company established in Belgium, which supplies secure messaging services in a large number of countries. Nationale Bank van België/Banque Nationale de Belgique acts as the lead overseer of SWIFT, and conducts, on the basis of a cooperative oversight arrangement, oversight in respect of SWIFT in cooperation with the other G10 central banks, including the ECB. The G10 overseers recognise that the main focus of oversight is SWIFT’s operational risk, as this is considered to be the primary risk category through which SWIFT could pose a systemic risk to the financial system in the Union. In this regard, the SWIFT Cooperative Oversight Group has developed a specific set of principles and high level expectations that apply to SWIFT, such as risk identification and management, information security, reliability and resilience, technology planning and communication with users. The G10 overseers subject SWIFT to an intense form of oversight, and expect that SWIFT specifically adheres to the CPMI-IOSCO Guidance on cyber resilience and other international standards on IT Security, which exceed the requirements set out in

text: Directive (EU) 2016/1148

text: 28 See the Eurosystem’s ‘Oversight expectations for links between retail payment systems’, available on the ECB’s website. 29 See paragraph 2.4.4 of ECB Opinion

text: and paragraph 3.2.3 of Opinion

text: . 30 Ο περί της Κεντρικής Τράπεζας της Κύπρου Νόμος του 2002 (Ν. 138(I)/2002). 31 See also paragraph 2.4.4 of Opinion

text: and paragraph 4.2 of Opinion

text: . 32 See paragraph 3.4.2 of Opinion

text: and paragraph 4.3 of Opinion

text: . 33 See the Eurosystem’s ‘Eurosystem oversight policy framework’ (revised version), p. 9, available on the ECB’s website. 3.3.2 Similar to the case of non-SIPS, the possibility cannot be excluded that the draft law and the supervisory powers of the DSA could cover critical service providers for which there are applicable oversight measures. It is therefore suggested that the Cypriot authorities take existing oversight arrangements into consideration in their application of the draft law, if the application affects critical service providers . In the particular case of SWIFT, it is proposed that the draft law excludes SWIFT from its scope considering that SWIFT is established in and operated from Belgium with infrastructure hubs that are not located within Cyprus, and that SWIFT simply supplies secure messaging services in Cyprus, as well as in a vast number of other countries. 3.4 Impact of the draft law on payment services and payment instruments and schemes 3.4.1 The Eurosystem oversight policy framework identifies payment instruments, such as cards, credit transfers, direct debit and electronic money, as an ‘integral part of payment systems’, and thus includes these within the scope of its central bank oversight. For payment instruments, the role of primary overseer (for the Eurosystem) is assigned by reference to the national anchor of the payment scheme and the legal incorporation of its governance authority. For credit transfer and direct debit schemes within the Single Euro Payments Area, as well as some of the international card payment schemes, the ECB has the primary oversight role. Payment service providers (PSPs), including credit institutions, payment institutions and electronic money institutions, are subject to

text: Directive (EU) 2015/2366

text: of the European Parliament and of the Council , which is applicable as of January 2018, as implemented into national law. The legal and regulatory framework set out requirements pertaining to operational and security risks and incident reporting. Nevertheless, prudential supervisors need to exercise careful judgment when deciding whether to publish information concerning individual cybersecurity incidents, to ensure public confidence in the affected institutions is not undermined. Furthermore, the European Banking Authority (EBA) has produced draft guidelines on information and communication technology (ICT) and security risk management which are intended to harmonise standards required from payment service providers as regards ICT security, incident reporting, project management and business continuity. While PSPs are therefore subject to Union and Cypriot legislation, and regulations based on Union legislation, the oversight of international and domestic card schemes is not subject to Union legislation as such . 3.4.2 The ECB understands that the various payment schemes and instruments and PSPs may potentially fall within the scope of the draft law. It is thus suggested that the same clarifications and effective information-sharing and cooperation framework as mentioned in paragraph 3.1.6 are established in relation to and between the authorities responsible for the oversight of payment schemes, instruments and services and for the supervision of PSPs and the DSA . The draft law

text: 34 See paragraph 3.3.1 of Opinion

text: and paragraph 5 of Opinion

text: . 35

text: Directive (EU) 2015/2366

text: of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives

text: and

text: and

text: Regulation (EU) No 1093/2010

text: , and repealing Directive

text: (OJ L 337, 23.12.2015, p. 35). 36 See EBA Guidelines on internal governance under Directive

text: of 26 September 2017 (

text: ) and EBA draft Guidelines on ICT and security risk management of 13 December 2018 (EBA/CP/2018/15) available on the EBA’s website at www.eba.europa.eu. 37 See paragraph 2.4.3 of Opinion

text: and paragraph 3.4.2 of Opinion

text: . 38 See also paragraph 3.4.3 of Opinion

text: and paragraph 6.2 of Opinion

text: . could also clarify that as regards the supervision of PSPs, the DSA’s responsibilities are without prejudice to and are aligned with the tasks of the CBC. 3.5 Impact of the draft law on central securities depositories (CSDs) 3.5.1 CSDs are strictly regulated and supervised by different authorities pursuant to

text: Regulation (EU) No 909/2014

text: of the European Parliament and of the Council , which sets out requirements pertaining to operational risk. Furthermore, CSDs should take note of the CPMI-IOSCO Cyber Guidance, which is applicable to all financial market infrastructures. 3.5.2 In addition to the supervisory competences entrusted to national competent authorities (NCAs) under

text: Regulation (EU) No 909/2014

text: , it should be noted that national authorities, in particular the members of the ESCB, may be entrusted with oversight competences in relation to CSDs. In this regard,

text: recital 8

text: of

text: Regulation (EU) No 909/2014

text: states that the Regulation should be without prejudice to the responsibilities of the ECB and the NCBs to ensure efficient and sound clearing and payment systems within the Union and other countries and that the Regulation should not prevent the members of the ESCB from accessing information relevant for the performance of their duties, including the oversight of CSDs and other financial market infrastructures . 3.5.3 The Cyprus Central Securities Depository and Central Registry (CDCR) is operated by the Cyprus Stock Exchange (CSE) , is supervised by the Cyprus Securities and Exchange Commission (CySEC), and overseen by the CBC. While the CDCR may fall within the scope of the draft law, the ECB understands that the draft law should be without prejudice to the supervision and oversight of the CDCR given that such supervision and oversight is performed on the basis of Union legislation. The draft law could also clarify that the DSA’s responsibilities are without prejudice to and are aligned with the tasks of the CBC and of the CySEC. 3.6 Eurosystem cyber resilience strategy for Financial Market Infrastructures (FMIs) 3.6.1 The Cypriot authorities may also wish to take note of the Eurosystem cyber resilience strategy for FMIs, which is intended to support the implementation of the CPMI-IOSCO guidance from an oversight perspective. The objective of this strategy is to (i) improve the cyber resilience of the euro area financial sector as a whole by enhancing the ‘cyber readiness’ of individual FMIs that are overseen by the Eurosystem central banks; and (ii) foster collaboration among FMIs, their critical service providers and the relevant authorities. As part of the strategy, the Eurosystem has developed a range of tools that can be used by FMIs to enhance their cyber resilience, such as a European red team testing framework and other tools, such as cyber surveys and focused assessments to assess the level of cyber maturity of Eurosystem payment systems and to develop

text: Regulation (EU) No 909/2014

text: of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives

text: and

text: and

text: Regulation (EU) No 236/2012

text: (OJ L 257, 28.8.2014, p. 1). 40 See paragraph 7.2 of Opinion

text: and paragraph 7.3 of Opinion

text: . 41 The Cyprus CSD is established in accordance with the provisions of the Law 27(I)/1996 on securities and the Cyprus Stock Exchange (Central Securities Depository and Central Registry) (Ο περί Αξιών και Χρηματιστηρίoυ Αξιών Κύπρoυ (Κεντρικό Απoθετήριo και Κεντρικό Μητρώo Αξιών) Νόμoς τoυ 1996 (Ν. 27(I)/1996)). 42 See the Eurosystem’s Framework for Threat Intelligence-based Ethical Red Teaming (TIBER-EU) (May 2018), available on the ECB’s website. cyber resilience oversight expectations which will provide more detailed guidance to payment system operators.

text: 4. Impact of the draft law on credit institutions

text: Recital 13

text: of

text: Directive (EU) 2016/1148

text: states that requirements in respect of information systems, which often exceed the requirements provided for under

text: Directive (EU) 2016/1148

text: , are set out in a number of Union legal acts, including the rules on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms. Member States should consider those requirements in their application of provisions transposing

text: Directive (EU) 2016/1148

text: as lex specialis. Indeed, the Union legal acts harmonising the area of supervision of credit institutions include

text: Regulation (EU) No 575/2013

text: of the European Parliament and of the Council and Directive

text: of the European Parliament and of the Council , jointly establishing the CRR/CRDIV framework. Credit institutions established in Cyprus must also adhere to the Directive on governance and management arrangements , enacted by the CBC, which sets, inter alia, a framework of principles for a sound and effective operation of information technology systems in the context of managing operational risk. 4.2 The ECB and the CBC are the competent authorities exercising specified supervisory powers under the CRR/CRDIV framework, by virtue of

text: Council Regulation (EU) No 1024/2013

text: which confers specific tasks on the ECB concerning the prudential supervision of credit institutions within the euro area and makes the ECB responsible for the effective and consistent functioning of the Single Supervisory Mechanism (SSM) within which specific supervisory responsibilities are distributed between the ECB and the participating NCAs, including the CBC. In particular, the ECB carries out the task to authorise and to withdraw the authorisations of all credit institutions. For significant credit institutions the ECB also has the task, among others, to ensure compliance with the relevant Union law that imposes prudential requirements on credit institutions, including the requirement to have in place robust governance arrangements, such as sound risk management processes and internal control mechanisms . To this end, the ECB is given all supervisory powers to intervene in the activity of credit institutions that are necessary for the exercise of its functions. 4.3 The prudential supervision of credit institutions, as exercised by the ECB and the CBC within the SSM, covers several aspects related to cybersecurity as part of the prudential supervision of operational risk, which means the risk of loss resulting from inadequate or failed internal processes,

text: 43 See the Cyber resilience oversight expectations for financial market infrastructures (CROE) (December 2018), available on the ECB’s website. 44

text: Regulation (EU) No 575/2013

text: of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending

text: Regulation (EU) No 648/2012

text: (OJ L 176, 27.6.2013, p. 1). 45 Directive

text: of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive

text: and repealing Directives

text: and

text: (OJ L 176, 27.6.2013, p. 338). 46 H περί Ρυθμίσεων Διακυβέρνησης και Διαχείρισης Οδηγία του 2014. 47

text: Council Regulation (EU) No 1024/2013 of 15 October 2013

text: conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63). 48 See

text: Articles 4(1)

text: (e) and 6(4) of

text: Regulation (EU) No 1024/2013

text: . people and systems or from external events . In addition, the EBA has produced guidelines on internal governance, covering aspects of IT risks, and, as noted in paragraph 3.4.1, draft guidelines on ICT and security risk management which are intended to harmonise requirements for credit institutions, investment firms and payment service providers as regards ICT security, incident reporting, project management and business continuity. Further EBA Guidelines are under development, concerning inclusion of cyber risk aspects in the Supervisory Review and Evaluation Process . The ECB has developed comprehensive IT risk questionnaires for supervised credit institutions that are fed into their SREP outcomes and also uses insights on cyber-security issues that may be drawn from thematic reviews, on-site inspections and reports of cyber incidents . Such insights may form the basis for ad hoc institution-specific recommendations and general sector-wide comparisons and policies. At the same time, prudential supervisors need to exercise careful judgment when deciding to publish information concerning individual cybersecurity incidents so as to not undermine public confidence in the affected credit institutions. 4.4 Moreover, the ECB and the NCAs within the SSM are responsible for the assessment of recovery plans and taking early intervention measures under Directive

text: of the European Parliament and of the Council (as transposed into national law). Further, the primary responsibility for determining that a significant credit institution is failing or likely to fail as a condition to the resolution of a credit institution lies with the ECB . In the case of resolution, one of the resolution objectives is to ensure the continuity of critical functions , which can include the continuing functioning of the credit institution’s payment and cash circulation systems. 4.5 Central banks are excluded from the scope of Directive

text: and are thus not supervised institutions falling within the scope of

text: Regulation (EU) No 575/2013

text: . Therefore, neither the ECB nor the CBC falls within the scope of the ‘banking sector’ for the purposes of point (3) of Annex II to

text: Directive (EU) 2016/1148

text: . 4.6 It is understood that, during the exercise of its monitoring task, the DSA might request the assistance of both significant and less significant credit institutions established or operating in Cyprus, and of the CBC and the ECB as competent authorities exercising specific supervisory powers in relation to such credit institutions within the SSM . It is also understood that credit institutions established in Cyprus can be designated as operators of essential services, and thus

text: 49 See

text: Article 4(1)

text: (52) of

text: Regulation (EU) No 575/2013

text: . 50 See the EBA Guidelines on internal governance under Directive

text: of 26 September 2017 (

text: ) and the EBA draft Guidelines on ICT and security risk management of 13 December 2018 (EBA/CP/2018/15), available on the EBA’s website. 51 See the EBA draft Guidelines on ICT Risk Assessment under the Supervisory Review and Evaluation process (SREP) of 6 October 2016 (EBA/CP/2016/14), available on the EBA’s website. 52 See also the Newsletter article of 13 February 2019 on ‘IT and cyber risk - the SSM perspective’, available on the ECB’s website. 53 See

text: Articles 27

text: to 30 of Directive

text: of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending

text: Council Directive 82/891/EEC

text: , and Directives

text: and

text: , and Regulations

text: (EU) No 1093/2010

text: and

text: (EU) No 648/2012

text: , of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190). 54 See

text: Article 32(1)

text: (a) of Directive

text: . 55 See

text: Article 31(2)

text: (a) of Directive

text: . 56 See paragraph 2.4 of Opinion

text: . 57 See

text: Article 17

text: (hh) οf the draft legislative provisions. would need to comply with their obligations under the draft law. Finally, it is understood that informing the general public about cyber incidents, as anticipated in the draft law , might include incidents originating from credit institutions. 4.7 In light of the above, the ECB recommends clarifying that the scope of the draft law and any powers granted to the DSA thereunder are without prejudice to the competences, tasks and powers of the ECB and the CBC under

text: Regulation (EU) No 1024/2013

text: and relevant national law . In addition, to enable the ECB and the CBC to fulfil their tasks within the SSM, the ECB recommends that, for the purposes of the draft law, cooperation and information-sharing arrangements are established not only between the DSA and the CBC, but also between the DSA and the ECB, through the CBC as referred to in paragraph 2.3 . Examples of areas which such cooperation and information-sharing arrangements may helpfully address include, but are not limited to, reporting requirements imposed on credit institutions, the process for deciding on publication of information concerning individual cybersecurity incidents, and the safeguarding of the continuity of critical functions of credit institutions. This opinion will be published on the ECB’s website. Done at Frankfurt am Main, 2 May 2019. [signed] The President of the ECB Mario DRAGHI

text: 58 See Article 35 of the draft law. 59 See also paragraph 4 of Opinion

text: ; paragraph 3.5 of Opinion

text: ; and paragraph 8.7 of Opinion

text: . 60 See also paragraph 4.6 of Opinion

text: and paragraph 8.7 of Opinion


publisher: Europeiska centralbanken

sprak: en

title: Opinion of the European Central Bank of 10 May 2019 on the tax on banks’ financial assets and the interest rate benchmark for consumer credit agreements (CON/2019/18)

serie: con

text: OPINION OF THE EUROPEAN CENTRAL BANK of 10 May 2019 on the tax on banks’ financial assets and the interest rate benchmark for consumer credit agreements (

text: ) Introduction and legal basis

type: rubrik

text: On 20 March 2019 the European Central Bank (ECB) received a request from Ministerul Finanțelor Publice (the Romanian Ministry of Public Finances) for an opinion on a draft Government Emergency Ordinance on the amendment and supplementation of three legislative acts in relation to the tax on banks’ financial assets and the interest rate benchmark for consumer credit agreements (hereinafter the ‘draft ordinance’). On 29 March 2019 the draft ordinance was adopted with amendments by the Romanian government (hereinafter the ‘government ordinance’) and is currently subject to the parliamentary approval procedure. The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the third and sixth indents of

text: Article 2(1) of Council Decision 98/415/EC

text: , as the government ordinance relates to Banca Naţională a României (BNR) and rules applicable to financial institutions insofar as they materially influence the stability of financial institutions and markets. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

type: stycke

text: 1. Purpose of the government ordinance

text: 1.1 The government ordinance was introduced to revise certain features of the tax on banks’ financial assets which was introduced in late December 2018 and to replace the interest rate benchmark referenced in consumer credit agreements with variable interest rates denominated in Romanian lei .

text: 1 Ordonanţa de urgenţă a Guvernului nr. 19/2019 pentru modificarea şi completarea unor acte normative, publicată în Monitorul Oficial al României, Partea I, nr. 245 din 29 martie 2019.

text: Council Decision 98/415/EC of 29 June 1998

text: on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42).

text: 3 Government Emergency Ordinance 114/2018 of 28 December 2018 on the establishment of certain measures in the field of public investment and of certain fiscal and budgetary measures, the amendment and supplementation of certain legislative acts and the prolongation of certain time limits (Ordonanţa de urgenţă a Guvernului nr. 114/2018 privind instituirea unor măsuri în domeniul investiţiilor publice şi a unor măsuri fiscal-bugetare, modificarea şi completarea unor acte normative şi prorogarea unor termene, publicată în Monitorul Oficial al României, Partea I, nr. 1116 din 29 decembrie 2018).

text: 4 By virtue of Government Emergency Ordinance 50/2010 of 9 June 2010 on credit agreements for consumers (Ordonanţa de urgenţă a Guvernului nr. 50/2010 privind contractele de credit pentru consumatori, publicată în Monitorul Oficial al României, Partea I, nr. 389 din 11 iunie 2010) and Government Emergency Ordinance 52/2016 of 14 September 2016 on credit agreements offered to consumers for immovable property, as well as for amending and completing Government Emergency Ordinance 50/2010 on credit agreements for consumers (Ordonanţa de urgenţă 1.2 The tax on banks’ financial assets The objectives underlying the revised features of this tax are to increase financial intermediation, reduce the cost of credit for households and stimulate savings. The government ordinance thus aims to encourage credit institutions to contribute to achieving these objectives by: (a) increasing lending to non-financial corporations and households; and (b) reducing the difference between interest rates for loans granted to non-financial corporations and households and the interest rates for deposits made by non-financial corporations and households . 1.3 The tax on banks’ financial assets is levied on credit institutions which are Romanian legal entities, including their foreign branches, and Romanian branches of foreign legal entities. The proceeds of the tax are considered State budget revenue and the tax expense will be deductible when establishing the banks’ fiscal result in accordance with the Law on the Fiscal Code . 1.4 Following the amendments introduced by the government ordinance, the tax base is represented by the banks’ financial assets at net value as recorded in the balance sheet at the end of the semester or of the year for which the tax is due, from which the following categories of financial assets are subtracted: (a) cash; (b) cash balances with central banks at net value, excluding nonperforming exposures; (c) non-performing exposures at net value; (d) debt securities issued by the public administration at net value, excluding non-performing exposures; (e) loans and credit advances to the public administration at net value, excluding non-performing exposures; (f) loans to the non-governmental sector which are guaranteed by the central public administration at net value, excluding non-performing exposures; (g) loans to credit institutions, related receivables and amounts to be depreciated at net value, excluding non-performing exposures; (h) deposits with credit institutions, related receivables and amounts to be depreciated at net value, excluding nonperforming exposures; (i) nostro accounts with credit institutions and related receivables at net value, excluding non-performing exposures; (j) reverse-repo operations and borrowed securities, related receivables and amounts to be depreciated at net value, excluding non-performing exposures. 1.5 Following the amendments introduced by the government ordinance, the tax rate is either 0.4% of the tax base per year for banks with a market share above or equal to 1%, or 0.2% of the tax base per year for banks with a market share below 1%. For this purpose, a bank’s market share is calculated as the ratio between the total value of the bank’s assets and the total amount of aggregate assets for the banking system, including branches. 1.6 Following the amendments introduced by the government ordinance, the tax on banks’ financial assets is limited to the accounting profit as recorded at the end of the semester or year for which the tax is due. Moreover, banks that register losses at the end of the semester or year for which this tax is due will not be subject to it. Additionally, banks on which lending restrictions have been a Guvernului nr. 52/2016 privind contractele de credit oferite consumatorilor pentru bunuri immobile, precum şi pentru modificarea şi completarea Ordonanţei de urgenţă a Guvernului nr. 50/2010 privind contractele de credit pentru consumatori, publicată în Monitorul Oficial al României, Partea I, nr. 727 din 20 septembrie 2016).

text: 5 Preamble to the government ordinance and Explanatory memorandum to the government ordinance as submitted to Parliament.

text: 6 Legea nr. 227/2015 privind Codul fiscal, publicată în Monitorul Oficial al României, Partea I, nr. 688 din 10 septembrie 2015. imposed by the supervisory authority for the period in which those restrictions apply will not be subject to this tax. 1.7 Furthermore, in line with its stated objectives, the government ordinance introduces two categories of tax deductions: (a) a tax deduction of up to 50% in return for contributing to increasing financial intermediation by increasing lending to non-financial corporations and households in accordance with an annually-established governmental target; and (b) a tax deduction of up to 50% in return for reducing interest rate margins, either below an annually-established reference margin rate or in line with an annually-established governmental target. For this purpose the interest rate margin is the difference between the weighted average interest rate for loans denominated in lei to non-financial corporations and households and the weighted average interest rate for deposits denominated in lei received from non-financial corporations and households. 1.8 Accordingly, as regards the first category of tax deduction, the government ordinance provides for a pro-rata tax reduction of up to 50%, if the balance of loans to non-financial corporations and households at the end of the semester or year for which the tax is due increases in relation to the balance of the same type of credits at the end of the preceding year. The tax deduction is proportional to the ratio between the increase in lending to non-financial corporations and households and the lending increase target established for the year for which the tax is due. If lending to non-financial corporations and households decreases, there is no tax deduction. In addition, the benchmark against which the increase in lending is calculated for the following year will not be reduced, but instead maintained at the level of the balance of loans at the end of the year preceding the year in which lending to non-financial corporations and households decreased until the balance of loans to non-financial corporations and households at the end of the semester or year for which the tax is due exceeds that benchmark. 1.9 As for the second category of tax deduction, the government ordinance provides for: (a) a tax deduction of 50%, if the interest rate margin for the semester or year for which the tax is due is below or equal to the reference interest rate margin established for the year for which the tax is due; or (b) a pro-rata tax deduction of up to 50%, if the interest rate margin calculated at the end of the semester or year for which the tax is due decreases in relation to the interest rate margin calculated at the end of the preceding year. The tax deduction is proportional to the ratio between the decrease in the interest rate margin and the margin decrease target established for the year for which the tax is due. If the interest rate margin increases, there is no tax deduction. In addition, the benchmark against which the decrease in the interest rate margin is calculated for the following year will not be increased, but instead maintained at the level of the interest rate margin at the end of the year preceding the year in which the interest rate margin increased until the interest rate margin at the end of the semester or year for which the tax is due falls short of that benchmark. 1.10 In addition to these tax deductions, the government ordinance provides for an exemption from the tax for the first semester in any of the following cases: (a) where the lending increase target has been fully met; (b) where the margin decrease target has been fully met; (c) where the aggregated percentage of the lending increase and of the interest-margin decrease is at least 100%. 1.11 Finally, the government ordinance specifies that the lending increase target, the margin decrease target and the reference interest rate margin are established annually by the Romanian government, upon the proposal of Ministerul Finanțelor Publice on the recommendation of Comitetul Național pentru Supravegherea Macroprudențială (the National Committee for Macroprudential Oversight). For 2019, the government ordinance sets the lending increase target and the margin decrease target at 8% and the reference interest rate margin at 4%. 1.12 The interest rate benchmark for consumer credit agreements The government ordinance aims to increase the transparency of the interest rate benchmark referenced in consumer credit agreements with variable interest rates denominated in lei by replacing the Romanian Interbank Offer Rate with a new benchmark calculated exclusively on the basis of interbank transactions . 1.13 The government ordinance stipulates that the new interest rate benchmark is to be published each working day on BNR’s website. 1.14 The government ordinance further stipulates that the new interest rate benchmark will be an average of interest rates weighted against the volumes of interbank market transactions. The benchmark is calculated at the end of each quarter as an arithmetic mean of the daily interest rates determined for the preceding quarter and is applied by each credit institution for the following quarter.

text: 2. Observations regarding tax on banks’ financial assets

text: 2.1 Need for impact assessment The ECB has consistently advised that the introduction of special taxes on banks or financial institutions should be preceded by a comprehensive impact assessment . A comprehensive impact assessment of the tax on banks’ financial assets is necessary to ensure that the benefits of the fiscal measure outweigh its costs not only in view of the potentially negative effects on financial stability and the economy, but also in view of the potential implications for bank lending conditions and for the transmission of monetary policy. In this respect, the ECB notes that the use of timely and meaningful impact assessments was also emphasised, albeit more broadly, in Council Recommendation of 13 July 2018 on the 2018 National Reform Programme of Romania and delivering a Council opinion on the 2018 Convergence Programme of Romania , according to which Romania should take action to increase the predictability of decision-making by enforcing the systematic and effective use of regulatory impact assessments and stakeholder consultations and involvement in the design and implementation of reforms. 2.2 Effects on financial stability Without prejudice to the government’s objective of increasing financial intermediation, the introduction of the tax would benefit from a prior impact assessment so as to mitigate potential risks to financial stability. Given the incentive mechanism introduced by the government ordinance, such

text: 7 Explanatory memorandum to the government ordinance as submitted to Parliament.

text: 8 See paragraph 3.2.2 of Opinion

text: , paragraph 3.3 of Opinion

text: , paragraph 2.2 of Opinion

text: and paragraph 2 of Opinion

text: . All ECB opinions are published on the ECB website at www.ecb.europa.eu.

text: 9 Council Recommendation of 13 July 2018 on the 2018 National Reform Programme of Romania and delivering a Council opinion on the 2018 Convergence Programme of Romania (OJ C 320, 10.9.2018, p. 98). an assessment should also take into account the risk that the provision of credit to non-financial corporations and households might be steered by the potential tax benefits. Such an assessment should also consider whether the design of the tax gives credit institutions an incentive to change their risk profile by restructuring their portfolios. The provision of credit should primarily rely on a robust prudential system and full compliance with requirements for the creditworthiness of borrowers . This latter approach would contribute to an appropriate distribution of loans in the economy, and this in turn would safeguard banks’ balance sheets from future potential losses. Over time, this approach would also aid in fostering sustainable financial stability, and contributing to the safety and soundness of banks. Finally, the incentives created by the revised tax must be aligned with macroprudential policy objectives and measures implemented in Romania. 2.3 Effects on the Romanian economy A thorough and timely impact analysis of the practical implications of the government ordinance is warranted, also in view of the fact that introducing ad hoc taxes on banks may create uncertainty for their business and eventually pose risks to the provision of credit, which could adversely affect 11 12 long-term growth in the real economy . In line with the stance maintained in the past , the ECB cautions against incentives in loan provision that may lead to distortions in the efficient allocation of loan supply and further sectoral imbalances in the real economy. 2.4 Implications for bank lending conditions and for the transmission of monetary policy An inefficient allocation of credit is detrimental not only to financial stability and the real economy but also to the monetary policy transmission mechanism. The government ordinance introduces tax deductions for banks that lend more, or at low margins, to the real sector. Any measure aimed at stimulating lending activity, if not appropriately designed, may cause distortions in the allocation of credit. Such measures may result in banks becoming overly lenient with regard to their lending standards in order to meet their lending volume targets. At the opposite extreme, in an attempt to meet their targets in terms of margin compression, banks may disproportionately tilt their lending supply away from relatively riskier but still creditworthy borrowers involving high risk premia, e.g. small and medium-sized enterprises, which rely solely on bank lending and have no access to capital market finance. The likelihood that such side effects materialise depends on the details of the calibration and on the credit risk and demand conditions that each intermediary is facing. 2.5 While the tax introduced by the government ordinance is designed to have a lower impact on banks which lend more to the real economy, it can nonetheless be expected to have an overall adverse impact on their profitability. Since retained earnings are an important source of capital, a tax on banks’ activity could have implications on their intermediation capacity that should not be neglected. Thus, the impact assessment should also take into account the overall equilibrium effects of the fiscal measure, even more so in a country relying on the presence of foreign intermediaries who can more easily avoid the increased tax burden by geographically reallocating their assets.

text: 10 See paragraph 3.2 of Opinion

text: 11 See paragraph 2.1 of Opinion

text: and paragraph 3.2.2 of Opinion

text: 12 See paragraph 3.1 of Opinion

text: . 2.6 Finally, the cost-benefit analysis should also consider the financing conditions for the real sector that play an important role in the monetary policy transmission mechanism and might de facto represent an intermediate target for central banks. The same applies to the volume of lending to the real economy, which can be explicitly utilised as an intermediate target of monetary policy measures. Consequently, the incentive mechanism provided for under the government ordinance, which is targeting financing conditions and lending activity, should be assessed to determine whether it may have any implications on BNR’s toolbox.

text: 3. Observations regarding interest rate benchmark for consumer credit agreements

text: 3.1 The ECB welcomes the government ordinance’s aim to introduce a transaction-based benchmark for consumer credit agreements with variable interest rates denominated in lei (the ‘new benchmark’). This is in line with the principles underlying the Union regulatory framework on financial benchmarks, in particular

text: Regulation (EU) 2016/1011

text: of the European Parliament and of 13 14 the Council , and other recognised international best practice . Where the input data is transaction-based data, less discretion can be exercised in providing input data and therefore the opportunity to manipulate the data is reduced . 3.2 However, the government ordinance should take into account the fact that actual transaction-based input data are to be used only where available and appropriate. If transaction data is insufficient or inappropriate to accurately and reliably represent the market or economic reality that the benchmark is intended to measure, input data which is not transaction data may also be used, including estimated prices, quotes and committed quotes, or other values . 3.3 Furthermore, the compatibility of the government ordinance with

text: Regulation (EU) 2016/1011

text: and related provisions of Directive

text: of the European Parliament and of the Council and Directive

text: of the European Parliament and of the Council should be ensured. Without prejudice to the European Commission’s competence to monitor the implementation of Union law, the ECB notes that, although interest rate benchmarks are referenced in consumer credit agreements with variable interest rates denominated in foreign currencies or denominated in lei (such as the new benchmark), the government ordinance does not introduce information requirements concerning the names of the respective benchmarks and of their administrators and the potential impact of the means by which the benchmarks are determined on the consumer .

text: Regulation (EU) 2016/1011

text: of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives

text: and

text: and

text: Regulation (EU) No 596/2014

text: (OJ L 171, 29.6.2016, p. 1).

text: 14 See the Board of the International Organization of Securities Commissions (OICU-IOSCO), Principles for Financial Benchmarks (July 2013), available at www.iosco.org.

text: Recital 26

text: of

text: Regulation (EU) 2016/1011

text: 17 Directive

text: of the European Parliament and of the Council of 4 February 2014 on credit agreements for consumers relating to residential immovable property and amending Directives

text: and

text: and

text: Regulation (EU) No 1093/2010

text: (OJ L 60, 28.2.2014, p. 34).

text: 18 Directive

text: of the European Parliament and of the Council of 23 April 2008 on credit agreements for consumers and repealing

text: Council Directive 87/102/EEC

text: (OJ L 133, 22.5.2008, p. 66). 3.4 The ECB further notes that the government ordinance does not specify key features of the new benchmark, such as the name (and acronym) and the administrator of the new benchmark, nor does it specify the full methodology for the determination of the new benchmark or where such details are to be made available. If the administrator of the new benchmark envisaged under the government ordinance were to be BNR, the ECB notes that

text: Regulation (EU) 2016/1011

text: does not apply to central banks , as central banks already meet principles, standards and procedures which ensure that they exercise their activities with integrity and in an independent manner . Accordingly, if BNR were to be the designated administrator the government ordinance should not impinge on BNR’s discretion to develop the methodology for determining the new benchmark so as to ensure its accuracy, integrity and reliability. When central banks provide benchmarks, it is their responsibility to establish appropriate internal procedures in order to ensure the accuracy, integrity, reliability and independence of those benchmarks, taking into account international best practice where relevant and appropriate . The ECB would need to be consulted under Articles 127(4) and 282(5) of the Treaty with regard to draft national legislation that confers further tasks on BNR in this respect. This opinion will be published on the ECB’s website. Done at Frankfurt am Main, 10 May 2019. [signed] The President of the ECB Mario DRAGHI

text: Recital 14

text: of

text: Regulation (EU) 2016/1011

text: 22 See the Board of the International Organization of Securities Commissions (OICU-IOSCO), Principles for Financial Benchmarks (July 2013), available at www.iosco.org.

type: vagledning

utgivare: ecb