Commission Delegated Regulation (EU) 2021/1351 of 6 May 2021 supplementing Regulation (EU) 2016/1011 of the European Parliament and of the Council with regard to regulatory technical standards specifying the characteristics of the systems and controls for the identification and reporting of any conduct that may involve manipulation or attempted manipulation of a benchmark (Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2016/1011 of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/2014 ¹, and in particular Article 14(4) thereof,

Whereas:

• (1) It should be ensured that the detection of benchmark manipulation or attempted manipulation is effective and adequate. It is therefore necessary that the systems and controls of a benchmark administrator are proportionate to the nature, the complexity and the risk of manipulation of the benchmark provided and that the risk of manipulation is evaluated on the basis of an objective assessment which takes into account the origin, nature, peculiarity and severity of such risk.

• (2) In order to ensure that the detection of any conduct that may involve manipulation or attempted manipulation of a benchmark is effective, it is necessary to provide for appropriate automated systems to monitor input data. However, automated systems alone are not sufficient to ensure that manipulative behaviour is effectively detected. Automated systems should therefore be complemented by an appropriate level of human analysis to be carried out by appropriately trained staff.

• (3) To ensure that competent authorities can effectively assess measures taken to identify and report misconduct, administrators should, upon request, provide the competent authority with information on the nature, complexity and risk of manipulation of the benchmark concerned, and substantiate the appropriateness of the level of automation and human analysis chosen.

• (4) The employees of a benchmark administrator that are in charge of operating the administrator’s systems and controls should receive appropriate training to enable them to analyse whether or not a given data input is suspicious. Such training should ensure that those employees are aware of the features of proper input data submission and of discrepancies in input data potentially caused by manipulation or attempted manipulation. Effective training should be tailored to the nature, complexity and risk of manipulation of the benchmark provided.

• (5) Administrators may prefer to outsource functions related to the systems and controls. Such outsourcing should only be possible to the extent it does not materially impair the administrator’s control over the provision of the benchmark or the ability of the relevant competent authority to supervise the benchmark, and is in any case subject to the requirements of Article 10 of Regulation (EU) 2016/1011.

• (6) This Regulation is based on the draft regulatory technical standards submitted to the Commission by the European Securities and Markets Authority (ESMA).

• (7) ESMA has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the advice of the Securities and Markets Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council ².

• (8) In order to ensure consistency with the date of application of Article 5 of Regulation (EU) 2019/2175 of the European Parliament and of the Council ³, which introduced in Regulation (EU) 2016/1011 Article 14(4) of that Regulation, this Regulation should apply from 1 January 2022,

HAS ADOPTED THIS REGULATION:

Article 1

Adequate systems and effective control

• (a) appropriate for and proportionate to the nature, complexity and risk of manipulation of the benchmark concerned;

• (b) regularly, and at least annually, reviewed, and updated when necessary to ensure that those systems and controls continue to comply with point (a);

• (c) be documented in writing in a clear and comprehensible manner, including any changes to or updates of those systems and controls.

For the purposes of point (a) of the first subparagraph, an administrator shall, on a regular basis and at least annually, assess the risk of manipulation of the benchmark provided, taking into account the following elements:

• (a) the envisaged operations required to provide the benchmark;

• (b) the potential origin, nature, peculiarity and severity of the manipulation risk;

• (c) the measures envisaged to address the risk of manipulation, including safeguards, security measures and internal procedures.

• (a) software capable of deferred automated reading, replaying and analysis of input data;

• (b) human analysis in the detection and identification of behaviour that may involve manipulation or attempted manipulation of a benchmark.

Article 2

Training

• (a) detect and identify any suspicious input data that could be the result of benchmark manipulation or attempted manipulation;

• (b) promptly report any such findings to their internal reporting line.

Article 3

Input data integrity policy

The adequate systems and effective controls referred to in Article 14(1) of Regulation (EU) 2016/1011 shall be documented in an input data integrity policy indicating:

• (a) the risk of benchmark manipulation;

• (b) a general description of the adequate systems and effective controls, including their compliance with the requirements laid down in Article 1;

• (c) a general description of the training of the employees of the administrator involved in the operation of the adequate systems and effective controls, as referred to in Article 2;

• (d) the name and contact details of the persons responsible for the adequate systems and effective controls.

Article 4

Entry into force and application

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 1 January 2022.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 6 May 2021.

For the Commission

The President

Ursula VON DER LEYEN