Decision (EU) 2022/1981 of the European Central Bank of 10 October 2022 on the use of services of the European System of Central Banks by competent authorities (ECB/2022/33)

Article 1

Definitions

For the purposes of this Decision, the following definitions apply:

• (1) ‘competent authority’ means either a national competent authority or the European Central Bank (ECB);

• (2) ‘national competent authority’ (NCA) means a national competent authority as defined in point (2) of Article 2 of Regulation (EU) No 1024/2013 and, for the purposes of this Decision, also includes, in respect of the supervisory tasks assigned to them, national central banks that have been assigned certain supervisory tasks under national law and are not designated as NCAs;

• (3) ‘ESCB services’ means any one or more of the electronic applications, systems, platforms, databases and services listed in Annexes I and II;

• (4) ‘providing central bank’ means a central bank developing, running and maintaining an ESCB service.

Article 2

Use of ESCB services by competent authorities

Article 3

Financial arrangements

Article 4

Entry into force

This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

ANNEX I

ESCB services that competent authorities are required to use

• — AnaCredit (Anacredit)

• — Banks’ Integrated Reporting Dictionary Operational Tasks Project (BIRD OT)

• — Centralised Securities Database (CSDB)

• — CoreNet

• — Enterprise Service Bus (ESB)

• — Identity and Access Management Service (IAM)

• — Register of Institutions and Affiliates Database (RIAD)

• — Securities Holdings Statistics Database (SHSDB)

ANNEX II

ESCB services that competent authorities may use

• — ESCB Teleconference System

• — Secure ESCB Email (SEE)

• — ESCB public key infrastructure (ESCB PKI)

• — ESCB Performing Survey Initiative LimeSurvey-based Solution (EPSILON)

• — ENTM Modelling tool and repository (ENTM)

ANNEX III

Requirements for ESCB services that competent authorities are required to use

• (1)Competent authorities must carry out the tasks and assume the responsibilities corresponding to their role in the relevant ESCB service.

• (2)Competent authorities must adjust their internal systems and interfaces to operate seamlessly with the ESCB service.

• (3)Competent authorities will be liable for any loss or damage incurred as a result of any deliberate or negligent action and/or omission in performing their obligations. The limitations of liability laid down in the Level 2 – Level 3 Agreement will apply accordingly.

• (4)Competent authorities will bear the burden of proof of demonstrating that they have not breached their duty of reasonable care in performing their obligations, including in operating the technical facilities.

• (5)Outsourcing, delegation or subcontracting by a competent authority to third parties will be without prejudice to the liability of that competent authority.

• Competent authorities may only outsource, delegate or subcontract to a third party tasks that have or may have a material impact on compliance with the requirements set forth in this Annex to the extent that they have obtained the express, prior and written consent (or deemed consent as provided for in paragraph (6)) of the Eurosystem central banks, or the ESCB central banks, as the case may be. No such consent is needed if the third party is a joint affiliate of the relevant competent authority and if that competent authority’s rights and obligations remain materially unchanged.

• (6)Competent authorities must give reasonable prior notice of any planned outsourcing, delegation or subcontracting as referred to in paragraph 5 and must provide details of the requirements that are proposed to apply to such outsourcing, delegation or subcontracting.

• The competent ESCB Committee must respond to any request for consent under paragraph 5 within two months of it being notified of the planned outsourcing, delegation or subcontracting. Any refusal to grant consent must be accompanied by the reasons for such refusal. If the competent authority receives no response within the two-month deadline, it may notify the competent ESCB Committee of its request once again. The Eurosystem central banks, or ESCB central banks, as the case may be, will have one further month within which to respond to the second notification. If there is no response within that time period, the competent authority will be deemed to have received consent to proceed with the outsourcing, delegation or subcontracting.

• (7)Competent authorities must keep confidential all sensitive, secret or confidential information and know-how (whether such information is of a commercial, financial, regulatory, technical or other nature) that is marked as such and belongs to the providing central bank and/or to other ESCB/Eurosystem central banks, and may not disclose such information to any third party without the express, prior and written consent of the central bank(s) concerned.

• (8)Competent authorities must restrict access to the information or know-how referred to in paragraph 7 to their relevant technical staff, and such access may only be exercised in cases of clear operational need.

• (9)Competent authorities must establish appropriate measures to prevent access to such confidential information or know-how by persons other than the relevant technical staff.

• (10)In the case that the usage of the ESCB service involves the processing of personal data by the competent authority, the competent authority must comply with the applicable data protection legislation.

• (11)Access to personal data may be granted only to those with an need to know in order to perform their tasks and fulfil their responsibilities in relation to the relevant ESCB service.