Quick Take: EBA sharpens its supervisory tone yet leaves questions open

The EBA's SPoRs share a number of common supervisory aims set out in similar Opinions issued by the EBA's sister European Supervisory Authorities (the ESAs) during 2017 and the updates issued in 2018. Despite common principles, the EBA's SPoRs are comparably longer, stricter and often add additional obligations affecting the market, even if the requirements are specifically tailored to:

  • Credit institutions and the banking sector
  • MiFID Investment Firms and the investment management sector but not regulated funds and their managers
  • Payment institutions and electronic money institutions engaged in payments related business
  • Credit intermediaries and non-credit institutions admitted under the EU's "Mortgage Credit Directive" and active in the mortgage market

So what does this mean in practice? The 2017 and 2018 supervisory cycles and on-going dialogue with existing firms and applicants have begun to move the EU's SPoRs closer to the forefront of much sharper supervisory expectations and tone that if "BREXIT means BREXIT" then "third-country means third-country." After nearly a year of being in force, a number of questions on expectations remain. This remains important after the UK's "No Deal Guidance" was published for banking and the financial services sector on August 23, 2018.1

EBA's SPoRs and aims

This Client Alert assesses what the EBA's SPoRs mean in practice, especially given their impact on policies, processes and people involved in "change the business," "run the business," "change the compliance" as well as "close the business" workstreams. It will also affect firms and their supervisory engagement process with the national competent authorities (NCAs) across the EU-27 and, in the Eurozone, both the European Central Bank (ECB), acting in its capacity as the lead of the Single Supervisory Mechanism (SSM) in the Banking Union.

On October 12, 2017, the European Banking Authority (EBA) joined the other ESAs and released a legal instrument in the form of an 'Opinion' titled: "issues related to the departure of the United Kingdom from the European Union" (the EBA General Opinion).2 The EBA General Opinion was supplemented by a "Report" that provides explanations for certain SPoRs. An "Annex to the Report" details key questions that competent authorities should consider when reviewing a licence application. On June 25, 2018 the EBA released a further Opinion on preparations for the withdrawal of the United Kingdom from the European Union (the 2018 EBA Opinion)3 concluding that, in consultation with the NCAs and the SSM:

  1. A number of firms, not just those in the banking sector or those relocating to the Banking Union, have not done enough to put in place contingency planning, contractual continuity amendments and other preparations – the 2018 EBA Opinion focuses on what firms need to do to identify specific risk channels and exposures to UK counterparties, infrastructure providers and other linkages;
  2. Where planning is taking place a number of firms are delaying triggering the necessary actions – including a lack of taking preparatory measures to safeguard access to funding, including loss absorbent capital instruments, or to take account of own measures and how they interoperate with those taken by counterparties and financial market infrastructure providers; and
  3. The time to take required actions is reducing and should not rely on public sector solutions as they may not be proposed and/or agreed – and placing firms' communication with the public as a priority by no later than 2018 so as to minimise potential disruption from "customer"4 confusion setting out clearly and plainly the specific implications of BREXIT on the firm's engagement with customers, any mitigating measures, the contractual and statutory rights of customers as well as rights of escalation.

Almost a year on from the EBA General Opinion, the SPoRs remain more valid than ever. Even after the publication of the 2018 EBA Opinion and its stark warnings, the level of awareness of what the SPoRs require remains low and preparatory steps lacking. The EBA General Opinion focused very much on UK firms relocating, and the 2018 EBA Opinion expands that also to obligations on EU-27 firms engaging with or in the UK post-BREXIT. This expansion is important in its own right, but should also be compared to the SPoRs issued by the other ESAs as well as the ECB-SSM that are not limited in their application to just the UK. All of these SPoRs should be read in conjunction with one another even if the Opinions and related workstreams of each of the other agencies are only beginning to cross-reference each other's work as well as the European Commission's diverse "Notice to Stakeholders" and wider work on "contractual continuity".5

So what do the EBA's SPoRs require?

The EBA's SPoRs are built upon the premise of no automatic grandfathering of existing establishments, and there are, as yet, no definitive indications that the UK will be able to obtain a transition agreement to extend its EU Single Market access/rights beyond its exit of the EU in March 2019. In practical terms this means that firms in the UK will, from an EU regulatory perspective, become third-country entities (TCEs) and lose access along with other rights and permissions. This conclusion is also echoed in those SPoRs issued by other ESAs and communicated to the relevant national competent authorities (NCAs) and their respective supervisory mandates within the European System of Financial Supervision (ESFS) along with statements of European Central Bank (ECB), acting in its role in the Single Supervisory Mechanism (SSM).

For entities wishing to relocate, if the measures detailed in their licence applications do not reflect the outcomes set in the SPoRs, they may find their application documents being deemed to be "incomplete" and thus in need of improvements prior to resubmission. In practical terms, the SPoRs aim at ensuring supervisory convergence by focusing on the application of:

  1. Common standards, approaches and rules during the authorization process as well as internal model approvals,6 booking processes, internal governance7 and risk management - specifically where it concerns outsourcing and risk transfers using back-to-back or intragroup operations;
  2. Equivalent access for the provision of investment services (whether directly or by establishment) by firms in the EU; and
  3. Harmonized approaches on participation by firms in deposit guarantee scheme issues and ultimately revisiting adequacy of recovery and resolution plan (RRP) frameworks and how these are impacted by the UK's position as a third-country following it leaving the EU.

While these ESA Opinions are addressed to EU supervisors, the SPoRs will be directly relevant to new firms/business units relocating and any intermediate or parent holding companies. And they will also be relevant to those credit institutions and/or Banking Union supervised institutions (BUSIs) already operating in the EU and/or the Eurozone and its Banking Union. The latter is in particular the case in relation to assessing what type and volume of activity is permitted to be delegated from a BUSI back to the UK or other third-countries.

The impacts of the EBA General Opinion's SPoRs on relocating entities can be summarized as follows:

Summary of EBA General Opinion SPoRs Summary of 2018 EBA Opinion SPoRs What could this mean for relocating entities?
No automatic recognition of existing authorisations Financial institutions should ensure that they have the necessary regulatory permissions in the UK and in the EU-27 to conduct new as well as support existing business. If new or expanded regulatory permissions are needed, they should be applied for as soon as possible ahead of March 2019 EU law does not provide for a basis for supervisors to place reliance on previous or existing authorisation decisions granted by another EU Member State's authority or a third-country. Rather EU law supports the "...best use of existing information where information is exchanged."
Consequently, as the other ESAs have stated, existing branches and firms will not be able to benefit from any "grandfathering provision" nor will they be given "favorable treatment," rather each application will be assessed with fresh eyes
No lowering of existing standards by supervisors As a result, certain areas, notably those that factor into the 2019/2020 and beyond supervisory workplans and priorities will likely be subject to extra supervisory scrutiny and review
Authorisations, registration and variation of permissions granted by EU- 27 NCAs should be rigorous and efficient and take into account the final standards specifying information requirements as well details of supporting evidence to be submitted as a part of credit institution8 applications Firms should identify which existing or future contracts will be potentially affected and assess contractual continuity and given the time involved should make the necessary changes to those contracts as soon as possible as well as any relevant data protection considerations in terms of transfers in and out of the EU Relocating entities' applications may need to submit much more detail in the application as well as the supporting evidence than has previously been the case. A greater emphasis is likely to be placed on evidencing specifically why a specific choice or action is justifiable, the control processes involved and how relevant risks are identified, mitigated and managed. Applicants may need to also provide greater detail of evidence as to how a specific decision fits into the firm's general strategy
The 2018 EBA Opinion puts a greater focus on contractual continuity and the need for advance engagement with counterparties and clients so as to begin BREXIT-proofing of contracts as a matter of priority
NCAs should be able to verify the objective reasons for relocation
Special attention should be granted to avoid 'letter-box entities' and 'empty shells' in the EU-27 Careful consideration is required as to how existing organizational structures accommodate new or expanded EU-27 entities. The booking model of the financial institution should clearly articulate how and where risk, including market risk (pricing and hedging) will be managed as well as account considerations and resilience as part of recovery and resolution planning. All firms should have sufficient substance in the EU-27 to manage the risks they generate from the first day after the withdrawal of the UK Applicants will need to demonstrate sufficient presence and permanence in terms of persons and processes. As with the SPoRs set in other ESA Opinions, this may translate into ensuring that positions that are relocating are staffed with suitably qualified individuals with relevant experience and commitment to being employed and based in the jurisdiction of the relocating entity. Supervisors may also periodically check whether the actual regulated activity that has been applied for is actually being conducted in the EU-27
Since the initial publication of the SPoRs, a number of legal entity structuring solutions have been proposed that rely on IT to ensure that positions as opposed to actual people move – this is gaining supervisory interest in particular where firms are overly reliant on IT solutions and/or the absence of people means there is insufficient presence.
NCAs should ensure that substance requirements are met
NCAs should assess whether an applicant from the UK has considered that existing branches in the EU will become a third-country branch of a TCE following BREXIT and its regulatory permissions and ability to operate will change Firms should identify which UK and third country financial market infrastructure providers they will need access to and align own contingency plans with those taken by those parties. This follows earlier SPoRs of the sister ESAs and is quite clear that there is an expectation that any relocating applicant to incorporate as a subsidiary as opposed to a branch of a TCE.
The 2018 EBA Opinion focuses much more on firms being cognizant of how its BREXIT-proofing actions impact and interoperate with measures taken by the wider market.
Outsourcing and delegation will be subject to greater supervisory scrutiny9 The EBA General Opinion specifically mentions that the NCA and/or ECB-SSM should have the right to conduct onsite inspections at the outsourcing service provider. As with the SPoRs from the sister ESAs, outsourcing and delegation to third-countries is only possible under strict conditions.
Credit institutions engaging "...in back-to-back (undefined) or intragroup operations to transfer risk" to another entity should have adequate resources, including regulatory capital, to identify, account for, mitigate and manage risks in the event of a failure This suggests that far more supervisory scrutiny will be given to how firms monitor such exposures and that the concentration risk and large exposures regulatory regime will play a far more important component in the EU and Banking Union use of the Supervisory Review and Evaluation Process (SREP)10 tool.
The EBA General Opinion like the EIOPA Opinion, proposes "enhanced supervisory cooperation" and information sharing to be imposed, by the relevant NCA or the ECB-SSM This SPoR applies when: "...the transfer of market risk relates to volumes of transactions that are significant [undefined] having regard to the size of the local market." In the absence of such enhanced cooperation, the competent authority (i.e. NCA and/or ECB-SSM) can take steps:"...to limit or prevent the transfer of significant market risk."
NCAs should ensure sound governance of EU entities It is expected that this will translate into much closer supervisory scrutiny of both "key function holders" along with internal governance processes and policies. The tone that ESMA sets in these SPoRs follows on from existing guidance of the ESAs on governance as well as, to some degree, the supervisory expectations that are communicated in the ECB-SSM's Guide on Fitness and Propriety which is detailed in our Eurozone Hub's coverage11
Permissions for existing and new internal model approvals or extensions will receive closer supervisory scrutiny Financial institutions should assess as part of capital planning and models increased risk weights for UK exposures, including higher capital requirements for derivatives cleared through non-qualifying CCPs Any relocating entity will need to apply for model approvals prior to using them and take note of existing EBA and/or ECB-SSM supervisory expectations and obligations. This obligation applies regardless of a relocation
NCAs should ensure they have sufficient resources to deal with BREXIT- workstreams along with a host of workstreams that have "change the business" impact for supervised firms (MiFID II/MiFIR, PSD2 and GDPR etc.) This SPoR is directed at the supervisors and, as in the Opinions of the other ESAs, requires that sufficient and competent resources be made available to deal with the breadth of non-BREXIT related workstreams. Whilst some NCAs are increasing their resources, there is, notably in relation to Banking Union, a shift starting to emerge that some NCAs may be better at certain areas of supervisory mandates than others.
This may raise the bar amongst supervisors and brings with it both benefits but also risks for firms and the tone of supervisory engagement
ECB-SSM should be responsible for direct supervision those entities that qualify as "Class 1 Investment Firms" as such terms is used within the meaning of the EBA's proposal for a new prudential regime for MiFID Investment Firms This SPoR is particular to the EBA General Opinion and ties in with changes being proposed to create a new prudential regulatory capital regime specific to the risks of MiFID Investment Firms. Please see our Eurozone Hub's coverage12 on this development.
BREXIT exposure will matter for "close the business" workstreams NCAs will, in addition to factoring how BREXIT will affect supervised entities' RRP frameworks, their access and obligations towards deposit guarantee schemes as well as their exposure to financial market infrastructure providers located in the UK in the context of their recovery and resolution planning will also need to consider the impact on capital market instruments. This means in-scope firms will need to assess and cater for sufficient inventory and issuance plans for instruments used to meet the EU MREL framework13 and "...in particular their reliance on issues issued under English law."
Whilst the rationale for this supervisory approach is understandable, the concern really ought to be whether the choice of jurisdiction, including alternatives to the English courts is appropriate as opposed to attempting to regulate parties' freedom to choose the governing law.
There are a number of financial instruments admitted to trading across the EU-27 with financial transaction and operational documentation where the terms are governed by English law and the offering documentation as well as certain other points by local law
NCAs must be in a position to effectively supervise and enforce EU law and share information obtained far more greatly NCAs are instructed to implement coordination measures to ensure effective monitoring by the EBA as well as to periodically update the EU Credit Institutions Register14 and the EBA E-Gate15 process

The SPoRs, whilst quite vast in what they cover, will have varying degrees of impact across various regulated business types and legal entity structures. What is important to note is that the EBA General Opinion like with those of its sister authorities are drafted as 'jurisdiction agnostic' and 'firm-type agnostic'.

The SPoRs thus apply to all relevant types of entities addressed in the Opinions irrespective of their business activity and/or risk profile. As indicated in the Annex to the Report, firms relocating to the Banking Union may also want to consider how the ECB-SSM's streamlining i.e. elimination of national options and discretions in the CRR/CRD IV Framework16 will impact them.

Key takeaways from the Annex to the Report

The Annex to the Report has a number of general takeaways for supervisors reviewing applications for firms applying as a credit institution as well as more specific questions grouped in 43 headings. The principles in the general considerations should be fairly familiar to most regulated firms and applicants. The specific items however are highlighted below.

In short the SPoRs, plus the considerations in the Annex to the Report, should be read together with the items referenced in our recent coverage17 on the ECB-SSM's supervisory "guides" on banking licence applications for traditional and "FinTech" credit institutions and certain clarifications on EU banking regulation as well as other on-going coverage from our Eurozone Hub.

The specific considerations from the Annex to the Report include:

  • Does the applicant have a LEI? Has the applicant demonstrated sufficient preparedness to meet its regulatory reporting obligations?
  • If the applicant is a legal person, does it have a registered office in an EU Member State? Is the applicant's head office in the same Member State as the registered office? If not where is it? - NB the Explanatory Notes to these questions remind supervisors that Article 13(2) of CRD IV18 imposes harmonised principles relating to the location of the effective direction of the business and place of the head office. Further, the notes cross refer to Recital 16 of CRD IV and state that "...authorisation should be refused where the factors such as the geographical distribution of activities indicate clearly that an applicant has opted for the legal system of one Member State for the purpose of evading the stricter standards in force in another Member State on whose territory it carries out or intends to carry out the greater part of its activities";
  • Has a "significant event"19 taken or is one taking place in respect of the applicant or any of its subsidiaries?
  • Are the proposed regulated activities that are being applied relevant and do they align with the proposed business model?
  • Are other regulatory permissions, whether in EU or national legislation, being applied for?
  • Which SREP business model category would the applicant fall into? This will assist in determining whether any additional "special requirements" will need to be set during and following the licence approval process.
  • Has the applicant confirmed that before or upon authorisation it will become a member of a deposit guarantee scheme in accordance with Art. 4(3) of Directive 2014/49/EU (DGSD3)?
  • An outline of actual and expected indebtedness and security interests, guarantees, or indemnities granted or expected prior to the commencement of the applicant credit institution plus an analysis of the scope of consolidated supervision.
  • Has the applicant provided the following policies and frameworks? These are in addition to those required by national legislation and/or the Banking Union specific rules (in particular those in the ECB-SSM's NPL Guide20) and are different to the required "programme of operations" i.e., regulated business plan plus any requirement to explain the internal control framework and take account of the compliance manual as well as specific policies, the compliance monitoring framework, operations manual and/or business continuity plan, RRP or any SREP relevant policies (ICAAP, ILAAP or Risk Appetite Framework):

    • risk management framework
    • liquidity risk management framework
    • funding concentration and diversification policy
    • collateral management policy
    • deposit policy
    • credit and lending policy
    • concentration risk policy
    • provisioning policy
    • dividend distribution policy
    • trading book policy
  • Does the applicant have in place appropriate auditing and internal audit arrangements? and
  • Are there any obstacles which may prevent the effective exercise of supervisory functions of the competent authorities, including where relevant supervision is on a consolidated basis?

The above are minimum considerations. They are also not drafted in a way that interoperate with any additional as well as specific requirements set by NCAs and/or the ECB-SSM.

Putting it all together

The EBA General Opinion is the last of the ESA's 2017 Opinions. The European Securities and Markets Authority (ESMA) General Opinion was released during May 2017 and further supplemented by "Sector Specific Opinions" (SSOs). ESMA's SPoRs were the first in a series of regulatory tools to improve supervisory convergence amongst the NCAs as well as amongst the ESAs that make up the ESFS. The European Insurance and Occupational Pensions Authority (EIOPA) followed swiftly suit in July 2017.

The EBA General Opinion, like that of its sister ESAs is addressed to the NCAs across the EU-27 that with the ESAs make up the ESFS as well as the Eurozone-19's Banking Union authorities, the ECB-SSM and the Single Resolution Board. The EBA General Opinion also applies to the national competent authorities of Norway, Liechtenstein and Iceland in the European Economic Area (EEA). Given the breadth and depth it also needs to be read in conjunction with SPoRs of other authorities, even if a relevant firm may not be undertaking activity in that sector at present. This is recommended as the ESA's Opinions all aim to deliver on the supervisory convergence goals to making the Single Rulebook for financial services more uniform across the EU-27 and the Eurozone-19 and its Banking Union as well as to roll-out the 'level-playing field' to the EEA states.

Outlook and some next steps for firms affected by the SPoRs of the EBA and ESAs

The SPoRs in the ESA's Opinions have already set a new, more clearly mapped route on how financial services firms will need to structure themselves when relocating to the EU-27 and/or Eurozone-19 as a result of BREXIT or otherwise and the sharpened supervisory expectations that go with that new supervisory and regulatory environment. Navigating those requirements and complying with expectations will require a number of changes to existing and pending arrangements that will merit earlier consultation and support from external counsel and cross-disciplinary and business unit project teams.

Some of this may send certain firms back to the drawing board to ensure their BREXIT-proofing workstreams reflect the SPoRs and the much more invasive supervisory tone coupled with longer administrative processing time and a far more complex interplay between pan-EU and/or Banking Union-specific obligations and the requirements of individual jurisdictions and global standards in terms of firm specific policies, processes and procedures.

In terms of evidencing SPoR compliance, some firms may want to consider splitting off existing BREXIT-proofing resources and specialist counsel to focus in an independent manner on drafting and implementing policies and procedures that are compliant with the requirements applicable in the EU-27 and/or the Eurozone-19 and its Banking Union, in each instance as amended, supplemented or complemented by the SPoRs.

Please do get in touch with any of our Eurozone Hub key contacts if you require specialist support with your licence applications, variation of permissions or drafting of policies and procedures or for more analysis from our wider Eurozone Group.


1 The UK's No-Deal Guidance Note "Banking, insurance and other financial services if there's no Brexit deal" mirrors some of those conclusions – please see our Eurozone Hub's coverage on the text of the Guidance Note which is available https://www.gov.uk/government/publications/banking-insurance-and-other-financial-services-if-theres-no-brexit-deal/banking-insurance-and-other-financial-services-if-theres-no-brexit-deal#individual-and-business-customers---uk-based-customers-of-uk-based-providers

2 Available: http://www.eba.europa.eu/documents/10180/1756362/EBA+Opinion+on+Brexit+Issues+%28EBA-Op-2017-12%29.pdf

3 Available: https://www.eba.europa.eu/documents/10180/2137845/EBA+Opinion+on+Brexit+preparations+%28EBA-Op-2018-05%29.pdf

4 It is not clear whether this is meant to include all types of counterparties or just retail clients, but the conservative approach would be to suggest that the EBA, like its sister ESAs, recommends communication with all stakeholders regardless of their regulatory categorization.

5 See: Notices to stakeholders published on 8 February 2018, in particular relating to the 'Withdrawal of the United Kingdom and EU rules in the field of banking and payment services', available at: https://ec.europa.eu/info/brexit/brexitpreparedness_en?field_core_tags_tid_i18n=22848&page=3

6 Chapter II of the Report component of the EBA General Opinion provides a host of detail on the SPoRs relating to internal model approvals, governance and validation processes. These issues are discussed in greater detail in a standalone analysis available from our Eurozone Hub.

7 Please see our separate Eurozone Hub coverage on new EBA rules on governance and impacts on authorization and supervision of key function holders and other senior management staff.

8 See our coverage on: the ECB-SSM's supervisory Guides on licence applications covered in our standalone Client Alert on the topic available from our Eurozone Hub here: https://www.dentons.com/en/issues-and-opportunities/eurozone-hub/-/media/73a225386d0d4c1f91bf3ea003077b11.ashx

9 Please see our coverage on the ECB-SSM's new rules on on-site inspections: https://www.dentons.com/en/insights/articles/2018/august/3/the-draft-ecb-ssm-supervisory-guide-to-on-site-inspections-and-internal-model-investigations

10 See our coverage on how SREP is evolving in the Banking Union available from our Eurozone Hub.

11 See: https://www.dentons.com/en/insights/alerts/2018/july/2/ecb-ssm-releases-its-updated-may-2018-supervisory-guidance

12 See: https://www.dentons.com/en/insights/alerts/2018/july/18/the-impact-of-the-european-commissions-proposals

13 "Minimum requirement for own funds and eligible liabilities".

14 This resource, and equivalents of the sister ESAs, are a first and important step to introducing a centralized resource to collect and publish data on entities regulated to conduct financial services business: http://www.eba.europa.eu/risk-analysis-and-data/credit-institutions-register

15 EBA E-Gate is an IT tool designed to facilitate the collection, storage and display of different notifications that are reported by several data providers including competent authorities in the ESFS to the EBA. The EBA's ultimate supervisory objective is to include electronic submission of most, if not all, the notifications that are required to be submitted to the EBA.

16 See some of our Eurozone Hub lawyers' current and previous Thought Leadership contributions available from our Eurozone Hub as well as the Sweet & Maxwell's Journal of International Banking Law and Regulation

17 See: https://www.dentons.com/en/issues-and-opportunities/eurozone-hub/-/media/73a225386d0d4c1f91bf3ea003077b11.ashx

18 Directive 2013/3/EU, as amended and supplemented.

19 See page 69 of the EBA General Opinion, but this may be briefly summarized as any of the following having or currently occurring in relation to applicant or any of its subsidiaries:

1. declaration of a moratorium of any indebtedness, restructuring or reorganization process affecting its creditors etc.;

2. administrative penalty or civil or administrative judgment or arbitral award or decision with equivalent effect;

3. any unsatisfied judgment or awards outstanding;

4. any settlements reached in a financial services subject matter and details of any current proceedings; and

5. any criminal conviction or administrative penalty generally and specifically in respect of conducting unauthorized regulated activity, engaging in fraud, acting dishonestly, committing corruption, financial crime or failure to put in place adequate policies and procedures to prevent such events.

20 See our Client Alerts on this developments from our Eurozone Hub.

Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries. www.dentons.com.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.