40.—(1) This regulation applies in relation to a provider of a service who is established in the United Kingdom and is providing the service in another EEA state.
(2) The competent authority must, when requested to do so by a relevant authority in another EEA state, supply information about the provider to that authority.
(3) The information referred to in paragraph (2) includes in particular—
(a)confirmation that the provider is established in the United Kingdom;
(b)whether, to the competent authority’s knowledge, the provider is authorised to provide the service.
(4) The competent authority must, when requested to do so by a relevant authority in another EEA state—
(a)carry out checks, inspections or investigations in relation to the provider,
(b)inform the requesting authority of the results, and
(c)if it thinks it appropriate to take any measures in relation to the provider, inform the requesting authority of those measures.
(5) Nothing in paragraph (4) permits or requires a competent authority to do anything which it could not otherwise lawfully do.