Directive 2014/91/EU of the European Parliament and of the Council
of 23 July 2014
amending Directive 2009/65/EC on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS) as regards depositary functions, remuneration policies and sanctions
(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 53(1) thereof,
Having regard to the proposal from the European Commission,
After transmission of the draft legislative act to the national parliaments,
Having regard to the opinion of the European Central Bank,
OJ C 96, 4.4.2013, p. 18.
Acting in accordance with the ordinary legislative procedure,
Position of the European Parliament of 15 April 2014 (not yet published in the Official Journal) and decision of the Council of 23 July 2014.
Whereas:
(1) Directive 2009/65/EC of the European Parliament and of the Council should be amended in order to take into account market developments and the experiences of market participants and supervisors gathered so far, in particular to address discrepancies between national provisions in respect of the duties and liability of depositaries, remuneration policy and sanctions.
Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS) (OJ L 302, 17.11.2009, p. 32).
(2) In order to address the potentially detrimental effect of poorly designed remuneration structures on the sound management of risks and on the control of risk-taking behaviour by individuals, there should be an express obligation for management companies of undertakings for collective investment in transferable securities (UCITS) to establish and maintain, for those categories of staff whose professional activities have a material impact on the risk profiles of the UCITS that they manage, remuneration policies and practices that are consistent with sound and effective risk management. Those categories of staff should include any employee and other member of staff at fund or sub-fund level who are decision takers, fund managers and persons who take real investment decisions, persons who have the power to exercise influence on such employees or members of staff, including investment advisors and analysts, senior management and any employees receiving total remuneration that takes them into the same remuneration bracket as senior management and decision takers. Those rules should also apply to investment companies that have not designated a management company authorised pursuant to Directive 2009/65/EC. Those remuneration policies and practices should apply, in a proportionate manner, to any third party which takes investment decisions that affect the risk profile of the UCITS because of functions which have been delegated in accordance with Article 13 of Directive 2009/65/EC.
(3) Provided that management companies of UCITS and investment companies apply all the principles governing remuneration policies, they should be able to apply those policies in different ways according to their size, the size of the UCITS that they manage, their internal organisation, and the nature, scope and complexity of their activities.
(4) While some actions are to be taken by the management body, it should be ensured that where, according to national law, the management company or investment company has in place different bodies with specific functions assigned, the requirements directed at the management body or at the management body in its supervisory function should also, or should instead, apply to those bodies, such as the General Meeting.
(5) When applying the principles regarding sound remuneration policies and practices established by this Directive, Member States should take into account the principles set out in Commission Recommendation 2009/384/EC, the work of the Financial Stability Board and G-20 commitments to mitigate risk in the financial services sector.
Commission Recommendation 2009/384/EC of 30 April 2009 on remuneration policies in the financial services sector (OJ L 120, 15.5.2009, p. 22).
(6) Guaranteed variable remuneration should be exceptional because it is not consistent with sound risk management or the pay-for-performance principle and should be limited to the first year of engagement.
(7) The principles regarding sound remuneration policies should also apply to payments made from UCITS to management companies or investment companies.
(8) The Commission is invited to analyse what the common costs and expenses of retail investment products in the Member States are, and whether further harmonisation of those costs and expenses is needed, and to submit its findings to the European Parliament and to the Council.
(9) In order to promote supervisory convergence in the assessment of remuneration policies and practices, the European Supervisory Authority (European Securities and Markets Authority) (‘ESMA’), established by Regulation (EU) No 1095/2010 of the European Parliament and of the Council, should ensure the existence of guidelines on sound remuneration policies and practices in the asset management sector. The European Supervisory Authority (European Banking Authority) (‘EBA’), established by Regulation (EU) No 1093/2010 of the European Parliament and of the Council, should assist ESMA in the elaboration of such guidelines. In order to prevent circumvention of the provisions on remuneration, those guidelines should also provide further guidance on the persons to whom remuneration policies and practices apply and on the adaptation of the remuneration principles to the size of the management company or the investment company, the size of the UCITS that they manage, their internal organisation and the nature, scope and complexity of their activities. ESMA’s guidelines on remuneration policies and practices should, where appropriate, be aligned, to the extent possible, with those for funds regulated under Directive 2011/61/EU of the European Parliament and of the Council.
Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84).
Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).
Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010 (OJ L 174, 1.7.2011, p. 1).
(10) The provisions on remuneration should be without prejudice to the full exercise of fundamental rights guaranteed by the Treaty on European Union (TEU), the Treaty on the Functioning of the European Union (TFEU) and the Charter of Fundamental Rights of the European Union (the Charter), to general principles of national contract and labour law, applicable legislation regarding shareholders’ rights and involvement and the general responsibilities of the administrative and supervisory bodies of the companies concerned, as well as to the right, where applicable, of the social partners to conclude and enforce collective agreements, in accordance with national law and practice.
(11) In order to ensure the necessary level of harmonisation of the relevant regulatory requirements in different Member States, additional rules should be adopted laying down the tasks and duties of depositaries, designating the legal entities that may be appointed as depositaries and clarifying the liability of depositaries in the event that the assets of the UCITS are lost in custody or in the case of depositaries’ improper performance of their oversight duties. Such improper performance may result in the loss of assets but also in a loss of the value of assets, if, for example, a depositary fails to act on investments that are not compliant with fund rules.
(12) It is necessary to clarify that a UCITS should appoint a single depositary having general oversight over the assets of the UCITS. Requiring that there be a single depositary should ensure that the depositary has an overview of all the assets of the UCITS and both fund managers and investors have a single point of reference in the event that problems occur in relation to the safekeeping of assets or the performance of oversight functions. The safekeeping of assets includes holding assets in custody or, where assets are of such a nature that they cannot be held in custody, verification of the ownership of those assets as well as record-keeping for those assets.
(13) In performing its tasks, a depositary should act honestly, fairly, professionally, independently and in the interest of the UCITS and of the investors of the UCITS.
(14) In order to ensure a harmonised approach to the performance of depositaries’ duties in all Member States irrespective of the legal form taken by the UCITS, it is necessary to introduce a uniform list of oversight duties that are incumbent on depositaries in relation to UCITS with a corporate form (an investment company) and UCITS in a contractual form.
(15) The depositary should be responsible for the proper monitoring of the cash flows of the UCITS, and, in particular, for ensuring that investor money and cash belonging to the UCITS is booked correctly on accounts opened in the name of the UCITS, in the name of the management company acting on behalf of the UCITS, or in the name of the depositary acting on behalf of the UCITS, at an entity referred to in point (a), (b) or (c) of Article 18(1) of Commission Directive 2006/73/EC. Therefore, detailed provisions should be adopted on cash flow monitoring so as to ensure effective and consistent levels of investor protection. When ensuring investor money is booked in cash accounts, the depositary should take into account the principles set out in Article 16 of that Directive.
Commission Directive 2006/73/EC of 10 August 2006 implementing Directive 2004/39/EC of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive (OJ L 241, 2.9.2006, p. 26).
(16) In order to prevent fraudulent cash transfers, no cash account associated with the transactions of the UCITS should be opened without the depositary’s knowledge.
(17) Any asset held in custody for a UCITS should be distinguished from the depositary’s own assets, and should at all times be identified as belonging to that UCITS. Such a requirement should confer an additional layer of protection for investors in the event that the depositary defaults.
(18) In addition to the existing duty of safekeeping of assets belonging to a UCITS, assets that are capable of being held in custody should be differentiated from those that are not, to which record-keeping and ownership verification requirements apply instead. The group of assets that can be held in custody should be clearly differentiated, since the duty to return lost assets should apply only to that specific category of assets.
(19) The assets held in custody by the depositary should not be reused by the depositary, or by a third party to which the custody function has been delegated, for their own account. Certain conditions should apply to the reuse of assets for the account of the UCITS.
(20) It is necessary to lay down the conditions for the delegation of the depositary’s safekeeping duties to a third party. Delegation and sub-delegation should be objectively justified and subject to strict requirements in relation to the suitability of the third party entrusted with the delegated function, and in relation to the due skill, care and diligence that the depositary should employ to select, appoint and review that third party. For the purpose of achieving uniform market conditions and an equally high level of investor protection, such conditions should be aligned with those applicable under Directive 2011/61/EU. Provisions should be adopted to ensure that third parties to which safekeeping functions have been delegated have the necessary means to perform their duties and that they segregate the assets of the UCITS.
(21) When a Central Securities Depository (CSD), as defined in point (1) of Article 2(1) of Regulation (EU) No 909/2014 of the European Parliament and of the Council, or a third-country CSD provides the services of operating a securities settlement system as well as at least either the initial recording of securities in a book-entry system through initial crediting or providing and maintaining securities accounts at the top tier level, as specified in Section A of the Annex to that Regulation, the provision of those services by that CSD with respect to the securities of the UCITS that are initially recorded in a book-entry system through initial crediting by that CSD should not be considered to be a delegation of custody functions. However, entrusting the custody of securities of the UCITS to any CSD, or to any third-country CSD should be considered to be a delegation of custody functions.
Regulation (EU) No 909/2014 of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives 98/26/EC and 2014/65/EU and Regulation (EU) No 236/2012 (see page 1 of this Official Journal).
(22) A third party to which the safekeeping of assets is delegated should be able to maintain an omnibus account, as a common segregated account for multiple UCITS.
(23) Where custody is delegated to a third party, it is also necessary to ensure that the third party is subject to specific requirements on effective prudential regulation and supervision. In addition, in order to ensure that the financial instruments are in the possession of the third party to which custody was delegated, periodic external audits should be performed.
(24) In order to ensure consistently high levels of investor protection, provisions on conduct and on the management of conflicts of interest should be adopted and should apply in all situations, including in the case of a delegation of safekeeping duties. Those rules should in particular ensure a clear separation of tasks and functions between the depositary, the UCITS and the management company or the investment company.
(25) In order to ensure a high level of investor protection and to guarantee an appropriate level of prudential regulation and ongoing control, it is necessary to establish an exhaustive list of entities that are eligible to act as depositaries. Those entities should be limited to national central banks, credit institutions, and other legal entities authorised under the law of Member States to carry out depositary activities under this Directive, which are subject to prudential supervision and capital adequacy requirements not less than the requirements calculated depending on the selected approach in accordance with Article 315 or 317 of Regulation (EU) No 575/2013 of the European Parliament and of the Council, have own funds not less than the amount of initial capital under Article 28(2) of Directive 2013/36/EU of the European Parliament and of the Council and have their registered office or a branch in the UCITS home Member State.
Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1).
Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).
(26) It is necessary to specify and clarify the UCITS depositary’s liability in case of the loss of a financial instrument that is held in custody. The depositary should be liable, where a financial instrument held in custody has been lost, to return a financial instrument of an identical type or the corresponding amount to the UCITS. No discharge of liability in the case of loss of assets should be envisaged, except where the depositary is able to prove that the loss is due to an external event beyond its reasonable control, the consequences of which would have been unavoidable despite all reasonable efforts to the contrary. In that context, a depositary should not be able to rely on internal situations such as a fraudulent act by an employee to discharge itself of liability.
(27) Where the depositary delegates custody tasks and the financial instruments held in custody by a third party are lost, the depositary should be liable. In the case of loss of an instrument held in custody, a depositary should return a financial instrument of an identical type or the corresponding amount, even if the loss occurred with a third party to which the custody has been delegated. The depositary should be discharged of that liability only where it is able to prove that the loss resulted from an external event beyond its reasonable control and with consequences that were unavoidable despite all reasonable efforts to the contrary. In that context, a depositary should not be able to rely on internal situations such as a fraudulent act by an employee to discharge itself of liability. No discharge of liability, be it regulatory or contractual, should be possible in the case of loss of assets by the depositary or a third party to which the custody has been delegated.
(28) Every investor in a UCITS should be able to invoke claims relating to the liability of its depositary directly or indirectly through the management company or the investment company. Redress against the depositary should not depend on the legal form of the UCITS (corporate or contractual) or the legal nature of the relationship between the depositary, the management company and the unit-holders. The right of unit-holders to invoke depositary liability should not lead to a duplication of redress or to unequal treatment of the unit-holders.
(29) Without prejudice to this Directive, a depositary should not be prevented from making arrangements to cover damages and losses to the UCITS or to the unit-holders of the UCITS. In particular, such arrangements should not constitute a discharge of the depositary’s liability, result in a transfer or any change to the depositary’s liability nor should they impinge on investors’ rights, including redress rights.
(30) On 12 July 2010, the Commission proposed amendments to Directive 97/9/EC of the European Parliament and of the Council in order to provide a high level of protection for UCITS investors where a depositary cannot meet its obligations. That proposal is supplemented by a clarification of the obligations and scope of the liability of the depositary and the third party to which the safekeeping functions have been delegated in this Directive.
Directive 97/9/EC of the European Parliament and of the Council of 3 March 1997 on investor-compensation schemes (OJ L 84, 26.3.1997, p. 22).
(31) The Commission is invited to analyse in which situations the failure of a UCITS depositary or a third party to which the safekeeping functions have been delegated could lead to losses to UCITS unit-holders which are not recoverable under this Directive, to analyse further what kind of measures could be adequate to ensure a high level of investor protection, whatever the chain of intermediation between the investor and the transferable securities affected by the failure, and to submit its findings to the European Parliament and to the Council.
(32) It is necessary to ensure that the same requirements apply to depositaries irrespective of the legal form of the UCITS. Consistency of requirements should enhance legal certainty, increase investor protection and contribute to the creation of uniform market conditions. The Commission has not received any notification that the derogation from the general obligation to entrust assets to a depositary has been used by an investment company. Therefore, the requirements laid down in Directive 2009/65/EC regarding the depositary of an investment company should be considered to be redundant.
(33) While this Directive specifies a minimum set of powers that competent authorities should have, those powers are to be exercised within a complete system of national law which guarantees respect for fundamental rights, including the right to privacy. For the exercise of those powers, which may amount to serious interferences with the right to respect for private and family life, home and communications, Member States should have in place adequate and effective safeguards against any abuse, including, where appropriate, prior authorisation from the judicial authorities of a Member State concerned. Member States should allow competent authorities to exercise such intrusive powers to the extent necessary for the proper investigation of serious cases where there are no equivalent means for effectively achieving the same result.

(34) Existing recordings of telephone conversations and data traffic records from a UCITS, management companies, investment companies, depositaries or any other entities regulated by this Directive, as well as existing telephone and data traffic records from telecommunications operators, constitute crucial, and sometimes the only, evidence to detect and prove the existence of infringements of the national law transposing this Directive, as well as to verify compliance by the UCITS, management companies, investment companies, depositaries or any other entities regulated by this Directive with investor protection requirements and other requirements laid down in this Directive and the implementing measures adopted pursuant hereto. Therefore, competent authorities should be able to require existing recordings of telephone conversations, electronic communications and data traffic records held by a UCITS, management companies, investment companies, depositaries or any other entities regulated by this Directive.
Access to telephone records and data is necessary for the detection of, and imposition of sanctions for, infringements of the requirements of this Directive or its implementing measures. In order to introduce a level playing field in the Union in relation to access to telephone and existing data traffic records held by a telecommunications operator or the existing recordings of telephone conversations and data traffic held by UCITS, management companies, investment companies, depositaries or any other entities regulated by this Directive, competent authorities should, in accordance with national law, be able to require existing telephone and existing data traffic records held by a telecommunications operator, in so far as permitted under national law, and existing recordings of telephone conversations as well as data traffic held by UCITS, management companies, investment companies, depositaries or any other entities regulated by this Directive, in those cases where a reasonable suspicion exists that such records relating to the subject-matter of the inspection or investigation may be relevant to prove infringements of the requirements laid down in this Directive or its implementing measures. Access to telephone and data traffic records held by a telecommunications operator should not encompass the content of voice communications by telephone.
(35) A sound prudential and conduct of business framework for the financial sector should rest on strong supervisory, investigatory and sanctions regimes. To that end, competent authorities should be equipped with sufficient powers to act and should be able to rely on equal, strong and deterrent penalties regimes for the infringements of this Directive. A review of existing powers to impose sanctions and their practical application aimed at promoting convergence of sanctions across the range of supervisory activities was carried out in Commission Communication of 8 December 2010 on reinforcing sanctioning regimes in the financial services sector. Competent authorities should be empowered to impose pecuniary penalties which are sufficiently high to be effective, dissuasive and proportionate, in order to offset expected benefits from behaviour which infringes the requirements laid down in this Directive.
(36) Even though nothing prevents Member States from laying down rules for administrative and criminal sanctions for the same infringements, Member States should not be required to lay down rules for administrative sanctions for the infringements of this Directive where they are subject to national criminal law. In accordance with national law, Member States should not be obliged to impose both administrative and criminal sanctions for the same offence, but they could do so if their national law so permits. However, the maintenance of criminal rather than administrative sanctions for infringements of this Directive should not reduce or otherwise affect the ability of competent authorities, for the purposes of this Directive, to cooperate with competent authorities in other Member States or to access or exchange information with those competent authorities in a timely manner, including after any referral of the relevant infringements to the competent judicial authorities for criminal prosecution. Member States should be able to decide not to lay down rules for administrative sanctions for infringements which are subject to national criminal law. The option for Member States to impose criminal sanctions rather than, or in addition to, administrative sanctions should not be used to circumvent the sanctions regime in this Directive.
(37) In order to ensure a consistent application across Member States, when determining the type of administrative penalties or measures and the level of administrative pecuniary penalties, Member States should be required to ensure that their competent authorities take into account all relevant circumstances.
(38) In order to strengthen their dissuasive effect on the public at large and to inform them about infringements which may be detrimental to investor protection, sanctions should be published, save in certain well-defined circumstances. In order to ensure compliance with the principle of proportionality, sanctions should be published on an anonymous basis where publication would cause a disproportionate damage to the parties involved.
(39) In order to enable ESMA to strengthen consistency in supervisory outcomes further in accordance with Regulation (EU) No 1095/2010, all publicly disclosed sanctions should be simultaneously reported to ESMA, which should also publish an annual report on all sanctions imposed.
(40) Competent authorities should be entrusted with the necessary investigatory powers, and should establish effective mechanisms to encourage reporting of potential or actual infringements. Information on potential and actual infringements should also contribute to the effective performance of ESMA’s tasks in accordance with Regulation (EU) No 1095/2010. Communication channels for the reporting of those potential and actual infringements should therefore also be established by ESMA. Information on potential and actual infringements communicated to ESMA should be used only for the performance of ESMA’s tasks in accordance with Regulation (EU) No 1095/2010.
(41) This Directive respects the fundamental rights and observes the principles recognised in the Charter as enshrined in the TFEU.
(42) In order to ensure that the objectives of this Directive are attained, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission. In particular, the Commission should be empowered to adopt delegated acts to specify the particulars that need to be included in the standard agreement between the depositary and the management company or the investment company, the conditions for performing depositary functions, including the type of financial instruments that should be included in the scope of the depositary’s custody duties, the conditions subject to which the depositary may exercise its custody duties over financial instruments registered with a central depository and the conditions subject to which the depositary should safekeep the financial instruments issued in a nominative form and registered with an issuer or a registrar, the due diligence duties of depositaries, the segregation obligation, the conditions subject to and circumstances in which financial instruments held in custody should be considered to be lost, and what is to be understood by external events beyond reasonable control, the consequences of which would have been unavoidable despite all reasonable efforts to the contrary. The level of investor protection provided by those delegated acts should be at least as high as that provided by delegated acts adopted under Directive 2011/61/EU. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level. The Commission, when preparing and drawing up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and to the Council.
(43) As part of its overall review of the functioning of Directive 2009/65/EC, the Commission, taking into account Regulation (EU) No 648/2012 of the European Parliament and of the Council, will review counterparty exposure limits applicable to derivatives transactions, taking into account the need to establish appropriate categorisations for such limits so that derivatives with similar risk characteristics are treated in the same way.
Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories (OJ L 201, 27.7.2012, p. 1).
(44) In accordance with the Joint Political Declaration of 28 September 2011 of Member States and the Commission on explanatory documents Member States have undertaken to accompany, in justified cases, the notification of their transposition measures with one or more documents explaining the relationship between the components of a directive and the corresponding parts of national transposition instruments. With regard to this Directive, the legislator considers the transmission of such documents to be justified.
OJ C 369, 17.12.2011, p. 14.
(45) Since the objectives of this Directive, namely to improve investor confidence in UCITS by enhancing requirements concerning the duties and the liability of depositaries, the remuneration policies of management companies and investment companies, and by introducing common standards for the sanctions applying to the main infringements of this Directive, cannot be sufficiently achieved by the Member States, but can rather, by reason of their scale and effects, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 TEU. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve those objectives.
(46) The European Data Protection Supervisor has been consulted in accordance with Regulation (EC) No 45/2001 of the European Parliament and of the Council and delivered an opinion on 23 November 2012.
Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).
OJ C 100, 6.4.2013, p. 12.
(47) Directive 2009/65/EC should therefore be amended accordingly,
HAVE ADOPTED THIS DIRECTIVE:

Article 1 Directive 2009/65/EC is amended as follows:
(1) in Article 2(1), the following points are added:

‘(s) ‘management body’ means the body with ultimate decision-making authority in a management company, investment company or depositary, comprising the supervisory and the managerial functions, or only the managerial function if the two functions are separated. Where, according to national law, the management company, investment company or depositary has in place different bodies with specific functions, the requirements laid down in this Directive directed at the management body or at the management body in its supervisory function shall also, or shall instead, apply to those members of other bodies of the management company, investment company or depositary to whom the applicable national law assigns the respective responsibility;
(t) ‘financial instrument’ means a financial instrument specified in Section C of Annex I to Directive 2014/65/EU of the European Parliament and of the Council.
Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).’;’;

(2) the following articles are inserted:

‘Article 14a 1. Member States shall require management companies to establish and apply remuneration policies and practices that are consistent with, and promote, sound and effective risk management and that neither encourage risk taking which is inconsistent with the risk profiles, rules or instruments of incorporation of the UCITS that they manage nor impair compliance with the management company’s duty to act in the best interest of the UCITS.
2. The remuneration policies and practices shall include fixed and variable components of salaries and discretionary pension benefits.
3. The remuneration policies and practices shall apply to those categories of staff, including senior management, risk takers, control functions and any employee receiving total remuneration that falls within the remuneration bracket of senior management and risk takers whose professional activities have a material impact on the risk profiles of the management companies or of the UCITS that they manage.
4. In accordance with Article 16 of Regulation (EU) No 1095/2010, ESMA shall issue guidelines addressed to competent authorities or to financial market participants concerning the persons referred to in paragraph 3 of this Article and the application of the principles referred to in Article 14b. Those guidelines shall take into account the principles on sound remuneration policies set out in Commission Recommendation 2009/384/EC, the size of the management company and the size of the UCITS that they manage, their internal organisation, and the nature, scope and complexity of their activities. In the process of the development of those guidelines, ESMA shall cooperate closely with the European Supervisory Authority (European Banking Authority) (‘EBA’), established by Regulation (EU) No 1093/2010 of the European Parliament and of the Council, in order to ensure consistency with requirements developed for other financial services sectors, in particular credit institutions and investment firms.
Commission Recommendation 2009/384/EC of 30 April 2009 on remuneration policies in the financial services sector (OJ L 120, 15.5.2009, p. 22).
Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).
Article 14b 1. When establishing and applying the remuneration policies referred to in Article 14a, management companies shall comply with the following principles in a way and to the extent that is appropriate to their size, internal organisation and the nature, scope and complexity of their activities:
(a) the remuneration policy is consistent with and promotes sound and effective risk management and does not encourage risk taking which is inconsistent with the risk profiles, rules or instruments of incorporation of the UCITS that the management company manages;
(b) the remuneration policy is in line with the business strategy, objectives, values and interests of the management company and the UCITS that it manages and of the investors in such UCITS, and includes measures to avoid conflicts of interest;
(c) the remuneration policy is adopted by the management body of the management company in its supervisory function, and that body adopts, and reviews at least annually, the general principles of the remuneration policy and is responsible for, and oversees, their implementation; the tasks referred to in this point shall be undertaken only by members of the management body who do not perform any executive functions in the management company concerned and who have expertise in risk management and remuneration;
(d) the implementation of the remuneration policy is, at least annually, subject to central and independent internal review for compliance with policies and procedures for remuneration adopted by the management body in its supervisory function;
(e) staff engaged in control functions are compensated in accordance with the achievement of the objectives linked to their functions, independently of the performance of the business areas that they control;
(f) the remuneration of the senior officers in the risk management and compliance functions is overseen directly by the remuneration committee, where such a committee exists;
(g) where remuneration is performance-related, the total amount of remuneration is based on a combination of the assessment as to the performance of the individual and of the business unit or UCITS concerned and as to their risks and of the overall results of the management company when assessing individual performance, taking into account financial and non-financial criteria;
(h) the assessment of performance is set in a multi-year framework appropriate to the holding period recommended to the investors of the UCITS managed by the management company in order to ensure that the assessment process is based on the longer-term performance of the UCITS and its investment risks and that the actual payment of performance-based components of remuneration is spread over the same period;
(i) guaranteed variable remuneration is exceptional, occurs only in the context of hiring new staff and is limited to the first year of engagement;
(j) fixed and variable components of total remuneration are appropriately balanced and the fixed component represents a sufficiently high proportion of the total remuneration to allow the operation of a fully flexible policy on variable remuneration components, including the possibility to pay no variable remuneration component;
(k) payments relating to the early termination of a contract reflect performance achieved over time and are designed in a way that does not reward failure;
(l) the measurement of performance used to calculate variable remuneration components or pools of variable remuneration components includes a comprehensive adjustment mechanism to integrate all relevant types of current and future risks;
(m) subject to the legal structure of the UCITS and its fund rules or instruments of incorporation, a substantial portion, and in any event at least 50 %, of any variable remuneration component consists of units of the UCITS concerned, equivalent ownership interests, or share-linked instruments or equivalent non-cash instruments with equally effective incentives as any of the instruments referred to in this point, unless the management of the UCITS accounts for less than 50 % of the total portfolio managed by the management company, in which case the minimum of 50 % does not apply.
The instruments referred to in this point shall be subject to an appropriate retention policy designed to align incentives with the interests of the management company and the UCITS that it manages and the investors of such UCITS. Member States or their competent authorities may place restrictions on the types and designs of those instruments or ban certain instruments as appropriate. This point shall apply to both the portion of the variable remuneration component deferred in line with point (n) and the portion of the variable remuneration component not deferred;
(n) a substantial portion, and in any event at least 40 %, of the variable remuneration component, is deferred over a period which is appropriate in view of the holding period recommended to the investors of the UCITS concerned and is correctly aligned with the nature of the risks of the UCITS in question.
The period referred to in this point shall be at least three years; remuneration payable under deferral arrangements vests no faster than on a pro-rata basis; in the case of a variable remuneration component of a particularly high amount, at least 60 % of the amount shall be deferred;
(o) the variable remuneration, including the deferred portion, is paid or vests only if it is sustainable according to the financial situation of the management company as a whole, and justified according to the performance of the business unit, the UCITS and the individual concerned.
The total variable remuneration shall generally be considerably contracted where subdued or negative financial performance of the management company or of the UCITS concerned occurs, taking into account both current compensation and reductions in payouts of amounts previously earned, including through malus or clawback arrangements;
(p) the pension policy is in line with the business strategy, objectives, values and long-term interests of the management company and the UCITS that it manages.
If the employee leaves the management company before retirement, discretionary pension benefits shall be held by the management company for a period of five years in the form of instruments referred to in point (m). In the case of an employee reaching retirement, discretionary pension benefits shall be paid to the employee in the form of instruments referred to in point (m), subject to a five-year retention period;
(q) staff are required to undertake not to use personal hedging strategies or remuneration- and liability-related insurance to undermine the risk alignment effects embedded in their remuneration arrangements;
(r) variable remuneration is not paid through vehicles or methods that facilitate the avoidance of the requirements laid down in this Directive.
2. In accordance with Article 35 of Regulation (EU) No 1095/2010, ESMA may request information from competent authorities on the remuneration policies and practices referred to in Article 14a of this Directive.
ESMA shall, in close cooperation with EBA, include in its guidelines on remuneration policies provisions on how different sectoral remuneration principles, such as those set out in Directive 2011/61/EU of the European Parliament and of the Council and in Directive 2013/36/EU of the European Parliament and of the Council, are to be applied where employees or other categories of personnel perform services subject to different sectoral remuneration principles.
Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010 (OJ L 174, 1.7.2011, p. 1).
Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).’;
3. The principles set out in paragraph 1 shall apply to any benefit of any type paid by the management company, to any amount paid directly by the UCITS itself, including performance fees, and to any transfer of units or shares of the UCITS, made for the benefit of those categories of staff, including senior management, risk takers, control functions and any employee receiving total remuneration that falls into the remuneration bracket of senior management and risk takers, whose professional activities have a material impact on their risk profile or the risk profile of the UCITS that they manage.
4. Management companies that are significant in terms of their size or of the size of the UCITS that they manage, their internal organisation and the nature, scope and complexity of their activities shall establish a remuneration committee. The remuneration committee shall be constituted in a way that enables it to exercise competent and independent judgment on remuneration policies and practices and the incentives created for managing risk.
The remuneration committee that is, where appropriate, set up in accordance with the ESMA guidelines referred to in Article 14a(4) shall be responsible for the preparation of decisions regarding remuneration, including those which have implications for the risk and risk management of the management company or the UCITS concerned and which are to be taken by the management body in its supervisory function. The remuneration committee shall be chaired by a member of the management body who does not perform any executive functions in the management company concerned. The members of the remuneration committee shall be members of the management body who do not perform any executive functions in the management company concerned.
If employee representation on the management body is provided for by national law, the remuneration committee shall include one or more employee representatives. When preparing its decisions, the remuneration committee shall take into account the long-term interest of investors and other stakeholders and the public interest.’;

(3) in Article 20(1), point (a) is replaced by the following:

‘(a) the written contract with the depositary referred to in Article 22(2);’;

(4) Article 22 is replaced by the following:

‘Article 22 1. An investment company and, for each of the common funds that it manages, a management company shall ensure that a single depositary is appointed in accordance with this Chapter.
2. The appointment of the depositary shall be evidenced by a written contract.
That contract shall, inter alia, regulate the flow of information deemed to be necessary to allow the depositary to perform its functions for the UCITS for which it has been appointed as depositary, as laid down in this Directive and in other relevant laws, regulations and administrative provisions.
3. The depositary shall:
(a) ensure that the sale, issue, repurchase, redemption and cancellation of units of the UCITS are carried out in accordance with the applicable national law and the fund rules or instruments of incorporation;
(b) ensure that the value of the units of the UCITS is calculated in accordance with the applicable national law and the fund rules or the instruments of incorporation;
(c) carry out the instructions of the management company or an investment company, unless they conflict with the applicable national law, or with the fund rules or the instruments of incorporation;
(d) ensure that in transactions involving the assets of the UCITS any consideration is remitted to the UCITS within the usual time limits;
(e) ensure that the income of the UCITS is applied in accordance with the applicable national law and the fund rules or the instruments of incorporation.
4. The depositary shall ensure that the cash flows of the UCITS are properly monitored, and, in particular, that all payments made by, or on behalf of, investors upon the subscription of units of the UCITS have been received, and that all cash of the UCITS has been booked in cash accounts that are:
(a) opened in the name of the UCITS, of the management company acting on behalf of the UCITS, or of the depositary acting on behalf of the UCITS;
(b) opened at an entity referred to in points (a), (b) and (c) of Article 18(1) of Commission Directive 2006/73/EC; and
Commission Directive 2006/73/EC of 10 August 2006 implementing Directive 2004/39/EC of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive (OJ L 241, 2.9.2006, p. 26).’;
(c) maintained in accordance with the principles set out in Article 16 of Directive 2006/73/EC.
Where the cash accounts are opened in the name of the depositary acting on behalf of the UCITS, no cash of the entity referred to in point (b) of the first subparagraph and none of the own cash of the depositary shall be booked on such accounts.
5. The assets of the UCITS shall be entrusted to the depositary for safekeeping as follows:
(a) for financial instruments that may be held in custody, the depositary shall:
(i) hold in custody all financial instruments that may be registered in a financial instruments account opened in the depositary’s books and all financial instruments that can be physically delivered to the depositary;
(ii) ensure that all financial instruments that can be registered in a financial instruments account opened in the depositary’s books are registered in the depositary’s books within segregated accounts in accordance with the principles set out in Article 16 of Directive 2006/73/EC, opened in the name of the UCITS or the management company acting on behalf of the UCITS, so that they can be clearly identified as belonging to the UCITS in accordance with the applicable law at all times;
(b) for other assets, the depositary shall:
(i) verify the ownership by the UCITS, or by the management company acting on behalf of the UCITS, of such assets by assessing whether the UCITS or the management company acting on behalf of the UCITS holds the ownership based on information or documents provided by the UCITS or by the management company and, where available, on external evidence;
(ii) maintain a record of those assets for which it is satisfied that the UCITS or the management company acting on behalf of the UCITS holds the ownership and keep that record up to date.
6. The depositary shall provide the management company or the investment company, on a regular basis, with a comprehensive inventory of all of the assets of the UCITS.
7. The assets held in custody by the depositary shall not be reused by the depositary, or by any third party to which the custody function has been delegated, for their own account. Reuse comprises any transaction of assets held in custody including, but not limited to, transferring, pledging, selling and lending.
The assets held in custody by the depositary are allowed to be reused only where:
(a) the reuse of the assets is executed for the account of the UCITS;
(b) the depositary is carrying out the instructions of the management company on behalf of the UCITS;
(c) the reuse is for the benefit of the UCITS and in the interest of the unit holders; and
(d) the transaction is covered by high-quality and liquid collateral received by the UCITS under a title transfer arrangement.
The market value of the collateral shall, at all times, amount to at least the market value of the reused assets plus a premium.
8. Member States shall ensure that in the event of insolvency of the depositary and/or of any third party located in the Union to which custody of UCITS assets has been delegated, the assets of a UCITS held in custody are unavailable for distribution among, or realisation for the benefit of, creditors of such a depositary and/or such a third party.’;

(5) the following article is inserted:

‘Article 22a 1. The depositary shall not delegate to third parties the functions referred to in Article 22(3) and (4).
2. The depositary may delegate to third parties the functions referred to in Article 22(5) only where:
(a) the tasks are not delegated with the intention of avoiding the requirements laid down in this Directive;
(b) the depositary can demonstrate that there is an objective reason for the delegation;
(c) the depositary has exercised all due skill, care and diligence in the selection and the appointment of any third party to whom it intends to delegate parts of its tasks, and continues to exercise all due skill, care and diligence in the periodic review and ongoing monitoring of any third party to which it has delegated parts of its tasks and of the arrangements of the third party in respect of the matters delegated to it.
3. The functions referred to in Article 22(5) may be delegated by the depositary to a third party only where that third party at all times during the performance of the tasks delegated to it:
(a) has structures and expertise that are adequate and proportionate to the nature and complexity of the assets of the UCITS or the management company acting on behalf of the UCITS which have been entrusted to it;
(b) for custody tasks referred to in point (a) of Article 22(5), is subject to:
(i) effective prudential regulation, including minimum capital requirements, and supervision in the jurisdiction concerned;
(ii) an external periodic audit to ensure that the financial instruments are in its possession;
(c) segregates the assets of the clients of the depositary from its own assets and from the assets of the depositary in such a way that they can, at any time, be clearly identified as belonging to clients of a particular depositary;
(d) takes all necessary steps to ensure that in the event of insolvency of the third party, assets of a UCITS held by the third party in custody are unavailable for distribution among, or realisation for the benefit of, creditors of the third party; and
(e) complies with the general obligations and prohibitions laid down in Article 22(2), (5) and (7) and in Article 25.
Notwithstanding point (b)(i) of the first subparagraph, where the law of a third country requires that certain financial instruments be held in custody by a local entity and no local entities satisfy the delegation requirements laid down in that point, the depositary may delegate its functions to such a local entity only to the extent required by the law of that third country, only for as long as there are no local entities that satisfy the delegation requirements, and only where:
(a) the investors of the relevant UCITS are duly informed, prior to their investment, of the fact that such a delegation is required due to legal constraints in the law of the third country, of the circumstances justifying the delegation and of the risks involved in such a delegation;
(b) the investment company, or the management company on behalf of the UCITS, has instructed the depositary to delegate the custody of such financial instruments to such a local entity.
The third party may, in turn, sub-delegate those functions, subject to the same requirements. In such a case, Article 24(2) shall apply mutatis mutandis to the relevant parties.
4. For the purposes of this Article, the provision of services as specified by Directive 98/26/EC of the European Parliament and of the Council by securities settlement systems as designated for the purposes of that Directive or the provision of similar services by third-country securities settlement systems shall not be considered to be a delegation of custody functions.
Directive 98/26/EC of the European Parliament and of the Council of 19 May 1998 on settlement finality in payment and securities settlement systems (OJ L 166, 11.6.1998, p. 45).’;’;

(6) Article 23 is amended as follows:
(a) paragraphs 2, 3 and 4 are replaced by the following:

‘2. The depositary shall be:
(a) a national central bank;
(b) a credit institution authorised in accordance with Directive 2013/36/EU; or
(c) another legal entity, authorised by the competent authority under the law of the Member State to carry out depositary activities under this Directive, which is subject to capital adequacy requirements not less than the requirements calculated depending on the selected approach in accordance with Article 315 or 317 of Regulation (EU) No 575/2013 of the European Parliament and of the Council and which has own funds not less than the amount of initial capital under Article 28(2) of Directive 2013/36/EU.
Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No648/2012 (OJ L 176, 27.6.2013, p. 1).’;
A legal entity as referred to in point (c) of the first subparagraph shall be subject to prudential regulation and ongoing supervision and shall satisfy the following minimum requirements:
(a) it shall have the infrastructure necessary to keep in custody financial instruments that can be registered in a financial instruments account opened in the depositary’s books;
(b) it shall establish adequate policies and procedures sufficient to ensure compliance of the entity, including its managers and employees, with its obligations under this Directive;
(c) it shall have sound administrative and accounting procedures, internal control mechanisms, effective procedures for risk assessment and effective control and safeguard arrangements for information processing systems;
(d) it shall maintain and operate effective organisational and administrative arrangements with a view to taking all reasonable steps designed to prevent conflicts of interest;
(e) it shall arrange for records to be kept of all services, activities and transactions that it undertakes, which shall be sufficient to enable the competent authority to fulfil its supervisory tasks and to perform the enforcement actions provided for in this Directive;
(f) it shall take reasonable steps to ensure continuity and regularity in the performance of its depositary functions by employing appropriate and proportionate systems, resources and procedures including to perform its depositary activities;
(g) all members of its management body and senior management, shall, at all times, be of sufficiently good repute, possess sufficient knowledge, skills and experience;
(h) its management body shall possess adequate collective knowledge, skills and experience to be able to understand the depositary’s activities, including the main risks;
(i) each member of its management body and senior management shall act with honesty and integrity.
3. Member States shall determine which of the categories of institutions referred to in the first subparagraph of paragraph 2 shall be eligible to be depositaries.
4. Investment companies or management companies acting on behalf of the UCITS that they manage, which, before 18 March 2016, appointed as a depositary an institution that does not meet the requirements laid down in paragraph 2, shall appoint a depositary that meets those requirements before 18 March 2018.’;

(b) paragraphs 5 and 6 are deleted.
(7) Article 24 is replaced by the following:

‘Article 24 1. Member States shall ensure that the depositary is liable to the UCITS and to the unit-holders of the UCITS for the loss by the depositary or a third party to whom the custody of financial instruments held in custody in accordance with point (a) of Article 22(5) has been delegated.
In the case of a loss of a financial instrument held in custody, Member States shall ensure that the depositary returns a financial instrument of an identical type or the corresponding amount to the UCITS or the management company acting on behalf of the UCITS without undue delay. The depositary shall not be liable if it can prove that the loss has arisen as a result of an external event beyond its reasonable control, the consequences of which would have been unavoidable despite all reasonable efforts to the contrary.
Member States shall ensure that the depositary is also liable to the UCITS, and to the investors of the UCITS, for all other losses suffered by them as a result of the depositary’s negligent or intentional failure to properly fulfil its obligations pursuant to this Directive.
2. The liability of the depositary referred to in paragraph 1 shall not be affected by any delegation as referred to in Article 22a.
3. The liability of the depositary referred to in paragraph 1 shall not be excluded or limited by agreement.
4. Any agreement that contravenes paragraph 3 shall be void.
5. Unit-holders in the UCITS may invoke the liability of the depositary directly or indirectly through the management company or the investment company provided that this does not lead to a duplication of redress or to unequal treatment of the unit-holders.’;

(8) Article 25 is replaced by the following:

‘Article 25 1. No company shall act as both management company and depositary. No company shall act as both investment company and depositary.
2. In carrying out their respective functions, the management company and the depositary shall act honestly, fairly, professionally, independently and solely in the interest of the UCITS and the investors of the UCITS. In carrying out their respective functions, the investment company and the depositary shall act honestly, fairly, professionally, independently and solely in the interest of the investors of the UCITS.
A depositary shall not carry out activities with regard to the UCITS or the management company on behalf of the UCITS that may create conflicts of interest between the UCITS, the investors in the UCITS, the management company and itself, unless the depositary has functionally and hierarchically separated the performance of its depositary tasks from its other potentially conflicting tasks, and the potential conflicts of interest are properly identified, managed, monitored and disclosed to the investors of the UCITS.’;

(9) Article 26 is replaced by the following:

‘Article 26 1. The law or the fund rules of the common fund shall lay down the conditions for the replacement of the management company and of the depositary and rules to ensure the protection of unit-holders in the event of such a replacement.
2. The law or the instruments of incorporation of the investment company shall lay down the conditions for the replacement of the management company and of the depositary and rules to ensure the protection of unit-holders in the event of such a replacement.’;

(10) the following articles are inserted:

‘Article 26a The depositary shall make available to its competent authorities, on request, all information which it has obtained while performing its duties and that may be necessary for its competent authorities or for the competent authorities of the UCITS or of the management company.
If the competent authorities of the UCITS or of the management company are different from those of the depositary, the competent authorities of the depositary shall without delay share the information received with the competent authorities of the UCITS and of the management company.
Article 26b The Commission shall be empowered to adopt delegated acts in accordance with Article 112a specifying:
(a) the particulars that need to be included in the written contract referred to in Article 22(2);
(b) the conditions for performing the depositary functions pursuant to Article 22(3), (4) and (5), including:
(i) the types of financial instrument to be included in the scope of the custody duties of the depositary in accordance with point (a) of Article 22(5);
(ii) the conditions subject to which the depositary is able to exercise its custody duties over financial instruments registered with a central depositary;
(iii) the conditions subject to which the depositary is to safekeep the financial instruments issued in a nominative form and registered with an issuer or a registrar, in accordance with point (b) of Article 22(5);
(c) the due diligence duties of depositaries pursuant to point (c) of Article 22a(2);
(d) the segregation obligation pursuant to point (c) of Article 22a(3);
(e) the steps to be taken by the third party pursuant to point (d) of Article 22a(3);
(f) the conditions subject to which and circumstances in which financial instruments held in custody are to be considered to be lost for the purpose of Article 24;
(g) what is to be understood by external events beyond reasonable control, the consequences of which would have been unavoidable despite all reasonable efforts to the contrary, pursuant to Article 24(1);
(h) the conditions for fulfilling the independence requirement referred to in Article 25(2).’;

(11) in Article 30, the first paragraph is replaced by the following:

‘Articles 13 to 14b shall apply mutatis mutandis to investment companies that have not designated a management company authorised pursuant to this Directive.’;

(12) Section 3 of Chapter V is deleted;
(13) Article 69 is amended as follows:
(a) in paragraph 1, the following subparagraph is added:

‘The prospectus shall include either:
(a) the details of the up-to-date remuneration policy, including, but not limited to, a description of how remuneration and benefits are calculated, the identities of persons responsible for awarding the remuneration and benefits including the composition of the remuneration committee, where such a committee exists; or
(b) a summary of the remuneration policy and a statement to the effect that the details of the up-to-date remuneration policy, including, but not limited to, a description of how remuneration and benefits are calculated, the identity of persons responsible for awarding the remuneration and benefits, including the composition of the remuneration committee where such a committee exists, are available by means of a website – including a reference to that website – and that a paper copy will be made available free of charge upon request.’;

(b) in paragraph 3, the following subparagraph is added:

‘The annual report shall also include:
(a) the total amount of remuneration for the financial year, split into fixed and variable remuneration paid by the management company and by the investment company to its staff, and the number of beneficiaries, and where relevant, any amount paid directly by the UCITS itself, including any performance fee;
(b) the aggregate amount of remuneration broken down by categories of employees or other members of staff as referred to in Article 14a(3);
(c) a description of how the remuneration and the benefits have been calculated;
(d) the outcome of the reviews referred to in points (c) and (d) of Article 14b(1) including any irregularities that have occurred;
(e) material changes to the adopted remuneration policy.’;

(14) Article 78 is amended as follows:
(a) in paragraph 3, point (a) is replaced by the following:

‘(a) identification of the UCITS and of the competent authority of the UCITS;’;

(b) in paragraph 4, the following subparagraph is added:

‘Key investor information shall also include a statement to the effect that the details of the up-to-date remuneration policy, including, but not limited to, a description of how remuneration and benefits are calculated, the identity of persons responsible for awarding the remuneration and benefits including the composition of the remuneration committee, where such a committee exists, are available by means of a website – including a reference to that website – and that a paper copy will be made available free of charge upon request.’;

(15) in Article 98(2), point (d) is replaced by the following:

‘(d) require:
(i) in so far as permitted by national law, existing data traffic records held by a telecommunications operator, where there is a reasonable suspicion of an infringement and where such records may be relevant to an investigation into infringements of this Directive;
(ii) existing recordings of telephone conversations or electronic communications or other data traffic records held by UCITS, management companies, investment companies, depositaries or any other entities regulated by this Directive;’;

(16) Article 99 is replaced by the following:

‘Article 99 1. Without prejudice to the supervisory powers of competent authorities referred to in Article 98 and the right of Member States to provide for and impose criminal sanctions, Member States shall lay down rules on administrative sanctions and other administrative measures to be imposed on companies and persons in respect of infringements of national provisions transposing this Directive and shall take all measures necessary to ensure that they are implemented.
Where Member States decide not to lay down rules for administrative sanctions for infringements which are subject to national criminal law, they shall communicate to the Commission the relevant criminal law provisions.
Administrative sanctions and other administrative measures shall be effective, proportionate and dissuasive.
By 18 March 2016, Member States shall notify the laws, regulations and administrative provisions transposing this Article, including any relevant criminal law provisions, to the Commission and ESMA. Member States shall notify the Commission and ESMA without undue delay of any subsequent amendments thereto.
2. Where Member States have chosen, in accordance with paragraph 1, to lay down criminal sanctions for infringements of the provisions referred to in that paragraph, they shall ensure that appropriate measures are in place so that competent authorities have all the necessary powers to liaise with judicial authorities within their jurisdiction to receive specific information relating to criminal investigations or proceedings commenced for possible infringements of this Directive and provide the same to other competent authorities and ESMA in order to fulfil their obligation to cooperate with each other and ESMA for the purposes of this Directive.
Competent authorities may also cooperate with competent authorities of other Member States with respect to facilitating the recovery of pecuniary sanctions.
3. As part of its overall review of the functioning of this Directive, the Commission shall review, not later than 18 September 2017, the application of the administrative and criminal sanctions, and in particular the need to further harmonise the administrative sanctions laid down for infringements of the requirements laid down in this Directive.
4. A competent authority may refuse to act on a request for information or a request to cooperate with an investigation only in the following exceptional circumstances, namely where:
(a) communication of relevant information might adversely affect the security of the Member State addressed, in particular the fight against terrorism and other serious crimes;
(b) compliance with the request is likely to affect adversely its own investigation, enforcement activities or, where applicable, a criminal investigation;
(c) judicial proceedings have already been initiated in respect of the same actions and against the same persons before the authorities of the Member State addressed; or
(d) a final judgment has already been delivered in relation to such persons for the same actions in the Member State addressed.
5. Member States shall ensure that where obligations apply to UCITS, management companies, investment companies or depositaries, in the event of an infringement of national provisions transposing this Directive, administrative penalties or other administrative measures may be applied, in accordance with national law, to the members of the management body and to other natural persons who are responsible, under national law, for the infringement.
6. In accordance with national law, Member States shall ensure that, in all cases referred to in paragraph 1, the administrative penalties and other administrative measures that may be applied include at least the following:
(a) a public statement which identifies the person responsible and the nature of the infringement;
(b) an order requiring the person responsible to cease the conduct and to desist from a repetition of that conduct;
(c) in the case of a UCITS or a management company, suspension or withdrawal of the authorisation of the UCITS or the management company;
(d) a temporary or, for repeated serious infringements, a permanent ban against a member of the management body of the management company or investment company or against any other natural person who is held responsible, from exercising management functions in those or in other such companies;
(e) in the case of a legal person, maximum administrative pecuniary sanctions of at least EUR 5 000 000 or, in the Member States whose currency is not the euro, the corresponding value in the national currency on 17 September 2014, or 10 % of the total annual turnover of the legal person according to the last available accounts approved by the management body; where the legal person is a parent undertaking or a subsidiary of the parent undertaking which has to prepare consolidated financial accounts in accordance with Directive 2013/34/EU of the European Parliament and of the Council, the relevant total annual turnover shall be the total annual turnover or the corresponding type of income in accordance with the relevant Union law in the area of accounting according to the last available consolidated accounts approved by the management body of the ultimate parent undertaking;
Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC (OJ L 182, 29.6.2013, p. 19).’;
(f) in the case of a natural person, maximum administrative pecuniary sanctions of at least EUR 5 000 000 or, in the Member States whose currency is not the euro, the corresponding value in the national currency on 17 September 2014;
(g) as an alternative to points (e) and (f), maximum administrative pecuniary sanctions of at least twice the amount of the benefit derived from the infringement where that benefit can be determined, even if that exceeds the maximum amounts in points (e) and (f).
7. Member States may empower competent authorities, under national law, to impose types of penalty in addition to those referred to in paragraph 6 or to impose pecuniary penalties exceeding the amounts referred to in points (e), (f) and (g) of paragraph 6.’;

(17) the following articles are inserted:

‘Article 99a Member States shall ensure that their laws, regulations or administrative provisions transposing this Directive provide for penalties, in particular when:
(a) the activities of UCITS are pursued without obtaining authorisation, thus infringing Article 5;
(b) the business of a management company is carried out without obtaining prior authorisation, thus infringing Article 6;
(c) the business of an investment company is carried out without obtaining prior authorisation, thus infringing Article 27;
(d) a qualifying holding in a management company is acquired, directly or indirectly, or such a qualifying holding in a management company is further increased so that the proportion of the voting rights or of the capital held would reach or exceed 20 %, 30 % or 50 % or so that the management company would become its subsidiary (‘the proposed acquisition’), without notifying in writing the competent authorities of the management company in which the acquirer is seeking to acquire or increase a qualifying holding, thus infringing Article 11(1);
(e) a qualifying holding in a management company is disposed of, directly or indirectly, or reduced so that the proportion of the voting rights or of the capital held would fall below 20 %, 30 % or 50 % or so that the management company would cease to be a subsidiary, without notifying in writing the competent authorities, thus infringing Article 11(1);
(f) a management company has obtained an authorisation through false statements or any other irregular means, thus infringing point (b) of Article 7(5);
(g) an investment company has obtained an authorisation through false statements or any other irregular means, thus infringing point (b) of Article 29(4);
(h) a management company, on becoming aware of any acquisition or disposal of holdings in their capital that cause holdings to exceed or fall below one of the thresholds referred to in Article 11(1) of Directive 2014/65/EU fails to inform the competent authorities of those acquisitions or disposals, thus infringing Article 11(1) of this Directive;
(i) a management company fails to inform the competent authority, at least once a year, of the names of shareholders and members possessing qualifying holdings and the sizes of such holdings, thus infringing Article 11(1);
(j) a management company fails to comply with procedures and arrangements imposed in accordance with the national provisions transposing point (a) of Article 12(1);
(k) a management company fails to comply with structural and organisational requirements imposed in accordance with the national provisions transposing point (b) of Article 12(1);
(l) an investment company fails to comply with procedures and arrangements imposed in accordance with the national provisions transposing Article 31;
(m) a management company or an investment company fails to comply with requirements related to delegation of its functions to third parties imposed in accordance with the national provisions transposing Articles 13 and 30;
(n) a management company or an investment company fails to comply with rules of conduct imposed in accordance with the national provisions transposing Articles 14 and 30;
(o) a depositary fails to perform its tasks in accordance with national provisions transposing Article 22(3) to (7);
(p) an investment company or, for each of the common funds that it manages, a management company, repeatedly fails to comply with obligations concerning the investment policies of UCITS laid down in national provisions transposing Chapter VII;
(q) a management company or an investment company fails to employ a risk-management process or a process for accurate and independent assessment of the value of OTC derivatives as laid down in national provisions transposing Article 51(1);
(r) an investment company or, for each of the common funds that it manages, a management company, repeatedly fails to comply with obligations concerning information to be provided to investors imposed in accordance with the national provisions transposing Articles 68 to 82;
(s) a management company or an investment company marketing units of UCITS that it manages in a Member State other than the UCITS home Member State fails to comply with the notification requirement laid down in Article 93(1).
Article 99b 1. Member States shall ensure that competent authorities publish any decision against which there is no appeal imposing an administrative sanction or measure for infringements of the national provisions transposing this Directive on their official websites without undue delay after the person on whom the sanction or measure was imposed has been informed of that decision. The publication shall include at least information on the type and nature of the infringement and the identity of the persons responsible. That obligation does not apply to decisions imposing measures that are of an investigatory nature.
However, where the publication of the identity of the legal persons or of the personal data of the natural persons is considered by the competent authority to be disproportionate following a case-by-case assessment conducted on the proportionality of the publication of such data, or where publication jeopardises the stability of financial markets or an ongoing investigation, Member States shall ensure that competent authorities do one of the following:
(a) defer the publication of the decision to impose the sanction or measure until the reasons for non-publication cease to exist;
(b) publish the decision to impose the sanction or measure on an anonymous basis in a manner which complies with national law, if such anonymous publication ensures effective protection of the personal data concerned; or
(c) not publish the decision to impose a sanction or measure in the event that the options laid down in points (a) and (b) are considered to be insufficient to ensure:
(i) that the stability of the financial markets would not be put in jeopardy;
(ii) the proportionality of the publication of such decisions with regard to measures which are deemed to be of a minor nature.
In the case of a decision to publish a sanction or measure on an anonymous basis, the publication of the relevant data may be postponed for a reasonable period of time if it is envisaged that within that period the reasons for anonymous publication shall cease to exist.
2. Competent authorities shall inform ESMA of all administrative sanctions imposed but not published in accordance with point (c) of the second subparagraph of paragraph 1 including any appeal in relation thereto and the outcome of such an appeal. Member States shall ensure that competent authorities receive information and the final judgement in relation to any criminal sanction imposed and submit it to ESMA. ESMA shall maintain a central database of sanctions communicated to it solely for the purpose of exchanging information between competent authorities. That database shall be accessible only to competent authorities and it shall be updated on the basis of the information provided by the competent authorities.
3. Where the decision to impose a sanction or measure is subject to appeal before the relevant judicial or other authorities, competent authorities shall also publish immediately on their official website such information and any subsequent information on the outcome of such an appeal. Any decision annulling a previous decision to impose a sanction or a measure shall also be published.
4. Competent authorities shall ensure that any publication in accordance with this Article shall remain on their official website for a period of at least five years from its publication. Personal data contained in the publication shall be kept on the official website of the competent authority only for the period which is necessary in accordance with the applicable data protection rules.
Article 99c 1. Member States shall ensure that when determining the type of administrative penalties or measures and the level of administrative pecuniary penalties, the competent authorities ensure that they are effective, proportionate and dissuasive and take into account all relevant circumstances, including, where appropriate:
(a) the gravity and the duration of the infringement;
(b) the degree of responsibility of the person responsible for the infringement;
(c) the financial strength of the person responsible for the infringement, as indicated, for example, by its total turnover in the case of a legal person or the annual income in the case of a natural person;
(d) the importance of the profits gained or losses avoided by the person responsible for the infringement, the damage to other persons and, where applicable, the damage to the functioning of markets or the wider economy, in so far as they can be determined;
(e) the level of cooperation with the competent authority of the person responsible for the infringement;
(f) previous infringements by the person responsible for the infringement;
(g) measures taken after the infringement by the person responsible for the infringement to prevent its repetition.
2. In the exercise of their powers to impose penalties under Article 99, competent authorities shall cooperate closely to ensure that the supervisory and investigative powers and administrative penalties produce the results pursued by this Directive. They shall also coordinate their actions in order to avoid possible duplication and overlap when applying supervisory and investigative powers and administrative penalties and measures to cross-border cases in accordance with Article 101.
Article 99d 1. Member States shall establish effective and reliable mechanisms to encourage the reporting of potential or actual infringements of national provisions transposing this Directive to competent authorities, including secure communication channels for reporting such infringements.
2. The mechanisms referred to in paragraph 1 shall include at least:
(a) specific procedures for the receipt of reports on infringements and their follow-up;
(b) appropriate protection for employees of investment companies, management companies and depositaries, who report infringements committed within those entities, at least against retaliation, discrimination and other types of unfair treatment;
(c) protection of personal data concerning both the person who reports the infringements and the natural person who is allegedly responsible for an infringement, in accordance with Directive 95/46/EC of the European Parliament and of the Council;
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).’;
(d) clear rules that ensure that confidentiality is guaranteed in all cases in relation to the person who reports an infringement, unless disclosure is required by national law in the context of further investigations or subsequent judicial proceedings.
3. ESMA shall provide one or more secure communication channels for reporting infringements of the national provisions transposing this Directive. ESMA shall ensure that those communication channels comply with points (a) to (d) of paragraph 2.
4. Member States shall ensure that the reporting by employees of investment companies, management companies and depositaries referred to in paragraphs 1 and 3 shall not be considered to be an infringement of any restriction on disclosure of information imposed by contract or by any law, regulation or administrative provision, and shall not subject the person reporting to liability of any kind relating to such reporting.
5. Member States shall require management companies, investment companies and depositaries to have in place appropriate procedures for their employees to report infringements internally through a specific, independent and autonomous channel.
Article 99e 1. Competent authorities shall provide ESMA annually with aggregated information regarding all penalties and measures imposed in accordance with Article 99. ESMA shall publish that information in an annual report.
2. Where the competent authority has disclosed administrative penalties or measures to the public, it shall simultaneously report those administrative penalties or measures to ESMA. Where a published penalty or measure relates to a management company or investment company, ESMA shall add a reference to the published penalty or measure in the list of management companies published under Article 6(1).
3. ESMA shall develop draft implementing technical standards to determine the procedures and forms for submitting information as referred to in this Article.
ESMA shall submit those draft implementing technical standards to the Commission by 18 September 2015.
Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1095/2010.’;

(18) the following Article is inserted:

‘Article 104a 1. Member States shall apply Directive 95/46/EC to the processing of personal data carried out in the Member States pursuant to this Directive.
2. Regulation (EC) No 45/2001 of the European Parliament and of the Council shall apply to the processing of personal data carried out by ESMA pursuant to this Directive.
Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).’;’;

(19) in Article 12(3), Article 14(2), Article 43(5), Article 51(4), Article 60(6), Article 61(3), Article 62(4), Article 64(4), Article 75(4), Article 78(7), Article 81(2), Article 95(1) and Article 111, the words: ‘in accordance with Article 112(2), (3) and (4), and subject to the conditions of Articles 112a and 112b’ are replaced by the words: ‘in accordance with Article 112a’;
(20) in Article 50a, the words: ‘in accordance with Article 112a and subject to conditions of Articles 112b and 112c’ are replaced by the words: ‘in accordance with Article 112a’;
(21) in the third subparagraph of Article 52(4), the reference to ‘Article 112(1)’ is replaced by a reference to ‘Article 112’;
(22) Article 112 is replaced by the following:

‘Article 112 The Commission shall be assisted by the European Securities Committee established by Commission Decision 2001/528/EC.
Commission Decision 2001/528/EC of 6 June 2001 establishing the European Securities Committee (OJ L 191, 13.7.2001, p. 45)’;’;

(23) Article 112a is replaced by the following:

‘Article 112a 1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.
2. The power to adopt the delegated acts referred to in Articles 12, 14, 43, 60, 61, 62, 64, 75, 78, 81, 95 and 111 shall be conferred on the Commission for a period of four years from 4 January 2011.
The power to adopt the delegated acts referred to in Article 26b shall be conferred on the Commission for a period of four years from 17 September 2014.
The power to adopt the delegated acts referred to in Article 50a shall be conferred on the Commission for a period of four years from 21 July 2011.
The power to adopt the delegated acts referred to in Article 51 is conferred on the Commission for a period of four years from 20 June 2013.
The Commission shall draw up a report in respect of delegated power not later than six months before the end of the four-year periods. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period.
3. The delegation of power referred to in Articles 12, 14, 26b, 43, 50a, 51, 60, 61, 62, 64, 75, 78, 81, 95 and 111 may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.
4. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.
5. A delegated act adopted pursuant to Articles 12, 14, 26b, 43, 50a, 51, 60, 61, 62, 64, 75, 78, 81, 95 and 111 shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of three months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by three months at the initiative of the European Parliament or of the Council.’;

(24) Article 112b is deleted;
(25) in Schedule A of Annex I, point 2 is replaced by the following;

‘2. Information concerning the depositary:
2.1. the identity of the depositary of the UCITS and a description of its duties and of conflicts of interest that may arise;
2.2. a description of any safekeeping functions delegated by the depositary, the list of delegates and sub-delegates and any conflicts of interest that may arise from such a delegation;
2.3. a statement to the effect that up-to-date information regarding points 2.1 and 2.2 will be made available to investors on request.’.

Article 2 1. Member States shall adopt and publish, by 18 March 2016 the laws, regulations and administrative provisions necessary to comply with this Directive. They shall forthwith communicate to the Commission the text of those measures.
They shall apply the laws, regulations and administrative provisions referred to in the first subparagraph from 18 March 2016. When Member States adopt those measures, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such a reference is to be made.
2. Member States shall communicate to the Commission the text of the main provisions of national law which they adopt in the field covered by this Directive.
Article 3 This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
Article 4 This Directive is addressed to the Member States.
Done at Brussels, 23 July 2014.
For the European Parliament
The President
M. Schulz
For the Council
The President
S. Gozi