CHAPTER III

AUTHORISATION OF CSDs

(Article 17 of Regulation (EU) No 909/2014)
SECTION 1

General information on applicant CSDs

Identification and legal status of applicant CSDs
Article 4
1
An application for authorisation shall clearly identify the applicant CSD and the activities and services that it intends to carry out.
2
The application for authorisation shall include the following information:
a
contact details of the person responsible for the application;
b
contact details of the person or persons in charge of the applicant CSD's compliance and internal control function;
c
the corporate name of the applicant CSD, its Legal Entity Identifier (LEI) and registered address in the Union;
d
the memorandum and articles of association or other constitutional and statutory documentation of the applicant CSD;
e
an excerpt from the relevant commercial or court register, or other forms of certified evidence of the registered address and business activity of the applicant CSD that is valid at the date of the application;
f
the identification of the securities settlement systems that the applicant CSD operates or intends to operate;
g
a copy of the decision of the management body regarding the application and the minutes of the meeting in which the management body approved the application file and its submission;
h
a chart showing the ownership links between the parent undertaking, subsidiaries and any other associated entities or branches, wherein the entities shown in the chart are identified by their full corporate name, legal status, registered address, and tax numbers or company registration numbers;
i
a description of the business activities of the applicant CSD's subsidiaries and other legal persons in which the applicant CSD holds a participation, including information on the level of participation;
j
a list including:
1. the name of each person or entity who, directly or indirectly, holds 5 % or more of the applicant CSD's capital or voting rights;
2. the name of each person or entity that could exercise a significant influence over the applicant CSD's management due to its holding in the applicant CSD's capital;
k
a list including:
1. the name of each entity in which the applicant CSD holds 5 % or more of the entity's capital and voting rights;
2. the name of each entity over whose management the applicant CSD exercises significant influence;
l
a list of core services listed in Section A of the Annex to Regulation (EU) No 909/2014 that the applicant CSD is providing or intends to provide;
m
a list of ancillary services explicitly specified in Section B of the Annex to Regulation (EU) No 909/2014 that the applicant CSD is providing or intends to provide;
n
a list of any other ancillary services permitted under, but not explicitly specified under Section B of the Annex to Regulation (EU) No 909/2014 that the applicant CSD is providing or intends to provide;
o
a list of the investment services subject to Directive 2014/65/EU referred to in point (n);
p
a list of services and activities that the applicant CSD outsources or intends to outsource to a third party in accordance with Article 30 of Regulation (EU) No 909/2014;
q
the currency or currencies that the applicant CSD processes, or intends to process in connection with services that the applicant CSD provides, irrespective of whether cash is settled on a central bank account, a CSD account, or an account at a designated credit institution;
r
information on any pending and final judicial, administrative, arbitration or any other legal proceedings to which the applicant CSD is a party and which may cause it financial or other costs.
3
Where the applicant CSD intends to provide core services or to set up a branch in accordance with Article 23(2) of Regulation (EU) No 909/2014, the application for authorisation shall also include the following information:
a
the Member State or Member States in which the applicant CSD intends to operate;
b
a programme of operations stating in particular the services which the applicant CSD provides or intends to provide in the host Member State;
c
the currency or currencies that the applicant CSD processes or intends to process in the host Member State;
d
where the services are provided or intended to be provided through a branch, the organisational structure of the branch and the names of the persons responsible for its management;
e
where relevant, an assessment of the measures that the applicant CSD intends to take to allow its users to comply with the national laws referred to in Article 49(1) of Regulation (EU) No 909/2014.

General information concerning policies and procedures
Article 5
1
An application for authorisation shall specify the following information on the policies and procedures of the applicant CSD referred to in this Chapter:
a
the job titles of the persons responsible for the approval and implementation of the policies and procedures;
b
a description of the measures implementing and monitoring the compliance with the policies and procedures.
2
An application for authorisation shall include a description of the procedures put in place by the applicant CSD pursuant to Article 65(3) of Regulation (EU) No 909/2014.

Information concerning services and activities of the CSD
Article 6
The applicant CSD shall include the following in the application for authorisation:
1. a detailed description of the services referred to in points (l) to (p) of Article 4(2);
2. the procedures to be applied in the provision of the services referred to in point (a).

Information concerning groups
Article 7
1
Where the applicant CSD is part of a group of undertakings that includes other CSDs or credit institutions referred to in point (b) of Article 54(2) of Regulation (EU) No 909/2014, the application for authorisation shall include the following:
a
the policies and procedures referred to in Article 26(7) of Regulation (EU) No 909/2014;
b
information on the composition of the senior management, the management body, and the shareholders structure of the parent undertaking and of the other undertakings in the group;
c
the services and key individuals other than senior management that the applicant CSD shares with other undertakings in the group.
2
Where the applicant CSD has a parent undertaking, the application for authorisation shall provide the following information:
a
the registered address of the parent undertaking of the applicant CSD;
b
where the parent undertaking is an entity authorised or registered and subject to supervision under Union or third country legislation, any relevant authorisation or registration number and the name of the authority or authorities competent for the supervision of the parent undertaking.
3
Where the applicant CSD has outsourced services or activities to an undertaking within the group in accordance with Article 30 of Regulation (EU) No 909/2014, the application shall include a summary and a copy of the outsourcing agreement.
SECTION 2

Financial resources for the provision of services by the applicant CSD

Financial reports, business plan, and recovery plan
Article 8
1
An application for authorisation shall include the following financial and business information to enable the competent authority to assess compliance of the applicant CSD with Articles 44, 46 and 47 of Regulation (EU) No 909/2014:
a
financial reports including a complete set of financial statements for the preceding three years, and the statutory audit report on the annual and consolidated financial statements within the meaning of Directive 2006/43/EC of the European Parliament and of the Council , for the preceding three years;
b
where the applicant CSD is audited by an external auditor, the name and the national registration number of the external auditor;
c
a business plan, including a financial plan and an estimated budget that foresees various business scenarios for the services provided by the applicant CSD, over a reference period of at least three years;
d
any plan for the establishment of subsidiaries and branches and their location;
e
a description of the business activities that the applicant CSD plans to carry out, including the business activities of any subsidiaries or branches of the applicant CSD.
2
Where historical financial information referred to in point (a) of paragraph 1 is not available, an application for authorisation shall include the following information about the applicant CSD:
a
evidence that demonstrates sufficient financial resources during six months after the granting of an authorisation;
b
an interim financial report;
c
statements concerning the financial situation of the applicant CSD, including a balance sheet, income statement, changes in equity and in cash flows and a summary of accounting policies and other relevant explanatory notes;
d
audited annual financial statements of any parent undertaking for the three financial years preceding the date of the application.
3
The application shall include a description of an adequate recovery plan to ensure continuity of the applicant CSD's critical operations referred to in Article 22(2) of Regulation (EU) No 909/2014 including:
a
a summary that provides an overview of the plan and its implementation;
b
the identification of the critical operations of the applicant CSD, stress scenarios and events triggering recovery, and a description of recovery tools to be used by the applicant CSD;
c
an assessment of any impact of the recovery plan on stakeholders that are likely to be affected by its implementation;
d
an assessment of the legal enforceability of the recovery plan that takes account of any legal constraints imposed by Union, national or third country legislation.
SECTION 3

Organisational requirements

Organisational chart
Article 9
An application for authorisation shall include an organisational chart that describes the organisational structure of the applicant CSD. The chart shall include the following:
1. the identity and tasks of the persons responsible for the following positions:
  1. senior management;
  2. managers in charge of the operational functions referred to in Article 47(3);
  3. managers in charge of the activities of any branches of the applicant CSD;
  4. other significant roles in the operations of the applicant CSD;
2. the number of staff members in each division and operational unit.

Staffing policies and procedures
Article 10
An application for authorisation shall include the following information on the applicant CSD's policies and procedures related to staff:
1. a description of the remuneration policy including information about the fixed and variable elements of the remuneration of the senior management, the members of the management body and the staff employed in the risk-management, compliance and internal control, internal audit and technology functions of the applicant CSD;
2. the measures put in place by the applicant CSD to mitigate the risk of over-reliance on the responsibilities entrusted to any individual person.

Risk monitoring tools and governance arrangements
Article 11
1
An application for authorisation shall include the following information on the governance arrangements and risk monitoring tools of the applicant CSD:
a
a description of the governance arrangements of the applicant CSD established in accordance with paragraph 2 of Article 47;
b
the policies, procedures and systems established in accordance with paragraph 1 of Article 47;
c
a description of the composition, role and responsibilities of the members of the management body and senior management and the committees established in accordance with Article 48.
2
The information referred to in paragraph 1 shall include a description of the processes concerning the selection, appointment, performance evaluation and removal of senior management and members of the management body.
3
The applicant CSD shall describe its procedure to make its governance arrangements and the rules governing its activity available to the public.
4
Where the applicant CSD adheres to a recognised corporate governance code of conduct, the application shall identify any code, include a copy of that code and justify any situations where the applicant CSD deviates from the code.

Compliance, internal control and internal audit functions
Article 12
1
An application for authorisation shall include a description of the procedures for the applicant CSD's internal reporting of infringements referred to in Article 26(5) of Regulation (EU) No 909/2014.
2
An application for authorisation shall include information regarding an applicant CSD's internal audit policies and procedures referred to in Article 51, including:
a
a description of the monitoring and evaluation tools for the adequacy and effectiveness of the applicant CSD's internal audit systems;
b
a description of the control and safeguard tools for the applicant CSD's information processing systems;
c
a description of the development and application of the applicant CSD's internal audit methodology;
d
a work plan of the internal audit function for three years following the date of application;
e
a description of the roles and qualifications of each individual who is responsible for internal audit referred to in Article 47(3)(d) under the oversight of the audit committee referred to in Article 48(1)(b).
3
An application for authorisation shall include the following information concerning the compliance and internal control function of the applicant CSD's referred to in Article 47(3)(c):
a
a description of the roles and qualifications of individuals who are responsible for the compliance and internal control function and of any other staff involved in the assessments of compliance, including a description of the means to ensure the independence of the compliance and internal control function from the rest of the business units;
b
the policies and procedures of the compliance and internal control function, including a description of the compliance role of the management body and senior management;
c
where available, the most recent internal report prepared by the persons responsible for the compliance and internal control function or by any other staff involved in the assessments of compliance within the applicant CSD.

Senior management, management body and shareholders
Article 13
1
An application for authorisation shall include, for each member of the senior management and each member of the management body of the applicant CSD, the following information to enable the competent authority to assess compliance of the applicant CSD with Article 27(1) and (4) of Regulation (EU) No 909/2014:
a
a copy of a curriculum vitae which sets out the experience and knowledge of each member;
b
details regarding any criminal and administrative sanctions imposed on a member in connection with the provision of financial or data services or in relation to acts of fraud or misappropriation of funds, in the form of an appropriate official certificate where available in the relevant Member State;
c
a self-declaration of good repute in relation to the provision of financial or data services, where all members of the senior management and management body shall state whether they have been subject to any of the following:
1. they have been convicted of any criminal or administrative offence in connection with the provision of financial or data services or in relation to acts of fraud or misappropriation of funds;
2. they have been subject to an adverse decision in any proceedings of a disciplinary nature brought by a regulatory authority, a government body or agency or they are subject to any ongoing proceedings;
3. they have been subject to an adverse judicial finding in civil proceedings before a court in connection with the provision of financial or data services, or fraud in the management of a business;
4. they have been members of the management body or senior management of an undertaking whose registration or authorisation was withdrawn by a regulatory body while connected to the undertaking at least one year before the date of withdrawal of authorisation or registration;
5. they have been refused the right to carry on any type of activities which require registration or authorisation by a regulatory body;
6. they have been members of the management body or of senior management of an undertaking against whom insolvency proceedings have been opened at least one year before proceedings have been opened;
7. they have been members of the management body or the senior management of an undertaking that was subject to a sanction by a regulatory body while they were connected to the undertaking at least one year before such a sanction was imposed;
8. they have been otherwise fined, suspended, disqualified or subject to any other sanction in connection with the provision of financial or data services by a government, regulatory or professional body;
9. they have been disqualified from acting as a director or in any other managerial capacity, dismissed from employment or other appointment in an undertaking as a result of misconduct or malpractice.
For the purposes of point (c)(i) of this paragraph, the self-declaration shall not be required where an official certificate is submitted under point (b) of this paragraph.
2
The application for authorisation shall include the following information regarding the management body of the applicant CSD:
a
evidence of compliance with Article 27(2) of Regulation (EU) No 909/2014;
b
a description of the roles and responsibilities of the members of the management body;
c
the target for the representation of the underrepresented gender in the management body, the relevant policy on how to meet that target and the method used by the applicant CSD to make public the target, policy and its implementation.
3
The application for authorisation shall include the following information concerning the ownership structure and shareholders of the applicant CSD:
a
a description of the ownership structure of the applicant CSD referred to in point (i) of Article 4(2), including a description of the identity and size of interests of any entity in a position to exercise control over the operation of the applicant CSD;
b
a list of the shareholders and persons who are in a position to exercise, directly or indirectly, control over the management of the applicant CSD.

Management of conflicts of interest
Article 14
1
An application for authorisation shall include the following information on the policies and procedures put in place to identify and manage potential conflicts of interest by the applicant CSD in accordance with Article 50:
a
a description of the policies and procedures concerning the identification, management and disclosure to the competent authority of potential conflicts of interest and of the process used to ensure that the staff of the applicant CSD is informed of those policies and procedures;
b
a description of the controls and measures put in place to ensure that the requirements referred to in point (a) on the management of conflicts of interest are met;
c
a description of the following elements:
1. the roles and responsibilities of key personnel, especially where they also have responsibilities in other entities;
2. arrangements ensuring that individuals who have a permanent conflict of interest are excluded from the decision making process and from the receipt of any relevant information concerning the matters affected by the permanent conflict of interest;
3. an up-to-date register of existing conflicts of interest at the time of the application and a description of how those conflicts of interest are managed.
2
Where the applicant CSD is part of a group, the register referred to in point (c)(iii) of paragraph 1 shall include a description of the conflicts of interest arising from other undertakings within the group in relation to any service provided by the applicant CSD, and the arrangements put in place to manage those conflicts of interest.

Confidentiality
Article 15
1
An application for authorisation shall include the applicant CSD's policies and procedures put in place for preventing the unauthorised use or disclosure of confidential information. Confidential information shall include the following information:
a
information relating to participants, clients, issuers or other users of the applicant CSD services;
b
other information held by the applicant CSD as a result of its business activity not permitted to be used for commercial purposes.
2
An application for authorisation shall include the following information concerning the access of staff to information held by the applicant CSD:
a
the internal procedures concerning permissions of access to information that ensure secured access to data;
b
a description of any restrictions on the use of data for reasons of confidentiality.

User committee
Article 16
An application for authorisation shall include the following information on each user committee:
1. the mandate of the user committee;
2. the governance arrangements of the user committee;
3. the operating procedures of the user committee;
4. the admission criteria and the election mechanism for the members of the user committee;
5. a list of the proposed members of the user committee and the indication of interests that they represent.

Record-keeping
Article 17
1
An application for authorisation shall include a description of the record-keeping systems, policies and procedures of the applicant CSD, established and maintained in accordance with Chapter VIII of this Regulation.
2
Where an applicant CSD applies for authorisation before the date of application of Article 54, the application for authorisation shall contain the following information:
a
an analysis of the extent to which the applicant CSD's existing record-keeping systems, policies and procedures are compliant with the requirements under Article 54;
b
an implementation plan detailing how the applicant CSD will comply with the requirements referred to in Article 54 by the date on which it becomes applicable.
SECTION 4

Conduct of business rules

Goals and objectives
Article 18
An application for authorisation shall include a description of the goals and objectives of the applicant CSD referred to in Article 32(1) of Regulation (EU) No 909/2014.

Handling of complaints
Article 19
An application for authorisation shall include the procedures the applicant CSD has established for the handling of complaints.

Requirements for participation
Article 20
An application for authorisation shall include all necessary information concerning the participation in the securities settlement systems operated by the applicant CSD in accordance with Article 33 of Regulation (EU) No 909/2014 and Articles 88-90 of this Regulation. That information shall include the following:
1. the criteria for participation that allow fair and open access for all legal persons that intend to become participants in the securities settlement systems operated by the applicant CSD;
2. the procedures for the application of disciplinary measures against existing participants that do not comply with the criteria for participation.

Transparency
Article 21
1
An application for authorisation shall include the documents and information on the pricing policy of the applicant CSD concerning services referred to in Article 34 of Regulation (EU) No 909/2014. That information shall include in particular the prices and fees for each core service provided by the applicant CSD and any existing discounts and rebates, as well as the conditions for the reductions.
2
The applicant CSD shall provide the competent authority with a description of methods used to disclose the relevant information in accordance with paragraphs (1), (2), (4) and (5) of Article 34 of Regulation (EU) No 909/2014.
3
An application for authorisation shall include information allowing the competent authority to assess how the applicant CSD intends to comply with the requirements to account separately for costs and revenues in accordance with Article 34(6) and (7) of Regulation (EU) No 909/2014.

Communication procedures with participants and other market infrastructures
Article 22
An application for authorisation shall include the relevant information concerning the use by the applicant CSD of international open communication procedures and standards for messaging and reference data in its communication procedures with participants and other market infrastructures.
SECTION 5

Requirements for services provided by CSDs

Book-entry form
Article 23
An application for authorisation shall include information on the processes concerning book entries that ensure the compliance of the applicant CSD with Article 3 of Regulation (EU) No 909/2014.

Intended settlement dates and measures for preventing and addressing settlement fails
Article 24
1
An application for authorisation shall include the following information in respect of the applicant CSD:
a
the procedures and measures to prevent settlement fails in accordance with Article 6 of Regulation (EU) No 909/2014;
b
the measures to address settlement fails in accordance with Articles 7 of Regulation (EU) No 909/2014.
2
Where an applicant CSD applies for authorisation before Articles 6 and 7 of Regulation (EU) No 909/2014 are applicable in accordance with paragraphs (4) and (5) of Article 76 of that Regulation, the application for authorisation shall contain an implementation plan detailing how the applicant CSD will comply with the requirements under Articles 6 and 7 of Regulation (EU) No 909/2014.
Institutions referred to in Article 69(1) of Regulation (EU) No 909/2014 shall include in the implementation plan referred to in the first subparagraph an analysis of the extent to which their existing rules, procedures, mechanisms and measures comply with the requirements under Articles 6 and 7 of Regulation (EU) No 909/2014.

Integrity of the issue
Article 25
An application for authorisation shall include information concerning the applicant CSD's rules and procedures for ensuring the integrity of securities issues referred to in Article 37 of Regulation (EU) No 909/2014 and Chapter IX of this Regulation.

Protection of participants' and their clients' securities
Article 26
An application for authorisation shall include the following information concerning the measures put in place to protect the securities of the applicant CSD's participants and those of their clients in accordance with Article 38 of Regulation (EU) No 909/2014:
1. the rules and procedures to reduce and manage the risks associated with the safekeeping of securities;
2. a detailed description of the different levels of segregation offered by the applicant CSD, a description of the costs associated with each level, the commercial terms on which they are offered, their main legal implications and the applicable insolvency law;
3. the rules and procedures for obtaining the consents referred to in Article 38(7) of Regulation (EU) No 909/2014.

Settlement finality
Article 27
An application for authorisation shall contain information concerning the rules on settlement finality put in place by the applicant CSD in accordance with Article 39 of Regulation (EU) No 909/2014.

Cash settlement
Article 28
1
An application for authorisation shall include the procedures for the settlement of the cash payments for each securities settlement system that the applicant CSD operates in accordance with Article 40 of Regulation (EU) No 909/2014.
2
The applicant CSD shall provide information about whether the settlement of the cash payments is provided in accordance with Article 40(1) or (2) of Regulation (EU) No 909/2014.
If the settlement of the cash payments is intended to take place in accordance with Article 40(2) of Regulation (EU) No 909/2014, the applicant CSD shall explain why settlement in accordance with Article 40(1) of Regulation (EU) No 909/2014 is not practical and available.

Participant default rules and procedures
Article 29
An application for authorisation shall include the rules and procedures put in place by the applicant CSD to manage the default of a participant.

Transfer of participants and clients' assets in case of a withdrawal of authorisation
Article 30
An application for authorisation shall include information concerning the procedures put in place by the applicant CSD to ensure the timely and orderly settlement and transfer of the assets of clients and participants to another CSD in the event of a withdrawal of its authorisation.
SECTION 6

Prudential requirements

Legal risks
Article 31
1
An application for authorisation shall include all information necessary to enable the competent authority to assess that the rules, procedures, and contracts of the applicant CSD are clear, understandable and enforceable in all relevant jurisdictions in accordance with Article 43(1) and (2) of Regulation (EU) No 909/2014.
2
Where the applicant CSD intends to conduct business in different jurisdictions, the applicant CSD shall provide the competent authority with information concerning the measures put in place to identify and mitigate the risks arising from potential conflicts of laws across jurisdictions in accordance with Article 43(3) of Regulation (EU) No 909/2014. That information shall include any legal assessment on which those measures are based.

General business risks
Article 32
1
The applicant CSD shall provide the competent authority with a description of the risk-management and control systems as well as the IT tools put in place by the applicant CSD to manage business risks in accordance with Article 44 of Regulation (EU) No 909/2014.
2
Where the applicant CSD has obtained a risk rating from a third party, it shall provide it to the competent authority including any relevant information supporting that risk rating.

Operational risks
Article 33
1
An application for authorisation shall include information that demonstrates the applicant CSD is compliant with the requirements for the management of operational risks in accordance with Article 45 of Regulation (EU) No 909/2014 and Chapter X of this Regulation.
2
An application for authorisation shall also contain the following information concerning the list of services referred to in point (p) of Article 4(2) of this Regulation:
a
a copy of the outsourcing agreements;
b
the methods used to monitor the service level of the outsourced services and activities.

Investment policy
Article 34
An application for authorisation shall include evidence demonstrating that:
1. the applicant CSD holds its financial assets in accordance with Article 46(1), (2) and (5) of Regulation (EU) No 909/2014 and Chapter XI of this Regulation.
2. the investments of the applicant CSD are compliant with Article 46(3) of Regulation (EU) No 909/2014 and Chapter XI of this Regulation.

Capital requirements
Article 35
An application for authorisation shall include the following information concerning the capital requirements:
1. information demonstrating that the capital of the applicant CSD, including retained earnings and reserves of the applicant CSD, meets the requirements of Article 47 of Regulation (EU) No 909/2014;
2. the plan referred to in Article 47(2) of Regulation (EU) No 909/2014 and any updates to that plan, and evidence of its approval by the management body or an appropriate committee of the management body of the applicant CSD.
SECTION 7

CSD links
Article 36
Where the applicant CSD has established or intends to establish CSD links, the application for authorisation shall contain the following information:
1. a description of the CSD links accompanied by assessments of potential sources of risks arising from those link arrangements by the applicant CSD;
2. the expected or actual settlement volumes and values of the settlement performed within the CSD links;
3. the procedures concerning the identification, assessment, monitoring and management of all potential sources of risk for the applicant CSD and for its participants arising from the link arrangement and the appropriate measures put in place to mitigate them;
4. an assessment of the applicability of insolvency laws applicable to the operation of a CSD link and their implications for the applicant CSD;
5. other relevant information requested by the competent authority for assessing the compliance of CSD links with the requirements provided in Article 48 of Regulation (EU) No 909/2014 and Chapter XII of this Regulation.
SECTION 8

Access to CSDs

Access rules
Article 37
An application for authorisation shall include a description of the procedures for dealing with the following requests for access:
1. from legal persons intending to become participants in accordance with Article 33 of Regulation (EU) No 909/2014 and Chapter XIII of this Regulation;
2. from issuers in accordance with Article 49 of Regulation (EU) No 909/2014 and Chapter XIII of this Regulation;
3. from other CSDs in accordance with Article 52 of Regulation (EU) No 909/2014 and Chapter XIII of this Regulation;
4. from other market infrastructures in accordance with Article 53 of Regulation (EU) No 909/2014 and Chapter XIII of this Regulation.
SECTION 9

Additional information

Request for additional information
Article 38
The competent authority may request from the applicant CSD any additional information necessary for assessing whether, at the time of granting the authorisation, the applicant CSD complies with the requirements of Regulation (EU) No 909/2014.
Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC (OJ L 157, 9.6.2006, p. 87).