Directive (EU) 2019/2177 of the European Parliament and of the Council of 18 December 2019 amending Directive 2009/138/EC on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II), Directive 2014/65/EU on markets in financial instruments and Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money-laundering or terrorist financing (Text with EEA relevance)

‘1 This Directive shall apply to investment firms, market operators, and third-country firms providing investment services or performing investment activities through the establishment of a branch in the Union.’;

‘6 Where a published criminal or administrative sanction relates to an investment firm, market operator, credit institution in relation to investment services and activities or ancillary services, or a branch of third-country firms authorised in accordance with this Directive, or to an APA or ARM authorised in accordance with Regulation (EU) No 600/2014 which has a derogation in accordance with Article 2(3) of that Regulation, ESMA shall add a reference to the published sanction in the relevant register.’;

‘2 The delegations of power referred to in Article 2(3), the second subparagraph of point (2) of Article 4(1), Article 4(2), Article 13(1), Article 16(12), Article 23(4), Article 24(13), Article 25(8), Article 27(9), Article 28(3), Article 30(5), Article 31(4), Article 32(4), Article 33(8), Article 52(4), Article 54(4), Article 58(6), and Article 79(8) shall be conferred on the Commission for an indeterminate period of time from 2 July 2014.

3 The delegations of powers referred to in Article 2(3), the second subparagraph of point (2) of Article 4(1), Article 4(2), Article 13(1), Article 16(12), Article 23(4), Article 24(13), Article 25(8), Article 27(9), Article 28(3), Article 30(5), Article 31(4), Article 32(4), Article 33(8), Article 52(4) Article 54(4), Article 58(6), and Article 79(8) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.’;

‘5 A delegated act adopted pursuant to Article 2(3), the second subparagraph of point (2) of Article 4(1), Article 4(2), Article 13(1), Article 16(12), Article 23(4), Article 24(13), Article 25(8), Article 27(9), Article 28(3), Article 30(5), Article 31(4), Article 32(4), Article 33(8), Article 52(4), Article 54(4), Article 58(6) or Article 79(8) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of three months of notification of that act to the European Parliament and to the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by three months at the initiative of the European Parliament or of the Council.’;

‘3a Supervisory authorities shall inform EIOPA in accordance with Article 35(1) of Regulation (EU) No 1094/2010 of any applications to use or change an internal model. Upon the request of one or more supervisory authorities concerned, EIOPA may provide technical assistance, pursuant to point (b) of Article 8(1) of that Regulation, to the supervisory authority or authorities which requested the assistance, with respect to the decision on the application.’;

1 Where the supervisory authority of the home Member State intends to authorise an insurance or reinsurance undertaking whose scheme of operations indicates that a part of its activities will be based on the freedom to provide services or the freedom of establishment in another Member State, and that scheme of operations also indicates that those activities are likely to be of relevance with respect to the host Member State’s market, the supervisory authority of the home Member State shall notify EIOPA and the supervisory authority of the relevant host Member State thereof.

2 The supervisory authority of the home Member State shall, in addition to the notification provided for in paragraph 1, also notify EIOPA and the supervisory authority of the relevant host Member State where it identifies deteriorating financial conditions or other emerging risks posed by an insurance or reinsurance undertaking carrying out activities which are based on the freedom to provide services or the freedom of establishment and which may have a cross-border effect. The supervisory authority of the host Member State may also notify the supervisory authority of the relevant home Member State where it has serious and reasoned concerns with regard to consumer protection. The supervisory authorities may refer the matter to EIOPA and request its assistance in cases where no bilateral solution can be found.

3 The notifications referred to in paragraphs 1 and 2 shall be sufficiently detailed to allow for a proper assessment.

4 The notifications referred to in paragraphs 1 and 2 are without prejudice to the supervisory mandate of the supervisory authorities of the home Member State and host Member State provided for in this Directive.

1 EIOPA may, in the case of justified concerns about negative effects on policy holders, on its own initiative or at the request of one or more of the relevant supervisory authorities, set up and coordinate a collaboration platform to strengthen the exchange of information and to enhance collaboration between the relevant supervisory authorities where an insurance or reinsurance undertaking carries out, or intends to carry out, activities which are based on the freedom to provide services or the freedom of establishment and where: (a) such activities are of relevance with respect to the host Member State’s market; (b) a notification by the supervisory authority of the home Member State has been made under Article 152a(2) of deteriorating financial conditions or other emerging risks; or (c) the matter has been referred to EIOPA under Article 152a(2).

2 Paragraph 1 is without prejudice to the right of the relevant supervisory authorities to set up a collaboration platform where they all agree to do so.

3 The setting up of a collaboration platform pursuant to paragraphs 1 and 2 is without prejudice to the supervisory mandate of the supervisory authorities of the home Member State and host Member State provided for in this Directive.

4 Without prejudice to Article 35 of Regulation (EU) No 1094/2010, at the request of EIOPA, the relevant supervisory authorities shall provide all necessary information in a timely manner to allow for the proper functioning of the collaboration platform.’;

‘3 The Commission shall make the report referred to in paragraph 1 available to Member States and obliged entities in order to assist them in identifying, understanding, managing and mitigating the risks of money laundering and terrorist financing, and to allow other stakeholders, including national legislators, the European Parliament, the European Supervisory Authority (European Banking Authority) established by Regulation (EU) No 1093/2010 of the European Parliament and of the Council (EBA), and representatives from EU Financial Intelligence Units (FIUs), to better understand those risks. The report shall be made public at the latest six months after having been made available to Member States, except for those elements of the report which contain classified information.

‘5 Member States shall make the results of their risk assessments, including their updates, available to the Commission, to EBA and to the other Member States.’;

‘4 By 26 June 2017, the ESAs shall issue guidelines, addressed to competent authorities and the credit institutions and financial institutions, in accordance with Article 16 of Regulation (EU) No 1093/2010 on the risk factors to be taken into consideration and the measures to be taken in situations where enhanced customer due diligence measures are appropriate. From 1 January 2020, EBA shall, where appropriate, issue such guidelines.’;

‘1 The processing of personal data under this Directive is subject to Regulations (EU) 2016/679 and (EU) 2018/1725 of the European Parliament and of the Council.

‘4 The Member States and EBA shall inform each other of instances in which the law of a third country does not permit the implementation of the policies and procedures required under paragraph 1. In such cases, coordinated actions may be taken to pursue a solution. In assessing which third countries do not permit the implementation of the policies and procedures required under paragraph 1, Member States and EBA shall take into account any legal constraints that may hinder the proper implementation of those policies and procedures, including secrecy, data protection and other constraints limiting the exchange of information that may be relevant for that purpose.’;

‘6 EBA shall develop draft regulatory technical standards specifying the type of additional measures referred to in paragraph 5 and the minimum action to be taken by credit institutions and financial institutions where a third country’s law does not permit the implementation of the measures required under paragraphs 1 and 3. EBA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 26 December 2016.’;

‘10 EBA shall develop draft regulatory technical standards on the criteria for determining the circumstances in which the appointment of a central contact point pursuant to paragraph 9 is appropriate, and what the functions of the central contact points should be. EBA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 26 June 2017.’;

‘10 By 26 June 2017, the ESAs shall issue guidelines, addressed to competent authorities, in accordance with Article 16 of Regulation (EU) No 1093/2010, on the characteristics of a risk-based approach to supervision and the steps to be taken when conducting supervision on a risk-based basis. From 1 January 2020, EBA shall, where appropriate, issue such guidelines.’;

The competent authorities shall provide EBA with all the information necessary to allow it to carry out its duties under this Directive.’;

1 Member States shall adopt and publish, by 30 June 2021, the laws, regulations and administrative provisions necessary to comply with this Directive. They shall immediately communicate to the Commission the main provisions of national law which they adopt in the field covered by this Directive.

2 Member States shall adopt and publish, by 30 June 2020, the laws, regulations and administrative provisions necessary to comply with point (1) of Article 2 of this Directive. They shall immediately communicate to the Commission the main provisions of national law which they adopt in the field covered by this Directive.

3 Member States shall apply the measures with respect to Article 1 from 1 January 2022, and with respect to Articles 2 and 3 from 30 June 2021. Member States shall apply the measures with respect to point (1) of Article 2 by 1 July 2020.

4 When Member States adopt the measures referred to in paragraphs 1 and 2, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such a reference is to be made.

This Directive shall enter into force on the third day following that of its publication in the Official Journal of the European Union.

This Directive is addressed to the Member States.