Commission Delegated Regulation (EU) 2021/1351 of 6 May 2021 supplementing Regulation (EU) 2016/1011 of the European Parliament and of the Council with regard to regulatory technical standards specifying the characteristics of the systems and controls for the identification and reporting of any conduct that may involve manipulation or attempted manipulation of a benchmark (Text with EEA relevance)

1 The adequate systems and effective controls referred to in Article 14(1) of Regulation (EU) 2016/1011 shall be: (a) appropriate for and proportionate to the nature, complexity and risk of manipulation of the benchmark concerned; (b) regularly, and at least annually, reviewed, and updated when necessary to ensure that those systems and controls continue to comply with point (a); (c) be documented in writing in a clear and comprehensible manner, including any changes to or updates of those systems and controls. For the purposes of point (a) of the first subparagraph, an administrator shall, on a regular basis and at least annually, assess the risk of manipulation of the benchmark provided, taking into account the following elements: (a) the envisaged operations required to provide the benchmark; (b) the potential origin, nature, peculiarity and severity of the manipulation risk; (c) the measures envisaged to address the risk of manipulation, including safeguards, security measures and internal procedures.

2 The adequate systems and effective controls referred to in Article 14(1) of Regulation (EU) 2016/1011 shall include, to the level appropriate to the nature, complexity and risk of manipulation of the benchmark provided, all of the following elements: (a) software capable of deferred automated reading, replaying and analysis of input data; (b) human analysis in the detection and identification of behaviour that may involve manipulation or attempted manipulation of a benchmark.

3 An administrator shall, upon request by the competent authority, provide the competent authority with the information referred to in paragraph 1, first subparagraph, points (a), (b) and (c), and substantiate the appropriateness of the level of automation and human analysis chosen, as referred to in paragraph 2.

1 The adequate systems and effective controls referred to in Article 14(1) of Regulation (EU) 2016/1011 shall be operated by employees of the administrator who are adequately and regularly trained to: (a) detect and identify any suspicious input data that could be the result of benchmark manipulation or attempted manipulation; (b) promptly report any such findings to their internal reporting line.

2 In determining the content of the training referred to in paragraph 1 of this Article, an administrator shall take into account the nature, complexity and risk of manipulation of the benchmark provided as referred to in Article 1(1), point (a).

The adequate systems and effective controls referred to in Article 14(1) of Regulation (EU) 2016/1011 shall be documented in an input data integrity policy indicating: (a) the risk of benchmark manipulation; (b) a general description of the adequate systems and effective controls, including their compliance with the requirements laid down in Article 1; (c) a general description of the training of the employees of the administrator involved in the operation of the adequate systems and effective controls, as referred to in Article 2; (d) the name and contact details of the persons responsible for the adequate systems and effective controls.

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 1 January 2022.