European Union: The European Securities And Markets Authority's (ESMA) General Supervisory Principles On Relocations (SPoRs) And The 2018 Update

Quick Take: With time running out, ESMA publishes additional statements and a reminder to submit SPoR-compliant applications 

The regulatory and financial concerns arising from BREXIT prompted the various European Supervisory Authorities (ESAs) to issue a series of communications and Opinions during 2017 setting out SPoRs. Some of these were updated during 2018 in light of the lack of SPoR compliant applications or lack of preparatory measures from breadths of market participants, many of whom continued with a "wait and see" approach as the British government debated what "Brexit means Brexit" actually means. Irrespective of the political confusion, the ESAs have confirmed time is running out and that both sides of the divide must prepare for a messy BREXIT. This includes expediting legal entity structuring but also contractual continuity.  

Without reservation ESMA is blunt in stating in its July 2018 Public Statement¹ on "Timely submission of requests for authorization in the context of the United Kingdom withdrawing from the European Union" (the 2018 Update) that firms must have a fully authorized legal entity located in the EU-27 to continue providing services in the EU-27. This supervisory objective is not new, even if many firms and their professional advisers may be receiving institution-tailored" BREXIT-letters from supervisors, many may not be as fully aware of the EU's SPoRs and those of ESMA as supervisors would like. Other EU authorities have come to the same conclusion and implications of what this means are set out in further Client Alerts in this series available from our Eurozone Hub.²

ESMA launched its SPoRs in its 2017 general Opinion, i.e. a legal instrument titled "General principles to support supervisory convergence in the context of the United Kingdom withdrawing from the European Union" (the ESMA General Opinion).³ Following that release, ESMA published three Sector Specific Opinions (the SSOs) (see our standalone coverage from our Eurozone Hub on these), upon which the 2018 Update also builds. This Client Alert assesses the aims of the 2018 Update and the requirements of the ESMA General Opinion, and what firms may want to do in terms of preparatory action.

ESMA's overarching tone in the SPoRs and why it matters

For those that had begun to design and implement contingency planning and BREXIT-driven applications, the ESMA General Opinion, the SSOs and now the 2018 Update have caused or should cause many, irrespective of whether having received institution-tailored supervisory notifications, to re-examine plans. The SPoRs also affect those new entrants looking to set-up in the Eurozone that are not driven by BREXIT. 

In many ways the SPoRs introduced some firm lines and put some practical implications to what has otherwise been political positioning as to how market participants would be able to access each other's markets and customers post-BREXIT. It also reaffirmed the position of the ESAs, the national competent authorities (NCAs) along with the European Central Bank, in its supervisory and regulatory role within the Single Supervisory Mechanism (SSM) component of the Eurozone's Banking Union and multiple clear communications on 'supervisory expectations' and not tolerating a "regulatory race to the bottom," the use of "empty shell companies" or behavior that is more "cute than compliant".

On May 31, 2017, the European Securities and Markets Authority (ESMA), which is an EU-wide ESA released an Opinion, i.e. a legal instrument titled "General principles to support supervisory convergence in the context of the United Kingdom withdrawing from the European Union" (the ESMA General Opinion).⁴

The ESMA General Opinion, the first of a series, was released as part of the ESA's and ECB-SSM's work to improve supervisory convergence across the European System of Financial Supervision (ESFS) of the EU. Despite their content and tone, what the SPoRs do not do is close the door or raise the drawbridge for financial services firms looking to establish themselves within, or engage through, the EU-27 and the Eurozone-19. Rather, the SpoRs, like the on-going EU reforms on assessing third-country equivalence, are welcome in providing a roadmap of who can do what, where and with whom going forward with the aim of managing and mitigating (as far as possible) any regulatory arbitrage and race to the bottom between the EU 27 Member States. That being said, ESMA's SPoRs in the General Opinion and the SSOs, as supplemented by the 2018 Update are quite clear that the UK, post its departure, will become a "third-country" for EU regulatory purposes and is drafted as being "without prejudice" to any post-UK-EU relationship deal, including any assessment of equivalence.

Key aims and deliverables of the ESMA General Opinion

If the SSM's and other ESA's principles on BREXIT relocation already seemed potentially tough, the publication of ESMA's General Opinion, setting out nine supervisory "Principles," will likely be of interest as they cover a much broader set of financial market participants than those of the sister authorities looking at specific parts of say banking, insurance and pensions.⁵ Equally, the geographic scope of these Principles are directed at EU NCAs but also to those of the European Economic Area (EEA) and the European Free Trade Association (EFTA) states of Norway, Liechtenstein and Iceland, which have access to the EU's Single Market, including for financial services, as per the EEA Agreement. This means that a much broader set of firms, including those that are sat outside of the EU-27, may want to consider how this affects them as an initial but also on-going planning and compliance exercise.

The Principles of the ESMA General Opinion, which are explored in further practical detail below, include:

1. No automatic recognition of existing authorizations;
2. Authorizations granted by EU-27 NCAs should be rigorous and efficient;
3. NCAs should be able to verify the objective reasons for relocation;
4. Special attention should be granted to avoid letter-box entities in the EU-27;
5. Outsourcing and delegation to third-countries is only possible under strict conditions;
6. NCAs should ensure that substance requirements are met;
7. NCAs should ensure sound governance of EU entities;
8. NCAs must be in a position to effectively supervise and enforce EU law; and
9. NCAs need to implement coordination to ensure effective monitoring by ESMA.

In addition to the Principles in the ESMA General Opinion, ESMA will as part of its mandate to improve supervisory convergence,⁶ establish and maintain a forum – the Supervisory Coordination Network – to allow NCAs to report on and discuss cases of relocations of UK market participants. As part of the on-going review of the ESFS, it is expected that ESMA will receive further supervisory powers to push forward supervisory convergence as well as to support completion of the EU's Capital Markets Union project. Even if that network is set up, NCAs and firms are reminded in statements that are similar to those of its sister authorities, that BREXIT leads to longer lead times on processing new authorizations and variations of permissions as well as the proofing of delegation and outsourcing arrangements, especially where these flow from an EU-27 firm to a third-country entity (TCE).

Despite BREXIT, the use by firms and NCAs of English as the supervisory and regulatory lingua franca will continue. Despite this, the SPoRs, the increased use of soft law measures to make policy and some of the drafting quality of public and firm-specific communications present some challenges on clear, consistent and common understanding of communication. One area that has presented itself repeatedly as a challenge for non-native speakers is the use of the word "should" in regulatory and supervisory policy documentation, and when a "should" really means a "must" or "required" i.e., an absolute obligation, as opposed to an implied optionality.  This is particularly relevant to financial institutions with global/cross-border/cross-cultural footprint as well as for policymakers given some of the issues faced by the supervised market participants, including non-native speakers and different legal and regulatory traditions tasked with interpreting the same wording.

The following sections below provide a summary of the individual Principles.

Principle 1: No automatic recognition of existing authorizations

This Principle clearly states that firms relocating, and specifically that any TCEs relocating, will need to establish a presence in the EU-27 to avail of relevant benefits including passporting rights. This means that any UK entity cannot simply, once it becomes a TCE, apply and expect to receive preferential treatment since it was prior to BREXIT an EU entity whilst the UK was part of the EU-28. The 2018 EBA Update reiterates this point.

In a stark warning, there will be "...no automatic recognition of the authorization granted by the UK regulator[s] into the EU-27." Despite ESMA's minor oversight that the UK currently has two relevant regulators, namely the Financial Conduct Authority and the Prudential Regulatory Authority, this statement sets out a clear need for all passported entities to reapply for appropriate authorizations for those entity(ies) that will sit within the EU-27. This may considerably impact BREXIT-proofing and legal entity structuring planning as Principle 1 sets out the expectation that the evaluation of the application is made "with fresh eyes" as opposed to "grandfathering." The scope of this principle was expanded by various ESAs to also mean that any automatic recognition/waiver by the UK regulators would not result in reciprocal ESAs recognition/authorization of UK entities looking to relocate/establish themselves within the EU-27.

Consequently, impacted market participants would be best advised to plan for longer lead times and commence the requisite processes as well as engagement with their professional advisers sooner rather than later. This is further complicated by the fact that many of the relevant departments within the NCAs as well as those components of the SSM may themselves be growing or on-boarding new headcount to deal with the increased volume of reviews.

Principle 2: Authorizations granted by EU-27 NCAs should be rigorous and efficient

This Principle sets out that authorizations granted by the EU-27 NCAs "should" i.e., they "must" be rigorous and efficient. In the context of the Banking Union, this could include the ECB-SSM component as the body with ultimate responsibility for licensing credit institutions. Specifically, Principle 2 requires that entities must meet their obligations set by the relevant legislation from "day one of their authorization" and not rely on political solutions or potential "transition periods." The 2018 EBA Update flags this point specifically.  For some jurisdictions and NCAs this may reduce the ability of relocating firms to scale up operations based on a phased approach.

Principle 2 also sets out that despite being obliged to "strong scrutiny" and review, the entirety of the governance structure, human and technical resources along with the geographical distribution of activities and outsourcing/delegation arrangements, "some" assessments of third-country regulators may, where appropriate, be taken into consideration as part of the relevant authorization process including fitness and propriety assessments. See also our Eurozone Hub coverage on the "ECB-SSM's updated May 2018 supervisory guidance for "fit and proper" assessments in the Banking Union"⁷ for further information on how the SSM's new rules in this area may change the process for obtaining certain approvals or at the very least cause extra timelines in the approval process.

The relevant NCAs may however not be inclined to rely on existing authorizations, in particular if the UK authorities, following BREXIT, may push certain incoming EEA firms and their set-up. This is certainly something that the UK authorities (PRA/FCA) have communicated to certain incoming EEA firms, their subsidiaries and branches, even if the UK has indicated it will offer a temporary permissions regime that could grant some relief in the UK – but not necessarily from an EU perspective.

This means that EU NCAs cannot simply apply a waiver for applicants applying for authorization, in particular TCEs, simply because they have been authorized and/or regulated in a third-country with similar or equivalent standards. Principle 2 also flags that NCAs are encouraged to not grant authorizations where an applicant entity has opted to (re-)locate itself into a Member State to circumvent more stringent provisions in another Member State in "...which it intends to carry on the greater part of its activities." This anti-avoidance objective represents new thinking amongst the ESFS and also ties in with Principle 3.

Principle 3: NCAs should be able to verify the objective reasons for relocation

What this Principle means in practice is that NCAs are expected to check whether the planned EU-27 activity is the main basis driving the relocation of the relevant entities, the activities and the functions. This Principle is designed to address the ESMA "concerns about the risk of regulatory arbitrage between the EU27 Member States seeking to attract this business."  Hence, NCAs will use various supervisory tools to evidence this check, however the ESMA General Opinion clearly points to the "entity's programme of operations" i.e. a Regulatory Business Plan, which in the views of ESMA and thus the ESFS components "...provide a clear justification for relocating to the Member State of establishment." NCAs are also instructed, as part of their verification of geographical scope, to obtain information on:

• Prospective investors or marketing and promotional arrangements; and
• Location of development of products or services.

Some of these details may be detailed in an applicant's Regulatory Business Plan that is submitted as part of the application forms, a number of which have been standardized across the EU. What the ESMA General Opinion does clarify is that, unlike some jurisdictions, applicant entities need to disclose whether they have engaged with other NCAs. The obligation upon applicants to inform a relevant NCA whether an application has been rejected by another NCA is also reinforced in Principle 3. Furthermore, these considerations need to be included in any of the Brexit plans that firms are required to present to the various ESAs (incl. the discussions with other NCAs as well as the FCA/PRA).

These requirements tie in with the new obligation on NCAs to ascertain that an authorization does not breach the anti-avoidance objective introduced by Principle 2. As a result, ESMA's supervisory expectation is that NCAs will "particularly scrutinize applications" that appear to circumvent the anti-avoidance objective.

Principle 4: Special attention should be granted to avoid letter-box entities in the EU-27

This Principle specifies and ties in with SSM statements that special attention "should" i.e., "must" be dedicated to avoid the use of "letter-box" entities or shell companies in the EU-27. This specifically aims at capturing and then assessing the use of outsourcing or delegation arrangements by relevant market participants.

In particular, this Principle requires that NCAs assess the use of (1) regulatory outsourcing or delegation of substantial or critical functions to entities outside of EU-27; or (2) booking of risk by those within the EU-27 to those entities located outside of the EU-27. This Principle aims to prevent excessive use of regulated outsourcing and delegation that flouts the ability to sufficiently supervise the regulated activity in a manner that mitigates risk, as well as to avoid having all of the critical functions outside of the reach/scope of the ESFS. The expectation is that NCAs will take a proportionate view on what is "substantial" based on what is commensurate with existing practices within the regulated environment. It should be noted that in EIOPA's own Opinion and its SPoRs percentage thresholds were set as to what degree of risk can be booked from the EU-27 to a TCE.

Specifically, Principle 4 sets out that:

"NCAs should reject any relocation request creating letter-box entities, where, for instance, extensive use of outsourcing and delegation is foreseen with the intention of benefitting from an EU passport, while essentially performing all substantial activities or functions outside the EU-27. Similar considerations may apply if entities perform substantial activities and functions through third-country branches."

This echoes the SSM's earlier statements that on using certain booking models moving risk back to TCEs. The SPoR here could not be clearer, and this may prompt a rethink for a number of entities in relation to new or existing BREXIT-proofing plans (incl. governance, structure and personnel of the key functions) as well as regulatory applications.

Principle 5: Outsourcing and delegation to third countries is only possible under strict conditions

Building upon the other Principles, Principle 5 clarifies that outsourcing and delegation to third-countries is only possible under strict conditions. Principle 5 also recalls the existing regulatory principle that only functions as opposed to responsibilities may be outsourced/delegated (i.e. Principle 4 in terms of critical functions personnel is further reinforced).

NCAs are reminded to act prudently and also assess whether specific EU legislative and regulatory requirements are fulfilled prior to / during the entire period of an entity putting the outsourcing/delegation arrangement in place. This also includes ascertaining whether any regulatory/supervisory cooperation agreements are in place amongst NCAs and third-country authorities, as this is a prerequisite introduced by relevant EU regulatory requirements for certain areas.

Principle 6: NCAs should ensure that substance requirements are met

NCAs are required to ensure that "substance requirements" are met i.e., that regulated entities have sufficient substance within the EU-27. Whilst this applies beyond just outsourcing/delegation arrangements, Principle 6 reminds NCAs that any such arrangement must be clearly structured and set-up in a way that does not hinder the efficient supervision and control of that arrangement.

What Principle 6 does clearly do, in conjunction with the other Principles, is set this SPoR, in a way that goes beyond existing EU legislative/regulatory requirements, such as in MiFID Ii/MiFIR or AIFMD/R by stating that:

"This implies in particular that certain key activities and functions should be present in the EU-27. These activities and functions are key to the proper functioning of the regulated entity and consequently cannot be outsourced or delegated outside the EU; this is at least the case for the substance of decision-making. Some important activities and functions deserve special scrutiny and in certain sector specific circumstances cannot be outsourced and delegated without threatening the activity of the regulated entities and the possibility of effective supervision by NCAs."

These are crucial statements that are relevant for those firms relocating to the EU-27, but might also impact a number of firms, especially those that operate significant branches, including those in third-countries, and/or retain management and supervisory functions in such a third-country as opposed to within the EU-27. Principle 6 should also be viewed in light of on-going EU supervisory reform on how "significant branches" are to be categorized and supervised, although there are differing views between the ESFS in terms of whether third-country branches and subsidiaries should be treated differently when applying the SPoRs.

Principle 6 sets out that these "important activities" can be summarized as a minimum of the following six "activities and functions" comprised of inter alia:

• "Internal control functions" – including supervisory control functions other than compliance and risk such as governance and audit etc.
• "IT control infrastructure"
• "Risk assessment"
• "Compliance functions"
• "Key management functions"
• "Sector-specific functions"

These restrictions do not preclude firms from centralizing these functions at a group level, but it does suggest a need to reinforce entity level responsibility to comply with the supervisory expectations set by the SPoRs and in particular Principle 6.

Principle 7: should ensure sound governance of EU entities

Building on the other Principles, notably the six activities of Principle 6, the supervisory expectation is clear, namely that EU entities must have "the effective decision-making powers in relation to compliance of the EU authorized entity with Union law even where the entity is part of a corporate group" at board member (or such analogous function) and senior managers located in the EU-27.

Moreover, ESMA goes further in stating that: "ESMA expects that key executives and senior managers of EU authorized entities are employed in the Member State of establishment and work there to a degree proportionate to their envisaged role..."

NCAs are directed to satisfy themselves that this 'mind and matter' requirement is complied with by looking at the individual and collective suitability of resources present both at executive board level (or analogous equivalent) and senior manager level in the relevant Member State of establishment. It remains, however, to be seen what exactly would that mean in practical terms when considering the size and complexity of some of the larger firms. Notably, due to the fat that the critical activities under Principle 6 may be performed by multiple divisions with hierarchies and team structures that may make it difficult to determine whether the "decision-making" is correctly allocated.

Principle 8: NCAs must be in a position to supervise and enforce EU law effectively

This Principle concerns itself with the adequate resourcing and capacity of NCAs to supervise and enforce EU legislative and regulatory requirements and be able to respond to market developments within the relevant Member State and any jurisdictions to which functions are outsourced/delegated. Unfortunately, Principle 8 does not offer any blue-sky thinking on how to close some of the gaps on resourcing. Nor does Principle 8 offer a tie-in to Banking Union and the resulting benefits that joint supervisory teams and centralized functions have meant in creating a more uniform supervisory culture and process of engagement for regulated entities. The recent months following the UK application to withdraw from the EU, however, have seen certain developments in terms of improved staffing of both NCA/ESAs as well as firms' BREXIT/supervisory interaction teams.

Principle 9: Coordination to ensure effective monitoring by ESMA

This Principle confirms and communicates that ESMA will establish new practical convergence tools in addition to the Supervisory Coordination Network. ESMA thus "...stands ready to make use of all its powers in order to support supervisory convergence activity..."

This may be a more muted battle cry than ESMA's contemporaries at the ECB have become known for in relation to Euro monetary policy as well as supervision, but it does mark a definitive step, that on top of the ESMA General Opinion, more can be expected from ESMA to drive the pan-EU priority of improving and increasing supervisory convergence efforts.

Outlook and some next steps for firms affected by ESMA's SPoRs

The SPoRs have set a new, more clearly mapped route on how financial services firms will need to structure themselves when relocating to the EU and/or Eurozone as a result of BREXIT or otherwise firms with significant UK presence would like to maintain their presence whilst satisfying ESA/NCAs supervisory expectations. In practical terms, this has a number of implications for firms, internal project teams as well as their retained legal counsel, consultants and professional advisers. As a result, the impact of the SPoRs:

• Firstly, mean that in addition to tackling the diverse and rapid changing workstreams needed to BREXIT-proof and/or relocate a regulated firm, those existing plans and applications, including named individuals, need to crucially be proofed as to whether they would or could be capable of meeting supervisory expectations in an EU financial services market that is increasingly moving to deeper integration and converging standards;
• Secondly, mean a greater need to take account of potentially more invasive supervisory touchpoints along each of the levels of the ESFS, including a greater scrutiny of fitness and propriety of individuals, governance and control functions as well as the written policies and procedures underpinning those systems and controls. For BREXIT-proofing workstreams, this might mean retaining appropriate legal and regulatory specialists, both within internal and external project teams that can draft, implement and ensure compliance with EU, Eurozone, respective national levels as well as third-country regimes. This dedicated supervisory priority, whilst needing to be interoperable with license application and relocation workstreams, ought to be run separately so as to have sufficient degree of independence and an ability to challenge assumptions made by those advising on the relocation, in order to guarantee the integrity that the SPoRs expect of firms relocating; and
• Thirdly, mean that timeframes for processing reviews and approvals may not be extended considerably ("day one" BREXIT readiness), whilst the frequency of supervisory inspections and engagements might increase form all levels of the ESFS and certainly the ECB-SSM and NCAs in the Banking Union. This means that firms will need to have appropriate advice as to what are key priorities as well as quick wins that can effectively reassure relevant supervisors that a firm is meeting if not exceeding its obligations, the supervisory expectations and the SPoRs.

If you would like to receive more analysis from our Eurozone Hub or our wider Eurozone Group including what the SPoRs might mean for specific market participant types within or looking to enter the EU and/or the Eurozone, then please do get in touch with any of our Eurozone Hub key contacts.

Footnotes

Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries. www.dentons.com.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.