The joint guidelines established by the European Supervisory Authorities (ESAs) aim to create an information exchange system for assessing the fitness and propriety of directors and holders of qualifying holdings in financial institutions. This system, which includes a cross-sectoral database, will facilitate cooperation among competent authorities regarding assessments. The goal is to ensure that only suitable…
This document is a guide published in 2024 by the European Banking Authority (EBA), jointly with EIOPA and ESMA, collectively called the European Supervisory Authorities (ESAs). It concerns the system established by the ESAs for exchanging relevant information for the assessment of fitness and propriety (fit and proper) of holders of qualifying holdings, directors and key function holders in financial institutions and financial market participants. The scope covers European competent authorities, financial institutions, financial market participants, and is based on the founding regulations (EU) No 1093/2010, No 1094/2010 and No 1095/2010. The guide details the modalities of use of the ESAs Information System, information exchanges, reporting requirements, as well as data protection aspects, over an application period starting February 2025 (p. 1-28).
The guide addresses the establishment of a common system by the ESAs to facilitate information exchange among competent authorities within the framework of fitness and propriety assessments of key persons in financial institutions. This topic is crucial as adequate governance of financial institutions depends on the ability to ensure that persons in control or management positions are fit and trustworthy. Article 31a of the founding regulations require the ESAs to create this system, which includes an intersectoral database (ESAs Information System) and guidelines for its use. This system contains limited data on assessed persons (natural or legal) and aims to quickly identify authorities that have already conducted assessments, thus improving process efficiency. The effective exchange of relevant information takes place bilaterally, outside the system, in accordance with regulatory frameworks and data protection requirements. Authorities must continue to conduct their own independent assessments even if they use exchanged information. The guide specifies data entry modalities, response deadlines (two weeks), confidentiality rules, as well as authorities’ compliance notification obligations. A transitional period is planned for integrating historical data (5 years for natural persons, 2 years for legal entities). The system is designed to strengthen consistency, efficiency and transparency of assessments, while respecting legal and data protection requirements. Estimated costs are modest (about EUR 260,000 for development, EUR 40,000 to 45,000 annually for maintenance). This arrangement contributes to financial stability by ensuring better supervision of key persons (p. 3-17, 18-22).
The guide was developed in response to the legal obligation set by Article 31a of the ESAs founding regulations, which require the creation of an information exchange system for fitness and propriety assessments of key persons in the financial sector. The objective is to harmonize, improve efficiency and consistency of supervisory practices within the European System of Financial Supervision (ESFS). The guide specifies the operation of the ESAs Information System, the modalities of information exchange between competent authorities, data to be collected, deadlines and confidentiality rules. It aims to facilitate rapid identification of authorities holding relevant information, reduce fraud risks and avoid unnecessary information requests. The scope covers holders of qualifying holdings, directors and key function holders, whether natural or legal persons. Limitations include that the system does not store qualitative evaluation results nor replace the obligation for each authority to conduct its own assessment. The guide does not modify legal deadlines for assessment procedures and respects data protection constraints (p. 5-7, 10-17).
1. Legal framework and scope:
- Based on Article 31a of the founding regulations (EBA, EIOPA, ESMA) which require the creation of an information exchange system for fitness and propriety assessment.
- Addressed to competent authorities defined in these regulations, covering financial institutions and financial market participants (p. 5-7, 10).
2. Description of the ESAs Information System:
- Intersectoral digital platform containing limited data on assessed persons (name, date and place of birth for natural persons; legal name, LEI, country of incorporation for legal entities).
- Does not store qualitative evaluation results nor final decisions.
- Data retained up to 15 years, with possibility of shorter periods according to applicable legislation.
- Authorities must enter data within two weeks following receipt of a notification or evaluation request.
- Also integrates ongoing, withdrawn or suspended assessments for a complete overview (p. 11-14).
3. Information exchange process:
- Before any assessment, the competent authority consults the system to identify other authorities that have assessed the same person.
- Information requests are made via the system, but actual data exchange occurs bilaterally outside the system, in accordance with confidentiality and data protection rules.
- Authorities must respond within two weeks or explain a longer delay.
- In case of impossibility to provide certain information for legal reasons, the authority must promptly inform the other party (p. 14-17).
4. Data protection and confidentiality:
- The system complies with the requirements of Regulation (EU) 2028/1725 and other European data protection standards.
- Access is limited to staff involved in assessments.
- Requests are logged and must be justified by a legitimate reason.
- Sensitive data are treated confidentially and according to professional secrecy rules (p. 3-4, 16).
5. Implementation and timetable:
- Entry into force scheduled for 17 February 2025.
- Certain provisions (notably concerning information exchanges) will apply from 15 May 2025 for natural persons and from 30 April 2026 for legal entities.
- Integration of historical data: 5 years for natural persons by May 2025, 2 years for legal entities by April 2026.
- Mandatory compliance notification by competent authorities before 22 April 2025 (p. 9, 17).
6. Cost-benefit analysis:
- Development cost estimated at about EUR 260,000, annual maintenance costs between EUR 40,000 and 45,000.
- Minimal charges for financial institutions, limited to supervision costs.
- The system improves transparency, efficiency and contributes to financial stability by strengthening supervision of key persons.
- Two options considered: a simple directory (rejected) vs. a system with shared database (retained) (p. 18-22).
7. Public consultation and feedback:
- Two public consultations conducted, few responses received.
- Main concerns: respect of national authorities’ sovereignty, data protection, absence of binding effect of prior assessments, respect of legal deadlines.
- The ESAs confirmed that the system does not replace national assessments, that exchanged data are limited and protected, and that legal deadlines are not modified (p. 23-28).
- Established facts:
- Article 31a of the founding regulations require creation of an information exchange system for fit and proper assessments.
- The ESAs Information System is an intersectoral database containing limited data on assessed persons, accessible only to competent authorities.
- Relevant information exchanges occur bilaterally outside the system.
- Authorities must respond to requests within two weeks.
- The system will be operational from February 2025 with progressive integration of historical data.
- Assumptions:
- Use of the system will improve efficiency and consistency of assessments.
- Data retention for 15 years is sufficient to cover relevant assessments.
- Absence of a centralized data exchange system (beyond identification) is sufficient for security and confidentiality.
- Interpretations:
- The system reduces risks of fraud and omission of information by assessed persons.
- It facilitates cooperation between national and sectoral authorities.
- The system does not replace authorities’ responsibility to conduct their own assessments.
- Uncertainties:
- The real impact on reducing assessment delays remains to be measured.
- Completeness of historical data will depend on availability and workload of authorities.
- Future evolution towards a centralized information exchange platform is not excluded but not currently planned (p. 3-7, 14-22).
- The ESAs conclude that the establishment of the information system and guidelines is necessary to comply with legal obligations and improve supervision of key persons in the financial sector.
- The system must be used by all competent authorities to quickly identify prior assessments and exchange relevant information.
- Authorities must integrate historical data within the set deadlines (5 years for natural persons, 2 years for legal entities).
- Information exchanges must strictly respect confidentiality and data protection rules.
- Authorities must notify their compliance to the ESAs before 22 April 2025.
- The system contributes to financial stability by strengthening governance of financial institutions.
- No additional action plan is indicated in the guide, but the ESAs plan to communicate complementary operational rules to competent authorities (p. 17-22, 28).
Synthesis note written from the full document by DataSAI Academy. This note comes from the scientific library of the DataSAI Academy, open to all.