Administrative sanctions and other administrative measures
1. Without prejudice to the supervisory powers referred to in Section 4 of Chapter 2 of Title IV of this Directive, including investigatory powers and powers of competent authorities to impose remedies, and the right of Member States to provide for and impose criminal sanctions, Member States shall lay down rules on administrative sanctions and other administrative measures and ensure that their competent authorities have the power to impose such sanctions and measures in respect of breaches of national provisions transposing this Directive and of Regulation (EU) 2019/2033, including where an investment firm:
(a)
fails to have in place internal governance arrangements as set out in Article 26;
(b)
fails to report information or provides incomplete or inaccurate information on compliance with the obligation to meet own funds requirements set out in Article 11 of Regulation (EU) 2019/2033 to the competent authorities, in breach of point (b) of Article 54(1) of that Regulation;
(c)
fails to report to the competent authorities, in breach of point (e) of Article 54(1) of Regulation (EU) 2019/2033, information about concentration risk or provides incomplete or inaccurate information;
(d)
incurs a concentration risk in excess of the limits set out in Article 37 of Regulation (EU) 2019/2033, without prejudice to Articles 38 and 39 of that Regulation;
(e)
repeatedly or persistently fails to hold liquid assets in breach of Article 43 of Regulation (EU) 2019/2033, without prejudice to Article 44 of that Regulation;
(f)
fails to disclose information, or provides incomplete or inaccurate information, in breach of the provisions set out in Part Six of Regulation (EU) 2019/2033;
(g)
makes payments to holders of instruments included in the own funds of the investment firm where Article 28, 52 or 63 of Regulation (EU) No 575/2013 prohibit such payments to holders of instruments included in own funds;
(h)
is found liable for a serious breach of national provisions adopted pursuant to Directive (EU) 2015/849 of the European Parliament and of the Council ( 25 ) ;
(i)
allows one or more persons that do not comply with Article 91 of Directive 2013/36/EU to become or remain a member of the management body.
Member States that do not lay down rules on administrative sanctions for breaches which are subject to national criminal law shall communicate to the Commission the relevant criminal law provisions.
The administrative sanctions and other administrative measures shall be effective, proportionate and dissuasive.
2. The administrative sanctions and other administrative measures referred to in the first subparagraph of paragraph 1 shall include the following:
(a)
a public statement which identifies the natural or legal person, investment firm, investment holding company or mixed financial holding company responsible and the nature of the breach;
(b)
an order requiring the natural or legal person responsible to cease the conduct and to desist from repeating that conduct;
(c)
a temporary ban for members of the investment firm’s management body or any other natural persons who are held responsible on exercising functions in investment firms;
(d)
in case of a legal person, administrative pecuniary sanctions of up to 10 % of the total annual net turnover, including the gross income consisting of interest receivable and similar income, income from shares and other variable or fixed‐yield securities, and commissions or fees of the undertaking in the preceding business year;
(e)
in the case of a legal person, administrative pecuniary sanctions of up to twice the amount of the profits gained or losses avoided due to the breach where those profits or losses can be determined;
(f)
in the case of a natural person, administrative pecuniary sanctions of up to EUR 5 000 000, or in the Member States whose currency is not the euro, the corresponding value in the national currency on 25 December 2019.
Where an undertaking referred to in point (d) of the first subparagraph is a subsidiary, the relevant gross income shall be the gross income resulting from the consolidated account of the ultimate parent undertaking in the preceding business year.
Member States shall ensure that where an investment firm is in breach of national provisions transposing this Directive or in breach of the provisions of Regulation (EU) 2019/2033, administrative sanctions may be applied by the competent authority to the members of the management body and to other natural persons who under national law are responsible for the breach.
3. Member States shall ensure that, when determining the type of administrative sanctions or other administrative measures referred to in paragraph 1 and the level of administrative pecuniary sanctions, competent authorities shall take into account all relevant circumstances, including, where appropriate:
(a)
the gravity and the duration of the breach;
(b)
the degree of responsibility of the natural or legal persons responsible for the breach;
(c)
the financial strength of the natural or legal persons responsible for the breach, including the total turnover of legal persons or the annual income of natural persons;
(d)
the importance of profits gained or losses avoided by the legal persons responsible for the breach;
(e)
any losses incurred by third parties as a result of the breach;
(f)
the level of cooperation with the relevant competent authorities;
(g)
previous breaches by the natural or legal persons responsible for the breach;
(h)
any potential systemic consequences of the breach.
Investigatory powers
Member States shall ensure that competent authorities have all information‐gathering and investigatory powers that are necessary for the exercise of their functions, including:
(a)
the power to require information from the following natural or legal persons:
(i)
investment firms established in the Member State concerned;
(ii)
investment holding companies established in the Member State concerned;
(iii)
mixed financial holding companies established in the Member State concerned;
(iv)
mixed‐activity holding companies established in the Member State concerned;
(v)
persons belonging to the entities referred to in points (i) to (iv);
(vi)
third parties to whom the entities referred to in points (i) to (iv) have outsourced operational functions or activities;
(b)
the power to conduct all necessary investigations of any person referred to in point (a) that is established or located in the Member State concerned, including the right:
(i)
to require the submission of documents by the persons referred to in point (a);
(ii)
to examine the books and records of the persons referred to in point (a) and to make copies or extracts from those books and records;
(iii)
to obtain written or oral explanations from the persons referred to in point (a) or from their representatives or staff;
(iv)
to interview any other relevant person for the purpose of collecting information on the subject matter of an investigation;
(c)
the power to conduct all necessary inspections at the business premises of the legal persons referred to in point (a) and any other undertakings included in the supervision of compliance with the group capital test, where the competent authority is the group supervisor, subject to the prior notification of other competent authorities concerned.
Publication of administrative sanctions and other administrative measures
1. Member States shall ensure that competent authorities publish on their official website without undue delay any administrative sanctions and other administrative measures imposed in accordance with Article 18 and which have not been appealed or can no longer be appealed. That publication shall include information on the type and nature of the breach and the identity of the natural or legal person on whom the sanction is imposed or against whom the measure is taken. The information shall only be published after that person has been informed of those sanctions or measures and to the extent that the publication is necessary and proportionate.
2. Where Member States permit the publication of administrative sanctions or other administrative measures imposed in accordance with Article 18 against which there has been an appeal, competent authorities shall also publish on their official website information on the appeal status and on the outcome of the appeal.
3. Competent authorities shall publish the administrative sanctions or other administrative measures imposed in accordance with Article 18 on an anonymous basis in any of the following circumstances:
(a)
the sanction or measure has been imposed on a natural person and publication of that person’s personal data is found to be disproportionate;
(b)
the publication would jeopardise an ongoing criminal investigation or the stability of financial markets;
(c)
the publication would cause disproportionate damage to the investment firms or natural persons involved.
4. Competent authorities shall ensure that information published pursuant to this Article remains on their official website for at least five years. Personal data may only be retained on the official website of the competent authority where permitted by the applicable data protection rules.
Reporting sanctions to EBA
Competent authorities shall inform EBA of administrative sanctions and other administrative measures imposed pursuant to Article 18, of any appeal against those sanctions and other administrative measures and of the outcome thereof. EBA shall maintain a central database of administrative sanctions and other administrative measures communicated to it solely for the purpose of exchanging information between competent authorities. That database shall be accessible only to competent authorities and ESMA and it shall be updated regularly, and at least annually.
EBA shall maintain a website with links to each competent authority’s publication of administrative sanctions and other administrative measures imposed in accordance with Article 18 and shall state the period for which each Member State publishes administrative sanctions and other administrative measures.
Reporting of breaches
1. Member States shall ensure that competent authorities establish effective and reliable mechanisms to enable prompt reporting of potential or actual breaches of national provisions transposing this Directive and of Regulation (EU) 2019/2033 to competent authorities.
Those mechanisms shall include the following:
(a)
specific procedures for the reception, treatment and following up of such reports, including the establishment of secure communication channels;
(b)
appropriate protection against retaliation, discrimination or other types of unfair treatment by the investment firm for employees of investment firms who report breaches committed within the investment firm;
(c)
protection of personal data concerning both the person who reports the breach and the natural person who is allegedly responsible for that breach, in accordance with Regulation (EU) 2016/679;
(d)
clear rules that ensure that confidentiality is guaranteed in all cases in relation to the person who reports the breaches committed within the investment firm, unless disclosure is required by national law in the context of further investigations or subsequent administrative or judicial proceedings.
2. Member States shall require investment firms to have in place appropriate procedures for their employees to report breaches internally through a specific independent channel. Those procedures may be provided for by the social partners provided that those procedures offer the same protection as the protection referred to in points (b), (c) and (d) of paragraph 1.
Right of appeal
Member States shall ensure that decisions and measures taken pursuant to Regulation (EU) 2019/2033 or pursuant to laws, regulations and administrative provisions adopted in accordance with this Directive are subject to a right of appeal.
