Authorisation procedures
ANNEX IISupplementary provisions
ANNEX II Authorisation procedures 1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING The ECB, in cooperation with the NCAs, conducts assessments in the context of authorisation procedures comprising the acquisition of qualifying holdings, the granting and withdrawal of authorisation to take up the business of a credit institution, supervised entities’ right of establishment and freedom to provide services, approvals or exemptions from approval of (mixed) financial holding companies comprising significant supervised entities, or significant supervised groups, as well as mergers and divisions that are notified. In the context of each of the respective authorisation procedures, personal data are processed for the following purposes: (a) authorisation to take up the business of a credit institution: to assess whether an applicant for an authorisation fulfils the relevant requirements of national and Union law, which may include the assessment of the structural organisation, fit and proper assessments of members of the management body and key function holders, as well as the analysis of the suitability of the applicant’s shareholders or members; (b) qualifying holdings: to ascertain the financial soundness of the proposed acquisition and the suitability of the proposed acquirer; (c) withdrawals of authorisation to take up the business of a credit institution: to assess whether a supervised entity meets the conditions for withdrawal of an authorisation under national and Union law; (d) supervised entities’ right of establishment and freedom to provide services: to assess whether the establishment of a branch or the provision of services by significant supervised entities and less significant supervised entities, the establishment of a branch in a participating Member State by a credit institution established in non-participating Member State, the provision of services outside the participating Member States by a significant or a less significant supervised entity, the provision of services in a participating Member State by a credit institution established in a non-participating Member State, and changes in branch particulars or changes in the provision of services by significant supervised entities or less significant supervised entities comply with the relevant requirements of national and Union law; (e) approvals or exemptions from approval of (mixed) financial holding companies: to assess whether the criteria set out in the relevant national and Union law for granting an approval or exemption from approval of a (mixed) financial holding company are met, including the assessment of the internal arrangements and structural organisation of the group of which the (mixed) financial holding company is part, as well as the internal distribution of tasks within the that group, and the suitability of the members of the management body and of the shareholders (or members) of the (mixed) financial holding company. (f) mergers and divisions carried out by institutions and by (mixed) financial holding companies: to assess whether the criteria set out in the relevant national and Union law for the approval of mergers and divisions are met, including the assessment of the reputation and financial soundness of the financial stakeholders involved and whether the entity resulting from the proposed operation will be able to comply and continue to comply with the prudential requirements. 2. LEGAL BASIS (a) Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 4(1), points (a), (b), (c) and (g), Articles 4(2) and 6(4), Articles 14 and 15, and Article 17(1) of Regulation (EU) No 1024/2013; (b) Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Articles 8, 11 to 17 and Part V, Titles 1, 2 and 3 of Regulation (EU) No 468/2014 (ECB/2014/17); (c) Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Articles 8, 8a, 10 to 14, 18, 21a, 22, 23, 27i, 27j, 33, 34, 35 and 39 of Directive 2013/36/EU, as transposed into national law. 3. DATA SUBJECTS Personal data relating to the following categories of data subjects may be processed. 3.1. Authorisation to take up the business of a credit institution: (a) staff of the applicant; (b) members of the management body, key function holders, and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the applicant or other entities linked to the applicant; (c) persons with whom the applicant or members of the management body, key function holders, and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the applicant has or have relevant financial or non-financial relationships; (d) authorised representatives of the applicant in the authorisation procedure. 3.2. Qualifying holdings: (a) staff of the supervised entity subject to the procedure; members of the management body and shareholders of the supervised entity subject to the procedure or other relevant entities; (b) persons effectively directing the business of the acquirer and members of the management body who will direct the business of the supervised entity subject to the procedure as a result of the proposed acquisition of the qualifying holding, as well as persons with whom they have relevant financial or non-financial relationships; (c) the acquirer of a qualifying holding, as well as persons with whom they have relevant financial or non-financial relationships; (d) staff and authorised representatives of the acquirer. 3.3. Withdrawals of authorisation to take up the business of a credit institution: (a) members of the management body, key function holders, and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the supervised entity subject to the procedure; (b) persons with whom members of the management body, and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the supervised entity subject to the procedure has or have relevant financial or non-financial relationships; (c) staff and authorised representatives of the supervised entity subject to the procedure. 3.4. Supervised entities’ right of establishment and freedom to provide services: (a) staff of the supervised entity subject to the procedure; (b) members of the management body and shareholders of the supervised entity subject to the procedure; (c) authorised representatives of the supervised entity subject to the procedure. 3.5. Approvals or exemptions from approval of (mixed) financial holding companies: (a) staff of the (mixed) financial holding company subject to the procedure and of the supervised entity which is a subsidiary of the (mixed) financial holding company subject to the procedure; (b) members of the management body and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the supervised entity which is a subsidiary of the (mixed) financial holding company subject to the procedure, as well as persons with whom they have relevant financial or non-financial relationships; (c) members of the management body and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the (mixed) financial holding company subject to the procedure, as well as persons with whom they have relevant financial or non-financial relationships; (d) authorised representatives of the (mixed) financial holding company subject to the procedure. 3.6. Mergers and divisions carried out by institutions and by (mixed) financial holding companies: (a) staff of the supervised entity subject to the procedure; (b) members of the management body, key function holders, and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the supervised entity or other entities linked to the supervised entity subject to the procedure; (c) members of the management body who will direct the business of the supervised entity resulting from the proposed operation, as well as persons with whom they have relevant financial or non-financial relationships; (d) authorised representatives of the supervised entity subject to the procedure. 4. CATEGORIES OF PERSONAL DATA PROCESSED The following categories of personal data may be processed: (a) identification data, such as name, ID card/passport number, nationality and signature; (b) contact data, such as postal address, email address and phone number; (c) professional data relating to education, training, employment and other positions held; (d) professional data relating to any other business activities; (e) details of criminal records and information on criminal investigations and proceedings, relevant civil and administrative proceedings and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures; (f) financial details; (g) description of relevant financial and non-financial interests or relationships; (h) information on any refusal of registration, authorisation, membership of a trade, business or profession or licence to carry out a trade, business or profession; the withdrawal, revocation or termination of such registration, authorisation, membership or licence; or expulsion by a regulatory or government body or by a professional body or association; (i) information as to whether an assessment of reputation has already been conducted by another competent authority and information about the outcome of this assessment; (j) comments by the ECB or NCA staff regarding the performance of the relevant person in their current or any previous role that may have an impact on the relevant assessment; (k) sound recording of the relevant person’s voice.