Any legal person that falls within the definition of CSD shall obtain an authorisation from the competent authority of the Member State where it is established before commencing its activities.

The authorisation shall specify the core services listed in Section A of the Annex and non-banking-type ancillary services permitted under Section B of the Annex, which the CSD is authorised to provide.

A CSD shall comply at all times with the conditions necessary for authorisation.

A CSD as well as its independent auditors, shall, without undue delay, inform the competent authority of any substantive changes affecting the compliance with the conditions for authorisation.