1.Without prejudice to the right of Member States to provide for and impose criminal sanctions, Member States shall lay down rules on and ensure that their competent authorities may impose the administrative sanctions and other measures applicable in the circumstances defined in Article 63 to the persons responsible for infringements of the provisions of this Regulation and shall take all measures necessary to ensure that they are implemented. Such sanctions and other measures shall be effective, proportionate and dissuasive.
Member States may decide not to lay down rules for administrative sanctions as referred to in the first subparagraph where the infringements referred to in that subparagraph are already subject to criminal sanctions in their national law by 18 September 2016. Where they so decide, Member States shall notify, in detail, to the Commission and to ESMA, the relevant parts of their criminal law.
By 18 September 2016, the Member States shall notify the rules referred to in the first subparagraph to the Commission and ESMA. Member States shall notify the Commission and ESMA without undue delay of any subsequent amendments thereto.
2.The competent authorities shall be able to apply administrative sanctions and other measures, to CSDs, designated credit institutions, and, subject to the conditions laid down in national law in areas not harmonised by this Regulation, the members of their management bodies and any other persons who effectively control their business as well as to any other legal or natural person who under national law is held responsible for an infringement.
3.In the exercise of their sanctioning powers in the circumstances defined in Article 63 competent authorities shall cooperate closely to ensure that the administrative sanctions and other measures produce the results pursued by this Regulation and coordinate their actions in order to avoid any duplication or overlap when applying administrative sanctions and other measures to cross border cases in accordance with Article 14.
4.Where Member States have chosen, in accordance with paragraph 1 to lay down criminal sanctions for the infringements of the provisions referred to in Article 63, they shall ensure that appropriate measures are in place so that competent authorities have all the necessary powers to liaise with judicial authorities within their jurisdiction to receive specific information related to criminal investigations or proceedings commenced for possible infringements of this Regulation and provide the same to other competent authorities and ESMA to fulfil their obligation to cooperate with each other and ESMA for the purposes of this Regulation.
5.Competent authorities may also cooperate with competent authorities of other Member States with respect to facilitating the recovery of pecuniary sanctions.
6.Member States shall provide ESMA annually with aggregated information regarding all sanctions and other measures imposed in accordance with paragraph 1. ESMA shall publish that information in an annual report.
Where Member States have chosen, in accordance with paragraph 1, to lay down criminal sanctions for the infringements of the provisions referred to in Article 63 their competent authorities shall provide ESMA annually with anonymised and aggregated data regarding all criminal investigations undertaken and criminal penalties imposed. ESMA shall publish data on criminal sanctions imposed in an annual report.
7.Where the competent authority has disclosed an administrative sanction or an administrative measure or a criminal sanction to the public, it shall, at the same time, report that fact to ESMA.
8.Competent authorities shall exercise their functions and powers in accordance with their national frameworks:
(a)directly;
(b)in collaboration with other authorities;
(c)under their responsibility by delegation to entities to which tasks have been delegated according to this Regulation; or
(d)by application to the competent judicial authorities.
1.Member States shall ensure that the competent authorities publish on their official websites any decision imposing an administrative sanction or other measure for an infringement of this Regulation without undue delay after the person sanctioned is informed of that decision. The publication shall include at least information on the type and nature of the infringement and the identity of a natural or legal person on whom the sanction has been imposed.
Where the decision to impose a sanction or other measure is subject to an appeal before the relevant judicial or other relevant authorities, competent authorities shall, without undue delay, also publish on their official websites information on the appeal status and outcome thereof. Moreover, any decision annulling a previous decision to impose a sanction or a measure shall also be published.
Where the publication of the identity of the legal persons or of the personal data of the natural persons is considered by the competent authority to be disproportionate following a case-by-case assessment conducted on the proportionality of the publication of such data, or where publication jeopardises the stability of financial markets or an ongoing investigation, Member States shall ensure that competent authorities do one of the following:
(a)delay the publication of the decision to impose the sanction or other measure until the moment when the reasons for non-publication cease to exist;
(b)publish the decision to impose the sanction or other measure on an anonymous basis in a manner which is in conformity with national law, if such anonymous publication ensures effective protection of the personal data;
(c)not publish the decision to impose a sanction or other measure at all in the event that the options set out in points (a) and (b) above are considered to be insufficient to ensure:
that the stability of financial markets would not be put in jeopardy;
the proportionality of the publication of such decisions with regard to measures which are deemed to be of a minor nature.
In the case of a decision to publish a sanction or other measure on an anonymous basis, the publication of the relevant data may be postponed for a reasonable period if it is envisaged that within that period the reasons for anonymous publication will cease to exist.
Competent authorities shall inform ESMA of all administrative sanctions imposed but not published in accordance with point (c) of the third subparagraph including any appeal in relation thereto and the outcome thereof. Member States shall ensure that competent authorities receive information and the final judgement in relation to any criminal sanction imposed and submit it to ESMA. ESMA shall maintain a central database of sanctions communicated to it solely for the purposes of exchanging information between competent authorities. That database shall be accessible only to competent authorities and it shall be updated on the basis of the information provided by the competent authorities.
2.Competent authorities shall ensure that any publication, in accordance with this Article, shall remain on their official website for a period of at least five years after its publication. Personal data contained in the publication shall be kept on the official website of the competent authority only for the period necessary under the applicable data protection rules.
1.This Article shall apply to the following provisions of this Regulation:
(a)provision of services set out in Sections A, B and C of the Annex in infringement of Articles 16, 25 and 54;
(b)obtaining the authorisations required under Articles 16 and 54 by making false statements or by any other unlawful means as provided for in point (b) of Article 20(1) and point (b) of Article 57(1);
(c)failure of CSDs to hold the required capital, thus infringing Article 47(1);
(d)failure of CSDs to comply with the organisational requirements, thus infringing Articles 26 to 30;
(e)failure of CSDs to comply with the conduct of business rules, thus infringing Articles 32 to 35;
(f)failure of CSDs to comply with the requirements for CSD services, thus infringing Articles 37 to 41;
(g)failure of CSDs to comply with the prudential requirements, thus infringing Articles 43 to 47;
(h)failure of CSDs to comply with the requirements for CSD links, thus infringing Article 48;
(i)abusive refusals by CSDs to grant different types of access, thus infringing Articles 49 to 53;
(j)failure of designated credit institutions to comply with the specific prudential requirements related to credit risks, thus infringing Article 59(3);
(k)failure of designated credit institutions to comply with specific prudential requirements related to liquidity risks, thus infringing Article 59(4).
2.Without prejudice to the supervisory powers of competent authorities, at least in the event of an infringement referred to in this Article, the competent authorities shall, in conformity with national law, have the power to impose at least the following administrative sanctions and other measures:
(a)a public statement which indicates the person responsible for the infringement and the nature of the infringement in accordance with Article 62;
(b)an order requiring the person responsible for the infringement to cease the conduct and to desist from a repetition of that conduct;
(c)withdrawal of the authorisations granted under Article 16 or 54, in accordance with Article 20 or 57;
(d)a temporary or, for repeated serious infringements, a permanent ban against any member of the institution’s management body or any other natural person, who is held responsible, from exercising management functions in the institution;
(e)maximum administrative pecuniary sanctions of at least twice the amounts of the profit gained as a result of an infringement where those amounts can be determined;
(f)in respect of a natural person, maximum administrative pecuniary sanctions of at least EUR 5 million or in the Member States whose currency is not the euro, the corresponding value in the national currency on the date of adoption of this Regulation;
(g)in the case of a legal person, maximum administrative pecuniary sanctions of at least EUR 20 million or up to 10 % of the total annual turnover of the legal person according to the last available accounts approved by the management body; where the legal person is a parent undertaking or a subsidiary of the parent undertaking which has to prepare consolidated financial accounts according to Directive 2013/34/EU, the relevant total annual turnover shall be the total annual turnover or the corresponding type of income according to the relevant Accounting Directives according to the last available consolidated accounts approved by the management body of the ultimate parent undertaking.
3.Competent authorities may have other sanctioning powers in addition to those referred in paragraph 2 and may provide for higher levels of administrative pecuniary sanctions than those established in that paragraph.
Member States shall ensure that, when determining the type and level of administrative sanctions or other measures, the competent authorities take into account all relevant circumstances, including, where appropriate:
the gravity and the duration of the infringement;
the degree of responsibility of the person responsible for the infringement;
the financial strength of the person responsible for the infringement, for example as indicated by the total turnover of the responsible legal person or the annual income of the responsible natural person;
the importance of the profits gained, losses avoided by the person responsible for the infringement or the losses for third parties derived from the infringement, insofar as they can be determined;
the level of cooperation of the person responsible for the infringement with the competent authority, without prejudice to the need to ensure disgorgement of profits gained or losses avoided by that person;
previous infringements by the person responsible for the infringement.
1.Member States shall ensure that competent authorities establish effective mechanisms to encourage reporting of potential or actual infringements of this Regulation to competent authorities.
2.The mechanisms referred to in paragraph 1 shall include at least:
(a)specific procedures for the receipt and investigation of reports on potential or actual infringements and their follow-up, including the establishment of secure communication channels for such reports;
(b)appropriate protection for employees of institutions who report potential or actual infringements committed within the institution against retaliation, discrimination or other types of unfair treatment at a minimum;
(c)protection of personal data concerning both the person who reports the potential or actual infringements and the natural person who is allegedly responsible for an infringement in compliance with the principles laid down in Directive 95/46/EC;
(d)protection of the identity of both the person who reports the infringements and the natural person who is allegedly responsible for an infringement, at all stages of the procedures unless such disclosure is required by national law in the context of further investigation or subsequent administrative or judicial proceedings.
3.Member States shall require institutions to have in place appropriate procedures for their employees to report actual or potential infringements internally through a specific, independent and autonomous channel.
Such a channel may also be provided through arrangements provided for by social partners. The same protection as is referred to in points (b), (c) and (d) of paragraph 2 shall apply.
Member States shall ensure that decisions and measures taken in pursuance of this Regulation are properly reasoned and subject to a right of appeal before a tribunal. The right of appeal before a tribunal shall apply where no decision is taken, within six months of its submission, in respect of an application for authorisation which contains all the information required under the provisions in force.