COMMISSION DELEGATED REGULATION (EU) 2022/2118

of 13 July 2022

supplementing Regulation (EU) 2020/1503 of the European Parliament and of the Council with regard to regulatory technical standards on individual portfolio management of loans by crowdfunding service providers, specifying the elements of the method to assess credit risk, the information on each individual portfolio to be disclosed to investors, and the policies and procedures required in relation to contingency funds

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2020/1503 of the European Parliament and of the Council of 7 October 2020 on European crowdfunding service providers for business, and amending Regulation (EU) 2017/1129 and Directive (EU) 2019/1937, (1) and in particular Article 6(7), thereof,

Whereas:

(1) When investing in a portfolio of loans offered by a crowdfunding service provider, investors do not select the projects in which they will invest their funds, but rather select a number of parameters and risk indicators and leave to the crowdfunding service provider the task of allocating the funds accordingly. Therefore, the crowdfunding service provider should disclose appropriate levels of information to prospective and current investors, allowing those investors to have sufficient knowledge about the returns and risks of the projects and make informed decisions.

(2) In order to reduce the information asymmetry between crowdfunding service providers and investors, investors should be provided with all the relevant information about the composition of the portfolio, including the projects where their funds are invested, as well as the quality of the loans financing those projects. That should allow investors to better understand and compare the performance and riskiness of different portfolios, either offered on the same platform or on alternative platforms.

(3) Investors are exposed not only to risks connected to the projects or the loans in which their funds are invested, but also to the way the crowdfunding service provider assesses the risk of those loans and projects and how that provider manages the selection of loans for the portfolio. In that respect, performing stress tests on the portfolio and sensitivity analysis on the single loan and the single project owner can be particularly effective in providing a thorough and complete assessment of the investments. It is hence appropriate that, when the crowdfunding service provider performs such stress tests, the results of those analyses are disclosed to investors.

(4) In order to ensure effective transparency, the information about the elements to be included by the crowdfunding service provider in the method employed to perform credit risk assessments should be disclosed appropriately. That will allow investors to understand whether an adequate and prudential approach is taken by crowdfunding service providers in the process of assessing the sustainability of projects being financed, the affordability of the loans for the project owners, and the composition of the individual loans in a structured portfolio.

(5) A crowdfunding service provider may rely on a dedicated contingency fund to compensate investors for the losses those investors may incur in the event that project owners do not repay their loans. Investors will need to be made aware that the mere existence of such contingency fund does not provide a guarantee that the investment can be considered risk-free and that they will be reimbursed in the event that the loan they have financed is in default, as there is absolute discretion on the part of the crowdfunding service provider to decide on any payments. In order to ensure adequate investor protection, it is important that crowdfunding service providers have in place appropriate policies and governance arrangements when managing, either directly or through a third-party provider, contingency funds.

(6) This Regulation is based on the draft regulatory technical standards developed by the EBA in close cooperation with ESMA and submitted to the Commission.

(7) The EBA has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the advice of the Banking Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1093/2010 of the European Parliament and of the Council (2).

(8) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (3) and delivered an opinion on 1 June 2022,

HAS ADOPTED THIS REGULATION:

CHAPTER I

General provisions

Article 1

Accuracy and reliability of information to be provided to investors

1. Crowdfunding service providers shall ensure that the information provided to investors pursuant to Article 6(2) and (4) of Regulation (EU) 2020/1503 is accurate, reliable and kept regularly updated.

2. For the purposes of paragraph 1, crowdfunding service providers shall ensure that:

(a) the data used to conduct the assessments of creditworthiness referred to in Chapter II of this Regulation are consistent, complete and appropriate;

(b) the measurement techniques are appropriate to the complexity and level of the risks underlying the single crowdfunding projects and/or the portfolios, are based on reliable data, and are subject to periodic validation; and

Article 2

Format of the information to be disclosed

1. For the purposes of Chapter II, the information provided to investors shall be easily available in a dedicated section of the crowdfunding service provider’s website that is clearly distinguishable from marketing communications.

2. For the purposes of Chapter III, the information provided to individual investors on their portfolio of loans shall be made available on a secure page of the crowdfunding service provider’s website that shall be accessible via an adequate means of personal identification.

3. The information referred to in paragraphs 1 and 2 shall be presented in a way that is easy to read and expressed in a manner and using language that facilitates its understanding. Where ordinary words can be used, technical terms shall be avoided and, when used, they shall be explained.

CHAPTER II

Elements, including the format, to be included in the description of the method to assess credit risk

Article 3

Credit risk of individual crowdfunding projects

The description provided to investors of the method to assess the credit risk of individual crowdfunding projects within a portfolio as referred to in Article 6(2), point (a) of Regulation (EU) 2020/1503, shall contain all of the following elements:

(a) the criteria and the key financial indicators used to establish the feasibility and sustainability of the business plans of the individual crowdfunding projects;

(b) an analysis of the expected cash flows of the crowdfunding projects and an assessment of how certain those expected cash flows are over different time horizons;

(c) an analysis of the characteristics, including the degree of competition, of the business sector in which the project owners operate;

(d) an assessment of the project owners’ knowledge, experience, reputation and capacity to manage business activities in the project’s specific sector;

(e) the procedures regarding the acceptance and recognition of collateral or guarantee and credit risk mitigation measures, where relevant;

(f) the type of the repayment schedule for the loan and the frequency of instalments;

(g) the procedures to assign each loan associated with a project to an appropriate risk category as defined by the risk management framework;

(h) the source and type of data used for the purposes of points (a) to (g).

Article 4

Credit risk at the investor’s portfolio level

1. The description provided to investors of the method to assess credit risk at the investor’s portfolio level as referred to in Article 6(2), point (b) of Regulation (EU) 2020/1503, shall contain an explanation of how, in the process of composing a portfolio, the following elements are taken into account:

(a) the distribution of loans in accordance with their maturity within the same portfolio;

(b) the interest rate for each loan of the same portfolio;

(c) the share of loans in a single portfolio granted to the same project owner or to a group of connected project owners;

(d) the share of loans in a single portfolio granted to project owners established or operating in the same jurisdiction or geographical area;

(e) the share of loans in a single portfolio granted to project owners operating in the same business sector;

(f) the share of loans assigned to the same risk category;

(g) the method used to evaluate the correlation of risks within the same portfolio.

2. For the purposes of paragraph 1, point (c), a group of connected project owners shall mean any of the following:

(a) two or more natural or legal persons who constitute a single risk because one of them, directly or indirectly, has control over the other or others;

(b) two or more natural or legal persons are to be regarded as constituting a single risk because they are so interconnected that, if one of them were to experience financial problems, the other or all of the others would also be likely to encounter funding or repayment difficulties.

3. A crowdfunding service provider that advertises a specific target rate of return on investment for a portfolio shall disclose the procedure employed to select the individual loans to be included in the portfolio.

Article 5

Credit risk of project owners

The description provided to investors of the method used to assess the credit risk of project owners as referred to in Article 6(2), point (c) of Regulation (EU) 2020/1503, shall contain all of the following elements:

(a) the procedures for the credit approval and monitoring processes;

(b) the procedures to determine the project owner’s credit scoring, where applicable;

(d) the procedures regarding the acceptance and recognition of collateral or guarantee and credit risk mitigation measures, where relevant;

(e) the procedures and data used to assess the financial history of the project owner and the procedures to be followed in the event that the project owner fails or refuses to provide the required information.

Article 6

Use of models

1. For the purposes of Article 6(2), third subparagraph, of Regulation (EU) 2020/1503, crowdfunding service providers shall provide adequate information on the models included in the method used for the credit risk assessment of crowdfunding projects, for the assessment of the creditworthiness of project owners, for the credit approval and monitoring processes, and for the composition of portfolios, including all of the following:

(a) the source of the data used as input for the models;

(b) the framework employed to ensure the quality of the input data;

(d) the framework to ensure that the quality of the model output is regularly assessed and validated, and where appropriate, reviewed.

2. When automated models are used as part of the method for the credit risk assessment of crowdfunding projects, in the creditworthiness assessment of project owners, in the credit approval and monitoring processes, or in the composition of portfolios, crowdfunding service providers shall disclose all of the following:

(a) how the use of automated models is appropriate to the size, nature and complexity of the types of crowdfunding project selected for the investor’s portfolio;

(b) the conditions for the application of automated decision-making in the credit-approval and monitoring processes, including identifying loans, segments and limits for which automated decision-making is allowed.

Article 7

Information on stress testing and sensitivity analysis

Crowdfunding service providers that conduct stress test and sensitivity analysis exercises shall provide investors with information on all of the following:

(a) at the level of the single loan and single project owner, any sensitivity analyses conducted to reflect potentially negative future market and idiosyncratic events that are relevant to the type and purpose of the loan;

(b) at the level of the portfolio, the procedures and information systems for stress testing that are conducted to assess the resilience of the portfolio through the economic cycle and in different scenarios.

CHAPTER III

Information to be provided on each individual portfolio

Article 8

Calculation of the weighted average annual interest rate

1. For the calculation of the weighted average annual interest rate on loans in a portfolio as referred to in Article 6(4), point (b), of Regulation (EU) 2020/1503, crowdfunding service providers shall calculate the average, weighted for the outstanding amount of loans in a portfolio, of the annual interest rate of every loan of which the portfolio is composed.

2. In order to calculate the weighted average annual interest rate referred to in paragraph 1, crowdfunding service providers shall ensure all of the following:

(a) that the denominator consists of the sum of the notional amount of every loan included in the portfolio;

(b) that the numerator consists of the sum of the products of:

(i) the notional amount of every loan;

(ii) the annual interest rate of every loan included in the portfolio.

3. For the purposes of paragraph 2, point (b)(ii), the annual interest rate shall correspond to any of the following:

(a) in the case of a fixed interest rate, the annual interest rate as laid down in the loan contract;

(b) in the case of a variable interest rate, the interest rate in force at the time of the publication of the weighted average annual interest rate, taking into account any upper limit as laid down in the loan contract;

(c) in cases in which the loan is split into tranches earning different interest rates, the weighted average of the interest rates as laid down in the loan contract.

Article 9

Distribution of loans according to risk category

1. For the calculation of the distribution of loans according to risk category, in absolute numbers and as a percentage, as referred to in Article 6(4), point (c), of Regulation (EU) 2020/1503, crowdfunding service providers shall ensure that each individual loan is assigned to the relevant risk category set out in the risk management framework on the basis of sound and well-defined criteria, as referred to in Article 4(4), point (f), of Regulation (EU) 2020/1503, and as specified in accordance with Article 19(7), point (d) of that Regulation.

2. For the purposes of paragraph 1, and for each risk category, the following definitions shall apply:

(a) the distribution of loans according to risk category in absolute numbers shall refer to the sum of the notional amount of every loan in the same risk category;

(b) the distribution of loans according to risk category as a percentage shall refer to the ratio between:

(i) the sum of the notional amount of every loan in the same risk category;

(ii) the total notional amount of all loans within the portfolio.

3. For the disclosure of information to investors, crowdfunding service providers shall establish and maintain clear and effective policies and procedures for the specification of the risk categories.

Article 10

Key information for every loan included in the portfolio

1. The key information for every loan of which a portfolio is composed referred to in Article 6(4), point (d) of Regulation (EU) 2020/1503 shall contain all of the following:

(a) the amount of the loan, including the most recent outstanding balance;

(b) the currency in which the loan is granted;

(c) the entity responsible for the servicing of the loan, including its legal name, registration number and place of registration, registered office and contact details, and its servicing policy;

(d) the identity of the project owner, including indicating its legal name, the country of incorporation and registration number, the address of its registered office and its corporate website;

(e) the ownership structure of the project owner;

(f) the purpose of the loan, by adding a brief description of the crowdfunding project;

(g) the interest rate or any other compensation laid down in the loan, for each year until maturity, and where the interest rate or any other compensation is not directly available, the calculation method;

(h) the maturity date of the loan;

(i) the relevant risk category to which the loan is assigned in accordance with the risk management framework referred to in Article 4(4), point (f) of Regulation (EU) 2020/1503;

(j) the schedule for the repayment of the principal and for the payment of interest on the loan;

(k) the compliance of the project owner with the instalment payment schedule of the loan by indicating any past due payment or any default as referred to in Article 1(1) of Commission Delegated Regulation (EU) 2022/2115 (4);

(l) the percentage of the amount of the crowdfunding project being financed by the investor through the loan, expressed as the ratio between:

(i) the notional amount of the loan;

(ii) the total amount of the crowdfunding project.

2. The information provided for each loan included in a portfolio shall report whether a project owner has more than one crowdfunding project in place financed through any crowdfunding service provider, and contain all of the following information:

(a) the type of offer and the instrument used for financing the project;

(b) the completion date (past or expected);

(d) other relevant information, including all other financial obligations and contingent liabilities.

3. The crowdfunding service provider shall require the project owner to provide the information referred to in paragraph 2.

4. Crowdfunding service providers shall take appropriate steps to ensure that the information provided by project owners in accordance with paragraph 3 is accurate, reliable and up to date.

Article 11

Information about risk mitigation measures

1. For the purposes of Article 6(4), point (e), of Regulation (EU) 2020/1503, a ‘risk mitigation measure’ shall mean a technique used by a project owner to reduce the credit risk associated with a loan, which can take either of the following forms:

(a) ‘funded credit protection’, which means a technique of risk mitigation where the reduction of the credit risk associated with a loan derives from the right of the investor, in the event of the default of the loan or on the occurrence of other specified credit events relating to the project or project owner, to liquidate or obtain transfer or appropriation of, or to retain, certain assets or amounts, or to reduce the amount of the loan;

(b) ‘unfunded credit protection’, which means a technique of risk mitigation where the reduction of the credit risk associated with a loan derives from the obligation of a third party to pay an amount in the event of the default of the loan or on the occurrence of other specified credit events relating to the project or project owner.

2. In the event that a loan is guaranteed by ‘funded credit protection’ as referred to in paragraph 1, the crowdfunding service provider shall provide all of the following information:

(a) the type of asset(s);

(b) the most recent valuation of such asset(s) and the amount(s) that can be liquidated, transferred, retained or appropriated;

(d) the ratio between the amount referred to in for in point (b) and the total notional amount of the loan, expressed as a percentage.

3. In the event that a loan is guaranteed by ‘unfunded credit protection’ as referred to in paragraph 2, the crowdfunding service provider shall provide, as a minimum, the following information:

(a) the name, address and legal nature of the third party acting as protection provider or guarantor;

(b) the ratio between:

(i) the notional amount of the loan covered by the third party;

(ii) the total notional amount of the loan, expressed as a percentage.

4. For the purposes of paragraphs 2 and 3, crowdfunding service providers shall ensure all of the following:

(a) that the eligibility and the valuation of any risk mitigation measure are assessed in accordance with adequate policies and procedures within the risk management framework, as referred to in Article 4(4), point (f) of Regulation (EU) 2020/1503 and as specified in accordance with Article 19(7), point (d) of that Regulation;

(b) that the valuation of any risk mitigation measure takes into account all the disposition costs arising from obtaining and selling collateral.

Article 12

Information on defaults on credit agreements by the project owner

1. In order to comply with Article 6(4), point (f), of Regulation (EU) 2020/1503, crowdfunding service providers shall require project owners to provide information on defaults that have occurred under credit agreements in the past five years.

2. When ‘credit agreement’ refers to an agreement whereby an investor grants to a project owner credit in the form of a loan for a specific crowdfunding project, the following definitions shall apply:

(a) ‘default’ means ‘default’ as defined in Article 1(1) of Delegated Regulation (EU) 2022/2115;

(b) a ‘credit agreement’ means an agreement whereby an investor grants to a project owner credit in the form of a loan for a specific crowdfunding project.

3. The information on defaults referred to in paragraph 1 shall be provided by the project owner to the crowdfunding service provider at all of the instances:

(a) at the point of loan origination;

(b) immediately after the occurrence of a default event;

4. Crowdfunding service providers shall take appropriate steps to ensure that the information provided by project owners in accordance with paragraphs 2 and 3 is accurate, reliable and up to date.

5. When ‘credit agreement’ means any financial instrument as defined in Article 4(1), point (50), of Regulation (EU) No 575/2013 of the European Parliament and of the Council (5) and information on past defaults are not available, crowdfunding service providers shall require project owners to provide all of the following information over the past five years:

(a) past due days;

(b) amount of arrears.

6. Crowdfunding service providers shall disclose to investors whether the source of information referred to in paragraphs 2 and 5 is included in one or more of the following and specify which:

(a) a sworn statement by the project owner;

(b) information available in credit registers;

(d) other type of information.

7. Crowdfunding service providers shall take appropriate steps to ensure all of the following:

(a) that the information provided by project owners in accordance with paragraph 5 is accurate, reliable and up to date;

(b) that the disclosure to investors of the information referred to in paragraph 5 is in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (6).

Article 13

Information on fees paid in respect of the loan by the investor, the crowdfunding service provider or the project owner

The information about the fees paid in respect of loans as referred to in Article 6(4), point (g) of Regulation (EU) 2020/1503 shall contain all of the following:

(a) the natural or legal person paying the fees, including whether that person subject is the investor, the crowdfunding service provider, the project owner, or a third party;

(b) the monetary amount of the fees;

(c) the natural or legal person receiving the fees, including whether that person is the crowdfunding service provider or, in the event of operational functions being outsourced, a third party;

(d) any services remunerated by fees, including subscription fees, management fees, fees for debt collection processes and exit fees;

(e) the calculation method for the fees, including whether the amount of the fees represents a percentage of the notional amount of the loan or any other variable, or a fixed amount;

(f) the schedule of payment of the fees.

Article 14

Information on the valuation of the loan

1. The valuation of the loan referred to in Article 6(4), point (h) shall, for each individual loan, reflect the likely actual return, defined as the discounted annual return on the investment expected by the investor on a given valuation date, based on the most recent available information.

2. For the purposes of paragraph 1, the calculation of the likely actual return shall be based on all of the following information:

(a) the interest rate or any other compensation laid down in the loan;

(b) the yield to maturity;

(d) the expected default rates, determined in accordance with Article 4(1) of Delegated Regulation (EU) 2022/2115;

(e) any other costs paid by the project owner or the investor or the crowdfunding service provider in relation to the loan.

3. The valuation of the loan as referred to in Article 6(4), point (h) of Regulation (EU) 2020/1503 shall include the valuation of the portfolio in which the loan is included, expressed as the ratio between the following:

(a) numerator obtained by the sum of the products of:

(i) the notional amount of each loan in the portfolio;

(ii) the respective likely actual return of every loan of which the portfolio is composed;

(b) denominator obtained by the sum of the notional amount of every loan of which the portfolio is composed.

CHAPTER IV

Policies, procedures and organisational arrangements required with regard to contingency funds

Article 15

General requirements

1. Crowdfunding service providers that have established and operate a contingency fund for their activities relating to the individual portfolio management of loans shall have in place adequate policies and procedures and organisational arrangements to ensure that the contingency fund is managed prudently and can fulfil its objectives.

2. For the purposes of paragraph 1, the policies, procedures and organisational arrangements relating to the contingency fund shall be approved by the management body of the crowdfunding service provider and shall be in written form, updated, and well documented.

Article 16

Organisational arrangements

1. Crowdfunding service providers shall ensure a robust and transparent organisational and operational structure for any contingency fund they may have in place and shall have a written description of it.

2. The management body of crowdfunding service providers shall oversee the implementation of the governance and organisational arrangements of the contingency fund.

3. For the purposes of paragraph 2, all the members of the management body of crowdfunding service providers shall:

(a) have full knowledge of the legal, organisational and operational structure of the contingency fund and ensure that that structure is in line with its approved purposes;

(b) be fully aware of the structure, responsibilities and the division of tasks within the contingency fund.

4. The organisational structure of the fund shall not impede the ability of the management body to identify, oversee and manage effectively the risks that the fund will face as a result of its operations.

Article 17

Governance policy

1. Crowdfunding service providers shall have in place a governance policy to govern the contingency fund. That policy shall ensure that internal governance arrangements, processes and mechanisms are consistent, well integrated and adequate to ensure the well-functioning of the contingency fund.

2. The governance policy referred to in paragraph 1 shall contain all of the following elements and information:

(a) the purpose of the contingency fund;

(b) the legal and operational structure of the contingency fund, including whether it is operated by the crowdfunding service provider itself or by a third party;

3. In the event that the contingency fund is operated by a third party, the governance policy referred to in paragraph 1 shall also contain all of the following:

(a) the composition of the management body of the contingency fund;

(b) the responsibilities and duties of the management body of the contingency fund;

(d) the frequency of the meetings of the management body of the contingency fund;

(e) the reporting requirements between the management body of the contingency fund and the management body of the crowdfunding service provider;

(f) the responsibilities for the documentation, management and control of the outsourcing arrangements;

(g) the identification of one or more senior staff members who are directly accountable to the management body of the crowdfunding service provider and responsible for managing and overseeing the risks of outsourcing arrangements, including the respective documentation.

Article 18

Funding policy

1. The crowdfunding service provider shall have in place a funding policy to determine how the contingency fund is financed and how the proceeds collected are managed.

2. For the purpose of paragraph 1, the funding policy referred to in paragraph 1 shall contain all of the following elements and information:

(a) any initial contribution made by the crowdfunding service provider into the contingency fund;

(b) the type of fees that are collected for accruing the contingency fund;

(d) the criteria the contingency fund management takes into account when deciding the amount of fees to be levied for each loan;

(e) the decision-making process to determine the amount and nature of fees to be levied;

(f) the investment strategy adopted by the contingency fund for investing the funds under management;

(g) the legal ownership of the funds;

(h) how the funds will be dissolved in the event of the maturity of the contingency fund;

(i) how the funds are segregated from other assets owned by the crowdfunding service provider;

(j) how the money paid into the contingency fund will be treated in the event of the insolvency of the contingency fund operator.

Article 19

Disbursement policy

The crowdfunding service provider shall have in place a policy to determine how all of the following elements are considered in the decision on proceeding to any disbursement from the contingency fund to investors:

(a) updated available fund balance;

(b) the share of the loans that have defaulted in a given portfolio;

(d) the procedure to be followed when considering whether to make a discretionary payment from the contingency fund;

(e) the circumstances in which the contingency fund may be activated for the pay-out;

(f) the criteria to be considered in the event of competing or simultaneous claims of investors on the same defaulted loans.

Article 20

Business continuity policy

Crowdfunding service providers shall establish a sound business continuity policy for the contingency fund to ensure its ability to operate on an ongoing basis and to limit possible losses in the event of temporary or definitive failure.

Article 21

Transparency and disclosure to investors

1. The management body of the crowdfunding service provider shall inform and update its staff about the contingency fund’s policies and procedures in a clear and consistent way, at least to the level needed to carry out the duties of the contingency fund.

2. The policies, procedures and organisational arrangements that the crowdfunding service provider shall have in place in accordance with Article 6(7), point (c) of Regulation (EU) 2020/1503 shall be consistently reflected in the contingency fund policy referred to in Article 6(5), point (b), of that Regulation.

Article 22

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the

Official Journal of the European Union

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 13 July 2022.

For the Commission

The President

Ursula VON DER LEYEN

(1)

OJ L 347, 20.10.2020, p. 1

(2) Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (

OJ L 331, 15.12.2010, p. 12

(3) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (

OJ L 295, 21.11.2018, p. 39

(4) Commission Delegated Regulation (EU) 2022/2115 of 13 July 2022 supplementing Regulation (EU) 2020/1503 of the European Parliament and of the Council with regard to regulatory technical standards specifying the methodology for calculating default rates of loans offered on a crowdfunding platform (see page 33 of this Official Journal).

(5) Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (

OJ L 176, 27.6.2013, p. 1

(6) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (

OJ L 119, 4.5.2016, p. 1