COMMISSION DELEGATED REGULATION (EU) 2018/1639

of 13 July 2018

supplementing Regulation (EU) 2016/1011 of the European Parliament and of the Council with regard to regulatory technical standards specifying further the elements of the code of conduct to be developed by administrators of benchmarks that are based on input data from contributors

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2016/1011 of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/2014 (1), and in particular the fourth subparagraph of Article 15(6) thereof,

Whereas:

(1) Article 15 of Regulation (EU) 2016/1011 requires the administrator of a benchmark that is based on input data from contributors to develop a code of conduct for that benchmark clearly specifying the contributors' responsibilities with respect to the contribution of input data. If an administrator provides a family of benchmarks consisting of more than one benchmark based on input data from contributors, a single code of conduct may be developed for the family of benchmarks. Paragraph 2 of Article 15 of that Regulation lists elements that must be included, as a minimum, in each code of conduct developed under that Article. No code of conduct is required if the benchmark is a regulated-data benchmark as defined in Article 3(1)(24) of that Regulation.

(2) In order to ensure that the benchmark is determined correctly, it is crucial that the input data provided by contributors has all the features required by the methodology and is complete. The code of conduct should therefore describe those features in sufficient detail and specify what data has to be taken into account by the contributor, what data the contributor may exclude and how the contributor is to transmit the input data to the administrator.

(3) A key factor in ensuring the integrity of a benchmark based on input data contributions is that the persons appointed by a contributor to submit the input data have the correct knowledge, skills, training and experience to perform the role. The code of conduct should therefore contain provision requiring each contributor to undertake a number of checks in respect of those who are to become submitters, prior to authorising them as submitters.

(4) The reliability of a benchmark depends to a large extent on the correctness of its input data. It is therefore crucial that contributors check data before and after submission for any suspicious entries and also to confirm compliance with the requirements of the code of conduct. The code of conduct should therefore contain provisions requiring contributors to carry out pre- and post-contribution checks of the data.

(5) The risk of error or manipulation is arguably greatest in cases where contributors can exercise discretion in the contribution of input data. The code of conduct should therefore require contributors to establish policies that specify when, how and by whom discretion may be exercised.

(6) The code of conduct should contain provisions requiring contributors to keep records of the data that was considered for each contribution and any related exercise of discretion. Such records are an essential tool in establishing whether a contributor has adhered to the policies required by the code of conduct which seek to ensure that all the relevant input data is provided.

(7) The proper identification and management of conflicts of interest at the level of the contributors is a necessary step towards the integrity and accuracy of the benchmark. For this reason, the code of conduct should contain provisions requiring a contributor's systems and controls to include a register of conflicts of interest in which the contributor should record identified conflicts of interest and the measures taken to manage them.

(8) In accordance with the principle of proportionality, this Regulation avoids putting an excessive administrative burden on administrators and contributors with respect to significant and non-significant benchmarks by allowing administrators of significant or non-significant benchmarks to develop codes of conducts that are less detailed than those required for critical benchmarks.

(9) Administrators should be given sufficient time to prepare codes of conduct that comply with the requirements of this Regulation. This Regulation should therefore start to apply two months after it enters into force.

(10) This Regulation is based on the draft regulatory technical standards submitted by the European Securities and Markets Authority to the Commission.

(11) The European Securities and Markets Authority has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the opinion of the Securities and Markets Stakeholder Group established by Article 37 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council (2),

HAS ADOPTED THIS REGULATION:

Article 1

Description of input data

The code of conduct to be developed by the administrator under Article 15(1) of Regulation (EU) 2016/1011 (‘the code of conduct’) shall include a clear description of, and requirements with respect to, at least the following matters concerning the input data to be provided:

(a) the type or types of input data to be provided;

(b) the required standards to be met regarding the quality and accuracy of the input data;

(d) the order of priority, if any, in which the different types of input data are to be contributed;

(e) the format in which the input data is to be provided;

(f) the frequency of submission of the input data;

(g) the timing of submission of the input data;

(h) the procedures, if any, that each contributor is required to have in place for adjustments to and standardisation of the input data.

Article 2

Submitters

1. The code of conduct shall include provision ensuring that a person is only permitted to act as a submitter of input data on behalf of a contributor if the contributor is satisfied that the person has the necessary skills, knowledge, training and experience for the role.

2. The code of conduct shall describe the due diligence process that a contributor is required to undertake in order to be satisfied that a person has the necessary skills, knowledge, training and experience to submit input data on its behalf. The description of that process shall include a requirement to undertake checks to verify:

(a) the person's identity;

(b) the person's qualifications; and

(c) the person's reputation, including whether the person has previously been excluded from submitting input data to a benchmark for reasons of misconduct.

3. The code of conduct shall specify the process and means of communication to be used by a contributor to notify the administrator of the identity of any person submitting input data on its behalf, so as to allow the administrator to check that the submitter is authorised to submit the data on the contributor's behalf.

Article 3

Policies to ensure that a contributor provides all relevant input data

The code of conduct shall include provisions requiring contributors to have in place and comply with at least the following policies:

(a) an input data policy that includes at least a description of:

(i) the data to be taken into account in determining the input data contribution; and

(ii) the data that the contributor may exclude from a contribution of input data, together with the reason or reasons for which that data may be excluded;

(b) a policy on the transmission of data to the administrator that includes at least:

(i) a description of the process to be used for the secure transfer of data; and

(ii) contingency plans for submitting input data in the event of technical or operational difficulties, the temporary absence of a submitter or the unavailability of the input data required by the methodology.

Article 4

Systems and controls

1. The code of conduct shall include provisions ensuring that the systems and controls referred to in Article 15(2)(d) of Regulation (EU) 2016/1011 include, among other things, the following elements:

(a) pre-contribution checks to identify any suspicious input data, including checks in the form of a review of the data by a second person;

(b) post-contribution checks to confirm that the input data has been contributed in accordance with the requirements of the code of conduct and to identify any suspicious input data;

2. The code of conduct may permit a contributor to use an automated system for the contribution of input data, in which natural persons are not able to modify the contribution of input data, only if the code of conduct makes such permission subject to the following conditions:

(a) the contributor is able to monitor the proper functioning of the automated system on a continuous basis; and

(b) the contributor checks the automated system following any update or change to its software, before new input data is contributed.

In such a case, the code of conduct does not need to require the contributor to establish the checks referred to in paragraph 1.

3. The code of conduct shall define the procedures that a contributor must have in place to address any errors in the contributed input data.

4. The code of conduct shall require a contributor to review the systems and controls established by it concerning the contribution of input data on a regular basis and, in any event, at least annually.

Article 5

Policies on the use of discretion when contributing input data

If the code of conduct provides for a contributor to use discretion in contributing input data, it shall require the contributor to establish policies on the use of discretion that specify at least the following:

(a) the circumstances in which the contributor may exercise discretion;

(b) the individuals within the contributor's organisation who are permitted to exercise discretion;

(d) the individuals within the contributor's organisation who are authorised to conduct an

ex post

evaluation of the exercise of discretion.

Article 6

Record-keeping policies

1. The code of conduct shall include provisions requiring contributors to establish record-keeping policies that ensure that a record is kept by the contributor of all relevant information necessary to check the contributor's adherence to the code of conduct, including a record of at least the following information:

(a) the contributor's policies and procedures governing the contribution of input data and any material changes to those policies or procedures;

(b) the register of conflicts of interest referred to in Article (8)(1)(b) of this Regulation;

(d) a list of submitters and persons performing checks in respect of contributions, including their names and roles within the contributor's organisation and the dates when they were authorised and, where applicable, ceased to be authorised to carry out their submission-related roles;

(e) in respect of each contribution of input data:

(i) the input data contributed;

(ii) the data taken into account in determining the input data contribution, and any data that was excluded;

(iii) any use of discretion;

(iv) any input data checks undertaken;

(v) any communications in relation to the contribution of input data between the submitter and anyone within the contributor's organisation performing checks in respect of contributions.

2. The code of conduct shall require the record-keeping policies to provide that information be kept for a minimum of five years, or three years where the records are of telephone conversation or electronic communications, and be stored on a medium that allows the information to be accessible for future reference.

3. The administrator may choose to omit the requirement in point (iv) of paragraph 1(e) in the case of a contributor contributing input data to a significant benchmark.

4. The administrator may choose to omit either or both of the requirements in points (iv) and (v) of paragraph 1(e) in the case of a contributor contributing input data to a non-significant benchmark.

Article 7

Reporting of suspicious input data

1. The code of conduct shall require a contributor to establish documented internal procedures that provide for its staff to report any suspicious input data to the contributor's compliance function, if any, and to the contributor's senior management.

2. The code of conduct shall specify the conditions under which a contributor must report suspicious input data to the administrator, and shall specify the process and means of communication to be used by the contributor in order to contact the administrator.

Article 8

Conflicts of interest

1. The code of conduct shall require a contributor to establish systems and controls concerning the management of conflicts of interest that include at least the following elements:

(a) establishment of a conflicts of interest policy that addresses:

(i) the process for identifying and managing conflicts of interest, including any internal escalation of conflicts of interest;

(ii) steps to prevent, or minimise the risk of, conflicts of interest in the process for recruiting submitters;

(iii) steps to prevent, or minimise the risk of, conflicts of interest in the remuneration policies for the contributor's staff;

(iv) steps to prevent, or minimise the risk of, conflicts of interest arising from the contributor's management structure;

(v) requirements with respect to communications between submitters and other staff within the contributor's organisation;

(vi) any physical or organisational separation between submitters and other staff of the contributor required to prevent, or minimise the risk of, conflicts of interest;

(vii) rules and measures to address any financial exposure that the contributor may have to a financial instrument or financial contract which references the benchmark to which the contributor contributes input data;

(b) establishment of a register of conflicts of interest to be used to record any conflicts of interest identified and any measures taken to manage them, together with requirements to keep the register up-to-date and to provide internal or external auditors with access to it.

2. The code of conduct shall require that members of a contributor's staff who are involved in the contribution process be trained in all policies, procedures and controls relating to the identification, prevention and management of conflicts of interest.

3. The administrator may choose to omit one or more of the requirements in points (iii), (v), (vi) and (vii) of paragraph 1(a) in the case of a contributor contributing input data to a non-significant benchmark.

Article 9

Entry into force and application

This Regulation shall enter into force on the twentieth day following that of its publication in the

Official Journal of the European Union

It shall apply from 25 January 2019.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 13 July 2018.

For the Commission

The President

Jean-Claude JUNCKER

(1)

OJ L 171, 29.6.2016, p. 1

(2) Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (

OJ L 331, 15.12.2010, p. 84