ANNEX VII
Supervision of less significant supervised entities
1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING
In the context of the prudential supervision of less significant supervised entities, personal data are processed for the following purposes:
(a) | ensuring that less significant supervised entities comply with relevant Union law, including national transpositions thereof, imposing prudential requirements in the areas of (i) own funds, securitisation, large exposure limits, liquidity, leverage, and reporting and public disclosure of information on those matters; and (ii) governance, including risk management processes, internal control mechanisms, remuneration policies and practices and effective internal capital and liquidity adequacy assessment processes, including internal ratings based models; |
(b) | carrying out supervisory reviews and stress tests to determine whether less significant supervised entities comply with the relevant requirements of Union law and, on the basis of that supervisory review, imposing on less significant supervised entities specific requirements and other measures; |
(c) | carrying out supervision on a consolidated basis over less significant supervised entities’ parents established in one of the participating Member States, including over (mixed) financial holding companies, and participating in supervision on a consolidated basis, including in colleges of supervisors without prejudice to the participation of NCAs in those colleges as observers, in relation to parents not established in one of the participating Member States; |
(d) | carrying out supervisory tasks in relation to recovery plans and early intervention; |
(e) | carrying out on-site inspections of less significant supervised entities; |
(f) | exercising, vis-à-vis less significant supervised entities, supervisory powers granted under national law, including, among others, the approval of acquisitions by less significant supervised entities of holdings in a non-credit institution or a credit institution outside the Union, mergers or demergers of credit institutions, the acquisition or sale of assets or liabilities, amendments to credit institutions’ statutes, the appointment of external auditors, requests for information and specific reports from external auditors, outsourcing projects, operations in third countries, the exercise of powers vis-à-vis shareholders, the granting or limitation of credit to related parties, strategic decisions and the establishment of cooperative banking groups; |
(g) | exercising, vis-à-vis less significant supervised entities, supervisory powers granted to competent authorities under Regulation (EU) No 575/2013, and Directive 2013/36/EU, as transposed into national law. |
2. LEGAL BASIS
Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 4(1), points (b), (d), (g) and (i) and Article 6(6) of Regulation (EU) No 1024/2013.
3. DATA SUBJECTS
Personal data relating to the following categories of data subjects may be processed:
(a) | staff of less significant supervised entities; |
(b) | members of the management body, customers and their guarantors, shareholders and creditors, service providers, consultants and external auditors of less significant supervised entities; |
(c) | staff or representatives of banking associations; |
(d) | staff of Union institutions and bodies, and of national and international authorities; |
(e) | other third parties, such as persons filing complaints or submitting requests for information regarding a less significant supervised entity; |
(f) | authorised representatives of an appointee in a fit and proper procedure. |
4. CATEGORIES OF PERSONAL DATA PROCESSED
The following categories of personal data may be processed:
(a) | identification data, such as name, ID card/passport number, nationality and signature; |
(b) | contact data, such as postal address, email address and phone number; |
(c) | professional data relating to the education, training, employment and other positions held by the appointee in a fit and proper procedure and the members of the management body of the supervised entity in which the appointment is made; |
(d) | professional data relating to any other business activities of the appointee in a fit and proper procedure; |
(e) | details of criminal records; and information on criminal investigations and proceedings, relevant civil and administrative proceedings and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures; |
(f) | financial details of the appointee in a fit and proper procedure; |
(g) | description of the personal relationships of close relatives of the appointee in a fit and proper procedure with other members of the management body and/or key function holders of the supervised entity in which the appointment is made, its parent undertaking or its subsidiaries; and their professional and financial relationships with the supervised entity in which the appointment is made, its parent undertaking or its subsidiaries; |
(h) | information as to whether a fit and proper assessment has already been conducted by another competent authority and information about the outcome of this assessment; |
(i) | comments by ECB or NCA staff regarding the performance of the appointee in their current or any previous role that may have an impact on the current fit and proper procedure; |
(j) | information on the conduct of the appointee in their current role that may be relevant in the context of reassessments; |
(k) | financial details, such as in the context of a credit file review of a bank customer or in the context of a loan to a member of the management body when a pre-approval is required; |
(l) | sound recording of the voice of the appointee in a fit and proper procedure. |