This Regulation shall enter into force on the seventh day following that of its publication in the Official Journal of the European Union.
It shall apply from 1 July 2025.
However, Articles 1, 4, 49, 53, 54, 55, 57 to 66, 68 to 71, 100, 101 and 107 shall apply from 26 June 2024, and Article 103 shall apply from 31 December 2025.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Brussels, 31 May 2024.
For the European Parliament
The President
R. METSOLA
For the Council
The President
H. LAHBIB
(1) OJ C 152, 6.4.2022, p. 89.
(2) Position of the European Parliament of 24 April 2024 (not yet published in the Official Journal) and decision of the Council of 30 May 2024.
(3) Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849 (OJ L 150, 9.6.2023, p. 1).
(4) Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (OJ L, 2024/1624, 19.6.2024, ELI: http://data.europa.eu/eli/reg/2024/1624/oj).
(5) Directive (EU) 2024/1640 of the European Parliament and of the Council of 31 May 2024 on the mechanisms to be put in place by Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Directive (EU) 2019/1937, and amending and repealing Directive (EU) 2015/849 (OJ L, 2024/1640, 19.6.2024, ELI: http://data.europa.eu/eli/dir/2024/1640/oj).
(6) Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).
(7) Regulation (EU) 2021/240 of the European Parliament and of the Council of 10 February 2021 establishing a Technical Support Instrument (OJ L 57, 18.2.2021, p. 1).
(8) Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, p. 1).
(9) Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September 2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation (Euratom) No 1074/1999 (OJ L 248, 18.9.2013, p. 1).
(10) Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48).
(11) Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84).
(12) Commission Delegated Regulation (EU) 2019/715 of 18 December 2018 on the framework financial regulation for the bodies set up under the TFEU and Euratom Treaty and referred to in Article 70 of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council (OJ L 122, 10.5.2019, p. 1).
(13) OJ L 136, 31.5.1999, p. 15.
(14) OJ L 56, 4.3.1968, p. 1.
(15) Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43).
(16) Council Regulation No 1 determining the languages to be used by the European Economic Community (OJ 17, 6.10.1958, p. 385/58).
(17) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).
(18) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).
(19) Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (OJ L 305, 26.11.2019, p. 17).
(20) Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63).
(21) Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012 of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190).
(22) Directive 2014/49/EU of the European Parliament and of the Council of 16 April 2014 on deposit guarantee schemes (OJ L 173, 12.6.2014, p. 149).
(23) Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (OJ L 150, 9.6.2023, p. 40).
(24) OJ L 123, 12.5.2016, p. 1.
(25) OJ C 210, 25.5.2022, p. 5.
(26) OJ C 524, 29.12.2021, p. 10.
(27) Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1).
(28) Directive 2008/48/EC of the European Parliament and of the Council of 23 April 2008 on credit agreements for consumers and repealing Council Directive 87/102/EEC (OJ L 133, 22.5.2008, p. 66).
(29) Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC (OJ L 267, 10.10.2009, p. 7).
(30) Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (OJ L 335, 17.12.2009, p. 1).
(31) Directive 2014/17/EU of the European Parliament and of the Council of 4 February 2014 on credit agreements for consumers relating to residential immovable property and amending Directives 2008/48/EC and 2013/36/EU and Regulation (EU) No 1093/2010 (OJ L 60, 28.2.2014, p. 34).
(32) Regulation (EU) No 537/2014 of the European Parliament and of the Council of 16 April 2014 on specific requirements regarding statutory audit of public-interest entities and repealing Commission Decision 2005/909/EC (OJ L 158, 27.5.2014, p. 77).
(33) Directive 2014/56/EU of the European Parliament and of the Council of 16 April 2014 amending Directive 2006/43/EC on statutory audits of annual accounts and consolidated accounts (OJ L 158, 27.5.2014, p. 196).
(34) Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).
(35) Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35).
(36) Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338).
(37) Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC (OJ L 182, 29.6.2013, p. 19).
(38) Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53).
(39) Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA (OJ L 295, 21.11.2018, p. 138).
(40) Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ L 141, 5.6.2015, p. 73).
(41) Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (OJ L 193, 30.7.2018, p. 1).
(42) OJ L 136, 31.5.1999, p. 15.
(43) Council Regulation (EU) 2016/300 of 29 February 2016 determining the emoluments of EU high-level public office holders (OJ L 58, 4.3.2016, p. 1).
(44) Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU classified information (OJ L 72, 17.3.2015, p. 53).
(45) Commission Decision (EU, Euratom) 2015/443 of 13 March 2015 on Security in the Commission (OJ L 72, 17.3.2015, p. 41).
(46) Council Regulation (EC) No 2965/94 of 28 November 1994 setting up a Translation Centre for bodies of the European Union (OJ L 314, 7.12.1994, p. 1).
ANNEX I
List of the coefficients linked to aggravating and mitigating factors for the application of Article 22
The following coefficients shall be applicable in a cumulative way to the basic amounts referred to in Article 22(4) on the basis of each of the following aggravating and mitigating factors:
I.
Adjustment coefficients linked to aggravating factors:
1.
If the breach has been committed repeatedly, for every time it has been repeated, an additional coefficient of 1,1 shall apply.
2.
If the breach has been committed for more than six months, a coefficient of 1,5 shall apply.
3.
If the infringement has revealed systemic weaknesses in the organisation of the selected obliged entity, in particular in its procedures, management systems or internal controls, a coefficient of 2,2 shall apply.
4.
If the infringement has been committed intentionally, a coefficient of 3 shall apply.
5.
If no remedial action has been taken since the breach has been identified, a coefficient of 1,7 shall apply.
6.
If the selected obliged entity’s senior management has not cooperated with the Authority in carrying out its investigations, a coefficient of 1,5 shall apply.
II.
Adjustment coefficients linked to mitigating factors:
1.
If the selected obliged entity’s senior management can demonstrate that it has taken all the necessary measures to prevent the breach, a coefficient of 0,7 shall apply.
2.
If the selected obliged entity has quickly and effectively brought the complete breach to Authority’s attention, a coefficient of 0,4 shall apply.
3.
If the selected obliged entity has voluntarily taken measures to ensure that similar breaches cannot be committed anymore in the future, a coefficient of 0,6 shall apply.
ANNEX II
List of directly applicable requirements referred to in Article 22(3)
1.
Requirements related to customer due diligence referred to in Article 22(3), points (a) and (b), of this Regulation shall be those in Articles 19, 20, 21, 22, 23, 25, 26, 33, 34, 36, 39, 42, 44, 46 and 47 of Regulation (EU) 2024/1624.
2.
Requirements related to group-wide policies, procedures and controls referred to in Article 22(3), point (a), of this Regulation shall be those in Articles 16 and 17 of Regulation (EU) 2024/1624.
3.
Requirements related to reporting obligations referred to in Article 22(3), points (a) and (b), of this Regulation shall be those in Articles 69, 70 and 71 of Regulation (EU) 2024/1624 and Articles 9, 13 and 18 of Regulation (EU) 2023/1113.
4.
Requirements related to internal policies, procedures and controls referred to in Article 22(3), point (b), of this Regulation shall be those in Articles 9, 10, 11, 18, 48 and 49 of Regulation (EU) 2024/1624 and Article 23 of Regulation (EU) 2023/1113.
5.
Other requirements referred to in Article 22(3), points (c) and (d), of this Regulation shall be those in Articles 73, 77, 78 and 79 of Regulation (EU) 2024/1624 and Articles 7, 8, 10, 11, 12, 14, 16, 17, 19, 21, 24 and 26 of Regulation (EU) 2023/1113.
ELI: http://data.europa.eu/eli/reg/2024/1620/oj
ISSN 1977-0677 (electronic edition)