Publication of measures and sanctions for infringements of Regulation (EU) No 909/2014, Regulation (EU) 2015/2365, Regulation (EU) 2016/1011, Regulation (EU) 2017/2402, or Regulation (EU) 2022/2554

(1) The Federal Institute publishes, on its website, decisions on measures and sanctions issued for infringements of Regulation (EU) No 909/2014, or Article 4 or 15 of Regulation (EU) 2015/2365, Article 16(1) to (4) of Regulation (EU) 2016/1011, or the delegated acts based on them respectively, without delay after informing the natural or legal person against whom the measure or sanction was imposed.
(2) In the publication, the Federal Institute names the provision infringed and the natural or legal person or association of persons responsible for the infringement.
(3) Where publication of the identity of a legal person affected by the decision, or of the personal data of a natural person, would be disproportionate, or where publication would jeopardise ongoing investigations or the stability of the financial markets, then
1. the Federal Institute defers publication of the decision until the grounds for the deferral have ceased to apply,
2. the Federal Institute publishes the decision without naming the identity or the personal data, where this ensures effective protection of the identity or the personal data concerned, or
3. the Federal Institute does not publish the decision, where publication under points 1 and 2 would not be sufficient to ensure that
a) the stability of the financial markets is not jeopardised, or
b) the proportionality of the publication is maintained.
(4) For decisions that are not final or not legally binding, the Federal Institute adds a corresponding notice. Where an appeal is lodged against the decision to be published, the Federal Institute supplements the publication without delay with a note of the appeal and with all further information on the outcome of the appeal proceedings.
(5) A publication under subsection (1) must be deleted five years after its publication. By way of derogation from the first sentence, personal data must be deleted as soon as its publication is no longer necessary.
(6) For measures that have become final and fine decisions that have become unappealable, issued for an infringement of Article 6, 7, 9, or 27(1) of Regulation (EU) 2017/2402, or for infringements of Regulation (EU) 2022/2554, subsections (1) to (3) and (5) apply correspondingly, on the basis that the publication also covers the measures and fine decisions imposed, and that the proportionality assessment under subsection (3) examines whether the publication would cause disproportionate harm to the persons involved.