### (4) diverging rules on the disclosure of information , on the transparency and accountability of external reviewers reviewing environmentally sustainable bonds , and on the eligibility criteria for eligible environmentally sustainable projects , impede the ability of investors to identify , trust , and compare environmentally sustainable bonds , and the ability of issuers to use environmentally sustainable bonds to transition their activities towards more environmentally sustainable business models. ### (4) diverging rules on the disclosure of information , on the transparency and accountability of external reviewers reviewing environmentally sustainable bonds , and on the eligibility criteria for eligible environmentally sustainable projects , has impeded the ability of investors to identify , trust , and objectively compare environmentally sustainable bonds , and the ability of issuers to use environmentally sustainable bonds to fund their transition towards more environmentally sustainable business models.


### (4) diverging rules on the disclosure of information , on the transparency and accountability of external reviewers reviewing environmentally sustainable bonds , and on the eligibility criteria for eligible environmentally sustainable projects , impede the ability of investors to identify , trust , and compare environmentally sustainable bonds , and the ability of issuers to use environmentally sustainable bonds to transition their activities towards more environmentally sustainable business models. ### (4) diverging rules on the disclosure of information , on the transparency and accountability of external reviewers reviewing environmentally sustainable bonds , and on the eligibility criteria for eligible environmentally sustainable projects , has impeded the ability of investors to identify , trust , and compare environmentally sustainable bonds , and the ability of issuers to use environmentally sustainable bonds to fund their transition towards more environmentally sustainable business models.


### (22) to strengthen transparency towards investors on how the alignment of bond proceeds with the taxonomy requirements is assessed , external reviewers should disclose to users of pre-issuance reviews and post-issuance reviews the methodologies and key assumptions they use in their external review activities in sufficient detail , whilst taking due account of the protection of proprietary data and intellectual property. ### (22) to strengthen transparency towards investors on how the alignment of bond proceeds with the taxonomy requirements is assessed , external reviewers should disclose to users of pre-issuance reviews , post-issuance reviews and environmental impact reports , the methodologies and key assumptions they use in their external review activities in sufficient detail , whilst taking due account of the protection of proprietary data and intellectual property.


### capital expenditures , including those of households; ### capital expenditures , including those of households that were incurred less than three years prior to the issuance of the european green bond;


### where , at the time of the creation of the debt referred to in the first subparagraph , no delegated acts adopted pursuant to articles 10(3) , 11(3) , 12(2) , 13(2) , 14(2) or 15(2) of regulation (eu) 2020/852 were in force , issuers shall apply the first delegated acts that were adopted pursuant to articles 10(3) , 11(3) , 12(2) , 13(2) , 14(2) or 15(2) of regulation (eu) 2020/852. ### when allocating bond proceeds to the debt referred to in article 5(1) , point (a) , issuers shall apply the delegated acts adopted pursuant to articles10(3) , 11(3) , 12(2) , 13(2) , 14(2) or 15(2) of regulation (eu) 2020/852 applicable at the latest date of (i) the point in time when the debt was created and (ii) three years prior to the issuance of the bond.


### the full name of the applicant , the address of the registered office within the union , the applicant’s website and , where available , the legal entity identifier (lei); ### the full name of the applicant , the address of the registered office , the applicant’s website and , where available , the legal entity identifier (lei);


### 1. external reviewers shall adopt and implement measures to ensure that their pre-issuance reviews as referred to in article 8 and their post-issuance reviews as referred to in article 9 are based on a thorough analysis of all the information that is available to them and that , according to their methodologies , is relevant to their analysis. ### 1. external reviewers shall adopt and implement measures to ensure that their pre-issuance reviews as referred to in article 8 and their post-issuance reviews as referred to in article 9 are based on a thorough analysis of all the information that is available to them and that , according to their transparent and public methodologies , is relevant to their analysis.


### 4.2 process for selecting green projects and estimated environmental impact ### 4.2 process for selecting green projects / portfolios and estimated environmental impact.


### (6) combining both direct and indirect supervisory competences over obliged entities , and also functioning as a support and cooperation mechanism for fius , is the most appropriate means of bringing about supervision and cooperation between fius at union level. this should be achieved by creating an authority which should combine independence and a high level of technical expertise and which should be established in line with the joint statement and common approach of the european parliament , the council of the european union and the european commission on decentralised agencies32 . ### (6) combining both direct and indirect supervisory competences over obliged entities , and also functioning as a support and cooperation mechanism for fius , is the most appropriate means of bringing about supervision and cooperation between fius at union level. however , achieving the objectives of the mandate given to the authority depends on the cooperation and the adequate funding and equipment of the fius in the member states. this should be achieved by creating an authority which should combine independence and a high level of technical expertise and which should be established in line with the joint statement and common approach of the european parliament , the council of the european union and the european commission on decentralised agencies32 .


### (7) a seat agreement should be established between the authority and the host member state , stipulating the conditions of establishment of the seat and advantages conferred by the member state on the authority and its staff. ### (7) a seat agreement should be established between the authority and the host member state , stipulating the conditions of establishment of the seat and advantages conferred by the member state on the authority and its staff. the location of the newly created authority should take into account the equal geographic coverage of existing decentralised agencies in the union.


### (7) a seat agreement should be established between the authority and the host member state , stipulating the conditions of establishment of the seat and advantages conferred by the member state on the authority and its staff. ### (7) the arrangements concerning the authority’s seat should be laid down in a headquarters agreement between the authority and the host member state. that agreement should stipulate the conditions of establishment of the seat and the facilities to be provided by the member state to the authority and its staff.


### (42) the governing body of the authority should be the executive board composed of the chair of the authority and of five full time members , appointed by the general board based on the shortlist by the commission. with the aim of ensuring a speedy and efficient decision making process , the executive board should be in charge of planning and execution of all the tasks of the authority except where specific decisions are explicitly allocated to the general board. in order to ensure objectivity and appropriate rapidity of the decision-making process in the area of direct supervision of the selected obliged entities , the executive board should take all binding decisions addressed to selected obliged entities. in addition , together with a representative of the commission the executive board should be collectively responsible for the administrative and budgetary decisions of the authority. the consent of the commission should be required when the executive board is taking decisions related to the budget administration , procurement , recruitment , and audit of the authority , given that a portion of funding of the authority will be provided from union budget. ### (42) the governing body of the authority should be the executive board composed of the chair of the authority and of five full time members , appointed by the general board based on the shortlist by the commission. with the aim of ensuring a speedy and efficient decision making process , the executive board should be in charge of planning and execution of all the tasks of the authority except where specific decisions are explicitly allocated to the general board. in order to ensure objectivity and appropriate rapidity of the decision-making process in the area of direct supervision of the selected obliged entities , the executive board should take all binding decisions addressed to selected obliged entities. in addition , together with a representative of the commission the executive board should be collectively responsible for the administrative and budgetary decisions of the authority.


### (42) the governing body of the authority should be the executive board composed of the chair of the authority and of five full time members , appointed by the general board based on the shortlist by the commission. with the aim of ensuring a speedy and efficient decision making process , the executive board should be in charge of planning and execution of all the tasks of the authority except where specific decisions are explicitly allocated to the general board. in order to ensure objectivity and appropriate rapidity of the decision-making process in the area of direct supervision of the selected obliged entities , the executive board should take all binding decisions addressed to selected obliged entities. in addition , together with a representative of the commission the executive board should be collectively responsible for the administrative and budgetary decisions of the authority. the consent of the commission should be required when the executive board is taking decisions related to the budget administration , procurement , recruitment , and audit of the authority , given that a portion of funding of the authority will be provided from union budget. ### (42) the governing body of the authority should be the executive board composed of the chair of the authority and of five full time members , appointed by the general board based on a gender balanced shortlist by the commission , after having received the european parliament's approval. with the aim of ensuring a speedy and efficient decision making process , the executive board should be in charge of planning and execution of all the tasks of the authority except where specific decisions are explicitly allocated to the general board. in order to ensure objectivity and appropriate rapidity of the decision-making process in the area of direct supervision of the selected obliged entities , the executive board should take all binding decisions addressed to selected obliged entities. in addition , together with a representative of the commission the executive board should be collectively responsible for the administrative and budgetary decisions of the authority. the consent of the commission should be required when the executive board is taking decisions related to the budget administration , procurement , recruitment , and audit of the authority , given that a portion of funding of the authority will be provided from union budget.


### (43) to allow for swift decisions , all decisions of the executive board , including the decision where the commission has a right to vote , should be taken by simple majority , with the chair holding a casting vote in case of a tied vote. to ensure sound financial management of the authority , the commission’s consent should be required for decisions related to budget , administration and recruitment. the voting members of the executive board other than the chair should be selected by the general board , based on a short-list established by the commission. ### (43) to allow for swift decisions , all decisions of the executive board , including the decision where the commission has a right to vote , should be taken by simple majority , with the chair holding a casting vote in case of a tied vote. the voting members of the executive board other than the chair should be selected by the general board , based on a short-list established by the commission.


### (44) to ensure the independent functioning of the authority the five members of the executive board and the chair of the authority should act independently and in the interest of the union as a whole. they should behave , both during and after their term of office , with integrity and discretion as regards the acceptance of certain appointments or benefits. to avoid giving any impression that a member of the executive board might use its position as a member of the executive board of the authority to get a high-ranking appointment in the private sector after his term of office and to prevent any post-public employment conflicts of interests , a cooling-off period for the five members of the executive board , including the chair of the authority , should be introduced. ### (44) to ensure the independent functioning of the authority the five members of the executive board and the chair of the authority should act independently and in the interest of the union as a whole. they should behave , both during and after their term of office , with integrity and discretion as regards the acceptance of certain appointments or benefits. to avoid giving any impression that a member of the executive board might use its position as a member of the executive board of the authority to get a high-ranking appointment in the private sector after his term of office and to prevent any post-public employment conflicts of interests , a cooling-off period for the five members of the executive board , including the chair of the authority , should be introduced. further internal mechanisms should be proposed to ensure that all the senior staff would not be able to undermine the integrity of the authority after their term in charge. amla should take into consideration the recommendations of the ombudsman in this matter.


### (46) the executive director of the authority should be appointed by the executive board based on a shortlist from the commission. the executive director of the authority should be a senior administrative official of the authority , in charge of the day-to-day management of the authority , and responsible for budget administration , procurement , and recruitment and staffing. ### (46) the executive director of the authority should be appointed by the executive board based on a gender-balanced shortlist from the commission and after the consent of the european parliament. the executive director of the authority should be a senior administrative official of the authority , in charge of the day-to-day management of the authority , and responsible for budget administration , procurement , and recruitment and staffing.


### (48) to guarantee the proper functioning of the authority , funding should be provided by a combination of fees levied on certain obliged entities and a contribution from the union budget , depending on the tasks and functions. the budget of the authority should be part of the union budget , confirmed by the budgetary authority on the basis of a proposal from the commission. the authority should submit to the commission a draft budget and an internal financial regulation for approval. ### (48) to guarantee the achievement of the objectives and the proper functioning of the authority , funding should be provided by a combination of fees levied on certain obliged entities and a contribution from the union budget , depending on the tasks and functions , with a transparent methodology for the levies in order to ensure a predictable budget for the authority. the budget of the authority should be part of the union budget , confirmed by the budgetary authority on the basis of a proposal from the commission. the authority should submit to the commission a draft budget and an internal financial regulation for approval.


### (48) to guarantee the proper functioning of the authority , funding should be provided by a combination of fees levied on certain obliged entities and a contribution from the union budget , depending on the tasks and functions. the budget of the authority should be part of the union budget , confirmed by the budgetary authority on the basis of a proposal from the commission. the authority should submit to the commission a draft budget and an internal financial regulation for approval. ### (48) it is necessary to provide the authority with the necessary financial and human resources in order to fulfil the objectives , tasks and responsibilities assigned to it under this regulation. the authority should have autonomy regarding the recruitment of contract agents. to guarantee the proper functioning of the authority , funding should be provided by a combination of fees levied on certain obliged entities and a contribution from the union budget , depending on the tasks and functions. the budget of the authority should be part of the union budget , confirmed by the budgetary authority on the basis of a proposal from the commission. the authority should submit to the commission a draft budget and an internal financial regulation for approval.


### 1. the chair of the authority shall be selected on the basis of merit , skills , knowledge , recognised standing and experience in the area of anti-money laundering and countering the financing of terrorism and other relevant qualification , following an open selection procedure which shall be published in the official journal of the european union. the commission shall draw up a shortlist of two qualified candidates for the position of the chair of the authority. the council , after approval by the european parliament , shall adopt an implementing decision to appoint the chair of the authority. ### 1. the chair of the authority shall be selected on the basis of merit , skills , knowledge , recognised standing and experience in the area of anti-money laundering and countering the financing of terrorism and other relevant qualification , and have no prior criminal conviction; following an open selection procedure which shall be published in the official journal of the european union. the commission shall draw up a gender-balanced shortlist of two qualified candidates for the position of the chair of the authority. the council , after approval by the european parliament , shall adopt an implementing decision to appoint the chair of the authority.


### 1. the chair of the authority shall be selected on the basis of merit , skills , knowledge , recognised standing and experience in the area of anti-money laundering and countering the financing of terrorism and other relevant qualification , following an open selection procedure which shall be published in the official journal of the european union. the commission shall draw up a shortlist of two qualified candidates for the position of the chair of the authority. the council , after approval by the european parliament , shall adopt an implementing decision to appoint the chair of the authority. ### 1. the chair of the authority shall be selected on the basis of merit , skills , knowledge , recognised standing and experience in the area of anti-money laundering and countering the financing of terrorism and other relevant qualification , following an open selection procedure which shall respects the gender balance principle and be published in the official journal of the european union. the commission shall draw up a gender balanced shortlist of two qualified candidates for the position of the chair of the authority. the council , at the end of a hearing and approval procedure by the european parliament , shall adopt an implementing decision to appoint the chair of the authority.


### 2. the authority’s budget shall be balanced in terms of revenue and of expenditure. ### 2. the authority’s budget shall be adequate to ensure sufficient staff and up-to-date equipment in order to allow the authority to achieve the objectives and tasks set by this regulation.


### 3. on the occasion of every second evaluation , there shall be an assessment of the results achieved by the authority having regard to its objectives , mandate and tasks , including an assessment of whether the continuation of the authority is still justified with regard to these objectives , mandate and tasks. ### 3. on the occasion of every second evaluation , there shall be an assessment of the results achieved by the authority having regard to its objectives , mandate and tasks , including an assessment of whether a review of the authority is justified with regard to these objectives , mandate , tasks and powers.


### (9) with the objective to strengthen aml/cft rules at union level and to enhance their clarity while ensuring consistency with international standards and other legislation , it is necessary to establish the coordinating role of the authority at union level in relation to all types of obliged entities to assist national supervisors and promote supervisory convergence , in order to increase the efficiency of the implementation of aml/cft measures , also in the non-financial sector. consequently , the authority should be mandated to prepare regulatory technical standards , to adopt guidelines , recommendations and opinions with the aim that where supervision remains at national level , the same supervisory practices and standards apply in principle to all comparable entities. the authority should be entrusted , due to its highly specialised expertise , with the development of a supervisory methodology , in line with a risk-based approach. certain aspects of the methodology , which can incorporate harmonised quantitative benchmarks , such as approaches for classifying the inherent risk profile of obliged entities should be detailed in directly applicable binding regulatory measures – regulatory or implementing technical standards. other aspects , which require wider supervisory discretion , such as approaches to assessing residual risk profile and internal controls in the obliged entities should be covered by non-binding guidelines , recommendations and opinions of the authority. the harmonised supervisory methodology should take due account of , and where appropriate , leverage the existing supervisory methodologies relating to other aspects of supervision of the financial sector obliged entities , especially where there is interaction between aml/cft supervision and prudential supervision. specifically , the supervisory methodology to be developed by the authority should be complementary to guidelines and other instruments developed by the european banking authority detailing approaches of prudential supervisory authorities with respect to factoring ml/tf risks in prudential supervision , in order to ensure effective interaction between prudential and aml/cft supervision. ### (9) with the objective to strengthen aml/cft rules at union level and to enhance their clarity while ensuring consistency with international standards and other legislation , it is necessary to establish the coordinating role of the authority at union level in relation to all types of obliged entities to assist national supervisors and promote supervisory convergence , in order to increase the efficiency of the implementation of aml/cft measures , also in the non-financial sector. the authority ensures the cohesion and coordination between the union institutions , bodies , offices and agencies involved in the aml/cft framework in order to enhance efficiency and avoid overlaps. consequently , the authority should be mandated to prepare regulatory technical standards , to adopt guidelines , recommendations and opinions with the aim that where supervision remains at national level , the same supervisory practices and standards apply in principle to all comparable entities. the authority should be entrusted , due to its highly specialised expertise , with the development of a supervisory methodology , in line with a risk-based approach. certain aspects of the methodology , which can incorporate harmonised quantitative benchmarks , such as approaches for classifying the inherent risk profile of obliged entities should be detailed in directly applicable binding regulatory measures – regulatory or implementing technical standards. other aspects , which require wider supervisory discretion , such as approaches to assessing residual risk profile and internal controls in the obliged entities should be covered by non-binding guidelines , recommendations and opinions of the authority. the harmonised supervisory methodology should take due account of , and where appropriate , leverage the existing supervisory methodologies relating to other aspects of supervision of the financial sector obliged entities , especially where there is interaction between aml/cft supervision and prudential supervision. specifically , the supervisory methodology to be developed by the authority should be complementary to guidelines and other instruments developed by the european banking authority detailing approaches of prudential supervisory authorities with respect to factoring ml/tf risks in prudential supervision , in order to ensure effective interaction between prudential and aml/cft supervision.


### (59) the authority should establish cooperative relations with the relevant union agencies and bodies , including europol , eurojust , the eppo , and the european supervisory authorities , namely the european banking authority , the european securities and markets authority and the european insurance and occupational pensions authority. to improve cross-sectoral supervision and a better cooperation between prudential and aml/cft supervisors the authority should also establish cooperative relations with the authorities competent for prudential supervision of financial sector obliged entities , including the european central bank with regard to matters relating to the tasks conferred on it by council regulation (eu) no 1024/201343 , as well as with resolution authorities as defined in article 3 of directive (eu) 2014/59/eu of the european parliament and the council44 and designated deposit guarantee schemes authorities as defined in article 2 (1) , point 18 of directive 2014/49/eu of the european parliament and the council45 . to this end , the authority should be able to conclude agreements or memoranda of understanding with such bodies , including with regard to any information exchange which is necessary for the fulfilment of the respective tasks of the authority and these bodies. the authority should make its best efforts to share information with such bodies on their request , within the limits posed by legal constraints , including data protection legislation. in addition , the authority should enable effective information exchange between all financial supervisors in the aml/cft supervisory system and the aforementioned authorities , such cooperation and information exchanges should take place in a structured and efficient way. ### (59) the authority should play a central role in strengthening the cooperation and the facilitation of information flows between the relevant union agencies and bodies , including europol , eurojust , the eppo , and the european supervisory authorities , namely the european banking authority , the european securities and markets authority and the european insurance and occupational pensions authority. to improve cross-sectoral supervision and a better cooperation between prudential and aml/cft supervisors the authority should also establish cooperative relations with the authorities competent for prudential supervision of financial sector obliged entities , including the european central bank with regard to matters relating to the tasks conferred on it by council regulation (eu) no 1024/201343 , as well as with resolution authorities as defined in article 3 of directive (eu) 2014/59/eu of the european parliament and the council44 and designated deposit guarantee schemes authorities as defined in article 2 (1) , point 18 of directive 2014/49/eu of the european parliament and the council45 so that prudential supervisors can use the information held by aml/cft authorities in their supervisory processes and aml/cft supervisors can use the information from prudential supervisors to inform their approach to the aml/cft supervision of institutions. to this end , the authority should be able to conclude agreements or memoranda of understanding with such bodies , including with regard to any information exchange which is necessary for the fulfilment of the respective tasks of the authority and these bodies. the authority should make its best efforts to share information with such bodies on their request , within the limits posed by legal constraints , including data protection legislation. in addition , the authority should enable effective information exchange between all financial supervisors in the aml/cft supervisory system and the aforementioned authorities , and such cooperation and information exchanges should take place in a structured and efficient way , in order to draw on the experience of other relevant union institutions , bodies , offices and agencies.


### (4) ‘non-financial supervisor’ means a supervisor in charge of obliged entities listed in article 3 of [amlr] , other than credit and financial institutions. ### (4) ‘non-financial supervisor’ means a supervisor in charge of obliged entities listed in article 3 of [amlr] , other than credit institutions , financial institutions and independent legal professionals that are (i) registered with a self-regulatory body and (ii) bound by professional secrecy under the rule of law , taking account of the fact that the legal profession is self-regulatory by nature.


### each credit institution assessed pursuant to article 12 that has a high inherent risk profile in at least four member states and that has been under supervisory or other public investigation for material breaches of the acts referred to in article 1(2) in at least one of those member states in the previous three years; ### each credit institution assessed pursuant to article 12 that has a high inherent risk profile in at least two member states and that has been under supervisory or other public investigation for material breaches of the acts referred to in article 1(2) in at least one of those member states in the previous three years;


### 1. the authority may require selected obliged entities and natural or legal persons belonging to them , and third parties to whom the selected obliged entities have outsourced operational functions or activities and natural or legal persons affiliated to them , to provide all information that is necessary in order to carry out the tasks conferred on it by this regulation. ### 1. the authority may require selected obliged entities and natural or legal persons belonging to them , and third parties to whom the selected obliged entities have outsourced operational functions or activities and natural or legal persons affiliated to them , to provide all information that is necessary in order to carry out the tasks conferred on it by this regulation. any infringement of professional secrecy inherent in the legal profession should be avoided as breaching this basic principle would undermine judicial independence.


### 1. the authority may require selected obliged entities and natural or legal persons belonging to them , and third parties to whom the selected obliged entities have outsourced operational functions or activities and natural or legal persons affiliated to them , to provide all information that is necessary in order to carry out the tasks conferred on it by this regulation. ### 1. the authority may require selected obliged entities and natural or legal persons belonging to them , including their employees , and third parties to whom the selected obliged entities have outsourced operational functions or activities and natural or legal persons affiliated to them. to provide all information that is necessary in order to carry out the tasks conferred on it by this regulation and other instruments of union law.


### 2. the persons referred to in paragraph 1 or their representatives and , in the case of legal persons or associations having no legal personality , the persons authorised to represent them by law or by their constitution , shall supply the information requested. lawyers duly authorised to act may supply the information on behalf of their clients. the latter shall remain fully responsible if the information supplied is incomplete , incorrect or misleading. ### 2. the authority may require clients , counterparts and any other natural or legal persons involved in business dealings or transactions with the selected obliged entity to provide information for the purpose of verifying the information obtained pursuant to paragraph 1.


### 1. where a supervisory authority in the non-financial sector has not applied the union acts or the national legislation referred to in article 1(2) , or has applied them in a way which appears to be a breach of union law , in particular by failing to ensure that an entity under its supervision or oversight satisfies the requirements laid down in those acts or in that legislation , the authority shall act in accordance with the powers set out in paragraphs 2 , 3 , 4 , 6 and 7 of this article. ### 1. where a supervisory authority in the non-financial sector has not applied the union acts or the national legislation referred to in article 1(2) , or has applied them in a way which breaches union law , in particular by failing to ensure that an entity under its supervision or oversight satisfies the requirements laid down in those acts or in that legislation , the authority shall act in accordance with the powers set out in paragraphs 2 , 3 , 4 , 6 and 7 of this article.


### the supervisory authority shall , without delay , provide the authority with all information which the authority considers necessary for its investigation including information on how the union acts or in that legislation referred to in article 1(2) are applied in accordance with union law. ### the supervisory authority shall , without delay , provide the authority with all information relevant for the investigation including information on how the union acts or in that legislation referred to in article 1(2) are applied in accordance with union law.


### before issuing such a recommendation , the authority shall engage with the supervisory authority concerned , where it considers such engagement appropriate in order to resolve a breach of union law , in an attempt to reach agreement on the actions necessary for compliance with union law. ### before issuing such a recommendation , the authority shall engage with the supervisory authority concerned , in an attempt to reach agreement on the actions necessary for compliance with union law.


### the supervisory authority in the non-financial sector shall , within ten working days of receipt of the recommendation , inform the authority of the steps it has taken or intends to take to ensure compliance with union law. ### the supervisory authority in the non-financial sector shall , within two months of the recommendation , inform the authority of the steps it has taken or intends to take to ensure compliance with union law.


### 4. where the supervisory authority in the non-financial sector has not complied with union law within one month from receipt of the authority’s recommendation , the commission may , after having been informed by the authority , or on its own initiative , issue a formal opinion requiring the supervisory authority in the non-financial sector to take the action necessary to comply with union law. the commission’s formal opinion shall take into account the authority’s recommendation. ### 4. where a supervisory authority in the non-financial sector other than those in charge of the obliged entities listed in article 3 (3) (b) of the [aml regulation] has not complied with union law within one month from receipt of the authority’s recommendation , the commission may , after having been informed by the authority , or on its own initiative , issue a formal opinion requiring the supervisory authority in the non-financial sector to take the action necessary to comply with union law. the commission’s formal opinion shall take into account the authority’s recommendation.


### 1. the fiu of each member state may delegate one staff member to the authority. the national fiu delegate shall have his or her regular place of work at the seat of the authority. ### 1. the fiu of each member state shall delegate one staff member to the authority. the national fiu delegate shall have his or her regular place of work at the seat of the authority.


### 3. the five members of the executive board referred to in paragraph 1 , point (b) , shall be selected following an open selection procedure which shall be published in the official journal of the european union. they shall be appointed by the general board based on the shortlist drawn by the commission. the selection shall respect the principles of experience , qualification , and , to the extent possible , gender and geographical balance. ### 3. the five members of the executive board referred to in paragraph 1 , point (b) , shall be selected following an open selection procedure which shall be published in the official journal of the european union. they shall be appointed by the general board based on a gender-balanced shortlist drawn by the commission , at the end of a hearing and approval procedure carried out by the european parliament. the selection shall respect the principles of experience , qualification , gender and geographical balance.


### 2. if the chair of the authority no longer fulfils the conditions required for the performance of his or her duties or has been guilty of serious misconduct , the council may , following a proposal by the general board in either composition , adopt an implementing decision to remove the chair of the authority from office. the council shall act by qualified majority. ### 2. if the chair of the authority no longer fulfils the conditions required for the performance of his or her duties or has been guilty of serious misconduct , the council shall , following a proposal by the general board in either composition and after consultation of the european parliament , adopt an implementing decision to remove the chair of the authority from office. the council shall act by qualified majority.


### 4. the executive director shall be selected on the grounds of merit and documented high-level administrative , budgetary and management skills , following an open selection procedure which shall be published in the official journal of the european union , and , as appropriate , other press or internet sites. the commission shall draw up a shortlist of two qualified candidates for the position of the executive director. the executive board shall appoint the executive director. ### 4. the executive director shall be selected on the grounds of merit and documented high-level administrative , budgetary and management skills , following an open selection procedure which respects the gender balance principle , shall be published in the official journal of the european union , and , as appropriate , other press or internet sites. the commission shall draw up a gender balanced shortlist of two qualified candidates for the position of the executive director , submitted to the european parliament for approval. the executive board shall then appoint the executive director.


### 1. the executive director shall be in charge of the day-to-day management of the authority and shall aim to ensure gender balance within the authority. in particular , the executive director shall be responsible for: ### 1. the executive director shall be in charge of the day-to-day management of the authority and shall aim to ensure gender balance within the authority , at all levels of staff. in particular , the executive director shall be responsible for:


### 1. the authority may conclude working arrangements with union institutions , union decentralised agencies and other union bodies , acting in the field of law enforcement and judicial cooperation. those working arrangements may be of a strategic or technical nature , and shall in particular aim to facilitate cooperation and the exchange of information between the parties thereto. the working arrangements shall neither form the basis for allowing the exchange of personal data nor shall bind the union or its member states. ### 1. the authority shall conclude working arrangements with union institutions , union decentralised agencies and other union bodies , acting in the field of law enforcement and judicial cooperation. those working arrangements may be of a strategic or technical nature , and shall in particular aim to facilitate cooperation and the exchange of information between the parties thereto. the working arrangements shall neither form the basis for allowing the exchange of personal data nor shall bind the union or its member states.


### 2. the authority shall establish and maintain a close relationship with olaf , europol , eurojust , and the eppo. to that end , the authority shall conclude separate working arrangements with olaf , europol , eurojust , and the eppo setting out the details of their cooperation. the relationship shall aim in particular to ensure the exchange of strategic information and trends in relation to money laundering and terrorist financing threats facing the union. ### 2. the authority shall establish and maintain a close relationship with olaf , europol , eurojust , and the eppo. to that end , the authority shall conclude separate working arrangements with olaf , europol , eurojust , and the eppo setting out the details of their cooperation. the relationship shall aim in particular to ensure the exchange of relevant information and trends in relation to money laundering and terrorist financing threats facing the union.


### 1. in order to carry out the tasks conferred on it by this regulation , the authority may , subject to prior notification to the financial supervisor concerned , conduct all necessary on-site inspections at the business premises of the legal persons referred to in article 16. where the proper conduct and efficiency of the inspection so require , the authority may carry out the on-site inspection without prior announcement to those legal persons. ### 1. in order to carry out the tasks conferred on it by this regulation , the authority may , subject to prior notification to the financial or non-financial supervisor concerned , conduct all necessary on-site inspections at the business premises of the legal persons referred to in article 16. where the proper conduct and efficiency of the inspection so require , the authority may carry out the on-site inspection without prior announcement to those legal persons.


### (63) since the authority will have a full range of powers and tasks related to direct and indirect supervision and oversight of all obliged entities , it is necessary that these powers remain consolidated within one union body , and do not give rise to conflicting competences with other union bodies. therefore , the european banking authority should not retain its tasks and powers related to anti-money laundering and countering the financing of terrorism , and the respective articles in regulation (eu) no 1093/2010 of the european parliament and of the council46 should be deleted. the resources allocated to the european banking authority for the fulfilment of those tasks should be transferred to the authority. considering that all three european supervisory authorities (eba , esma and eiopa) will be cooperating with the authority , and may attend the meetings of the general board in supervisory composition as observers , the same possibility should be afforded to the authority in respect of meetings of the board of supervisors of the european supervisory authorities. in cases where the respective boards of supervisors discuss or decide on matters that are relevant for the execution of the authority’s tasks and powers , the authority should be able to participate in their meetings as an observer. the articles on the compositions of the board of supervisors in regulation (eu) no 1093/2010 , regulation (eu) 1094/2010 of the european parliament and the council47 , and regulation (eu) 1095/2010 of the european parliament and the council48 should therefore be amended accordingly. ### (63) since the authority will have a full range of powers and tasks related to direct and indirect supervision and oversight of all obliged entities , it is necessary that these powers remain consolidated within one union body , and do not give rise to conflicting competences with other union bodies. therefore , the european banking authority should not retain its tasks and powers related to anti-money laundering and countering the financing of terrorism , and the respective articles in regulation (eu) no 1093/2010 of the european parliament and of the council46 should be deleted. the resources allocated to the european banking authority for the fulfilment of those tasks should be transferred to the authority. considering that all three european supervisory authorities (eba , esma and eiopa) will be cooperating with the authority , and may attend the meetings of the general board in supervisory composition as observers , the same possibility should be afforded to the authority in respect of meetings of the board of supervisors of the european supervisory authorities , in order to ensure a smooth exchange of information and draw on relevant experiences. in cases where the respective boards of supervisors discuss or decide on matters that are relevant for the execution of the authority’s tasks and powers , the authority should be able to participate in their meetings as an observer. the articles on the compositions of the board of supervisors in regulation (eu) no 1093/2010 , regulation (eu) 1094/2010 of the european parliament and the council47 , and regulation (eu) 1095/2010 of the european parliament and the council48 should therefore be amended accordingly.


### 1. the authority shall , with a view to establishing consistent , efficient and effective supervisory and fiu-related practices , and to ensuring the common , uniform and consistent application of union law , issue guidelines addressed to all supervisory authorities , fius , or all obliged entities and issue recommendations to one or more supervisory authorities or to one or more obliged entities. ### 1. the authority shall , with a view to establishing consistent , efficient and effective supervisory and fiu-related practices , and to ensuring the common , uniform and consistent application of union law , issue guidelines addressed to all supervisory authorities , fius , or all obliged entities and issue recommendations to one or more supervisory authorities or to one or more obliged entities. the authority shall work closely with other union institutions , bodies , offices and agencies involved in the aml/cft framework , in order to enhance efficiency and avoid overlaps.


### 1. when carrying out the tasks conferred upon them by this regulation , the members of the general board in both compositions referred to in article 46(2) points (a) and (b) and (3) points (a) and (b) shall act independently and objectively in the sole interest of the union as a whole and shall neither seek nor take instructions from union institutions , bodies , offices nor agencies from any government or any other public or private body. ### 1. when carrying out the tasks conferred upon them by this regulation , the members of the general board in both compositions referred to in article 46(2) points (a) and (b) and (3) points (a) and (b) shall act independently and objectively in the sole interest of the union as a whole and shall neither seek nor take instructions from union institutions , bodies , national supervisors , offices nor agencies from any government or any other public or private body.


### 2. member states , union institutions , agencies , offices or bodies , and any other public or private body , shall not seek to influence the members of the general board in the performance of its tasks. ### 2. member states , union institutions , agencies , offices or bodies , national supervisors , and any other public or private body , shall not seek to influence the members of the general board in the performance of its tasks.


### 3. the general board shall lay down , in its rules of procedure , the practical arrangements for the prevention and the management of conflict of interest. ### 3. the general board shall lay down , in its rules of procedure , the practical arrangements for the prevention and the management of conflict of interest so that the authority's ability to carry out high quality supervision , launch investigations and impose administrative pecuniary sanctions throughout the union , as specified in article 21 and 22 , is ensured.


### (8) in order to avoid imposing a disproportionate financial and administrative burden on union institutions , bodies and agencies , the cybersecurity risk management requirements should be proportionate to the risk presented by the network and information system concerned , taking into account the state of the art of such measures. each union institution , body and agency should aim to allocate an adequate percentage of its it budget to improve its level of cybersecurity; in the longer term a target in the order of 10% should be pursued. ### (8) in order to avoid imposing a disproportionate financial and administrative burden on union institutions , bodies and agencies , the cybersecurity risk management requirements should be proportionate to the risk presented by the network and information system concerned , taking into account the state of the art of such measures. each union institution , body and agency should aim to allocate an adequate percentage of its it budget to improve its level of cybersecurity; in the longer term a target in the order of 10% should be pursued. in accordance with the edps recommendation , the minimum security requirements laid down by this regulation should be equal to or higher than this minimum security requirements of the entities of nis and nis 2.0 proposals.


### (11) in may 2011 , the secretaries-general of the union institutions and bodies decided to establish a pre-configuration team for a computer emergency response team for the union’s institutions , bodies and agencies (cert-eu) supervised by an inter-institutional steering board. in july 2012 , the secretaries-general confirmed the practical arrangements and agreed to maintain cert-eu as a permanent entity to continue to help improve the overall level of information technology security of the union’s institutions , bodies and agencies as an example of visible inter-institutional cooperation in cybersecurity. in september 2012 , cert-eu was established as a taskforce of the european commission with an interinstitutional mandate. in december 2017 , the union institutions and bodies concluded an interinstitutional arrangement on the organisation and operation of cert-eu3 . this arrangement should continue to evolve to support the implementation of this regulation. ### (11) in may 2011 , the secretaries-general of the union institutions and bodies decided to establish a pre-configuration team for a computer emergency response team for the union’s institutions , bodies and agencies (cert-eu) supervised by an inter-institutional steering board. in july 2012 , the secretaries-general confirmed the practical arrangements and agreed to maintain cert-eu as a permanent entity to continue to help improve the overall level of information technology security of the union’s institutions , bodies and agencies as an example of visible inter-institutional cooperation in cybersecurity. in september 2012 , cert-eu was established as a permanent taskforce of the european commission with an interinstitutional mandate. in december 2017 , the union institutions and bodies concluded an interinstitutional arrangement on the organisation and operation of cert-eu3 . this arrangement should continue to evolve to support the implementation of this regulation.


### 2. for the application of administrative and financial procedures , the head of cert-eu shall act under the authority of the commission. ### 2. for the application of administrative and financial procedures , the head of cert-eu shall act under the authority of the commission , after the approval of iicb.


### 3. cert-eu tasks and activities , including services provided by cert-eu pursuant to article 12(2) , (3) , (4) , (6) , and article 13(1) to union institutions , bodies and agencies financed from the heading of the multiannual financial framework dedicated to european public administration , shall be funded through a distinct budget line of the commission budget. cert-eu earmarked posts shall be detailed in a footnote to the commission establishment plan. ### 3. cert-eu tasks and activities , including services provided by cert-eu pursuant to article 12(2) , (3) , (4) , (6) , and article 13(1) to union institutions , bodies and agencies financed from the heading of the multiannual financial framework dedicated to european public administration , shall be funded through a distinct budget line of the commission budget. cert-eu earmarked posts shall be detailed in a footnote to the commission establishment plan. this establishment plan shall be subject to a midterm review , every 2 ,5 years.


### (4) the union institutions , bodies and agencies are attractive targets who face highly skilled and well-resourced threat actors as well as other threats. at the same time , the level and maturity of cyber resilience and the ability to detect and respond to malicious cyber activities varies significantly across those entities. it is thus necessary for the functioning of the european administration that the institutions , bodies and agencies of the union achieve a high common level of cybersecurity through a cybersecurity baseline (a set of minimum cybersecurity rules with which network and information systems and their operators and users have to be compliant to minimise cybersecurity risks) , information exchange and collaboration. ### (4) the union institutions , bodies and agencies are attractive targets who face highly skilled and well-resourced threat actors as well as other threats. at the same time , the level and maturity of cyber resilience and the ability to detect and respond to malicious cyber activities varies significantly across those entities. it is thus necessary for the functioning of the european administration that the institutions , bodies and agencies of the union achieve a high common level of cybersecurity through a cybersecurity measure (a set of minimum cybersecurity rules with which network and information systems and their operators and users have to be compliant to minimise cybersecurity risks) , information exchange and collaboration.


### (22) all personal data processed under this regulation should be processed in accordance with data protection legislation including regulation (eu) 2018/1725 of the european parliament and of the council.7 ### (22) all personal data processed under this regulation should be processed in accordance with union data protection legislation including regulation (eu) 2018/1725 of the european parliament and of the council.7the cert-eu and iicb should work in close cooperation with the edps and staff specialised in data protection in the union institutions , bodies and agencies to ensure the full compliance with union data protection legislation.


### (22) all personal data processed under this regulation should be processed in accordance with data protection legislation including regulation (eu) 2018/1725 of the european parliament and of the council.7 ### (22) all personal data processed under this regulation should be processed in accordance with data protection legislation including regulation (eu) 2018/1725 of the european parliament and of the council.7this regulation shall not affect the application of existing eu laws governing the processing of personal data , including the tasks and powers of the edps.


### this regulation applies to the management , governance and control of cybersecurity risks by all union institutions , bodies and agencies and to the organisation and operation of cert-eu and the interinstitutional cybersecurity board. ### this regulation applies to the management , governance and control of cybersecurity risks by all union institutions , bodies and agencies and to the organisation and operation of cert-eu and the interinstitutional cybersecurity board. the minimum security requirements should be at least equal or higher than the minimum security requirements of the entities in the nis 2.0 directive.


### 2. the provisions of regulation (ec) no 1049/2001 of the european parliament and the council9 shall apply with regard to requests for public access to documents held by cert-eu , including the obligation under that regulation to consult other union institutions , bodies and agencies whenever a request concerns their documents. ### 2. the provisions of regulation (ec) no 1049/2001 of the european parliament and the council9 shall apply with regard to requests for public access to documents held by cert-eu , including the obligation under that regulation to consult other union institutions , bodies and agencies , or a member state , whenever a request concerns their documents.


### 4. the handling of information by cert-eu and its union institutions , bodies and agencies shall be in line with the rules laid down in [proposed regulation on information security]. ### 4. the handling of information by cert-eu and its union institutions , bodies and agencies shall be in line with the rules laid down in [proposed regulation on information security]. when cooperating with other counterparts similar information handling should be used by the cert-eu.


### 5. any contacts with cert-eu initiated or sought by national security and intelligence services shall be communicated to the commission’s security directorate and the chair of the iicb without undue delay. ### 5. any contacts with cert-eu initiated or sought by national security and intelligence services shall be communicated to the commission’s security directorate , europol and the chair of the iicb without undue delay.


### 1. to enable cert-eu to coordinate vulnerability management and incident response , it may request union institutions , bodies and agencies to provide it with information from their respective it system inventories that is relevant for the cert-eu support. the requested institution , body or agency shall transmit the requested information , and any subsequent updates thereto , without undue delay. ### 1. to enable cert-eu to coordinate vulnerability management and incident response , it may request union institutions , bodies and agencies to provide it with information from their respective it system inventories that is relevant for the cert-eu support , including any changes in their it environment. the requested institution , body or agency shall transmit the requested information , and any subsequent updates thereto , without undue delay.


### 1. to enable cert-eu to coordinate vulnerability management and incident response , it may request union institutions , bodies and agencies to provide it with information from their respective it system inventories that is relevant for the cert-eu support. the requested institution , body or agency shall transmit the requested information , and any subsequent updates thereto , without undue delay. ### 1. to enable cert-eu to coordinate incident handling response , it may request union institutions , bodies and agencies to provide it with information from their respective it system inventories that is relevant for the cert-eu support. the requested institution , body or agency shall transmit the requested information , and any subsequent updates thereto , without undue delay.


### 3. cert-eu may only exchange incident-specific information which reveals the identity of the union institution , body or agency affected by the incident with the consent of that entity. cert-eu may only exchange incident-specific information which reveals the identity of the target of the cybersecurity incident with the consent of the entity affected by the incident. ### 3. cert-eu may only exchange incident-specific information which reveals the identity of the union institution , body or agency affected by the incident with the consent of that entity , except where such exchange is essential to prevent an imminent cybersecurity-incident affecting other union institution , body or agency. cert-eu may only exchange incident-specific information which reveals the identity of the target of the cybersecurity incident with the consent of the entity affected by the incident , except where such exchange is essential to prevent an imminent cybersecurity-incident affecting other union institution , body or agency.


### 4. the sharing obligations shall not extend to eu classified information (euci) and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu. ### 4. the sharing obligations shall not extend to eu classified information (euci) and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu , except if europol decides that the sharing obligation shall be extended to that information.


### 4. the sharing obligations shall not extend to eu classified information (euci) and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu. ### 4. the sharing obligations shall not extend to eu classified information (euci) and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu , unless they decide otherwise at a later stage.


### 5. the notification obligations shall not extend to euci and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu. ### 5. the notification obligations shall not extend to euci and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu , except if europol decides that the notification obligation shall be extended to that information.


### 5. the notification obligations shall not extend to euci and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu. ### 5. the notification obligations shall not extend to euci and to information that a union institution , body or agency has received from a member state security or intelligence service or law enforcement agency under the explicit condition that it will not be shared with cert-eu , unless they decide otherwise at a later stage.


### 4. the iicb shall issue guidance on incident response coordination and cooperation for significant incidents. where the criminal nature of an incident is suspected , cert-eu shall advise on how to report the incident to law enforcement authorities. ### 4. the iicb shall issue guidance on incident response coordination and cooperation for significant incidents. where the criminal nature of an incident is suspected , cert-eu shall advise on how to comply with their obligation to report the incident to competent law enforcement authorities.


### 4. the iicb shall issue guidance on incident response coordination and cooperation for significant incidents. where the criminal nature of an incident is suspected , cert-eu shall advise on how to report the incident to law enforcement authorities. ### 4. the iicb shall issue guidance on incident response coordination and cooperation for significant incidents. where the criminal nature of an incident is suspected , cert-eu shall report the incident to law enforcement authorities without undue delay.


### (6) to reach a high common level of cybersecurity , it is necessary that each union institution , body and agency establishes an internal cybersecurity risk management , governance and control framework that ensures an effective and prudent management of all cybersecurity risks , and takes account of business continuity and crisis management. ### (6) to reach a high common level of cybersecurity , it is necessary that each union institution , body and agency establishes an internal cybersecurity risk management , handling of incident , governance and control framework that ensures an effective and prudent management of all cybersecurity risks , and takes account of business continuity and crisis management.


### (7) the differences between union institutions , bodies and agencies require flexibility in the implementation since one size will not fit all. the measures for a high common level of cybersecurity should not include any obligations directly interfering with the exercise of the missions of union institutions , bodies and agencies or encroaching on their institutional autonomy. thus , those institutions , bodies and agencies should establish their own frameworks for cybersecurity risk management , governance and control , and adopt their own baselines and cybersecurity plans. ### (7) the differences between union institutions , bodies and agencies require flexibility in the implementation since one size will not fit all. the measures for a high common level of cybersecurity should not include any obligations directly interfering with the exercise of the missions of union institutions , bodies and agencies or encroaching on their institutional autonomy. thus , those institutions , bodies and agencies should establish their own frameworks for cybersecurity risk management , handling of incident , governance and control , and adopt their own baselines and cybersecurity plans.


### (9) a high common level of cybersecurity requires cybersecurity to come under the oversight of the highest level of management of each union institution , body and agency , who should approve a cybersecurity baseline that should address the risks identified under the framework to be established by each institution , body and agency. addressing the cybersecurity culture , i.e. the daily practice of cybersecurity , is an integral part of a cybersecurity baseline in all union institutions , bodies and agencies. ### (9) a high common level of cybersecurity requires cybersecurity to come under the oversight of the highest level of management of each union institution , body and agency , who should approve a cybersecurity measure that should address the risks identified under the framework to be established by each institution , body and agency. addressing the cybersecurity culture , i.e. the daily practice of cybersecurity , is an integral part of a cybersecurity measure in all union institutions , bodies and agencies.


### (10) union institutions , bodies and agencies should assess risks related to relationships with suppliers and service providers , including providers of data storage and processing services or managed security services , and take appropriate measures to address them. these measures should form part of the cybersecurity baseline and be further specified in guidance documents or recommendations issued by cert-eu. when defining measures and guidelines , due account should be taken of relevant eu legislation and policies , including risk assessments and recommendations issued by the nis cooperation group , such as the eu coordinated risk assessment and eu toolbox on 5g cybersecurity. in addition , certification of relevant ict products , services and processes could be required , under specific eu cybersecurity certification schemes adopted pursuant to article 49 of regulation eu 2019/881. ### (10) union institutions , bodies and agencies should assess risks related to relationships with suppliers and service providers , including providers of data storage and processing services or managed security services , and take appropriate measures to address them. these measures should form part of the cybersecurity measure and be further specified in guidance documents or recommendations issued by cert-eu. when defining measures and guidelines , due account should be taken of relevant eu legislation and policies , including risk assessments and recommendations issued by the nis cooperation group , such as the eu coordinated risk assessment and eu toolbox on 5g cybersecurity. in addition , certification of relevant ict products , services and processes could be required , under specific eu cybersecurity certification schemes adopted pursuant to article 49 of regulation eu 2019/881.


### (13) many cyberattacks are part of wider campaigns that target groups of union institutions , bodies and agencies or communities of interest that include union institutions , bodies and agencies. to enable proactive detection , incident response or mitigating measures , union institutions , bodies and agencies should notify cert-eu of significant cyber threats , significant vulnerabilities and significant incidents and share appropriate technical details that enable detection or mitigation of , as well as response to , similar cyber threats , vulnerabilities and incidents in other union institutions , bodies and agencies. following the same approach as the one envisaged in directive [proposal nis 2] , where entities become aware of a significant incident they should be required to submit an initial notification to cert-eu within 24 hours. such information exchange should enable cert-eu to disseminate the information to other union institutions , bodies and agencies , as well as to appropriate counterparts , to help protect the union it environments and the union’s counterparts’ it environments against similar incidents , threats and vulnerabilities. ### (13) many cyberattacks are part of wider campaigns that target groups of union institutions , bodies and agencies or communities of interest that include union institutions , bodies and agencies. to enable proactive detection , incident response or mitigating measures , union institutions , bodies and agencies should notify cert-eu of significant cyber threats , significant vulnerabilities , near misses and significant incidents and share appropriate technical details that enable detection or mitigation of , as well as response to , similar cyber threats , vulnerabilities , near misses and incidents in other union institutions , bodies and agencies. following the same approach as the one envisaged in directive [proposal nis 2] , where entities become aware of a significant incident they should be required to submit an early warning to cert-eu within 24 hours. such information exchange should enable cert-eu to disseminate the information to other union institutions , bodies and agencies , as well as to appropriate counterparts , to help protect the union it environments and the union’s counterparts’ it environments against similar incidents , threats and vulnerabilities.


### obligations on union institutions , bodies and agencies to establish an internal cybersecurity risk management , governance and control framework; ### obligations on union institutions , bodies and agencies to establish an internal cybersecurity risk management , handling of incidents , governance and control framework;


### (5) ‘highest level of management’ means a manager , management or coordination and oversight body at the most senior administrative level , taking account of the high-level governance arrangements in each union institution , body or agency; ### (5) ‘highest level of management’ means a manager , management or coordination and oversight body at the most senior administrative level , taking account of the high-level governance arrangements in each union institution , body or agency responsible of the functioning of the union institution , body or agency;


### (8) ‘major attack’ means any incident requiring more resources than are available at the affected union institution , body or agency and at cert-eu; ### (8) ‘major incident’ means any incident affecting two or more union institution , body or agency , or requiring more resources than are available at the affected union institution , body or agency and at cert-eu;


### (11) ‘significant cyber threat’ means a cyber threat with the intention , opportunity and capability to cause a significant incident; ### (11) ‘significant cyber threat’ means a cyber threat within the meaning of article 4(7a) of directive [proposal nis 2];


### (14) ‘cybersecurity risk’ means any reasonably identifiable circumstance or event having a potential adverse effect on the security of network and information systems; ### (14) ‘risk’ means cybersecurity risk within the meaning of article 4(7b) of directive [proposal nis 2];


### (16) ‘cybersecurity baseline’ means a set of minimum cybersecurity rules with which network and information systems and their operators and users must be compliant , to minimise cybersecurity risks. ### (16) ‘cybersecurity measures’ means a set of minimum cybersecurity rules and measures with which network and information systems and their operators and users must be compliant , to minimise cybersecurity risks.


### risk management , governance and control ### risk management , handling , governance and control


### 1. each union institution , body and agency shall establish its own internal cybersecurity risk management , governance and control framework (‘the framework’) in support of the entity’s mission and exercising its institutional autonomy. this work shall be overseen by the entity’s highest level of management to ensure an effective and prudent management of all cybersecurity risks. the framework shall be in place by …. at the latest [15 months after the entry into force of this regulation]. ### 1. each union institution , body and agency shall establish its own internal cybersecurity risk management , handling of incidents , governance and control framework (‘the framework’) in support of the entity’s mission and exercising its institutional autonomy. this work shall be overseen by the entity’s highest level of management to ensure an effective and prudent management of all cybersecurity risks. the framework shall be in place by …. at the latest [15 months after the entry into force of this regulation].


### 3. the highest level of management of each union institution , body and agency shall provide oversight over the compliance of their organisation with the obligations related to cybersecurity risk management , governance , and control , without prejudice to the formal responsibilities of other levels of management for compliance and risk management in their respective areas of responsibility. ### 3. the highest level of management of each union institution , body and agency shall provide oversight over the compliance and functioning of their organisation with the obligations related to cybersecurity risk management , handling , governance , and control , without prejudice to the formal responsibilities of other levels of management for compliance and risk management in their respective areas of responsibility.


### 5 cybersecurity baseline ### 5 cybersecurity measures


### 1. the highest level of management of each union institution , body and agency shall approve the entity’s own cybersecurity baseline to address the risks identified under the framework referred to in article 4(1). it shall do so in support of its mission and exercising its institutional autonomy. the cybersecurity baseline shall be in place by …. at the latest [18 months after the entry into force of this regulation] and shall address the domains listed in annex i and the measures listed in annex ii. ### 1. the highest level of management of each union institution , body and agency shall approve the entity’s own cybersecurity measures to address the risks identified under the framework referred to in article 4(1). it shall do so in support of its mission and exercising its institutional autonomy. the cybersecurity measures shall be in place by …. at the latest [18 months after the entry into force of this regulation] and shall address the domains listed in annex i and the measures listed in annex ii.


### each union institution , body and agency shall carry out a cybersecurity maturity assessment at least every three years , incorporating all the elements of their it environment as described in article 4 , taking account of the relevant guidance documents and recommendations adopted in accordance with article 13. ### each union institution , body and agency shall carry out a cybersecurity maturity assessment by at the latest [6 months after the entry into force of this regulation] , and at least every two years thereafter , incorporating all the elements of their it environment as described in article 4 , taking account of the relevant guidance documents and recommendations adopted in accordance with article 13.


### 1. following the conclusions derived from the maturity assessment and considering the assets and risks identified pursuant to article 4 , the highest level of management of each union institution , body and agency shall approve a cybersecurity plan without undue delay after the establishment of the risk management , governance and control framework and the cybersecurity baseline. the plan shall aim at increasing the overall cybersecurity of the concerned entity and shall thereby contribute to the achievement or enhancement of a high common level of cybersecurity among all union institutions , bodies and agencies. to support the entity’s mission on the basis of its institutional autonomy , the plan shall at least include the domains listed in annex i , the measures listed in annex ii , as well as measures related to incident preparedness , response and recovery , such as security monitoring and logging. the plan shall be revised at least every three years , following the maturity assessments carried out pursuant to article 6. ### 1. following the conclusions derived from the maturity assessment and considering the assets and risks identified pursuant to article 4 , the highest level of management of each union institution , body and agency shall approve a cybersecurity plan without undue delay after the establishment of the risk management , handling , governance and control framework and the cybersecurity measures. the plan shall aim at increasing the overall cybersecurity of the concerned entity and shall thereby contribute to the achievement or enhancement of a high common level of cybersecurity among all union institutions , bodies and agencies. to support the entity’s mission on the basis of its institutional autonomy , the plan shall at least include the domains listed in annex i , the measures listed in annex ii , as well as measures related to incident preparedness , response , handling and recovery , such as security monitoring and logging. the plan shall be revised at least every two years , following the maturity assessments carried out pursuant to article 6.


### 9. the head of cert-eu , or his or her alternate , shall participate in iicb meetings except where otherwise decided by the iicb. ### 9. the head of cert-eu , or his or her alternate , shall participate in iicb meetings. in exceptional cases , and in accordance with the internal rules of procedure of the iicb , the iicb may decide otherwise.


### 10. the secretariat of the iicb shall be provided by the commission. ### 10. the secretariat of the iicb shall be provided by the enisa.


### 11. the representatives nominated by the euan upon a proposal of the ict advisory committee shall relay the iicb’s decisions to the union agencies and joint undertakings. any union agency and body shall be entitled to raise with the representatives or the chair of the iicb any matter which it considers should be brought to the iicb’s attention. ### 11. the representatives nominated by the euan shall relay the iicb’s decisions to the union agencies and joint undertakings. any union agency and body shall be entitled to raise with the representatives or the chair of the iicb any matter which it considers should be brought to the iicb’s attention.


### 12. the iicb may act by a simplified written procedure initiated by the chair under which the relevant decision shall be deemed approved within the timeframe set by the chair , except where a member objects. ### deleted


### establish as many technical advisory groups as necessary to assist the iicb’s work , approve their terms of reference and designate their respective chairs. ### establish as many technical advisory groups as necessary , with concrete tasks to assist the iicb’s work , approve their terms of reference and designate their respective chairs.


### 1. the mission of cert-eu , the autonomous interinstitutional cybersecurity centre for all union institutions , bodies and agencies , shall be to contribute to the security of the unclassified it environment of all union institutions , bodies and agencies by advising them on cybersecurity , by helping them to prevent , detect , mitigate and respond to incidents and by acting as their cybersecurity information exchange and incident response coordination hub. ### 1. the mission of cert-eu , the autonomous interinstitutional cybersecurity centre for all union institutions , bodies and agencies , shall be to contribute to the security of the unclassified it environment of all union institutions , bodies and agencies by advising them on cybersecurity , by helping them to prevent , detect , handle , mitigate and respond to incidents and by acting as their cybersecurity information exchange and incident response coordination hub.


### raise to the attention of the iicb any issue relating to the implementation of this regulation and of the implementation of the guidance documents , recommendations and calls for action; ### raise to the attention of the iicb any issue relating to the implementation of this regulation and of the implementation of the article 13;


### report on the cyber threats faced by the union institutions , bodies and agencies and contribute to the eu cyber situational awareness. ### collect the cyber threats faced by the union institutions , bodies and agencies in order to contribute to the eu cyber situational awareness.


### 4. cert-eu shall engage in structured cooperation with the european union agency for cybersecurity on capacity building , operational cooperation and long-term strategic analyses of cyber threats in accordance with regulation (eu) 2019/881 of the european parliament and of the council. ### 4. cert-eu shall engage in structured cooperation with the european union agency for cybersecurity on capacity building , operational cooperation and long-term strategic analyses of cyber threats in accordance with regulation (eu) 2019/881 of the european parliament and of the council. furthermore , cert-eu may cooperate and exchange information with europol’s cybercrime centre.


### modalities for or improvements to cybersecurity risk management and the cybersecurity baseline; ### modalities for or improvements to cybersecurity risk management and the cybersecurity measure;


### 3. the iicb may adopt guidance documents or recommendations on proposal of cert-eu. ### deleted


### 4. the iicb may instruct cert-eu to issue , withdraw or modify a proposal for guidance documents or recommendations , or a call for action. ### deleted


### the head of cert-eu shall regularly submit reports to the iicb and the iicb chair on the performance of cert-eu , financial planning , revenue , implementation of the budget , service level agreements and written agreements entered into , cooperation with counterparts and partners , and missions undertaken by staff , including the reports referred to in article 10(1). ### the head of cert-eu shall , at least once a year , submit reports to the iicb and the iicb chair on the performance of cert-eu , financial planning , revenue , implementation of the budget , service level agreements and written agreements entered into , cooperation with counterparts and partners , and missions undertaken by staff , including the reports referred to in article 10(1).


### 1. the commission , after having obtained the unanimous approval of the iicb , shall appoint the head of cert-eu. the iicb shall be consulted at all stages of the procedure prior to the appointment of the head of cert-eu , in particular in drafting vacancy notices , examining applications and appointing selection boards in relation to this post. ### 1. the commission , after having obtained the approval of the iicb by qualified majority , shall appoint the head of cert-eu. the iicb shall be consulted at all stages of the procedure prior to the appointment of the head of cert-eu , in particular in drafting vacancy notices , examining applications and appointing selection boards in relation to this post.


### 1. cert-eu shall cooperate and exchange information with national counterparts in the member states , including certs , national cybersecurity centres , csirts , and single points of contact referred to in article 8 of directive [proposal nis 2] , on cyber threats , vulnerabilities and incidents , on possible countermeasures and on all matters relevant for improving the protection of the it environments of union institutions , bodies and agencies , including through the csirts network referred to in article 13 of directive [proposal nis 2]. ### 1. cert-eu shall cooperate and exchange information with national counterparts in the member states , including certs , national cybersecurity centres , csirts , and single points of contact referred to in article 8 of directive [proposal nis 2] , on cyber threats , vulnerabilities , incidents and near misses on possible countermeasures as well as best practices and on all matters relevant for improving the protection of the it environments of union institutions , bodies and agencies , including through the csirts network referred to in article 13 of directive [proposal nis 2]. the cert-eu shall support the commission in the eu-cyclone referred to in article 14 of directive [proposal nis 2] on coordinated management of major incidents and crises.


### 1. cert-eu may cooperate with non-member state counterparts including industry sector-specific counterparts on tools and methods , such as techniques , tactics , procedures and best practices , and on cyber threats and vulnerabilities. for all cooperation with such counterparts , including in frameworks where non-eu counterparts cooperate with national counterparts of member states , cert-eu shall seek prior approval from the iicb. ### 1. cert-eu may cooperate with non-member state counterparts that are subject to european cybersecurity requeriments or requeriments of similar nature , including industry sector-specific counterparts , on tools and methods , such as techniques , tactics , procedures and best practices , and on cyber threats and vulnerabilities. for all cooperation with such counterparts , including in frameworks where non-eu counterparts cooperate with national counterparts of member states , cert-eu shall seek prior approval from the iicb.


### 2. cert-eu may cooperate with other partners , such as commercial entities , international organisations , non-european union national entities or individual experts , to gather information on general and specific cyber threats , vulnerabilities and possible countermeasures. for wider cooperation with such partners , cert-eu shall seek prior approval from the iicb. ### 2. cert-eu may cooperate with other partners , such as commercial entities , international organisations , non-european union national entities or individual experts , to gather information on general and specific cyber threats , vulnerabilities , near misses and possible countermeasures. for wider cooperation with such partners , cert-eu shall seek prior approval from the iicb.


### 2. the union institutions , bodies and agencies , upon request from cert-eu and without undue delay , shall provide it with digital information created by the use of electronic devices involved in their respective incidents. cert-eu may further clarify which types of such digital information it requires for situational awareness and incident response. ### deleted


### all union institutions , bodies and agencies shall make an initial notification to cert-eu of significant cyber threats , significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. ### all union institutions , bodies and agencies shall make an early warning to cert-eu of significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them.


### in duly justified cases and in agreement with cert-eu , the union institution , body or agency concerned can deviate from the deadline laid down in the previous paragraph. ### deleted


### 2. the union institutions , bodies and agencies shall further notify to cert-eu without undue delay appropriate technical details of cyber threats , vulnerabilities and incidents that enable detection , incident response or mitigating measures. the notification shall include if available: ### 2. the union institutions , bodies and agencies shall further make an incident notification to cert-eu without undue delay and in any event within 72 hours after having become aware of the incident update the early warning and indicate an initial assessment of the incident with the appropriate technical details that enable detection , incident response or mitigating measures. the notification shall include if available:


### potential impact; ### potential severity and impact;


### 3. cert-eu shall submit to enisa on a monthly basis a summary report including anonymised and aggregated data on significant cyber threats , significant vulnerabilities and significant incidents notified in accordance with paragraph 1. ### 3. cert-eu shall submit to enisa on a monthly basis a summary report including anonymised and aggregated data on significant cyber threats , significant vulnerabilities , near misses and significant incidents notified.


### 4. the iicb may issue guidance documents or recommendations concerning the modalities and content of the notification. cert-eu shall disseminate the appropriate technical details to enable proactive detection , incident response or mitigating measures by union institutions , bodies and agencies. ### 4. the cert-eu may issue guidance documents or recommendations concerning the modalities and content of the notification. cert-eu shall disseminate the appropriate technical details to enable proactive detection , incident response or mitigating measures by union institutions , bodies and agencies.


### 1. in acting as a cybersecurity information exchange and incident response coordination hub , cert-eu shall facilitate information exchange with regards to cyber threats , vulnerabilities and incidents among: ### 1. in acting as a cybersecurity information exchange and incident response coordination hub , cert-eu shall facilitate information exchange with regards to cyber threats , vulnerabilities , near misses and incidents among:


### 3. cert-eu shall support union institutions , bodies and agencies regarding situational awareness of cyber threats , vulnerabilities and incidents. ### 3. cert-eu shall support union institutions , bodies and agencies regarding situational awareness of cyber threats , vulnerabilities , near misses and incidents , as well as sharing the latest developments in the field of cybersecurity.


### major attacks ### major incidents


### 1. cert-eu shall coordinate among union institutions , bodies and agencies responses to major attacks. it shall maintain an inventory of technical expertise that would be needed for incident response in the event of such attacks. ### 1. cert-eu shall coordinate among union institutions , bodies and agencies responses to major incidents. it shall maintain an inventory of technical expertise that would be needed for incident response in the event of such incident.


### 3. with the approval of the concerned union institutions , bodies and agencies , cert-eu may also call on experts from the list referred to in paragraph 2 for contributing to the response to a major attack in a member state , in line with the joint cyber unit’s operating procedures. ### 3. with the approval of the concerned union institutions , bodies and agencies , cert-eu may also call on experts from the list referred to in paragraph 2 for contributing to the response to a major incident in a member state , in line with operating procedures of eu cyclone.


### 1. the iicb , with the assistance of cert-eu , shall periodically report to the commission on the implementation of this regulation. the iicb may also make recommendations to the commission to propose amendments to this regulation. ### 1. the iicb , with the assistance of cert-eu , shall , at least once a year , report to the commission on the implementation of this regulation. the iicb may also make recommendations to the commission to propose amendments to this regulation.


### 2. the commission shall report on the implementation of this regulation to the european parliament and the council at the latest 48 months after the entry into force of this regulation and every three years thereafter. ### 2. the commission shall report on the implementation of this regulation to the european parliament and the council at the latest 36 months after the entry into force of this regulation and every two years thereafter.


### the following domains shall be addressed in the cybersecurity baseline: ### the following domains shall be addressed in the cybersecurity measures:


### union institutions , bodies and agencies shall address at least the following specific cybersecurity measures in the implementation of the cybersecurity baseline and in their cybersecurity plans , in line with the guidance documents and recommendations from the iicb: ### union institutions , bodies and agencies shall address at least the following specific cybersecurity measures in the implementation of the cybersecurity measures and in their cybersecurity plans , in line with the guidance documents and recommendations from the iicb:


### the contractual obligation to report incidents , vulnerabilities and cyber threats as well as to have appropriate incidents response and monitoring in place. ### the contractual obligation to report incidents , vulnerabilities , near misses and cyber threats as well as to have appropriate incidents response and monitoring in place.


### (5) to avoid an excessively regressive impact on contributions from the emissions trading , a maximum contribution should be established for eligible member states. for the period from 2023 to 2027 , member states are eligible if the gross national income per capita , measured in purchasing power standard and calculated on the basis of union figures for 2020 is below 90% of the eu average. for the period from 2028 to 2030 , the gross national income per capita in 2025 should be used. the maximum contribution should be established by comparing member states’ shares in the total emission trading based own resource with the shares of those member states in the union gross national income. a minimum contribution should be established for all member states if their share of the total amount of ets-based own resources is lower than 75% of their share in the union gross national income. ### (5) to avoid an excessively regressive impact on contributions from the emissions trading , a maximum contribution should be established for eligible member states until 2030. for the period from 2023 to 2027 , member states are eligible if the gross national income per capita , measured in purchasing power standard and calculated on the basis of union figures for 2020 is below 90% of the eu average. for the period from 2028 to 2030 , the gross national income per capita in 2025 should be used. the maximum contribution should be established by comparing member states’ shares in the total emission trading based own resource with the shares of those member states in the union gross national income. a minimum contribution should be established for all member states if their share of the total amount of ets-based own resources is lower than 75% of their share in the union gross national income.


### (7) in october 2021 , the organisation for economic co-operation and development and the g20 inclusive framework on base erosion and profit shifting reached an agreement on the allocation to participating market jurisdictions of 25% of residual profits of large multinational enterprises above the profitability threshold of 10% (‘oecd/g20 if pillar 1 agreement’). the own resource should consist in applying a uniform call rate to the share of residual profits of the multinational enterprises , re-allocated to member states [pursuant to the directive on implementation of the global agreement on re-allocation of taxing rights.] ### deleted