# Decision (EU) 2016/188 of the European Central BankShow full title

Decision (EU) 2016/188 of the European Central Bank of 11 December 2015 on the access and use of SSM electronic applications,            systems, platforms and services by the European Central Bank and the national competent authorities of the Single Supervisory            Mechanism (ECB/2015/47)         

        - Previous
        - Next

U.K.

# Decision (EU) 2016/188 of the European Central Bank

# of 11 December 2015

# on the access and use of SSM electronic applications, systems, platforms and services by the European Central Bank and the                        national competent authorities of the Single Supervisory Mechanism (ECB/2015/47)                     

THE GOVERNING COUNCIL OF THE EUROPEAN CENTRAL BANK,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 127(6) and Article 132 thereof,

Having regard to the Statute of the European System of Central Banks and of the European Central Bank, and in particular Article 34                           thereof,                        

Having regard to Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central                           Bank concerning policies relating to the prudential supervision of credit institutions(1), and in particular Article 6(1) in conjunction with Article 6(7) thereof,                        

Having regard to the proposal from the Supervisory Board and in consultation with the national competent authorities,

Whereas:

(1)For the performance of the specific tasks concerning policies relating to the prudential supervision of credit institutions,                              as conferred on the European Central Bank (ECB) by Regulation (EU) No 1024/2013, the ECB uses the European System of Central                              Banks (ESCB) and Eurosystem electronic applications, systems, platforms and services, as well as the new electronic applications,                              systems, platforms and services specific for carrying out the tasks entrusted to the ECB pursuant to Regulation (EU) No 1024/2013                              on the basis of Article 127(6) of the Treaty and Article 25.2 of the Statute of the European System of Central Banks and of                              the European Central Bank.

(2)It is necessary for the smooth, effective and consistent functioning of the Single Supervisory Mechanism (SSM) that practical                              arrangements for the cooperation between the ECB and the national competent authorities (NCAs) within the SSM include arrangements                              for the use of such electronic applications, systems, platforms and services that are necessary for the fulfilment of their                              responsibilities under Regulation (EU) No 1024/2013.

(3)The public key infrastructure for the European System of Central Banks (hereinafter the ‘ESCB-PKI’) was established in Decision                              ECB/2013/1(2). Pursuant to Article 3(1) of Decision ECB/2013/1, ESCB and Eurosystem electronic applications, systems, platforms and services                              with medium or above medium criticality should only be accessed and used if a user has been authenticated by means of an electronic                              certificate issued and managed by a certification authority accepted by the ESCB in accordance with the ESCB/SSM certificate                              acceptance framework, or by the ESCB-PKI certification authority or by certification authorities accepted by the ESCB for                              TARGET2 and TARGET2 Securities for those two applications.

(4)The Governing Council has identified a need for advanced information security services, such as strong authentication, electronic                              signatures and encryption, through the use of electronic certificates for the electronic applications, systems, platforms                              and services that are necessary for the fulfilment of the ECB's and NCAs' responsibilities, as competent authorities within                              the SSM, under Regulation (EU) No 1024/2013. Hence, certificates issued by the ESCB-PKI may be used to access and use electronic                              applications, systems, platforms and services used for the functioning of the SSM.

(5)The ECB and the NCAs of the SSM may decide to use certificates and services provided by the ESCB-PKI to access and use SSM                              electronic applications, systems, platforms and services,

HAS ADOPTED THIS DECISION:

## Article 1U.K.Definitions

For the purposes of this Decision:

‘national competent authority’ (NCA) means a national competent authority designated by a participating Member State in accordance                              with Article 2(2) of Regulation (EU) No 1024/2013. This meaning is without prejudice to arrangements under national law that                              assign certain supervisory tasks to a national central bank (NCB) that is not designated as an NCA. With regard to such arrangements,                              a reference to an NCA in this Decision shall also refer to the NCB in respect of the supervisory tasks assigned to it by national                              law;                           

‘competent authority’ means either an NCA or the ECB;

‘ESCB and Eurosystem electronic applications, systems, platforms and services’, ‘certificate’ or ‘electronic certificate’,                              ‘ESCB-PKI certification authority’, ‘registration authority’, ‘user’, ‘Eurosystem central bank’, and ‘relying party’ have                              the meanings defined in Article 1 of Decision ECB/2013/1;                           

‘SSM electronic applications, systems, platforms and services’ means electronic applications, systems, platforms and services                              that are used for the fulfilment of the ECB's and NCAs' responsibilities under Regulation (EU) No 1024/2013;                           

‘ESCB/SSM certificate acceptance framework’ means the criteria established by the ESCB Information Technology Committee to                              identify the certification authorities, both internal and external to the ESCB, which can be trusted in relation to ESCB and                              Eurosystem electronic applications, systems, platforms and services and in relation to SSM electronic applications, systems,                              platforms and services.                           

## Article 2U.K.Use of and access to SSM electronic applications, systems, platforms and services

1.SSM electronic applications, systems, platforms and services with medium or above medium criticality shall only be accessed                        and used if a user has been authenticated by means of an electronic certificate issued and managed by a certification authority                        accepted in accordance with the ESCB/SSM certificate acceptance framework, including by the ESCB-PKI certification authority.                  

2.The ESCB-PKI certification authority shall issue electronic certificates and provide other certification services to the competent                        authorities participating in the ESCB-PKI pursuant to Article 3 for their certificate subscribers and for the certificate                        subscribers of third parties working with them to enable them to securely access and use SSM electronic applications, systems,                        platforms and services.                  

3.A relying party may rely upon such certificates under the conditions laid down in Article 8 of Decision ECB/2013/1.                  

## Article 3U.K.Participation of the competent authorities in relation to the ESCB-PKI

1.A competent authority may decide to use ESCB-PKI services in order to access and use SSM electronic applications, systems,                        platforms and services and/or may act for that purpose as registration authority for its internal users as well as for third                        party users, under the same conditions as those applying to Eurosystem central banks.                  

2.The participating competent authority shall be subject to the obligations set out in Articles 6, 7 and 12 of Decision ECB/2013/1                        and shall submit a declaration to the Governing Council by which it confirms its participation and compliance with the obligations                        laid down in the Level 2 — Level 3 Agreement referred to in Article 4(2) of that Decision.                  

## Article 4U.K.Entry into force

This Decision shall enter into force on the third day following that of its publication in the *Official Journal of the European Union*.                  

Done at Frankfurt am Main, 11 December 2015.

*The President of the ECB*                            

Mario Draghi                            

1

OJ L 287, 29.10.2013, p. 63.                           

2

Decision ECB/2013/1 of the European Central Bank of 11 January 2013 laying down the framework for a public key infrastructure                              for the European System of Central Banks (OJ L 74, 16.3.2013, p. 30).