QuickTake: Taking the SPoRs beyond their original supervisory objectives

Ensuring that “mind and matter” are located in the EU-27 is a core objective of the European Supervisory Authorities (ESAs), notably the European Securities and Markets Authority’s (ESMA) publications of various Supervisory Principles on Relocations (SPoRs). The key goal is to avoid “letter box entities.” The soft-law instruments that collectively make-up SPoRs have been used by ESAs since mid-2017 to sharpen supervisory expectations or set the supervisory tone in relation to how supervisors are to approach policing compliance with legal and regulatory objectives. In short, they have set a number of barriers and guidelines as to what is permitted and tolerated, ultimately allowing firms affected by Brexit or otherwise setting up in the EU-27 to plan their legal entity structure and decide from where to base their operations. The use of branches from new EU-domiciled subsidiaries back into the UK or other non-EU countries, i.e. the process colloquially known as “back-branching,” has been mooted as a solution to many resourcing issues some firms are facing in their Brexit-proofing.

For the most part, the SPoRs largely have been addressed at those firms from the UK and other non-EU, i.e. third countries, accessing the EU. Only in certain instances do SPoRs set expectations as to what an EU-27 may or may not be able to do in terms of its business into a third-country.¹ On February 6, 2019, ESMA published a “MiFID II Supervisory Briefing: On the supervision of non-EU branches of EU firms providing investment services and activities” (ESMA’s Non-EU Branch Rules), which immediately entered into force.

This Client Alert assesses the key outcomes that ESMA sets and how this might impact those Brexit-proofing plans that may have over-relied on back-branching and those firms for whom back-branching options are unrelated to Brexit-planning. ESMA specifically mentions that identified issues and risks on back branching thus “…appear relevant beyond Brexit, and it is thereby important to address them in a convergent manner among [Competent Authorities] as regards all third countries.

At the time of writing, the other ESAs, i.e. EBA for the banking sector and EIOPA for the insurance and occupational pensions sector, have yet to publish comparable requirements. Neither have the Eurozone’s Banking Union authorities, chief among them, the European Central Bank (ECB) at the head of the Single Supervisory Mechanism (SSM), published an update to their own SPoRs.  This Client Alert should be read in conjunction with coverage from our Eurozone Hub on “New Rules for Intermediate Parent Undertakings for Third Country Firms.”

Scope of the ESMA Non-EU Branch Rules

ESMA is clear that its “supervisory briefing,” which is issued pursuant to Art. 29(2) of the ESMA Regulation, is aimed at EU-27 competent authorities, as set out under MiFID II, but it is also “…meant to give market participants indications of compliant implementation of the MiFID II provisions and of the recommendations expressed…” by ESMA in its existing SPoRs.  In contrast to the SPoRs, ESMA does mention that the content of this supervisory briefing is not subject to comply or explain mechanisms for EU-27 competent authorities and is non-binding. This wording is presumably to alleviate some concerns expressed, including politically, by select national competent authorities.  We expect that this supervisory briefing may be refined and expanded so that these ESMA Non-EU Branch Rules may be the product of accelerated drafting and that another version may be issued at an appropriate juncture.

In keeping with the SPoRs and ESAs recent use of soft law instruments, ESMA clarifies that the supervisory briefing is set to foster supervisory convergence and help national competent authorities to make their judgement during the authorization and supervision of MiFID investment firms and credit institutions (i.e. firms) when conducting MiFID investment services and/or activities and which intend to establish or have established a branch in a non-EU jurisdiction. Nevertheless, the overarching purpose that ESMA attaches to the supervisory briefing sets supervisory expectations, which do, as with the SPoRs and other ESA soft law instruments, rather read like rules. Some EU-27 national competent authorities, as well as certain firms, are comparably quicker to move to compliance with these supervisory expectations than others. Those that do not embrace a move to adapt to the ESAs’ sharpened tone may find themselves needing to take specific measures in tightened timelines.

Affected firms are thus advised to ensure they are able, regardless of references to non-binding application etc., to justify why certain aspects are structured in the relevant manner. This is especially the case as ESMA’s Non-EU Branch Rules place a considerable degree of importance on a firm being able to justify why it should conduct activity from a third-country branch. It is important to note that certainly within the Banking Union, notably SSM parlance, due to a number of staffing resource reasons, the tone has shifted to focus much more on “on-shore” versus “off-shore” capabilities and arrangements where the precise nature of the legal entity in the third-country may be of a lesser importance when assessing why specific activity is taking place outside of the EU.

One linguistic challenge (or perhaps oversight) is that ESMA’s Non-EU Branch Rules speak specifically, see para. 14, of “non-EU Branches.”  This would include branches into Switzerland and the European Economic Area inasmuch as the brunt of what the SPoRs were aiming to mitigate is over-reliance and potential risks resulting from back-branching as part of Brexit-proofing.

What does this mean in practice for firms?

While ESMA does not put a blanket ban on non-EU branches or back-branching--indeed doing so would offend basic principles of long-standing corporate and financial services law--the SPoRs have a presumption that a firm ought to, notably those establishing an EU-27 presence, favor a geographical distribution where the (new/existing) EU-27 entities’ strategic steering, governance and control functions regime reside within the EU-27. An exception is the third-country branch set-up to provide specific services in that non-EU jurisdiction or local marketing support.

As a result, use of a third-country branch, as per ESMA’s Non-EU Branch Rules, should only be permitted where the EU-27 competent authorities are satisfied that the risks of letter-boxing or non-EU legal/operational barriers are minimized and that:

• The use of the non-EU branch is based on objective reasons:

1. Linked to services provided in the non-EU jurisdiction; and
2. Does not result in the performance of material functions or services back into the EU-27; 

• The firm’s “program of operations” i.e. its regulatory business plan, provides a clear evidence of sufficient substance of the business activity of the firm, its organization, governance and risk management arrangements in relation to EU-27 and non-EU-27 operations and how the EU head office will be able to monitor and manage any non-EU branch’s arrangements and ensure that EU-27 competent authorities have full access to perform their supervisory functions;

• Back-branching does not create or accentuate any hurdles to supervision effectively by the EU-27 competent authority (not relying on supervisory cooperation with the third-country entity) and that the overall organizational structure and relevant risk management procedures are commensurate with the nature, scale and complexity of its business activity and geographical distribution; and

• That an applicant seeking authorization as a MiFID investment firm (and it is interesting to see how ESMA’s wording here does not clarify whether this extends to credit institutions applying for MiFID “top-up” permissions) provides detailed information in relation to each non-EU branch. This includes much more than was previously the case, notably:

1. How the non-EU branch will contribute to the group strategy as well as activities and functions performed by it and any activity provided to the firm’s head office or other EU entities of the group – this includes non-MiFID II regulated entities;  
2. The expected number and geographical distribution of the clients with which the non-EU branch will be dealing – the term dealing is troublesome as this may cover transactions where a branch effectively routes orders and/or engages as riskless principal;
3. A description of how the firm will ensure that any local legal requirements in the non-EU jurisdiction do not interfere with the compliance by the EU firm with its EU obligations;
4. Details on points of contact for EU-27 authorities (including senior management locally and in EU responsible for non-EU branch) as well as organizational structure, reporting lines, allocation of responsibilities including of control functions, explanation of how risks originated in the non-EU branch will be managed by the firm in the EU as well as details of key function holders within the non-EU branch – in this respect it is important to note that in the UK there will be an interlink between the Senior Managers and Certification Regime (SMCR)² – and how it applies to UK branches of EEA and thus EU firms; and
5. Details (presumably in quite granular format) on the composition and distribution of staff, their location (including EU head office and non-EU branches), their seniority and type of presence in a relevant jurisdictions (full-time, part-time or secondment) and equally description of arrangements on how to deal with senior management or key function holders being allowed to carry out functions in more than one group entity i.e. dual hatting – this in part borrows from the principles struck in the Banking Union on Fit and Proper Assessments and having sufficient time.

Firms are required to provide the relevant EU-27 competent authority of their home Member State with relevant information (as set out above i.e. paras. 16 to and incl. 18 of ESMA’s Non-EU Branch Rules) on any new non-EU branch that they plan to establish or on any relevant material change in the activities of non-EU branches already established. Moreover, EU-27 competent authorities are reminded that on an ad hoc or on a periodic basis requests for the following information should be made concerning the activities of non-EU branches:

• Information on number and geographical distribution of clients served by non-EU branches (it is unclear whether this needs to be set out per branch);
• Information on activities and functions provided by each non-EU branch to EU head office;
• Information on activities and functions provided by each non-EU branch to other entities of the group – this would read to include non-EU group entities; and
• Information on the outcome of its regular compliance monitoring and notably assessments of activities performed by non-EU branches.  

What are national competent authorities expected to do?

As with the SPoRs, ESMA’s Non-EU Branches Rules direct EU-27 competent authorities to undertake certain measures to improve their supervisory functioning. This includes in particular:

1. Setting up internal criteria and arrangements to undertake comprehensive supervision of Non-EU Branches;  
2. Preparing supervisory plans and allocate resources to this activity including in relation to on-site inspections; 
3. Ensuring they have sufficient measures in place to request documents and data from that non-EU branch;  
4. Strengthening cooperation arrangements with non-EU competent authorities to support (but not outsource/replace it) the work by the EU-27 competent authority. 

Outlook and next steps

ESMA’s Non-EU Branches Rules mark a further sharpening of the SPoRs but also a broadening of their application to a much wider set of existing and new market participants and their business models. ESMA’s actions, which could be followed by the sister ESAs and equally by the SSM where ESMA’s expectations are perhaps still a bit vague could also be flanked by ESMA updating this present publication. What is clear is that this sharpened tone covers the setting up of branches with justifiable grounds as to their operations as well as the process of back-branching from the EU-27 to non-EU jurisdictions.  Another issue that is worth watching is that not all EU-27 competent authorities may move as quickly to meet ESMA’s expectations despite having firm legal obligations to follow the guidance set at ESA level.

In any event, affected firms will want to consider whether they have documented justifications in a sufficiently strong and evidenced manner, including ensuring that any decisions have been carried out in line with applicable governance guidelines (such as the EBA’s own revised guidelines – see dedicated coverage from our Eurozone Hub on this). For many existing firms, including those whose legal entity structuring may have grown as a result of business acquisitions or following divestments, this may be a tall order, and it would be advisable to segment the relevant branches by EU legal entity, business line and risk profile of business line and respective jurisdictions. Unlike ESMA’s previous efforts to curb risks that it perceives from non-EU branches, there are no distinctions between whether business activities conducted relate to clients that are categorized, for MiFID II/MiFIR purposes as retail or non-retail.

ESMA’s drafting in these Non-EU Branch Rules go back to earlier policymaking during 2018 where, in addition to flagging the need for a minimum common harmonized regime on non-EU branches, ESMA indicated it considers risks from reverse solicitation in particular from third-country entities, not just non-EU branches. This is primarily around ESMA’s concerns that  clients/investors would not be subject to MiFID II/MiFIR protections when reverse solicitation is used and that particular concern was expressed in relation to retail clients.

It is thus conceivable that ESMA may be only just getting started in how it will permit operations that it considers should be within in the EU, and thus subject to EU rules, be carried out by non-EU entities regardless of the type of legal vehicle. With the ECB-SSM increasingly referring to “on-shore” and “off-shore” capabilities, this direction of travel will likely require firms to keep close tabs on their legal entity structuring as well as how to transport certain business operations and/or relationships in the event that supervisory scrutiny strikes a certain operation. In any event, ESMA’s action in this area, notably by intelligently using a new form of soft law instrument to deliver much sharper focus and standards that relevant competent authorities will have to follow given the overall supervisory convergence requirements is smart supervisory policymaking and standard setting even if it poses new supervisory and regulatory risk(s) for a range of existing and new business and legal entity models of market participants.

If you would like to discuss any of the items mentioned above, in particular how to forward-plan any impacts on operationalizing compliance across legal entity structuring as well as  documentation (policies, procedures as well as client/counterparty facing agreements) and non-documentation or other operational workstreams or how these priorities may affect your business or your clients more generally, please contact our Eurozone Hub key contacts.

1. MiFID II/MiFIR and relevant Commission Delegated Regulations do have specific third country rules, but this relates mostly to regulated activity, notably in relation to Art. 32 Commission Delegated Regulation 2017/565, to third-parties in third-countries and a need to verify their regulated categorization and obtain undertakings that they will comply with certain mandatory aspects of EU law as if they had a primary compliance obligation in that respect.
2. See: https://www.dentons.com/en/issues-and-opportunities/senior-managers-and-certification-regime