2024/2545

26.11.2024

COMMISSION IMPLEMENTING REGULATION (EU) 2024/2545

of 24 September 2024

laying down implementing technical standards for the application of Regulation (EU) 2023/1114 of the European Parliament and of the Council with regard to standard forms, templates and procedures for the cooperation and exchange of information between competent authorities

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (1), and in particular Article 95(11), third subparagraph, thereof,

Whereas:

(1) Markets in crypto-assets are inherently cross-border. It is therefore necessary to ensure that competent authorities in different Member States can cooperate and exchange information that enables them to effectively supervise issuers and offerors of crypto-assets and crypto-asset service providers operating across the Union. Competent authorities should have access to the information necessary to allow the effective discharge of their supervisory, investigative and enforcement duties and functions.

(2) To ensure that competent authorities are able to cooperate and to exchange information in an efficient and timely manner and to provide assistance to each other for the purposes of Regulation (EU) 2023/1114, it is appropriate to set out common procedures, forms and templates for the submission of requests for assistance, acknowledgments of receipts and replies to such requests.

(3) Information should normally be exchanged in writing. However, oral communications should be possible in appropriate cases, including, in particular, before a written request for cooperation or exchange of information is sent, to provide information on an upcoming request for cooperation or exchange of information, or to discuss any issues that might make it difficult to comply with that request. In urgent cases, it should also be possible to orally communicate a request for cooperation or exchange of information, provided that such urgency is not due to a delay on the part of the requesting party.

(4) Urgent requests for cooperation or exchange of information should be allowed where a prompt response is required by the requesting authority in order to stop significant harm or to prevent potential significant harm to investors or to the stability of and trust in the financial system. This includes cases where, for instance, the competent authority of a host Member State recently obtained evidence showing that a crypto-asset service provider authorised in another Member State is marketing crypto-assets which are not compatible with the provisions on protection of clients or retail holders set out in Article 102 of Regulation (EU) 2023/1114. Urgent requests should also be allowed where a competent authority of a host Member State has received relevant complaints relating to a crypto-asset service provider authorised in another Member State or where a competent authority has reasons to believe that a crypto-asset service provider operating in its jurisdiction is at risk of insolvency, which may affect clients in its jurisdiction or the stability of financial markets.

(5) Regulation (EU) 2023/1114 establishes that competent authorities are to cooperate with each other, exchange information and render assistance to each other.

(6) Unsolicited transmissions of information should be provided for in accordance with Regulation (EU) 2023/1114, including on a voluntary basis when the competent authority of a Member State considers that information in its possession may be of use to another competent authority. When transmitting unsolicited information, the competent authority should ensure that is has a legal basis to do so, and indicate it in the form set out in the relevant Annex.

(7) A request for assistance pursuant to Article 95 of Regulation (EU) 2023/1114 should provide sufficient information about the subject matter of the request, including the reason for the request and its context, to enable the requested authority to process the request efficiently and expediently. It should not be necessary for a requesting authority to indicate the facts giving rise to the suspicion of infringement that prompted the request where the requested information is necessary for that authority to fulfil its duties.

(8) The procedures for cooperation should allow and facilitate the communication, consultation and interaction between the requesting authority and the requested authority, to ensure an efficient processing of requests for information or assistance. These procedures should also allow competent authorities to provide each other with feedback on the usefulness of the information or assistance received, on the outcome of the case in relation to which the assistance was sought, and on any problems encountered in providing such information or assistance.

(9) The procedures and forms for the exchange of information and assistance should ensure the confidentiality of the information exchanged or transmitted and compliance with the rules on the protection of the rights of individuals with regard to the processing of personal data and on the free movement of such data.

(10) This Regulation is based on the draft implementing technical standards developed by the European Securities and Markets Authority (ESMA) in close cooperation with European Banking Authority (EBA) and submitted to the Commission.

(11) ESMA has requested the advice of the Securities and Markets Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council (2).

(12) ESMA has not conducted open public consultations on the draft implementing technical standards on which this Regulation is based, nor has it analysed the potential related costs and benefits of introducing such standards, as to have done so would have been highly disproportionate in relation to the scope and impact of those standards, taking into account that this Regulation would only affect competent authorities and entities and would not affect market participants,

HAS ADOPTED THIS REGULATION:

Article 1

Definition

For the purposes of this Regulation, ‘electronic means’ are means of electronic equipment for the processing (including digital compression), storage and transmission of data, employing wires, radio, optical technologies, or any other electromagnetic means that ensure that the completeness, integrity and confidentiality of the information are maintained during the transmission.

Article 2

Contact points

1. Each competent authority shall designate a contact point for the purposes of the communication of requests for cooperation or exchange of information pursuant to Article 95 of Regulation (EU) 2023/1114.

2. Competent authorities shall communicate the details of their contact points to ESMA by 15 January 2025 and shall provide updated information to ESMA as necessary.

3. ESMA shall maintain and keep up to date a list of the contact points designated by competent authorities pursuant to paragraph 1.

Article 3

Request for cooperation or exchange of information

1. A requesting authority shall make a request for cooperation or exchange of information in writing, by post or by electronic means. It shall address the request to the contact point designated pursuant to Article 2.

2. When requesting cooperation or the exchange of information, a competent authority shall use the form set out in Annex I and shall:

(a) specify the details of the relevant information requested;

(b) identify, where appropriate, issues relating to the confidentiality of the information requested.

Article 4

Acknowledgment of receipt of requests for cooperation or exchange of information

1. Within 5 working days of receipt of a request for cooperation or exchange of information, the requested authority shall send an acknowledgement of receipt, by post or by electronic means, to the contact point designated pursuant to Article 2, unless otherwise specified in the request. The acknowledgement of receipt shall be made by using the form set out in Annex II and shall include, where possible, an indication of the estimated date or timeframe in which a reply is expected to be provided.

2. Where it is not possible to indicate an estimated date or timeframe for the reply, the requested authority shall indicate the frequency with which it will update the requesting authority.

Article 5

Reply to a request for cooperation or exchange of information

1. The requested authority shall reply to a request for cooperation or exchange of information in writing, by post or by electronic means. The reply shall be addressed to the contact point designated pursuant to Article 2, unless otherwise specified in the request. Where the requested authority requires additional information in relation to the request for cooperation or exchange of information, it shall request further clarifications promptly by any means.

2. The requested authority shall reply to the request for cooperation or exchange of information using the form set out in Annex III and shall:

(a) take all reasonable steps within the scope of its powers to provide the requested information or assistance;

(b) act without undue delay, taking into account the complexity of the request and the necessity to involve third parties or another competent authority.

3. Where the requested authority refuses to act, in full or in part, upon a request for cooperation or exchange of information, it shall inform the requesting authority as soon as possible of its decision in writing, either by post or by electronic means, indicating which of the grounds for refusal set out in Article 95(2) of Regulation (EU) 2023/1114 it has relied upon.

Article 6

Urgent requests for cooperation or exchange of information

1. By way of derogation from Articles 4 and 5, the procedure in this Article shall apply to urgent requests for cooperation or exchange of information.

2. The requesting authority shall specify, in a clear manner, the reasons for the urgency of the request, using the form set out in Annex I.

3. By way of derogation from paragraph 2, the requesting authority may initially communicate the information orally where this is justified by the concrete circumstances that prompted the request. That oral submission shall be subsequently confirmed in writing and transmitted to the requested authority without undue delay using the form set out in Annex I, unless the requested authority agrees otherwise.

4. Within 3 working days of receipt of an urgent request for cooperation or exchange of information, the requested authority shall send an acknowledgement of receipt in writing, by post or by electronic means, to the contact point designated pursuant to Article 2, unless otherwise specified in the request, using the form set out in Annex II.

5. If the requested authority disagrees with the urgency of the request, it shall inform the requesting authority thereof together with the acknowledgement of receipt, detailing its reasons in a clear manner and using the form set out in Annex II. In such case, the request shall not be treated as an urgent request for cooperation or exchange of information.

6. Where the requested authority refuses to act, in full or in part, upon an urgent request for cooperation or exchange of information, it shall inform the requesting authority as soon as possible of its decision in writing, by post or by electronic means, indicating which of the grounds for refusal set out in Article 95(2) of Regulation (EU) 2023/1114 it has relied upon.

7. The requested authority shall provide a precise and comprehensive reply as soon as possible and no later than 10 working days from the receipt of the request. The reply shall be provided in writing, by post or by electronic means, using the form set out in Annex III, unless the requesting authority agrees otherwise.

8. Where the requested authority is unable to provide the requesting authority with a precise and comprehensive reply within 10 working days, it shall, by way of derogation from paragraph 7, provide a partial reply within that deadline. In that case, the requested authority shall provide a precise and comprehensive reply within 20 working days from the date of the receipt of the original request. Where the requested authority is unable to gather all necessary information within that deadline, it shall provide to the requesting authority an explanation of the relevant constraints.

Article 7

Procedures for sending and processing a request for cooperation or exchange of information

1. The requesting authority and the requested authority shall communicate using the most expedient means, taking due account of the following:

(a) confidentiality considerations;

(b) correspondence times;

(d) the ease of access to the information by the requesting authority.

The requesting authority shall reply promptly to any request for clarifications from the requested authority.

2. Where a reply cannot be provided by the estimated date or timeframe referred to in Article 4(1), the requested authority shall give a new estimated date or timeframe to the requesting authority explaining the reasons for the delay, using the same means used to acknowledge receipt of the request.

3. The requested authority and the requesting authority shall cooperate in order to resolve any difficulties that may arise in executing a request.

Article 8

Procedure for requests concerning the taking of a statement from a person

1. Where the requesting authority includes within its request the taking of a statement from any person, the requested authority and the requesting authority shall, subject to existing legal limitations or constraints and any differences in procedural requirements, assess and take into account the following:

(a) the rights of the persons from whom the statements are to be taken including, where applicable, any self-incrimination issues;

(b) the role and the nature of participation of the staff of the requested authority and requesting authority in the taking of the statement, in particular whether the participation is active or passive;

(c) whether the person from whom the statement is to be taken has the right to be assisted by a legal representative and, if so, the scope of the legal representative’s assistance during the taking of the statement, including in relation to any records or report of the statement;

(d) whether the statement is to be taken on a voluntary or mandatory basis, where that distinction exists;

(e) whether, based on the information available at the time of the request, the person from whom the statement is to be taken is a witness or a suspect, where that distinction exists;

(f) whether, based on the information available at the time of the request, the statement could be or is intended to be used in criminal proceedings;

(g) the admissibility of the statement in the requesting authority’s jurisdiction;

(h) the recording of the statement and the applicable procedures, including whether the statement will be contemporaneous, summarised in written minutes or recorded by audio or audiovisual means;

(i) procedures on the certification or confirmation of the statement by the persons providing the statement, including whether such certification or confirmation takes place after the statement is taken; and

(j) the procedure for the transmission of the statement to the requesting authority, including the format of and timing for such transmission.

2. The requested authority and the requesting authority shall ensure that arrangements are in place which allow their staff to proceed efficiently and to agree on the following:

(a) planning of dates;

(b) the list of questions to be asked to the person from whom the statement is to be taken;

(c) travelling arrangements, including ensuring that the requested authority and the requesting authority are able to meet to discuss the matter prior to the taking of the statement;

(d) language arrangements;

(e) any other practical issue that might arise in connection to taking of a statement.

Article 9

Procedure for requests concerning an investigation or an on-site inspection

1. Where a request to carry out an investigation or an on-site inspection is made pursuant to Article 95(4) of Regulation (EU) 2023/1114, the requesting authority and the requested authority shall consult each other on the best way to give useful effect to the request, taking into account Article 95(4), second subparagraph, points (a) to (d), of Regulation (EU) 2023/1114, including on the merits of conducting a joint investigation or a joint on-site inspection.

2. The requested authority shall keep the requesting authority informed of the progress of the investigation or on-site inspection and shall transmit its findings promptly to the requesting authority.

3. In deciding whether to initiate a joint investigation or a joint on-site inspection, the requesting authority and the requested authority shall take into account at least the following:

(a) the content of any requests for assistance received from the requesting authority including any suggestion on the appropriateness of carrying out a joint investigation or a joint on-site inspection;

(b) whether the competent authorities are separately conducting their own inquiries into a matter with cross-border implications and whether that matter would be more suitable for joint action;

(c) the legal and regulatory framework in each of their jurisdictions as well as the potential constraints and legal limitations on the conduct of any joint investigation or joint on-site inspection and on any proceedings that may follow, including any issues relating to the principle of

ne bis in idem

;

(d) the management and direction needed for the investigation or on-site inspection;

(e) the allocation of resources and appointment of staff in charge of carrying out investigations or on-site inspections;

(f) the possibility of establishing a joint action plan and a time schedule for the work to be undertaken by each competent authority;

(g) the determination of actions to be taken, jointly or individually, by each competent authority;

(h) the mutual sharing of information gathered and reporting on the outcomes of any individual actions taken;

(i) other case specific issues.

4. Where the requesting authority and the requested authority decide to carry out a joint investigation or a joint on-site inspection, they shall:

(a) agree on procedures for its conduct and conclusion;

(b) engage in an ongoing dialogue to coordinate the information gathering and joint fact finding;

(c) work closely and cooperate with each other on the conduct of the joint investigation or the joint on-site inspection;

(d) provide mutual assistance on subsequent enforcement proceedings to the extent legally permitted, including coordinating any proceedings or other enforcement action related to the outcome of the joint investigation or the joint on-site inspection, whether administrative, civil or criminal, or, where appropriate, the prospects of a settlement;

(e) identify the specific legal provisions governing the subject matter of the joint investigation or of the joint on-site inspection.

Article 10

Unsolicited provision of information

Where a competent authority has information that it believes would assist another competent authority for the purposes of carrying out its duties under Regulation (EU) 2023/1114, it shall transmit that information in writing by post or electronic means to the other competent authority without undue delay, using the form set out in Annex IV, and specify the legal basis for the provision of the information.

Article 11

Restrictions and permissible use of information

1. The requesting authority and the requested authority shall include an appropriate confidentiality warning in any request for assistance, reply to a request for assistance or transmission of unsolicited information in accordance with the forms set out in the relevant Annex.

2. Where, in order to execute the request, the requested authority is required to disclose the fact that the requesting authority has made a request, it shall disclose the request after having discussed the nature and extent of the disclosure required with the requesting authority and after having obtained the consent of that competent authority to such disclosure. Where the requesting authority does not provide its consent to the disclosure, the requested authority shall not act upon the request, and the requesting authority may withdraw or suspend its request until it is able to provide such consent to disclosure.

3. Information received in accordance with Article 10 shall be used solely for the purposes of securing compliance with or enforcement of the provisions of Regulation (EU) 2023/1114, including initiating, conducting or assisting in criminal, administrative, civil or disciplinary proceedings resulting from a breach of the provisions of that Regulation.

Article 12

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the

Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 24 September 2024.

For the Commission

The President

Ursula VON DER LEYEN

(1)

OJ L 150, 9.6.2023, p. 40

, ELI:

http://data.europa.eu/eli/reg/2023/1114/oj

(2) Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (

OJ L 331, 15.12.2010, p. 84

, ELI:

http://data.europa.eu/eli/reg/2010/1095/oj

ANNEX I

FORM FOR REQUEST FOR COOPERATION OR EXCHANGE OF INFORMATION

Request for cooperation or exchange of information

Reference number:

Date:

General information

FROM

Member State:

Competent Authority:

Address:

(Contact details of the contact point)

Name:

Telephone:

Email:

Member State:

Competent Authority:

Address:

(Contact details of the contact point)

Name:

Telephone:

Email:

Dear [insert appropriate name]

In accordance with Article 3 your input is sought in relation to the matter(s) set out in further detail below.

I would be grateful to receive a response to the above request within [provide timeframe based on the type of request] from the receipt of this request.

Type of Request

Please tick the appropriate box(es)

Supervisory activities (provision of information, taking of a statement)

□

Investigation

□

On-site inspection

□

Urgency of Request

Please tick the appropriate box(es)

Non-urgent request

□

Urgent request

□

The [requesting authority] requests the [requested authority] to consider this request as urgent for the following reasons:

…

[please provide, in a clear manner, the reasons underlying the urgency of the request, including if the request was initially made orally]

Reasons for the Request

…

[insert provision(s) of the sectoral legislation i) under which the requesting authority is competent to deal with the matter and ii) which may potentially be infringed.]

The request concerns cooperation or exchange of information on

…

[insert the description of the subject matter of the request, the purpose for which the cooperation or exchange of information is sought, facts underlying the investigation which form the basis of the request and explanation of how the reply to the requested information or assistance will be useful for fulfilling the duties under Regulation (EU) 2023/1114 of the European Parliament and of the Council (1)]

Further to

…

[if applicable, insert details of any previous request in order to enable it to be identified]

Supervisory Activities (provision of information, taking of a statement)

Provision of information

Please provide a detailed description of the specific information sought with reasons why that information will be of assistance and, if known, a list of the persons who might possess the information sought or the places where such information might be obtained.

…

If the request concerns information relating to a transaction or order in a specific crypto-asset, please provide the following information.

Product ID:

…

[insert precise description of the crypto-asset, including the product identifier in accordance with Commission Delegated Regulation establishing technical standards adopted pursuant to Article 68(10)(b) of Regulation (EU) 2023/1114]

Person ID:

…

[insert the identity of any person connected with the transaction or order, including a person dealing in the crypto-asset or on whose behalf the dealing is considered to have taken place. Where available, include any applicable identification code, such as an LEI code or client Id as under Regulation (EU) No 600/2014 of the European Parliament and of the Council (2)]

Dates:

…

[insert the dates between which transactions or orders in those crypto-assets took place including in the case of a significant period of time, reasons why the entirety of the time period is necessary]

If the request concerns information relating to the business or activities of a person, please provide information that makes it possible to identify that person.

…

If there are special considerations regarding the sensitivity of the information sought, please provide an indication of that sensitivity and any special precautions that have to be taken in collecting the information due to considerations relating to the investigation. Please also specify whether the requested authority may reveal the identity of the requesting authority.

…

Please provide any additional information that is considered relevant.

…

[For example, whether the requesting authority has been or will be in contact with any other authority or law enforcement agency in the Member State of the requested authority in relation to the subject matter of the request or with any other authority which, as far as the requesting authority is aware, has an active interest in the subject matter of the request]

Taking of a statement

Please indicate:

(a)

Statement under:

(i)

oath

□

(ii)

affirmation

□

(iii)

in writing

□

(b)

Basis of the statement:

(i)

voluntary

□

(ii)

mandatory

□

(c)	Need and purpose of the taking of a statement and, where applicable, of requiring a statement under oath or affirmation: … … …

(d)	Name of the persons from whom the statement is to be obtained: … … … [insert details of the persons from which the statement will be taken to enable the requested authority to begin the summoning process where applicable]

(e)	Detailed description of the information sought, including a preliminary list of questions (if available at the time of the request). … … …

(f)	Any additional information that is considered relevant: … … …

[For example, whether the requesting authority’s staff is requesting participation in the taking of the statement, details of the participating officials of the requesting authority, where appropriate, a description of any legal and procedural requirements that must be complied with to ensure the admissibility of the statements made in the jurisdiction of the requesting authority]

The opening of an investigation

If the request concerns the opening of an investigation on behalf of the requesting authority, please provide information to enable the requested authority to assess whether it may have an interest in entering into a joint investigation, including the requesting authority’s proposal for the investigation, its reasoning for opening the investigation and the perceived benefits to that authority.

…

[including all relevant information that the requested authority needs to be able to provide the necessary assistance by opening an investigation or a joint investigation, as appropriate]

The opening of an on-site inspection

If the request concerns the opening of an on-site inspection on behalf of the requesting authority, please provide information to enable the requested authority to assess whether it may have an interest in entering into a joint on-site inspection, including the requesting authority’s proposal for the inspection, its reasoning for the inspection and the perceived benefits to that authority.

…

[including all relevant information that the requested authority needs to provide the necessary assistance by opening an on-site inspection or a joint on-site inspection, as appropriate]

The information included in this request shall be kept confidential in accordance with Article 11 of this Regulation and Article 100 of Regulation (EU) 2023/1114. The requirements set out in Article 101 of Regulation (EU) 2023/1114 shall be observed with respect to any personal data included in this request. In particular, the relevant competent authorities shall ensure that all relevant information on the processing of personal data is provided to data subjects in accordance with Section 2 ‘Information and access to personal data’ of Chapter III ‘Rights of the data subject’ of Regulation (EU) 2016/679 of the European Parliament and of the Council(3).

Yours sincerely,

[signature]

(1) Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (

OJ L 150, 9.6.2023, p. 40

, ELI:

http://data.europa.eu/eli/reg/2023/1114/oj

(2) Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Regulation (EU) No 648/2012 (

OJ L 173, 12.6.2014, p. 84

, ELI:

http://data.europa.eu/eli/reg/2014/600/oj

(3) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (

OJ L 119, 4.5.2016, p. 1

, ELI:

http://data.europa.eu/eli/reg/2016/679/oj

ANNEX II

FORM FOR ACKNOWLEDGEMENT OF RECEIPT

Acknowledgement of receipt

Reference number:

Date:

FROM

Member State:

Competent Authority:

Address:

(Contact details of the contact point)

Name:

Telephone:

Email:

Member State:

Competent Authority:

Address:

(Contact details of the contact point)

Name:

Telephone:

Email:

Dear [insert appropriate name],

We hereby acknowledge receipt of your request for cooperation or exchange of information [insert reference to the request] on [insert date].

□

The [requested authority] will not be capable of responding within the deadline indicated in the request for the following reasons [please specify which exception(s) is/are applicable in your situation]:

…

[In case the requested authority is not capable of responding within the deadline indicated in the request, please provide reasons and the estimated date of response]

□

The [requested authority] considers that the request received from the [requesting authority] on [insert date] is not urgent for the following reasons:

…

[In case the requested authority disagrees with the urgency of the request, please provide reasons within the deadline set out in Article 6(3)]

Any personal data provided shall be processed by the relevant competent authorities in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council(1). In particular, the relevant competent authorities shall ensure that all relevant information on the processing of personal data is provided to data subjects in accordance with Section 2 ‘Information and access to personal data’ of Chapter III ‘Rights of the data subject’ of that Regulation.

Yours sincerely,

[signature]

(1) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (

OJ L 119, 4.5.2016, p. 1

, ELI:

http://data.europa.eu/eli/reg/2016/679/oj

)

ANNEX III

FORM FOR REPLY TO A REQUEST FOR COOPERATION OR EXCHANGE OF INFORMATION

Reply to request for cooperation or exchange of information

Reference number:

Date:

FROM

Member State:

Competent Authority:

Address:

(Contact details of the contact point)

Name:

Telephone:

Email:

Member State:

Competent Authority:

Address:

(Contact details of the contact point)

Name:

Telephone:

Email:

Dear [insert appropriate name],

In accordance with Article 5, your request dated [dd.mm.yyyy] with reference number [insert reference number] has been processed by us.

Information gathered

…

[If the information has been gathered, please set out the information here or provide an explanation of how it will be provided]

The information provided is confidential and is disclosed to [Insert name of the requesting authority] pursuant to the [insert provision of the applicable sectoral legislation] and on the basis that the information shall remain confidential in accordance with Article 11 of this Regulation and Article 100 of Regulation (EU) 2023/1114 of the European Parliament and of the Council(1).

The [insert name of the requesting authority] shall observe the requirements set out in Article 11 with respect to the permissible uses of the information provided, and in Article 101 of Regulation (EU) 2023/1114 with respect to personal data processing and transfer. In particular, the relevant competent authorities shall ensure that all relevant information on the processing of personal data is provided to data subjects in accordance with Section 2 ‘Information and access to personal data’ of Chapter III ‘Rights of the data subject’ of Regulation (EU) 2016/679 of the European Parliament and of the Council(2).

Where the [insert name of the requesting authority] intends to use or disclose information provided in this reply for a purpose different than the one stated in the request but falling under the scope of Regulation (EU) 2023/1114, [insert name of the requesting authority] shall notify [insert name of the requested authority] which has 10 working days to object to such use or disclosure, or where necessary to indicate a precise time limit by which they will be able to provide such feedback.

Where the [insert name of the requesting authority] intends to use or disclose information provided in this reply for any purpose outside the scope of Regulation (EU) 2023/1114, it shall notify [insert name of the requested authority] and, unless the exception set out in Article 100(2) of Regulation (EU) 2023/1114 applies, shall obtain the prior consent of [insert name of the requested authority]. Where [insert name of the requested authority] consents to such use or disclosure, it may subject it to certain conditions.

Yours sincerely,

[signature]

OJ L 150, 9.6.2023, p. 40

, ELI:

http://data.europa.eu/eli/reg/2023/1114/oj

(2) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (

OJ L 119, 4.5.2016, p. 1

, ELI:

http://data.europa.eu/eli/reg/2016/679/oj

)

ANNEX IV

FORM FOR UNSOLICITED PROVISION OF INFORMATION

Unsolicited provision of information

Reference number:

Date:

FROM

Member State:

Competent Authority:

Address:

(Contact details of the contact point)

Name:

Telephone:

Email:

Member State:

Competent Authority:

Address:

(Contact details of the contact point)

Name:

Telephone:

Email:

Dear [insert appropriate name],

In accordance with Article 10, we are providing the following information we believe may be of assistance in carrying out your duties.

Information provided

…

[Please set out the details of the information here, including if relevant a description of any supporting documents or material attached]

The information provided is confidential and is disclosed to [insert name of the competent authority receiving the information] pursuant to Article 95 of Regulation (EU) 2023/1114 of the European Parliament and of the Council(1) and on the basis that the information shall remain confidential in accordance with Article 11 of this Regulation and Article 100 of Regulation (EU) 2023/1114.

The [insert name of the competent authority receiving the information] shall observe the requirements of the Article 11 with respect to the permissible uses of that information, and of Article 101 of Regulation (EU) 2023/1114 with respect to personal data processing and transfer. In particular, the relevant competent authorities shall ensure that all relevant information on the processing of personal data is provided to data subjects in accordance with Section 2 ‘Information and access to personal data’ of Chapter III ‘Rights of the data subject’ of Regulation (EU) 2016/679 of the European Parliament and of the Council(2).

Where the [insert name of the competent authority receiving the information] intends to use or disclose information provided in this reply for purposes different than those stated in Article 11(3), it shall notify [insert name of the competent authority providing the information] and, unless the exception referred to in Article 100(2) of Regulation (EU) 2023/1114 applies, shall obtain the prior consent of [insert name of the competent authority providing the information]. Where [insert name of the competent authority providing the information] consents to such use or disclosure of the information, it may subject it to certain conditions.

Yours sincerely,

[signature]

OJ L 150, 9.6.2023, p. 40

, ELI:

http://data.europa.eu/eli/reg/2023/1114/oj

OJ L 119, 4.5.2016, p. 1

, ELI:

http://data.europa.eu/eli/reg/2016/679/oj

)

ELI: http://data.europa.eu/eli/reg_impl/2024/2545/oj

ISSN 1977-0677 (electronic edition)