Opinion of the European Central Bank of 19 June 2026 on supervisory independence, prevention of conflicts of interest, notifications of material holdings and mergers and divisions, ESG risks, suitability assessments of management bodies and key function holders, and administrative penalties and periodic penalty payments (CON/2026/20)

OPINION OF THE EUROPEAN CENTRAL BANK of 19 June 2026 on supervisory independence, prevention of conflicts of interest, notifications of material holdings and mergers and divisions, ESG risks, suitability assessments of management bodies and key function holders, and administrative penalties and periodic penalty payments (CON/2026/20) Introduction and legal basis

On 19 May 2026 the European Central Bank (ECB) received a request from the Austrian Ministry of Finance for an opinion on a draft law transposing, inter alia, the amendments to Directive 2013/36/EU of the European Parliament and of the Council (hereinafter the ‘CRD’) introduced by Directive (EU) 2024/1619 of the European Parliament and of the Council (hereinafter the ‘CRD6’) as well as Directive (EU) 2024/2994 of the European Parliament and of the Council into Austrian law (hereinafter the ‘draft law’). The draft law amends the Law on banking, the Law on the Financial Market Authority, the Law on savings banks, the Law on investment firms and the Law on credit service providers and credit purchasers. The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and Article 2(1) of Council Decision 98/415/EC , as the draft law relates to specific tasks conferred upon the ECB concerning the prudential supervision of credit institutions pursuant to Article 127(6) of the Treaty. In addition, pursuant to Article 25.1 of the Statute of the European System of Central Banks and of the European Central Bank (hereinafter the ‘Statute of the ESCB’), the ECB may offer advice to, and be consulted by, the competent authorities of the Member States on the implementation of Union legislation relating to the prudential supervision of credit institutions, among other matters. In accordance with Article 17.5, first sentence, of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

1 Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338, ELI: http://data.europa.eu/eli/dir/2013/36/oj).

2 Directive (EU) 2024/1619 of the European Parliament and of the Council of 31 May 2024 amending Directive 2013/36/EU as regards supervisory powers, sanctions, third-country branches, and environmental, social and governance risks (OJ L, 2024/1619, 19.6.2024, http://data.europa.eu/eli/dir/2024/1619/oj).

3 Directive (EU) 2024/2994 of the European Parliament and of the Council of 27 November 2024 amending Directives 2009/65/EC, 2013/36/EU and (EU) 2019/2034 as regards the treatment of concentration risk arising from exposures towards central counterparties and of counterparty risk in centrally cleared derivative transactions (OJ L, 2024/2994, 4.12.2024, ELI: http://data.europa.eu/eli/dir/2024/2994/oj).

4 Council Decision 98/415/EC of 29 June 1998 on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42, ELI: http://data.europa.eu/eli/dec/1998/415/oj).

1. Purpose of the draft law

1.1 The main purpose of the draft law is to transpose into Austrian law the amendments to the CRD introduced by the CRD6. In addition, the draft law includes, inter alia, provisions that transpose Directive (EU) 2024/2994 into Austrian law. The draft law also contains a number of amendments not related to the implementation of Union directives. 1.2 In particular, the draft law transposes the CRD6 provisions regarding (a) the prudential framework for the internal governance of credit institutions and certain investment firms, including the assessment of the suitability of members of the management body and holders of key functions and the role of the Financial Market Authority (FMA) in this respect; (b) a regulatory framework applicable to branches established in the Union by undertakings established in a third country for the purpose of providing banking services there; (c) rules on material transactions planned by credit institutions or (mixed) financial holding companies, namely the acquisition or disposal of qualifying holdings, material transfers of assets and liabilities, and mergers or divisions involving such entities; (d) environmental, social and governance (ESG) risks; (e) administrative penalties, periodic penalty payments and other administrative measures; (f) systemic risk buffers; and (g) supervisory tasks related to risks arising from crypto-asset exposures and the provision of crypto-asset services by amending the Law on banking . The amendments to the Law on banking further implement the provisions of Directive (EU) 2024/2994. 1.3 To transpose Article 4a of the CRD as inserted by the CRD6, regarding the supervisory independence of competent authorities, the draft law amends the Law on the Financial Market Authority . Further changes to the Law on the Financial Market Authority concern the exchange of information between authorities . 1.4 The draft law amends certain provisions of the Law on savings banks, mainly introducing changes regarding the role and renumeration of the Savings Bank Council and for the purposes of alignment with the Law on companies . 1.5 The draft law amends the Law on investment firms in order to transpose Article 110a of the CRD as inserted by the CRD6 on the scope of application to investment firm groups . 1.6 Finally, the draft law amends the Law on credit service providers and credit purchasers by including clarifications regarding the provision of information as well as amendments further aligning the text with Union law, in particular with Directive (EU) 2021/2167 of the European Parliament and of the 10, 11 Council .

5 See Article 1 of the draft law.

8 Article 3 of the draft law.

9 Article 4 of the draft law.

10 Directive (EU) 2021/2167 of the European Parliament and of the Council of 24 November 2021 on credit servicers and credit purchasers and amending Directives 2008/48/EC and 2014/17/EU (OJ L 438, 8.12.201, p. 1, ELI: https://eurlex.europa.eu/eli/dir/2021/2167/oj).

11 Article 5 of the draft law.

2. Supervisory independence and prevention of conflicts of interest

2.1 General observations 2.1.1 Article 19 of Council Regulation (EU) No 1024/2013 (hereinafter the ‘SSM Regulation’) stipulates that when carrying out the tasks conferred on it by the SSM Regulation, the ECB and the national competent authorities acting within the Single Supervisory Mechanism (SSM) must act independently. Article 31(3) of the SSM Regulation furthermore requires the ECB, in cooperation with the national competent authorities, to: (a) establish and maintain comprehensive and formal procedures including ethics procedures and proportionate periods to assess in advance and prevent possible conflicts of interest resulting from subsequent employment within two years of members of the Supervisory Board; and (b) provide for appropriate disclosures. Those procedures are without prejudice to the application of stricter national rules . The legal basis for those provisions of the SSM Regulation is Article 127(6) of the Treaty. 2.1.2 In view of this independence and these requirements of the SSM Regulation, the ECB has established an ethics framework to ensure the independence of national competent authorities, such as the FMA, when assisting the ECB in carrying out the tasks conferred on it by the SSM Regulation. This ethics framework includes the ECB’s Code of Conduct for high-level ECB officials (hereinafter the ‘Single Code’), which applies, among others, to the members of the Supervisory Board of the ECB when exercising their functions as members of a high-level ECB body, and Guideline (EU) 2021/2256 of the European Central Bank (ECB/2021/50) , which is addressed to the national competent authorities of the SSM and establishes ethics requirements applicable to the members of their bodies and the members of staff of the national competent authorities. In view of the responsibility of the ECB for the effective and consistent functioning of the SSM , the national competent authorities must comply with Guideline (EU) 2021/2256 (ECB/2021/50) . 2.1.3 In contrast to the ethics framework, which is ultimately based on Article 127(6) of the Treaty, the CRD6, including its provision on the supervisory independence of competent authorities , is based on Article 53(1) of the Treaty. A legal act based on this provision cannot alter the rights and obligations of the ECB and the national competent authorities when carrying out the tasks conferred on them by the SSM Regulation based on Article 127(6) of the Treaty. It follows from settled case-

12 Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63, ELI: http://data.europa.eu/eli/reg/2013/1024/oj).

13 See paragraph 2.4 of Opinion CON/2025/23, paragraph 2.4 of Opinion CON/2025/27, paragraph 2.4 of Opinion CON/2025/32, paragraph 2.4 of Opinion CON/2025/33, paragraph 2.4 of Opinion CON/2025/36, paragraph 2.4 of Opinion CON/2026/1 and paragraph 2.4 of Opinion CON/2026/2. All ECB opinions are published on EUR-Lex.

14 Code of Conduct for high-level ECB officials (OJ C 478, 16.12.2022, p. 3).

15 Guideline (EU) 2021/2256 of the European Central Bank of 2 November 2021 laying down the principles of the Ethics Framework for the Single Supervisory Mechanism (ECB/2021/50) (OJ L 454, 17.12.2021, p. 21, ELI: http://data.europa.eu/eli/guideline/2021/2256/oj).

17 See paragraph 2.5 of Opinion CON/2025/23, paragraph 2.5 of Opinion CON/2025/27, paragraph 2.5 of Opinion CON/2025/32, paragraph 2.5 of Opinion CON/2025/33, paragraph 2.5 of Opinion CON/2025/36, paragraph 2.5 of Opinion CON/2026/1 and paragraph 2.5 of Opinion CON/2026/2.

18 See Article 4a of the CRD, as inserted by Article 1, point (4), of the CRD6. law of the Court of Justice of the European Union that the different legal bases, namely Article 53(1) and Article 127(6) of the Treaty, cannot be combined as the legal basis for a legal act, in view of the different procedures involved. In particular, measures under Article 53(1) of the Treaty are adopted by the European Parliament and the Council, acting in accordance with the ordinary legislative procedure, and after consulting the Economic and Social Committee (and, if relevant, the ECB in accordance with Articles 127(4) and 282(5) of the Treaty). By contrast, regulations under Article 127(6) of the Treaty are adopted by the Council alone, by way of a special legislative procedure, in which the Council acts unanimously, after consulting the European Parliament and the ECB . 2.1.4 Hence, the amendments made by the CRD6 are without prejudice to the ethics framework, which the ECB has established to ensure the independence of the national competent authorities in the context of the SSM, as both frameworks have their own scope and legal basis. The Union legislator acknowledged this through the CRD6’s amendments to the CRD, which provide that Article 4a(2) of the CRD is without prejudice to the rights and obligations of the national competent authorities pursuant to the SSM established by the SSM Regulation . For the avoidance of doubt, the national legislator may wish to clarify this within the text of the draft law. From an ECB perspective, the CRD6 provisions may nevertheless serve as guidance for establishing safeguards for the independence of the ECB and the national competent authorities when carrying out the tasks conferred on them by the SSM Regulation . 2.2 Specific observations 2.2.1 The Single Code applies, inter alia, to the members of the Supervisory Board of the ECB, including the FMA representative, when exercising their functions as members of the Supervisory Board of the ECB. It also applies to persons replacing the members in meetings of the Supervisory Board in the performance of their duties and responsibilities relating to that high-level body where explicitly provided for in the Single Code. 2.2.2 National competent authorities, including the FMA, are required to take the necessary measures to implement and comply with Guideline (EU) 2021/2256 and must inform the ECB of any obstacles that national law poses to their implementation. 2.2.3 Regarding independence, the draft law highlights that the existing legal framework already provides that the FMA is not bound by any instructions in the performance of its duties . The ECB notes that

19 See judgment of the Court of Justice of 29 April 2004, Commission v Council, C-338/01, ECLI:EU:C:2004:253, paragraphs 57 and 58; and judgment of the Court of Justice of 10 January 2006, Commission v Parliament and Council, C-178/03, ECLI:EU:C:2006:4, paragraphs 43 to 60.

20 See also paragraph 2.6.2 of Opinion CON/2024/21 of the European Central Bank of 21 June 2024 on a proposal for a regulation of the European Parliament and of the Council as regards certain reporting requirements in the fields of financial services and investment support (OJ C, C/2024/5048, 16.8.2024, ELI: http://data.europa.eu/eli/C/2024/5048/oj).

21 See Article 4a(2), fourth subparagraph, of Directive 2013/36/EU, as inserted by the CRD6. This acknowledgement refers directly to the dismissal requirements included in Article 4(2), second subparagraph, of the CRD6.

22 See paragraph 2.7 of Opinion CON/2025/23, paragraph 2.7 of Opinion CON/2025/27, paragraph 2.7 of Opinion CON/2025/32, paragraph 2.7 of Opinion CON/2025/33, paragraph 2.7 of Opinion CON/2025/36 and paragraph 2.7 of Opinion CON/2026/2.

24 See Article 3.2 of the Single Code.

25 See Article 4 of Guideline (EU) 2021/2256.

28 See Article 17.3, point (b), of the Single Code.

29 The FMA’s Executive Board consists of two members (see Section 5(1) of the Law on the Financial Market Authority), one of whom is a member of the ECB’s Supervisory Board.

30 See Article 2 of the draft law, adding Section 15a(5) to the Law on the Financial Market Authority.

31 See Article 2 of the draft law, adding Section 15a(7) to the Law on the Financial Market Authority.

32 See also paragraph 2.2.3 of Opinion CON/2025/19. 2.2.5 In addition, the Single Code sets limits on the establishment of post-employment relationships not only directly with significant or less significant credit institutions, but also with other financial institutions and with ‘any entity engaged in lobbying in relation to the ECB, or consultancy and/or advocacy for the ECB or for any [supervised] institution’ . The ECB notes that, under the draft law, the cooling-off period only applies in respect of employment or the provision of professional services with (a) credit institutions with which the member of staff or the member of the FMA’s Executive Board has been directly involved for the purposes of supervision or decision-making, including the direct or indirect parent undertakings, subsidiaries or affiliates of those institutions; (b) entities providing services to entities referred in (a); and (c) entities conducting lobbying or advocacy activities directed at the FMA on matters for which the member of the FMA’s Executive Board or the member of staff of the FMA was responsible during their employment or term of office. The broader category of ‘other financial institutions’ is not included . Furthermore, the draft law does not cover lobbying and advocacy activities for supervised institutions. The ECB therefore considers that the requirements of the draft law are less restrictive than those of the Single Code. The ECB highlights that the draft law should be without prejudice to the Single Code, as it may be amended from time to time, and must allow the application of the cooling-off period also with respect to other financial institutions and entities conducting lobbying and advocacy activities for supervised institutions with regard to members of the FMA’s Executive Board that serve as members of the ECB’s Supervisory Board. 2.2.6 The prohibition on trading by members of the FMA’s Executive Board and members of staff of the FMA set out in the draft law is less restrictive as regards the relevant entities than the requirements 35 36 set out in the Single Code and Guideline (EU) 2021/2256 . The draft law limits the prohibition to financial instruments issued by credit institutions subject to the supervision of the FMA, their direct or indirect parent companies, their subsidiaries or affiliated companies, save for some exceptions, and does not extend to instruments issued by other regulated entities . The ECB highlights that the draft law should be without prejudice to the Single Code, as it may be amended from time to time, and to Guideline (EU) 2021/2256, and must not prevent the possibility of extending such prohibition to financial instruments issued by other regulated institutions. 2.2.7 The Single Code also contains rules, inter alia, on declarations of interests , which are more restrictive than the provisions of the draft law . The ECB notes that the application of the draft law’s less restrictive provisions would be without prejudice to the application of the stricter rules of the Single Code to those individuals who are subject to the Single Code. 2.2.8 The ECB notes that the FMA has the power to adopt regulations if there is a specific statutory delegation . The FMA’s Executive Board must also prepare a compliance code that sets out

33 See Article 17.1 and 17.2 of the Single Code.

34 See Article 2 of the draft law, inserting Section 15a(5) into the Law on the Financial Market Authority.

35 See Article 16 of the Single Code.

36 See Article 11 of Guideline (EU) 2021/2256.

37 See Article 2 of the draft law, inserting Section 15a(3) into the Law on the Financial Market Authority.

38 See Article 10.

39 See Article 2 of the draft law, inserting Section 15a(10) into the Law on the Financial Market Authority.

40 See Section 22 of the Law on the Financial Market Authority. procedural guidelines on how to conclude private legal transactions between, on the one hand, members of the FMA’s Executive Board and members of its staff and, on the other hand, supervised institutions . The FMA has implemented the Compliance Code as well as an internal code of conduct. The ECB notes the draft law could be amended to empower the FMA to adopt further provisions on conflicts of interest and incompatibilities following termination of office by means of internal regulatory acts (such as the Code of Conduct) to fulfil its obligations arising from its membership in the SSM . 2.2.9 The CRD, as amended by the CRD6, provides that Member States must ensure that members of a competent authority’s governance body can be dismissed if they no longer meet the criteria of appointment or have been convicted of a serious criminal offence . Under the current version of the Law on the Financial Market Authority, the members of the FMA’s Executive Board can be dismissed if an important reason exists, such as in particular: (a) if a condition for appointment is no longer being fulfilled; (b) if it subsequently emerges that a condition for appointment had not been fulfilled; (c) if a gross breach of duty has occurred; (d) in the event of permanent incapacity or if the member concerned is absent from work for a period of longer than half a year as a result of illness, an accident or an infirmity; or (e) if despite supervisory measures having been taken breaches of duty have not been rectified or have not been rectified in a lasting manner . In addition, only persons who are not excluded from the right to be elected to the Austrian National Assembly may be appointed as members of the FMA’s Executive Board . This provision excludes persons who have been convicted of an intentional criminal offence and sentenced to a prison sentence of more than six months without probation, a suspended prison sentence exceeding one year, or a prison sentence exceeding six months for certain corruption offences . The ECB understands that these provisions – which are to be interpreted in conformity with the requirements of Article 4a(2), second subparagraph, of the CRD, as inserted by the CRD6 – enable, in line with the CRD, the dismissal of members of the FMA’s Executive Board if they no longer meet the criteria for appointment or have been convicted of a serious criminal offence, even though the latter point is not explicitly covered by the wording of the draft law.

3. Other provisions transposing the CRD6

3.1 Third-country branches With regard to third-country branches, the ECB notes that certain provisions of the CRD relating to authorisation requirements and minimum regulatory requirements for third-country branches, the supervisory review and evaluation process, supervisory measures and powers and notifications to EBA have not been transposed into Austrian law, nor is the reason for their non-transposition mentioned in the explanatory memorandum accompanying the draft law. The ECB understands that

42 See also paragraph 1.4 of Opinion CON/2025/33 and paragraph 1.11 of Opinion CON/2025/36.

43 See Article 4a(2), second subparagraph, of the CRD, as inserted by the CRD6. third-country branches are already required to obtain a licence under Austrian law , which amounts to a more stringent requirement than that imposed by the CRD6. 3.2 Notification of material holdings and mergers and divisions With regard to the notification of material holdings and mergers and divisions, the CRD6 provides that, if the national competent authority does not oppose the relevant operation for which the CRD6 prescribes an assessment period within that assessment period in writing, the relevant operation is to be deemed approved for acquisitions of material holdings or the opinion of the competent authority is to be deemed positive for intragroup mergers and divisions . According to the draft law, the FMA must issue a decision even if it does not impose a prohibition at the request of the prospective purchaser (in the case of acquisitions of material holdings) or at the request of the notifying party (in the case of intragroup mergers and divisions) . The ECB understands these provisions as implying that the FMA must, in contrast to the CRD6, always issue a decision if requested to do so by the respective credit institution. The ECB understands that this obligation on the FMA is of a procedural nature and would not have to be applied by the ECB in cases where the ECB is responsible for the direct supervision of significant credit institutions incorporated in Austria . In addition, it should be noted that the obligation could be interpreted as constraining the discretion of the competent authorities to determine on a case-by-case basis whether to conduct assessments of mergers and divisions or acquisitions of material holdings, as specified by the CRD6 . For the purposes of clarity and transparency, the ECB suggests that the Austrian legislator should consider formulating the obligation to issue a decision on request in a way that makes it clear that this obligation applies only in relation to the FMA, and not to the ECB, and that it does not apply to situations where the competent authority has decided to exercise the CRD6 discretion not to assess the operation. 3.3 ESG risks 3.3.1 According to the CRD6, Member States must ensure that the management body approves and at least every two years reviews the strategies and policies for taking up, managing, monitoring and mitigating the risks the institution is or might be exposed to, including those resulting from the current and short-, medium- and long-term impacts of ESG factors . Pursuant to the CRD6, Member States must ensure that the management body develops and monitors the implementation of specific plans that include quantifiable targets and processes to monitor and address the financial risks arising in the short, medium and long term from ESG factors . The draft law contains no specific reference to

48 See Articles 27a(6) and 27i(4) of the CRD as inserted by the CRD6.

49 See Article 27a(14) of the CRD as inserted by the CRD6.

50 See Article 27i(9) of the CRD as inserted by the CRD6.

51 See Article 1 of the draft law, inserting Section 20d(2) into the Law on banking.

52 See Article 1 of the draft law, inserting Section 20m(8) into the Law on banking.

53 See also paragraph 2.4 of Opinion CON/2025/44 in which the ECB opined that introducing a deadline in national law is a procedural burden that could jeopardise the ECB’s ability to fully use its supervisory discretion for the (non) assessment of intra-group mergers involving significant institutions.

54 See Articles 27a(7) and 27i(2) of the CRD as inserted by the CRD6. See also paragraphs 3.2.1 to 3.2.3 of Opinion CON/2025/36. the responsibility of the management body to approve and review strategies and polices for ESGrisk management and to develop and monitor the implementation of plans that address these risks . 3.3.2 The CRD6 contains further provisions on ESG risks. For example, it requires that institutions need to consider a long-term time horizon of at least 10 years . Moreover, competent authorities must ensure that institutions test their resilience to long-term negative impacts of ESG factors, both under baseline and adverse scenarios within a given timeframe, starting with climate-related factors. For such resilience testing, competent authorities must ensure that institutions include a number of ESG scenarios . The draft law only partially implements these provisions. The draft law requires that the FMA must establish, by regulation, minimum requirements for the proper identification, management, monitoring, and mitigation of ESG risks . The ECB understands that the minimum requirements on resilience testing, scenarios and the minimum time horizon of 10 years will therefore be implemented by the FMA via the delegated regulation provided for under Section 39(4) of the Law on banking. 3.4 Suitability assessment for management bodies and key function holders The ECB understands that the draft law permits credit institutions to designate further persons as key function holders in addition to the heads of internal control functions and, where applicable, the chief financial officer . Such further key function holders would be subject to the suitability requirements currently laid down in the Law on banking and to the internal assessment obligations under the draft law. In the interest of legal certainty and supervisory consistency, the draft law should clarify that the appointment of persons to those additional key function holder positions does not give rise to a notification obligation vis-à-vis the competent authority, unless such persons otherwise fall within a category for which a notification obligation is expressly provided under the Law on banking. In addition, under an amendment to the CRD made by the CRD6, heads of the internal control functions are not to be removed without the prior approval of the management body in its supervisory function . By contrast, the draft law only requires prior notification of the management body in its supervisory function . 3.5 Administrative penalties, periodic penalty payments and other administrative measures 3.5.1 The ECB welcomes that the draft law extends the availability of administrative penalties to additional breaches of law. The ECB takes the view that the dissuasiveness of the sanctioning regime could be further improved by granting the national supervisory authority powers to impose penalties for all breaches mentioned in Articles 66 and 67 of the CRD on an institution and on the individuals that are liable for such breaches. In this respect, the ECB observes that the scope of the persons subject to administrative penalties, periodic penalty payments and other administrative measures has been extended to include senior management, key function holders and other members of staff whose professional activities have a material impact on an institution's risk profile.

58 See Article 87a(2) of the CRD as inserted by the CRD6.

59 See Article 87a(3) of the CRD as inserted by the CRD6.

61 See Article 1 of the draft law, inserting Section 39f(1) into the Law on banking.

64 See Article 1 of the draft law, inserting Section 39(5a) into the Law on banking. 3.5.2 The ECB further notes that, in respect of failure to comply with decisions or to obtain a necessary licence, the draft law refers exclusively to decisions and licences of the FMA . This would not cover the situation where the ECB imposes a requirement or a required ECB permission was not obtained when the institution is a significant institution and then becomes a less significant institution under the direct supervision of the FMA . The ECB also takes the view that it would be desirable for the draft law to clarify whether decisions imposing periodic penalty payments are to be published by the national competent authority and whether the national competent authority enjoys a margin of discretion regarding the imposition of absorption interest in line with the judgment of the General Court in BAWAG PSK v ECB . This opinion will be published on EUR-Lex. Done at Frankfurt am Main, 19 June 2026. [signed] The President of the ECB Christine LAGARDE

67 See judgment of the General Court of 28 February 2024, BAWAG PSK v ECB, T-667/21, ECLI:EU:T:2024:131.