1. The home Member State shall require that investment firms comply with the organisational requirements laid down in paragraphs 2 to 10 of this Article and in Article 17.
2. An investment firm shall establish adequate policies and procedures sufficient to ensure compliance of the firm including its managers, employees and tied agents with its obligations under this Directive as well as appropriate rules governing personal transactions by such persons.
4. An investment firm shall take reasonable steps to ensure continuity and regularity in the performance of investment services and activities. To that end the investment firm shall employ appropriate and proportionate systems, resources and procedures.
5. An investment firm shall ensure, when relying on a third party for the performance of operational functions which are critical for the provision of continuous and satisfactory service to clients and the performance of investment activities on a continuous and satisfactory basis, that it takes reasonable steps to avoid undue additional operational risk. Outsourcing of important operational functions may not be undertaken in such a way as to impair materially the quality of its internal control and the ability of the supervisor to monitor the firm’s compliance with all obligations.
An investment firm shall have sound administrative and accounting procedures, internal control mechanisms, effective procedures for risk assessment, and effective control and safeguard arrangements for information processing systems.
Without prejudice to the ability of competent authorities to require access to communications in accordance with this Directive and Regulation (EU) No 600/2014, an investment firm shall have sound security mechanisms in place to guarantee the security and authentication of the means of transfer of information, minimise the risk of data corruption and unauthorised access and to prevent information leakage maintaining the confidentiality of the data at all times.
8. An investment firm shall, when holding financial instruments belonging to clients, make adequate arrangements so as to safeguard the ownership rights of clients, especially in the event of the investment firm’s insolvency, and to prevent the use of a client’s financial instruments on own account except with the client’s express consent.
9. An investment firm shall, when holding funds belonging to clients, make adequate arrangements to safeguard the rights of clients and, except in the case of credit institutions, prevent the use of client funds for its own account.
10. An investment firm shall not conclude title transfer financial collateral arrangements with retail clients for the purpose of securing or covering present or future, actual or contingent or prospective obligations of clients.
11. In the case of branches of investment firms, the competent authority of the Member State in which the branch is located shall, without prejudice to the possibility of the competent authority of the home Member State of the investment firm to have direct access to those records, enforce the obligation laid down in paragraphs 6 and 7 with regard to transactions undertaken by the branch.
Member States may, in exceptional circumstances, impose requirements on investment firms concerning the safeguarding of client assets additional to the provisions set out in paragraphs 8, 9 and 10 and the respective delegated acts as referred to in paragraph 12. Such requirements must be objectively justified and proportionate so as to address, where investment firms safeguard client assets and client funds, specific risks to investor protection or to market integrity which are of particular importance in the circumstances of the market structure of that Member State.
Member States shall notify, without undue delay, the Commission of any requirement which they intend to impose in accordance with this paragraph and at least two months before the date appointed for that requirement to come into force. The notification shall include a justification for that requirement. Any such additional requirements shall not restrict or otherwise affect the rights of investment firms under Articles 34 and 35.
The Commission shall within two months of the notification referred to in the third subparagraph provide its opinion on the proportionality of and justification for the additional requirements.
Member States may retain additional requirements provided that they were notified to the Commission in accordance with Article 4 of Directive 2006/73/EC before 2 July 2014 and that the conditions laid down in that Article are met.
The Commission shall communicate to Member States and make public on its website the additional requirements imposed in accordance with this paragraph.