On 6 July 2026, the European Commission adopted amendments to Delegated Regulation (EU) 2017/392, imposing new information requirements on Central Securities Depositories (CSDs) for the supervisory review and evaluation process under Article 22(1) of Regulation (EU) No 909/2014 (CSDR). The delegated regulation, published as C(2026)4642, aims to align reporting obligations with the strengthened supervisory framework introduced by the CSDR Refit, affecting CSDs operating in the EU.
The amendments require CSDs to submit a summary report of key changes since the last review, covering group structure, management, shareholders, activities, services, outsourcing, and links. Additional periodic information must be provided on changes to risk management, including legal, business, and operational risks, as well as progress on addressing outstanding findings from competent authorities. CSDs must also supply statistical data on cross-border activities, specifying jurisdictions of participants and issuers and the governing law of securities. Information sharing with relevant authorities is expanded to reflect their strengthened role under CSDR Refit.
To ease implementation, the application of certain new requirements is deferred by one year, allowing CSDs time for IT and process adaptations. The regulation enters into force on the twentieth day following its publication in the Official Journal of the European Union.
The expanded reporting obligations increase the administrative burden on CSDs, requiring them to collect and submit more detailed data on risk management and cross-border operations. However, the one-year deferral provides a transitional period to adjust systems. Competent authorities gain enhanced access to information, enabling more effective supervision and early identification of risks. The measures support financial stability by improving oversight of CSD activities, particularly in cross-border contexts. The European Securities and Markets Authority (ESMA) will be involved in the review of the information submitted, ensuring consistency across the EU.
The delegated regulation will be transmitted to the European Parliament and the Council for scrutiny. If no objections are raised within the standard three-month period, it will be formally adopted and published in the Official Journal.