Due to the high public interest in the project, ECB had decided to publish the Draft Regulation implementing AnaCredit, the European Analytical Credit Dataset.
As we have major concerns with regard to its legal basis, data protection and proportionality, we submitted to the ECB our comments which can be found here and below.
Legal basis
The ECB claims that the AnaCredit project is a purely statistical undertaking and consequently takes Council Regulation (EC) No 2533/98 of 23 November 1998 concerning the collection of statistical information by the European Central Bank (the Statistics Regulation) as AnaCredit’s legal basis. As a result, the ECB is of the opinion that from a legal perspective only a simplified costs and merits procedure is required.
However, Article 3 of Regulation No 223/2009 of 11 March 2009 states ‘statistics’ “means quantitative and qualitative, aggregated and representative information characterising a collective phenomenon in a considered population.“ Clearly, by requiring detailed data on a loan-by-loan basis, AnaCredit data does not meet this definition.
Moreover, AnaCredit also has a monitoring function. The AnaCredit Draft Regulation itself states in recital 1: „These data will also be useful for banking supervision purposes in the context of the Single Supervisory Mechanism (SSM)“.
Furthermore, Decision ECB/2014/6 of 24 February 2014 indicates in recitals 3 and 4 that AnaCredit will also serve supervisory purposes: „…including in particular contributing to the smooth conduct of policies pursued by the competent authorities relating to the prudential supervision of credit institutions and the stability of the financial system“.
Additionally, the fact that AnaCredit is designed to support the ECB in performing also its banking supervision function is clearly stated on ECB’s website:
https://www.ecb.europa.eu/stats/money/aggregates/anacredit/html/index.en.html
Finally, some data attributes required by AnaCredit do not only serve statistical but also or exclusively supervisory purposes, for example ‚Default status of the instrument‘, ‚Date of the default status of the instrument‘, ‚Accumulated write-offs‘, ‚Accumulated impairment amount‘, ‚Type of impairment‘, ‚Impairment assessment method‘, ‚Sources of encumbrance‘, ‚Accumulated changes in fair value due to credit risk‘, ‚Performing status of the instrument‘, ‚Date of the performing status of the instrument‘, ‚Probability of default‘, ‚Default status of the counterparty‘, and ‚ Date of the default status of the counterparty‘.
For all these reasons it is clear that AnaCredit cannot be based on the Statistics Regulation (alone) and a simplified costs and merits procedure is not sufficient. Serving also supervisory purposes, the AnaCredit Regulation should (also) be based on the SSM Regulation (Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions) which requires in Article 4 (3) to conduct, before adopting a regulation, open public consultations. Following the Interinstitutional Agreement 2013/694/EU between the European Parliament and the European Central Bank, the ECB shall duly inform Parliament’s competent committee of the procedures (including timing) it has set up for adoption of ECB regulations, decisions, guidelines and recommendations (‘acts’), which are subject to public consultation in accordance with Regulation (EU) No 1024/2013. The ECB shall, in particular, inform Parliament’s competent committee of the principles and kinds of indicators or information it is generally using in developing acts and policy recommendations, with a view to enhancing transparency and policy consistency. The ECB shall transmit to Parliament’s competent committee the draft acts before the beginning of the public consultation procedure. Where Parliament submits comments on the acts, there may be informal exchanges of views with the ECB on such comments. Such informal exchanges of views shall take place in parallel with the open public consultations which the ECB shall conduct in accordance with Article 4(3) of Regulation (EU) No 1024/2013.
The decision of the ECB to hold an informal call for comments is, although not publicly announced, welcomed. With the aim to achieve the transparency required by a project with the impact of AnaCredit, the outcome of the costs and merits procedure as well as the comments received as replies to the present consultation need to be made publicly available. Nevertheless, this cannot heal that the current legal basis is not sufficient for the AnaCredit project and should be widened accordingly. Consequently, the ECB should make up for any provisions foreseen in the SSM Regulation and in the Interinstitutional Agreement that have been neglected so far.
The same holds true for any future step extending the scope of AnaCredit as outlined in recital 10 of the AnaCredit Draft Regulation which can only be taken after having held a proper public consultation to allow every party affected to obtain a hearing.
Costs and merits
The registration requirements associated with the AnaCredit project will entail high initial installation costs and high operating costs for credit institutions and data centres. Small and medium-sized banks will be disproportionately affected, a situation which might distort competition in the financial services market. As not all reporting agents are already collecting all data attributes requested by AnaCredit and in order to minimise banks‘ IT expenses as well as the data of clients being reported to the Central Bank causing issues of (personal) data protection, the ECB is asked to provide evidence for each data attribute that it is necessary for the ECB to fulfil the objectives of AnaCredit. In particular, the annual actualisation of data attributes such as ’number of employees‘ and ‚annual turnover‘ will result in a high administrative burden and should therefore be rethought.
The ECB also argues that the comprehensive collection of data means that special requests can be avoided in the future. The blanket collection of data which might be relevant at a later date cannot be reconciled with the principle of data minimisation, especially as new, specific questions will always arise over time, and these cannot be answered using an already-existing statistic.
Finally, the ECB should also clarify how to deal with loans that have already been granted in the past. It seems appropriate to foresee a phasing-in of the reporting requirements for old stock. This grandfathering rule has to be part of the Final Regulation on AnaCredit.
Data protection
Personal data (Article 13)
AnaCredit enables sensitive data to be collected and stored in a central data pool at the ECB. Even anonymisation might lead to the de facto assignment of all the data in the ECB’s central data pool to a borrower by way of criteria such as place of residence or postcode. In combination, for example, with the probability of default, which allows conclusions to be drawn about the borrower’s creditworthiness, and the collateral for loans which must be stated, the result is the collection of data on every borrower which is on a par with data collection by internet companies. Since all assets, such as collateral and securities, also have to be listed, data consultation through AnaCredit amounts more or less to the disclosure of the economic situation to the ECB. Therefore, a general reference to the EU Data Protection Directive without further specification is not sufficient. The Final AnaCredit Regulation needs to specify minimum safeguards so that effective personal data protection is guaranteed.
Feedback loop to reporting agents (Article 11)
With regard to feedback loop, the informal comments of the European Data Protection Supervisor (EDPS) on the AnaCredit Draft Regulation should be taken into account. EDPS recommends ECB to ensure that the Regulation “clearly states that actual and prospective debtors who are natural persons shall be informed that their personal data are processed for the pruposes of assessing their creditworthiness or financial institution. Pursuant to Articles 10 and 11 of Directive 95/46/EC, they shall also be informed on the entity/ies in charge of processing their data and, in accordance with Article 15 of Directive 95/46/EC, be given the opportunity to comment on, and possibly rectify, any conclusion reached as to their creditworthiness. In addition, the Proposal should provide for a maximum retention period applicable to the personal data collected, which should be deleted once such term has expired.”
With the aim to limit the possibilities for abuse and unlawful access to (personal) data, the final AnaCredit Regulation needs to specify and limit which entities will have access to the data register and also which data will be accessible. Additionally, the rules concerning the feedback loop to reporting agents must be harmonised across the EU.
The EDPS informal comments can be found here.
Alignment with other reporting requirements
As currently designed, AnaCredit will impose additional reporting requirements on reporting agents. In order to avoid redundant and overlapping reporting requirements, AnaCredit has to be aligned with other, already existing reporting requirements on European level and with the development of the European Reporting Framework (ERF). As an example, the list of institutional sectors required by AnaCredit is not in line with EBA reporting. This lack of alignment of the counterparty classification creates an unnecessary administrative burden for reporting agents. The counterparty sector used for FINREP should be used instead.
Moreover, national credit registers have to be integrated into AnaCredit. Within a Single Market, the reporting requirements should be harmonised in a proportional manner and if this cannot be achieved immediately the ECB should work towards this objective by integrating national or regional special reporting obligation into one cost efficient reporting framework.
Before the implementation of AnaCredit, the ECB should at least provide clarification on the meaning of specific data attributes. It has to be ensured that the requirements are agreed on European level so that they are comparable as far as differing accounting standards allow.
Reporting agents in scope (Article 3)
As currently designed, only credit institutions are in the scope of AnaCredit which means a discriminatory treatment with regard to other financial corporations engaged in lending. In line with the opinion from the European Commission of 7 August 2015 on the AnaCredit draft Regulation, regulatory arbitrage has to be prevented and all lenders must be made subject to the reporting requirements of AnaCredit. The inclusion of all financial corporations engaged in lending has to be ensured beginning with the first implementation of AnaCredit and cannot wait until next steps extending the scope of AnaCredit may be taken in the future.
Accounting standard to be used (Article 6)
Article 6 of the AnaCredit Draft Regulation states that the reporting will be submitted on an individual basis. However, it does not specify the accounting standard to be used.
Some of the attributes listed regarding AnaCredit are based on International Financial Reporting Standards (IFRS). This is in violation of Council Regulation (EU) No 1024/2013 of 15 October 2013 (the SSM Regulation) which states in recital 19: “Nothing in this Regulation should be understood as changing the accounting framework applicable pursuant to other acts of Union and national law” and in recital 39: “The ECB’s request for information to perform its calculation should not force the institutions to apply accounting frameworks differing from those applicable to them pursuant to other acts of Union and national law”. Users of national accounting standards, in particular small and medium-sized banks, do not currently have IFRS data and would be forced to obtain these standards, in spite of their rights as documented. This would entail a considerable burden for precisely those institutions which should be protected by the proportionality principle.
Beyond that, in order to avoid that banks already applying IFRS need to make substantial revisions to their IT-systems twice, the AnaCredit Regulation should not be implemented before IFRS 9 ‘Financial Instruments’ has become applicable in the EU.
Reporting thresholds (Article 5)
In the first stage, the ECB will record all performing loans in excess of EUR 25 000 made by credit institutions to legal persons which, with regard to Germany for example, would increase the number of borrowers and loans covered by the reporting obligation by a multiple of the previous level. In accordance with Section 14 of the Banking Act (KWG), the ceiling for borrowers is currently EUR 1 million in Germany. This already provides sufficient coverage for the necessary macro-prudential analysis to be carried out by AnaCredit.
The reporting threshold for non-performing loans is set at EUR 100. Consequently, if reporting agents are to fulfil a possible future registration obligation in line with the ECB’s requirements, they will have to collect all AnaCredit data attributes when accounts are opened. This is not standard procedure, and to the extent required here, in all cases of business relations based on loans. It has not yet been made clear that the AnaCredit data collection follows the principles of necessity and simplicity.
Derogations (Article 17)
As currently designed, the decision on derogations for reasons of proportionality is up to the national central bank. In order to achieve a level playing field, derogations must be set exclusively at EU level.