ESMA has fined REGIS-TR, S.A. €1,374,000 for seven negligent breaches of organisational obligations under EMIR and SFTR, marking the first SFTR enforcement action and ESMA's highest fine against a trade repository. The breaches involved deficiencies in policies, procedures, organisational structure, operational risk management, and data confidentiality, compromising SFTR reporting and market data integrity. This underscores ESMA's intensified enforcement on trade repositories (TRs) to ensure high-quality data for market surveillance and financial stability.
What Changed
This is an enforcement decision, not new legislation, but it reinforces existing EMIR and SFTR requirements on TRs, particularly:
Policies and procedures: Must be adequate to ensure compliance, with clear roles and responsibilities for governing bodies (breaches under EMIR Art. 78(3) and SFTR Art. 9(1), Point (c) Section I Annex I EMIR).
Organisational structure: Must ensure business continuity and orderly functioning, especially for SFTR services (breach under SFTR).
Operational risk management: Identify and minimise risks via systems, controls, and procedures (breaches under EMIR and SFTR,...
What You Need To Do
- For REGIS-TR specifically
- For all TRs
- Audit organisational structure for SFTR business continuity and orderly functioning
- Conduct operational risk assessments, implementing controls/systems to minimise risks under EMIR/SFTR
- Enhance data confidentiality/integrity protections and misuse prevention measures
Key Dates
14 November 2013 - REGIS-TR initial registration with ESMA under EMIR.
7 May 2020 - REGIS-TR registration extended to SFTR reporting.
14 June 2024 - ESMA Supervisory Report identifying serious indications of breaches.
17 June 2024 - Public notice references investigations leading to findings (dated in decision docs).
17 February 2026 - ESMA Board of Supervisors meeting discussing the case.
Compliance Impact
Urgency: High – As the first SFTR enforcement and record TR fine (€1.374M), it demonstrates ESMA's commitment to punitive action on negligence causing systemic data risks, directly threatening market integrity and surveillance. TRs face immediate remediation pressure (three breaches ongoing), with fines amplified by duration/systemic factors; non-TRs using TRs risk indirect exposure via poor data quality. Firms should prioritise audits now to avoid similar "negligent" findings.