{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2018-02-06","gaps":[],"covered":["2017/571 — RTS — Authorisation of data reporting services providers [no longer in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/6","url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/6","title":"Article 6 — Organisational requirements regarding outsourcing","family":"l2_unit_view","work_id":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","view_of":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","status":"repealed","force_status":"no_longer_in_force","date_state":"no_longer_in_force","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Consolidated version of 6 February 2018","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0571-20180206","valid_from":"0001-01-01","valid_until":"2025-11-23","content_id":"e9c228e64d9b37e0","versions":["0001-01-01"],"version_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/6/versions/2018-02-06","revision_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/6/versions/2018-02-06/rev/e9c228e64d9b37e0","versions_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/6/versions","relations_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/6/relations","act_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the#art-6","source_line":"Commission Delegated Regulation (EU) 2017/571 · superseded — not in force · OJ L 87, 31.3.2017 · dated 2 Jun 2016 [no longer in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2016-06-02","entry_into_force":"2017-04-20","locators":{"document_date":"CELLAR 32017R0571 work_date_document","entry_into_force":"CELLAR 32017R0571 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","name":"Commission Delegated Regulation (EU) 2017/571","number":"2017/571","celex":"32017R0571","title_official":"COMMISSION DELEGATED REGULATION (EU) 2017/571 of 2 June 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council with regard to regulatory technical standards on the authorisation, organisational requirements and the publication of transactions for data reporting services providers (Text with EEA relevance)","document_date":"2016-06-02"},"position":{"kind":"article","key":"6","index":6,"articles":22,"annexes":0},"prev":{"path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/5","key":"5","title":"Article 5 — Conflicts of interest"},"next":{"path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/7","key":"7","title":"Article 7 — Business continuity and back-up facilities"},"act_anchor":"#art-6"}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0571-20180206","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the.md","unit_text_sha256":"35f0f74e2ffe5eae2a000830275feebe064361b923cbeeed64c55f3f349d5664","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/art-6","kind":"article","key":"6","heading":"Article 6 — Organisational requirements regarding outsourcing","text":"## <a id=\"art-6\"></a>Article 6 — Organisational requirements regarding outsourcing\n\n1. <a id=\"art-6-p-1\"></a>Where a data reporting services provider arranges for activities to be performed on its behalf by third parties, including undertakings with which it has close links, it shall ensure that the third party service provider has the ability and the capacity, to perform the activities reliably and professionally.\n\n2. <a id=\"art-6-p-2\"></a>A data reporting services provider shall specify which of the activities are to be outsourced, including a specification of the level of human and technical resources needed to carry out each of those activities.\n\n3. <a id=\"art-6-p-3\"></a>A data reporting services provider that outsources activities shall ensure that the outsourcing does not reduce its ability or power to perform senior management or management body functions.\n\n4. <a id=\"art-6-p-4\"></a>A data reporting services provider shall remain responsible for any outsourced activity and shall adopt organisational measures to ensure:\n\n    <a id=\"art-6-p-4-a\"></a>**(a)** that it assesses whether the third party service provider is carrying out outsourced activities effectively and in compliance with applicable laws and regulatory requirements and adequately addresses identified failures;\n\n    <a id=\"art-6-p-4-b\"></a>**(b)** the identification of the risks in relation to outsourced activities and adequate periodic monitoring;\n\n    <a id=\"art-6-p-4-c\"></a>**(c)** adequate control procedures with respect to outsourced activities, including effectively supervising the activities and their risks within the data reporting services provider;\n\n    <a id=\"art-6-p-4-d\"></a>**(d)** adequate business continuity of outsourced activities;\n\n    For the purposes of point (d), the data reporting services provider shall obtain information on the business continuity arrangements of the third party service provider, assess its quality and, where needed, request improvements.\n\n5. <a id=\"art-6-p-5\"></a>A data reporting services provider shall ensure that the third party service provider cooperates with the competent authority of the data reporting services provider in connection with outsourced activities.\n\n6. <a id=\"art-6-p-6\"></a>Where a data reporting services provider outsources any critical function, it shall provide the competent authority of its home Member State with:\n\n    <a id=\"art-6-p-6-a\"></a>**(a)** the identification of the third party service provider;\n\n    <a id=\"art-6-p-6-b\"></a>**(b)** the organisational measures and policies with respect to outsourcing and the risks posed by it as specified in paragraph 4;\n\n    <a id=\"art-6-p-6-c\"></a>**(c)** internal or external reports on the outsourced activities.\n\n    For the purpose of the first sub paragraph 6, a function shall be regarded as critical if a defect or failure in its performance would materially impair the continuing compliance of the data reporting services provider with the conditions and obligations of its authorisation or its other obligations under Directive 2014/65/EU.\n\n","marks":[],"text_hash":"35f0f74e2ffe5eae2a000830275feebe064361b923cbeeed64c55f3f349d5664","revision":1}}