{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2018-02-06","gaps":[],"covered":["2017/571 — RTS — Authorisation of data reporting services providers [no longer in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/9","url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/9","title":"Article 9 — Security","family":"l2_unit_view","work_id":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","view_of":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","status":"repealed","force_status":"no_longer_in_force","date_state":"no_longer_in_force","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Consolidated version of 6 February 2018","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0571-20180206","valid_from":"0001-01-01","valid_until":"2025-11-23","content_id":"8d174c1cd3bca290","versions":["0001-01-01"],"version_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/9/versions/2018-02-06","revision_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/9/versions/2018-02-06/rev/8d174c1cd3bca290","versions_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/9/versions","relations_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/9/relations","act_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the#art-9","source_line":"Commission Delegated Regulation (EU) 2017/571 · superseded — not in force · OJ L 87, 31.3.2017 · dated 2 Jun 2016 [no longer in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2016-06-02","entry_into_force":"2017-04-20","locators":{"document_date":"CELLAR 32017R0571 work_date_document","entry_into_force":"CELLAR 32017R0571 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the","name":"Commission Delegated Regulation (EU) 2017/571","number":"2017/571","celex":"32017R0571","title_official":"COMMISSION DELEGATED REGULATION (EU) 2017/571 of 2 June 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council with regard to regulatory technical standards on the authorisation, organisational requirements and the publication of transactions for data reporting services providers (Text with EEA relevance)","document_date":"2016-06-02"},"position":{"kind":"article","key":"9","index":9,"articles":22,"annexes":0},"prev":{"path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/8","key":"8","title":"Article 8 — Testing and capacity"},"next":{"path":"/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/articles/10","key":"10","title":"Article 10 — Management of incomplete or potentially erroneous information by APAs and CTPs"},"act_anchor":"#art-9"}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0571-20180206","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the.md","unit_text_sha256":"850382b8394cbb682e720f27f1f7e0cfc997f626c50c2f08464138f7aec8b2a0","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/mifid-ii/level-2/rts/2017-571-the-authorisation-organisational-requirements-and-the/art-9","kind":"article","key":"9","heading":"Article 9 — Security","text":"## <a id=\"art-9\"></a>Article 9 — Security\n\n1. <a id=\"art-9-p-1\"></a>A data reporting services provider shall set up and maintain procedures and arrangements for physical and electronic security designed to:\n\n    <a id=\"art-9-p-1-a\"></a>**(a)** protect its IT systems from misuse or unauthorised access;\n\n    <a id=\"art-9-p-1-b\"></a>**(b)** minimise the risks of attacks against the information systems as defined in Article 2(a) of Directive 2013/40/EU of the European Parliament and of the Council;\n\n    <a id=\"art-9-p-1-c\"></a>**(c)** prevent unauthorised disclosure of confidential information;\n\n    <a id=\"art-9-p-1-d\"></a>**(d)** ensure the security and integrity of the data.\n\n2. <a id=\"art-9-p-2\"></a>Where an investment firm (‘reporting firm’) uses a third party (‘submitting firm’) to submit information to an ARM on its behalf, an ARM shall have procedures and arrangements in place to ensure that the submitting firm does not have access to any other information about or submitted by the reporting firm to the ARM which may have been sent by the reporting firm directly to the ARM or via another submitting firm.\n\n3. <a id=\"art-9-p-3\"></a>A data reporting services provider shall set up and maintain measures and arrangements to promptly identify and manage the risks identified in paragraph 1.\n\n4. <a id=\"art-9-p-4\"></a>In respect of breaches in the physical and electronic security measures referred to in paragraphs 1, 2 and 3, a data reporting services provider shall promptly notify:\n\n    <a id=\"art-9-p-4-a\"></a>**(a)** the competent authority of its home Member State and provide an incident report, indicating the nature of the incident, the measures adopted to cope with the incident and the initiatives taken to prevent similar incidents;\n\n    <a id=\"art-9-p-4-b\"></a>**(b)** its clients that have been affected by the security breach.\n\n5. <a id=\"art-9-p-5\"></a>In the case of ARMs, the notification referred to in paragraph 4(a) shall also be made to any other competent authorities to whom the ARM submits transaction reports.\n\n","marks":[],"text_hash":"850382b8394cbb682e720f27f1f7e0cfc997f626c50c2f08464138f7aec8b2a0","revision":1}}