{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2017/584 — RTS — Organisational requirements of trading venues [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues/articles/23","url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues/articles/23","title":"Article 23 — Security and limits to access (Article 48(1) of Directive 2014/65/EU)","family":"l2_unit_view","work_id":"spaces/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues","view_of":"/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Commission Delegated Regulation (EU) 2017/584, OJ L 87, 31.3.2017","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_del/2017/584/oj/eng","valid_from":"2017-04-20","valid_until":null,"content_id":"6ac89a11b5dd7f28","versions":["2017-04-20"],"version_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues/articles/23/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues/articles/23/versions/2026-10-26/rev/6ac89a11b5dd7f28","versions_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues/articles/23/versions","relations_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues/articles/23/relations","act_url":"https://www.headlesslaw.com/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues#art-23","source_line":"Commission Delegated Regulation (EU) 2017/584 · binding · OJ L 87, 31.3.2017 · dated 14 Jul 2016 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2016-07-14","entry_into_force":"2017-04-20","locators":{"document_date":"CELLAR 32017R0584 work_date_document","entry_into_force":"CELLAR 32017R0584 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues","path":"/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues","name":"Commission Delegated Regulation (EU) 2017/584","number":"2017/584","celex":"32017R0584","title_official":"COMMISSION DELEGATED REGULATION (EU) 2017/584 of 14 July 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council with regard to regulatory technical standards specifying organisational requirements of trading venues (Text with EEA relevance)","document_date":"2016-07-14"},"position":{"kind":"article","key":"23","index":23,"articles":24,"annexes":1},"prev":{"path":"/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues/articles/22","key":"22","title":"Article 22 — Specific requirements for trading venues permitting sponsored access (Article 48(7) of Directive 2014/65/EU)"},"next":{"path":"/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues/articles/24","key":"24","title":"Article 24 — Entry into force"},"act_anchor":"#art-23"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg_del/2017/584/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues.md","unit_text_sha256":"342fab6b07028035f1df191572a38de6891c7aa23412bb70328bcba50c32f033","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/mifid-ii/level-2/rts/2017-584-organisational-requirements-of-trading-venues/art-23","kind":"article","key":"23","heading":"Article 23 — Security and limits to access (Article 48(1) of Directive 2014/65/EU)","text":"## <a id=\"art-23\"></a>Article 23 — Security and limits to access (Article 48(1) of Directive 2014/65/EU)\n\n1. <a id=\"art-23-p-1\"></a>Trading venues shall have in place procedures and arrangements for physical and electronic security designed to protect their systems from misuse or unauthorised access and to ensure the integrity of the data that is part of or passes through their systems, including arrangements that allow the prevention or minimisation of the risks of attacks against the information systems as defined in Article 2(a) of Directive 2013/40/EU of the European Parliament and of the Council.\n1. <a id=\"art-23-p-2\"></a>In particular, trading venues shall set up and maintain measures and arrangements for physical and electronic security to promptly identify and prevent or minimise the risks related to:\n\n    <a id=\"art-23-p-2-a\"></a>**(a)** unauthorised access to their trading system or to a part thereof, including unauthorised access to the work space and data centres;\n\n    <a id=\"art-23-p-2-b\"></a>**(b)** system interferences that seriously hinder or interrupt the functioning of an information system by inputting data, by transmitting, damaging, deleting, deteriorating, altering or suppressing such data, or by rendering such data inaccessible;\n\n    <a id=\"art-23-p-2-c\"></a>**(c)** data interferences that delete, damage, deteriorate, alter or suppress data on the information system, or render such data inaccessible;\n\n    <a id=\"art-23-p-2-d\"></a>**(d)** interceptions, by technical means, of non-public transmissions of data to, from or within an information system, including electromagnetic emissions from an information system carrying such data.\n\n1. <a id=\"art-23-p-3\"></a>Trading venues shall promptly inform the competent authority of incidents of misuse or unauthorised access by promptly providing an incident report indicating the nature of the incident, the measures adopted in response to the incident and the initiatives taken to avoid similar incidents from occurring in the future.\n\n","marks":[],"text_hash":"342fab6b07028035f1df191572a38de6891c7aa23412bb70328bcba50c32f033","revision":1}}