1. TITRE 4 th REMIT IT Expert Group Ljubljana, 27 th June 2013 Discussion on ACER Guidelines for RRM and RIS Stefano Bracco Knowledge Manager

2. Section 1, Question 1: The registration process for both Registered Reporting Mechanisms and Regulated Information Services comprises two stages: Firstly, the Agency will review a written application, and if appropriate make a provisional registration (pre-registration of the applicant); secondly, the Agency will make a final registration subject to successful integration with the Agency’s technology as described in the Agency’s „Technical Specifications for Registered Reporting Mechanisms and Regulated Information Services” document. For reasons of operational reliability, the technical specifications document will be kept confidential and applicants will have to sign a non-disclosure agreement before receiving a copy of the technical specifications document. This is a best practice applied by national financial regulators under EU financial market rules which the Agency also intends to apply for REMIT purposes. Please indicate your views on the proposed approach for the registration process. Respondents’ feedback The majority of respondents agree with proposed two-stage registration process. Nevertheless there is a need of clarification of registration criteria and setting a time frame of a registration process (length of application assessment) expressed. Also more respondents stated that there are no reasons for confidentiality of technical specifications documents than vice versa. Some respondents proposed to include possibility of direct registration and reporting to ACER. One respondent stated that reporting requirements for RRM and RIS must be aligned with ENTSO-E, one respondent stated need of synchronising under REMIT and EMIR. Also opinion that registration process must be implemented minimising the number of new processes and only with the necessary costs and as simple as possible was expressed.

3. Section 1, Question 2: According to the REMIT Technical Advice for setting up a data reporting framework from June 2012 from DG ENER’s consultants, it is currently considered that only Registered Reporting Mechanisms and Regulated Information Services with legal status in an EU Member State or an EEA country should be eligible to become a Registered Reporting Mechanism or Regulated Information Service. Please indicate your views on this suggestion. Respondents’ feedback The view on this question isn’t unanimous. One part of respondents’ agree with ACER suggestion that RRMs and RISs must have legal status in EU Member States or EEA countries to avoid difficulties of supervision of such entities and ensuring data security requirements, another part of respondents disagree with this suggestion arguing that there is no reason of such restriction if RRMs and RISs from non EU and EEA countries conform to the data protection, operational requirements set by EU legislation. One respondent is proposing that RRM must be regulated and authorized bus national regulators. One respondent emphasize vagueness of concept of legal status. One respondent suggests that NRAs could become RRM: in such way double reporting in TSOs case will be avoided.

4. Section 1, Question 3: Do you have any general remarks on the draft RRM and or draft RIS Guidelines? Respondents’ feedback In this section respondents have wide range of proposals and suggestions on financing, procedure and reporting issues. Some Respondents are expressing need for more detailed guidelines as some aspects are not covered sufficiently at the moment and doubts necessity of renewing the status on biannual base. Also individual respondents are proposing that RRM must be financed not from fees charged on market participants, but from some other source, express need in detailed procedure in case RRM/RIS reporting transactions for external third parties does not comply data security and other operational requirements, proposing to use security platforms and protocols developed by ENTSO-E, saying that storage of 7 years old information isn’t necessary because of rapid market development, suggesting model of reporting distinction to market participants, reporting for themselves and affiliate companies and on behalf of the other market participants. Respondents are asking clarification on cooperation between RRM, possibilities to choose more than one RRM for reporting, RRM possibilities of limiting its services to certain exchanges or geographical zones. One respondents opposing the suggestion of annual report provision while other proposing audit and publicity of annual report. Respondents are also proposing to unify requirements for entities applying for RIS with those for RRM.

5. Section 2, Question 1 The aim of the Guidelines is to ensure operational reliability of the information received pursuant to Article 4(2) and Articles 8 and 10 of REMIT. Should Registered Reporting Mechanisms be required to have an ISO certification 27001 or similar to become a Registered Reporting Mechanisms as proposed in the REMIT Technical Advice for setting up a data reporting framework from June 2012 from DG ENER’s consultants? Respondents’ feedback Some participants believe that requiring ISO 27001 will not add any additional value to the regulatory reporting regime because they believe best practices already exist that are proven. One trade body is concerned that ACER has yet to identify the security protocols that may go into such a standard. It calls for wider engagement with the industry to develop those protocols, particularly regarding how individual NRAs and other regulatory authorities will gain access. A trade body for exchanges suggested that a certification scheme go into place but opposes nominating a specific scheme, such as ISO 27001. One particular candidate to become a third party RRM said ISO 27001 was not appropriate because it would add undue cost, take a long time to implement (minimum of a year to attain the certification in any event according to one party) and require that the entire organisation be audited whilst not addressing the specifies of the RRM security requirement. Market participants ought to receive guarantees of legal, technical, organisational and procedural assurance to insure that data is securely transmitted. Some market participants believed that ISO 27001 is fully justified. However, differing requirements should apply to third party reporters and direct market participant reporters. Some participants argued that because third parties will deal with other parties’ data only those parties should have to be certified under ISO 27001 whereas self reporting parties should have no such obligation.

6. Section 2, Question 2 Respondents’ feedback The draft RRM Guidelines currently foresee a simplified registration procedure for trade repositories registered according to EMIR. Do you agree with this approach? Comments were very mixed as to whether there should be a simplified registration process for trade repositories under EMIR. No consistent view can be gleaned. However it was generally recognised that thorough tests would be needed on the trade repository to ensure they are capable of receiving and processing data for the wholesale energy market as this would prevent double reporting. Several market participants believe that the trade repository reporting under EMIR and the system operating under ACER ought to interoperate so as to simplify the reporting requirement for market participants. Some candidate third party RRMs suggested that a level playing field be created so as not deter significant investment in processes and security by the trade repositories if they did not meet the standards required. Having established trade repositories going through an easy process may prevent RRMs from applying to register simply because of their first-to-the-market competitive advantage. A trade body representing exchanges said there should be no simplification because consistent high quality data needs to be reported. However, some participants identified that the simplification should actually apply to market participants that wish to report directly as opposed to a trade repository! Some participants said ESMA’s registration process and criteria seem adequate but ACER would still need to ensure the criteria met its own needs. Trade repositories must also ensure they have the same guarantees and liabilities as RRMs and RISs.

7. Section 2, Question 3: Please express your views on the RRM criteria proposed. Respondents’ feedback Many participants called for two approaches to be used for the RRM guidelines so that a lighter set of guidelines apply to market participants reporting their own transactions directly and those that are third party. One participant indicated that this was envisaged under Recommendation 10 to the Commission and called for the creation of a new category called “Certified Self Reporting Party”. Some participants suggest allowing direct reporting by market participants in case there was a failure of a RRM or RIS to report in a timely manner. One trade body called for RRMs from each of the areas of activity: TSOs for schedules and nominations Power exchanges and brokers for orders and trades Trade matching for standardised trades executed outside of a venue A trade body suggested that ACER ensures there is a possibility of updating and periodically improving the guidelines / criteria. Several respondents raised the question of where liability fell. Several trade bodies suggested that liability be transferred to the third party RRM if a market participant delegates responsibility to report trades......

8. Section 2, Question 4. Should Registered Reporting Mechanisms, for reasons of operational reliability, be required to support their annual reports, upon request and with at least 12 months’ notice, by a recognised external auditor’s report which confirms that the Registered Reporting Mechanism met all the criteria in the preceding 12 months? Respondents’ feedback Concerns that the audit requirement may place an unnecessarily high burden on direct reporting market participants as opposed to third party RRMs providing a service. Most parties got the idea that this was an audit on activities and not the financial annual report! Candidate RRM suggested that the findings of the audit be made public and agreed with the approach. Some market participants said that for third parties such an audited report seems fully justified. Whereas a trade body for power exchanges strongly opposed the idea, preferring the option to create a report as and when required as such an audit report would not increase the operational reliability of an RRM. There was a question raised on why no such audit report would be required for RISs. Some RRM candidates suggested that the implications of a failed audit are profound on the RRM, Market Participants and ACER. Further guidelines might be needed covering: What are the market impacts of a failed audit, it must be understood that switching RRM is unlikely to be a simple and quick step for MPs; What are the sanctions; What is the timescale to rectify; and How is the market notified. Also if a self reporting market participant were found to be non compliant with the standards of the audit for the previous 12 months what sanctions would there be?

9. Section 3, Question 1 Do you agree with the three different types of Regulated Information Services proposed and the distinction made concerning their reporting of information? Respondents’ Feedback The majority of respondents agree with three different types of RISs proposed and the distinction made between the reported information Also several respondents noted that they see no need to report directly fundamental data or inside information additionally to ACER, when such information is already published on publicly available websites. Others state that the necessity that the reporting obligation is set to be in force only once all intermediation and delegation entities are in place and ready to operate. There are some respondents believing in that RIS provide the best reporting of information and the people who work with RIS must be elected directly by the ACER. Others claim that three types of platforms could coexist in order to report RIS, however, one platform should not be limited to respond to only one type as enumerated in the guidance. It was noted that in relation of the third type of RIS, TSOs and other infrastructure operators could provide this to ACER. One respondent noted that distinction between types of the proposed RISs is not clear.

10. Section 3, Question 2 Do you agree that ENTSO-E and –G transparency platforms should play a crucial role in the reporting of transparency information according to Regulations (EC) No 714/2009 and (EC) No 715/2009, including network codes and guidelines, and be treated differently than other information sources? Respondents’ feedback Most respondents agree with the crucial role of ENTSO-E and ENTSO-G. A problematic point is that not all respondents fully understood what is meant by “treated differently” in the question. This led to the fear that they will not be allowed to use their existing and well established reporting mechanisms using already existing platforms in the future. Therefore, some market participants mention that in addition to the use of ENTSO-E and ENTSO-G they should be allowed to use already existing platforms which should not be treated differently than ENTSO-E and ENTSO-G.

11. Section 3, Question 3: Do you agree that it should be sufficient that inside information platforms make their information available to the Agency through web-feeds? Respondents’ feedback Many respondents agree with the use of web feeds, although some of them mention that is has to be further defined what is meant by the term “web-feed” and how the format will look like. The following proposals regarding the publication channel were made by one respondent: MADES web-services secure FTP solutions

12. Section 3, Question 4: Do you agree that the technical specifications document should be the same for Regulated Information Services reporting individual and non-aggregated information than for Registered Reporting Mechanisms reporting confidential trade data due to the same sensitivity of the information? Respondents’ feedback Most respondents simply agree with this statement, some do not provide any answer at all. Only one respondent disagrees, but is it not sure if he understood the question correctly: “No, we don’t agree. The technical specifications for RRMs should apply stricter data security regulations since the data they provide for ACER is not to be published. Furthermore the quantity will be much higher than when reporting inside information. RIS reported information will be published to the market in most cases almost at the same time as to ACER.” “The two services are quite different in terms of magnitude of data and this aspect must be kept into considerations in the technical requirements.”

13. Section 3, Question 4: Do you agree that the technical specifications document should be the same for Regulated Information Services reporting individual and non-aggregated information than for Registered Reporting Mechanisms reporting confidential trade data due to the same sensitivity of the information? Respondents’ feedback Most respondents simply agree with this statement, some do not provide any answer at all. Only one respondent disagrees, but is it not sure if he understood the question correctly: “No, we don’t agree. The technical specifications for RRMs should apply stricter data security regulations since the data they provide for ACER is not to be published. Furthermore the quantity will be much higher than when reporting inside information. RIS reported information will be published to the market in most cases almost at the same time as to ACER.” “The two services are quite different in terms of magnitude of data and this aspect must be kept into considerations in the technical requirements.”

14. Thank you for your attention Thank you for your attention! www.acer.europa.eu