EU adopts RTS setting compliance, ICT and information-quality criteria for European Green Bond external reviewers
External reviewers of European Green Bonds must meet ESMA's compliance, ICT, recordkeeping and information-quality criteria to gain or keep recognition
Change
On 17 June 2026 the European Commission adopted Delegated Regulation (EU) 2026/544, regulatory technical standards under the European Green Bonds Regulation specifying the criteria for assessing external reviewers' systems, compliance function, internal controls, ICT risk management and information quality, and the machine-readable application format for third-country reviewer recognition by ESMA; it enters into force 20 days after publication.
Why it matters
The RTS bundles the standards empowered under Articles 26, 29, 30, 31 and 42 of Regulation (EU) 2023/2631 and sets the criteria external reviewers of European Green Bonds must satisfy: secure and continuous review systems with sufficient resources; an independent monitoring function with recorded remediation and management-body oversight; a compliance function with board-approved authority, adequate resources and expertise, and full access to corporate and control records; sound accounting with a clear audit trail; a risk-management and internal-control framework; and ICT risk management including security assessments at least every 24 months and tested redundant capacity. It also sets information-quality and source-reliability criteria for reviews, and the machine-readable application format, document-referencing and senior-management attestation required for ESMA recognition of third-country reviewers, with a five-year personal-data retention limit. The Regulation enters into force 20 days after publication in the Official Journal.
Implications
- — External reviewers of European Green Bonds must maintain a compliance function with board-approved policies giving it independent authority, sufficient resources and expertise, and physical and digital access to corporate and control records — including audit reports, whistleblowing and complaint records and information on outsourced functions — to satisfy ESMA's assessment criteria.
- — External reviewers must operate sound administrative, accounting and internal-control arrangements with a clear audit trail and a risk-management framework, and ICT risk management that includes security assessments of ICT and information systems at least once every 24 months and tested redundant capacity for business continuity.
- — External reviewers must apply the prescribed information-quality and source-reliability criteria in every review — using information that is complete, directly related to the bond, up to date and based on reasonable assumptions, drawn from credible, documented sources, giving prominence to information subject to disclosure requirements, audit, assurance or recognised standards.
- — Third-country reviewers applying for ESMA recognition must submit machine-readable, durable applications that assign a unique reference number to each document, map information to the Article 23(2) and 42(3) requirements via the Annex I table, and include a senior-management-signed attestation of accuracy and completeness.
Who is affected
- — External reviewers of European Green Bonds operating in or recognised in the EU
- — Third-country external reviewers applying to ESMA for recognition
- — Compliance, ICT-risk and governance functions within external reviewer firms
What to watch
- — Effective: 20 days after publication in the Official Journal of 17 June 2026 — the RTS criteria become binding on external reviewers of European Green Bonds from that date.