In most publications that deal with the Banking Union, the global financial crisis of 2008 is mentioned in the introductory paragraph. It is also the unavoidable starting point of this contribution, as it is the collapse of the banking sector that has shown the necessity to rethink the mechanism of banking supervision.

Economic growth and financial stability have been seriously damaged by the global crisis that has plagued the world since 2007. The financial and banking crisis shed some light on the need for stronger and more efficient supervision but also on the need for a more effective system of sanctions and penalties to be applied. In particular, the Eurozone proved to be particularly exposed to the waves of the market because of the differences in supervision policies among the Member States which adopted the Euro as a single currency.

Whether more effective banking supervision could have prevented the crisis is not sure, but at least the crisis uncovered one of its most fundamental flaws, namely that banking supervision based on the Westphalian model of the nation-state, is not capable to grasp the risks inherent to the banking sector. The banking system has played a key role in the financial crisis: major bank groups suffered deficits and debt positions, leading a number of them to seek State aid. In Eurozone countries, the banking and sovereign debt crises highlighted the flaws of a common monetary and currency Union without consistency of banking supervision. Indeed, when the bankruptcy of Lehman Brothers dragged major European banks into the crisis, it became clear that if risk knows no borders, neither should supervision. National regulators were faced with their insufficiency to face global problems and Eurozone Member States were particularly subject to spill-over effects from each other's budgetary policies.

This insight nourished the desire to achieve deep supervisory integration, a desire which eventually gave birth to a centralised structure, baptised the “European Banking Union”¹. Since 2010, the EU Commission has therefore taken an inclusive approach supporting the swift progress towards an integrated financial framework as a vital part of the policy measures to put Europe back on the path of financial stability, economic recovery and growth.² In September 2012 the Commission presented a communication entitled “A Roadmap towards a Banking Union” in order “to break the link between sovereign debt and bank debt and the vicious circle which has led to over €4,5 trillion of taxpayers money being used to rescue banks in the EU”.³

The European Banking Union places the European Central Bank (ECB) at the heart of banking supervision in Europe and in particular in the Eurozone. It represents a product of a recent tendency to transfer “decisive regulatory powers as well as powers concerning enforcement – investigations, measures and penalties – to the EU level”.⁴

This article offers an account on the Single Supervisory Mechanism, its functioning and its articulated sanctioning system, composed of administrative measures and penalties. Part I analyses the institutional design and the complex legal framework composed of both directly applicable European rules and national law implementing the Capital Requirements Regulation (CRR)⁵ and the Capital Requirements Directive (CRD IV).⁶ We will try to shed some light on the division of tasks between the ECB and the national competent authorities (NCAs) operating at national level. Part II explores the investigatory powers the measures and penalties applicable in the framework of banking supervision and the proceedings for their enforcement. It will also discuss their controversial nature: administrative, punitive or quasi-criminal? Part III examines judicial protection for the supervised entities. Specific attention will be given to judicial review. Part IV will outline some conclusions.

I. The SSM: a Mechanism of Single Supervision

The Single Supervisory Mechanism is part of a broader architecture that aims to consolidate the banking sector of the European Union. This project is named the European Banking Union, and is built on three pillars: The Single Supervisory Mechanism (SSM), the Single Resolution Mechanism (SRM),⁷ and a uniform deposit guarantee scheme.⁸ This entire construction rests upon the foundations of the so-called Single Rulebook, which is composed of the CRR and the CRD IV. It contains a harmonised set of rules that aim to safeguard the soundness, stability and integrity of the banking system, also referred to as “prudential regulation”. Such regulation consists in requirements such as capital buffers, liquidity ratios, or large exposure limits on banks. Far from being an example of “rule making by principles”, the CRR and CRD IV provide detailed and precise enforceable rules.⁹ The two legal instruments represent the substantive law on prudential and capital requirements for credit institutions in the European Union based on the international agreement called ‘Basel III’¹⁰ and they are applicable in both Eurozone and non-Eurozone Member States. It is relevant to highlight that the different pillars of the banking union do not have the same territorial scope. While the SSM is limited to the Eurozone, all other pillars are applicable in the whole European Union. Within the Banking Union, the role of the SSM is to ensure that Eurozone banks respect the prudential requirements that are imposed on them.

The SSM is shaped by Council Regulation (EU) n^o 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (hereinafter the SSMR). As its title suggests, the SSMR entrusts the ECB with the enforcement of prudential regulation. To that aim, the SSMR provides the ECB with a supervisory toolbox composed of investigative measures, administrative measures as well as administrative penalties. Nevertheless, the SSM does not put the task of banking supervision exclusively on the shoulders of the ECB as the only supervisor. As revealed by its name, the SSM is a mechanism. It is a mechanism that, while relying on the assistance, cooperation and expertise of multiple national supervisory authorities, achieves single supervision of the Eurozone banking sector.

Within the SSM, the ECB has been given the exclusive competence to carry out specific supervisory tasks, based on a cooperative framework that involves the national competent authorities (hereinafter NCAs). In order to determine the allocation of enforcement powers between the ECB and the NCAs, the SSMR has adopted a distinction between significant and less significant credit institutions.¹¹ While the significant institutions are under direct supervision by the ECB, less significant institutions remain under direct NCA supervision. This implies that the ECB can only directly exercise the supervisory powers attributed to it by the SSMR over significant banks.

By no means does the distinction between significant and less significant banks aim at excluding less significant banks from the SSM or from ECB supervision. Several features of the SSM establish the contrary. While the NCAs retain their power to adopt the supervisory decisions concerning less significant banks, they must execute their mission in accordance with the regulations, guidelines or general instructions issued by the ECB, and are subject to a duty of cooperation in good faith as well as an obligation to exchange information with the ECB. Moreover, the supervision of less significant institutions remains subject to oversight by a specific Directorate General of the ECB entrusted with the indirect supervision of less significant institutions. In addition, the ECB may decide at any time to take over direct supervision over one or more less significant banks when this is considered to be necessary for the consistent application of high supervisory standards. Furthermore, where the SSMR does not confer certain powers of the ECB, for instance in the case of supervision of less significant institutions, the ECB may require the NCAs by way of instructions to make use of their powers under and in accordance with the conditions set out in national law. The NCAs must follow such instructions,¹² even while the nature of their acts remains national.¹³

While the ECB stays involved in the supervision of less significant institutions, the NCAs are also involved in the supervision of significant institutions that are under direct ECB supervision. This involvement intervenes both during the investigations and during the execution of specific measures or penalties. This reflects again the fact that the SSM is conceived rather as a mechanism, than as a single supervisory entity.¹⁴ The cooperation between the ECB and NCAs will play a crucial role in the effectiveness of the SSM.¹⁵

The supervision of significant institutions is organised through the establishment of Joint Supervisory Teams (hereinafter “JSTs”). For each significant institution, a JST has been created, composed of staff of the ECB as well as the NCAs. Every JST will be coordinated by a designated ECB staff member (the JST coordinator) and one or more NCA subcoordinators. The ECB is in charge of the establishment and composition of JSTs, but the appointment of staff members from the NCAs to JSTs is made by the respective NCAs. A JST is the main tool within which the NCA assist the ECB in the supervision of significant institutions and is a far-reaching example of a mixed administration. The JSTs are considered to be a cornerstone and a symbol of the SSM,¹⁶ since the strength of this organisational structure lies in the fact that it relies on the NCAs’ experience and expertise to execute a policy that is decided on the European level. The JSTs should perform the supervisory review and evaluation, participate in the preparation of a supervisory examination programme to be proposed to the Supervisory Board, including an on-site inspection plan, implement the supervisory examination programme approved by the ECB and any ECB supervisory decisions, ensure coordination with the on-site inspection team referred and liaise with NCAs where relevant.

The main supervisory task of the ECB is to “ensure compliance with” the prudential requirements of CRD IV and CRR by Eurozone banks. To perform this task, the ECB can apply not only directly applicable Union law, such as CRR, but also national law exercising options granted by directly applicable Union law, or national law implementing Directives,¹⁷ such as the national legislation adopted to transpose the prudential requirements of CRD IV. The fact that an EU institution can apply national substantive rules has been described as “a model of enforcement that is unseen in European law”.¹⁸ For the first time, indeed, a European institution will rely on the national implementation of European law to carry out its tasks.

In order to ensure compliance with the above-mentioned prudential requirements, the ECB utilizes a set of supervisory powers, ranging from investigatory powers to preventive administrative measures and administrative (pecuniary) penalties. Unfortunately, these powers are not foreseen by one single legal basis. The supervisory toolbox of the ECB is composed of different layers, including directly applicable Union law (for instance, the SSMR, the SSM Framework Regulation – hereinafter SSMFR –, or Regulation 2532/98), as well as national legislation implementing Directives (for instance, CRD IV).

The following section will discuss the different supervisory powers of the ECB on the basis of the distinction adopted by the SSMR itself, namely investigatory powers, the power to impose administrative penalties, and the power to take administrative measures that are not considered to be administrative penalties. Attention will also be given to the procedural regime attached to the exercise of each of these powers. To remind, these are the powers that the ECB can exercise for the direct supervision of significant credit institutions. As pointed out above, when less significant credit institutions are concerned, the ECB’s powers are limited to issuing regulations, guidelines or general instructions to the NCAs, which need to adopt their supervisory decisions accordingly. The present analysis will be limited to the allocation of enforcement powers in case of breaches of CRD or CRR requirements by significant banks.

The Different Layers of the ECB’s Supervisory Toolbox

To ensure compliance with the CRD/CRR requirements, the ECB has supervisory powers coming from different legal bases. According to the SSMR, the ECB not only has all the powers set out in the SSMR itself, but also has all powers that NCAs have under Union law, unless otherwise provided for by the SSMR.¹⁹ When it comes to investigatory powers and administrative measures that are not considered to constitute administrative penalties, the ECB possesses all of the powers that NCAs have under Union law, while the Regulation provides otherwise in the case of administrative penalties.

Investigatory powers

In order to fulfil its tasks, the ECB can rely on direct investigatory powers provided by the Chapter III of the SSMR. These powers are not limited to significant banks but they also apply to investigations involving less significant banks when the ECB decides, pursuant to Art. 6(5)(d) SSMR, to make use of these investigatory powers with respect to a less significant supervised entity.²⁰ In this case, the supervision is shared between the European level and the national level, because the decision of the ECB to carry on direct investigation cannot exclude or limit the power of NCAs to supervise less significant banks. As a result, the investigatory powers of the ECB are not exclusive but they should be carried out in strict cooperation with the national authorities.

In order to carry out its tasks, the ECB has “appropriate supervisory powers”. These powers include all the powers that Union law requires to be conferred on competent authorities designated by the Member States for those purposes. “To the extent that those powers fall within the scope of the supervisory tasks conferred on the ECB, for participating Member States the ECB should be considered the competent authority and should have the powers conferred on competent authorities by Union law”.

The broad investigatory powers of the ECB include the right to request information from a wide range of entities and individuals, to carry out general investigations and to conduct on-site inspections.

In order to open an investigation, the ECB shall adopt a specific decision specifying its legal basis and purpose together with the intention to exercise the investigatory powers laid down in Art. 11(1) SSMR and the fact that any obstruction of the investigation by the person being investigated constitutes a breach of an ECB decision, susceptible to entail sanctions according to Art. 18(7) SSMR and in accordance with Regulation 2532/98.²¹

The power to conduct general investigations is provided by Art. 11 SSMR according to which the ECB may conduct all necessary investigations of any legal or natural person “established or located in a participating Member State”. This limitation is relevant because it excludes any direct investigatory power outside the SSM-zone. The general investigations include the right to:

• (a) require the submission of documents;

• (b) examine the books and records and take copies or extracts from such books and records;

• (c) obtain written or oral explanations from any legal or natural person or their representatives or staff;

• (d) interview any other person who consents to be interviewed for the purpose of collecting information relating to the subject matter of an investigation.

In the first three cases, the ECB has the power to oblige the natural or legal persons under investigation to execute its orders. However, it lacks strict enforcement powers when a person obstructs the conduct of the investigation. In the latter case, the ECB should rely on the support of the NCAs where the relevant premises are located.

In compliance with national law, the NCAs shall offer necessary assistance, including granting the ECB access to the business premises of the supervised legal persons. No specific power is provided when it comes to private premises or vehicles of the managers or related staff.

While Art. 11 provides for the interview of any person on a voluntary basis, Art. 10 SSMR provides that the ECB may require from both legal and natural persons (including managers or members of staff) all information that is necessary for supervisory and related statistical purposes. Upon such a request by the ECB, the legal or natural persons cannot refuse, and have to supply the information requested. This investigatory power conferred to the ECB interferes with the professional and banking secrecy existing in several Member States. Art. 10(2) SSMR makes clear that “professional secrecy provisions do not exempt those persons from the duty to supply that information. Supplying that information shall not be deemed to be in breach of professional secrecy”, including banking secrecy rules.

Both the SSMR and the SSMFR are silent on the status of legal profession privilege. Recital 48 of the SSMR refers to it as a “fundamental principle of Union law, protecting the confidentiality of communications between natural or legal persons and their advisors, in accordance with the conditions laid down in the case-law of the Court of Justice of the European Union”. This recital seems to recall the case law of the ECJ as developed in the field of competition law and in particular in the leading case of Akzo Nobel Chemicals and Ackros Chemicals v. European Commission.²² In that case the ECJ confirmed its restrictive interpretation refusing to modify or overturn prior precedent (dated back to 1982²³) according to which communications with in-house lawyers are not accorded legal professional privilege under European law. The SSMR is confirming this restrictive approach, which seems to be problematic if we consider the strong protection offered by the ECHR.

The investigatory powers include the right to carry out all necessary on-site inspections at the business premises of the supervised legal persons.²⁴ This power represents the most intrusive investigatory measure of the ECB and it is subject to prior notification to the NCA of the place where the premises are located. When the ECB is not suspecting any infringement of banking regulation, it notifies the supervised entity of its intention to carry out an inspection, specifying when it will take place. In exigent cases, “where the proper conduct and efficiency of the inspection so require, the ECB may carry out the on-site inspection without prior announcement”.²⁵

In order to carry out these on-site inspections, the ECB appoints on-site inspections teams composed by both ECB and NCAs officials.²⁶ In case of obstruction, the NCA of the relevant Member State provides for assistance including “the sealing of any business premises and books or records. Where that power is not available to the national competent authority concerned, it uses its powers to request the necessary assistance of other national authorities”.²⁷ It means that the NCAs must assist, if necessary by force and by sealing any business premises and books or records.

Due to their coercive nature, on-site inspections and forced sealing may require judicial authorization in several Member States. When that is the case, the prior authorization should be obtained before the investigatory measure takes place. This “dependence on national law leaves room for differences between the Member States”²⁸ composing a variable geometry puzzle. The lack of a specific and common provision on judicial authorization risks hampering the homogeneous application of the SSM in the EU. It would have been preferable to establish common rules implying the need for a judicial authorization when a coercive measure needs to be carried out. This solution would also have been more in line with the case law of the ECHR on access to business premises and sealing of books and records.

Furthermore, Art. 13 of the SSMR limits the effectiveness of judicial review by the national courts, by stipulating that national courts “shall control that the decision of the ECB is authentic and that the coercive measures envisaged are neither arbitrary nor excessive having regard to the subject matter of the inspection”.²⁹ In principle national courts are entitled to check the proportionality of the measures; to this aim, they may ask the ECB for detailed explanations on the grounds for suspicion that an infringement has occurred, its seriousness and to what extent the supervised entity is involved.³⁰ However, the national courts “shall not review the necessity for the inspection” and they cannot have direct access to the ECB’s file.

This information should be available to the national competent authorities concerned. It means that before making such a request, the ECB should verify the existing information already at disposal of the NCAs.³¹ The ECB and the national competent authorities should indeed have access to the same information “without credit institutions being subject to double reporting requirements”.³²

Administrative measures and penalties

The ECB legal framework distinguishes between administrative measures and penalties, although this distinction is not always clear.

a) Administrative measures that are not considered to constitute administrative penalties

Next to its sanctioning powers, analysed in the following paragraph, the ECB can also adopt administrative measures that are not considered to constitute administrative penalties, as they are not foreseen under Art. 18, which is devoted to pecuniary and non-pecuniary penalties. This power of the ECB stems once again from different legal bases. To remind, in conformity with Art. 9(1), 2^nd indent SSMR, the ECB not only can exercise the powers directly granted to it by the SSMR, but also the powers that the NCAs have under relevant Union law.

Art. 16(1) SSMR foresees that when a bank fails to honour the prudential requirements imposed by CRR, by the national legislation exercising options granted by CRR, or by the national legislation implementing CRD IV, the ECB can take certain specific measures to require any entity under its supervision to take the necessary steps at an early stage. Likewise, the ECB can take the same measures when it has evidence that a bank is likely to breach those requirements within the next 12 months, or when its arrangements, strategies, processes and mechanisms and the own funds and liquidity held by it do not ensure a sound management and coverage of risks. The wording of Art. 16(1) SSMR already suggests that these measures are not of a punitive, but rather of a preventive nature, since the purpose is to intervene at an early stage, to avoid that there will be a breach in the near future, or to ensure a sound management and risk coverage.

Art. 16(2) SSMR sums up the measures announced by Art. 16(1). The ECB can require banks to hold own funds in excess of the capital requirements imposed on them, to reinforce the arrangements, processes, mechanisms and strategies, to present a plan to restore compliance with supervisory requirements, to apply a specific provisioning policy or treatment of assets in terms of own funds requirements, to reduce the risk inherent in certain activities, products and systems of institutions, to limit variable remuneration as a percentage of net revenues where it is consistent with the maintenance of a sound capital base, or to use net profits to strengthen own funds. In addition, the ECB can restrict or limit the business, operations or network of institutions that pose excessive risks to the soundness of a bank, or request the divestment of activities that would pose such risks. Furthermore, the ECB can also restrict or prohibit distributions by the institution to shareholders, members or holders of Additional Tier 1 instruments where the prohibition does not constitute an event of default of the institution. Moreover, the ECB can impose additional or more frequent reporting requirements, and specific liquidity requirements. It can also require additional disclosures and decide at any time on the removal of members from a bank’s management body who do not fulfil the requirements set out in CRR or in the national law implementing CRD IV.

b) Administrative penalties

When imposing administrative penalties, the ECB has to take into account different rules in order to determine the level of the penalty to be imposed and the procedure to be respected. The applicable rules differ according to the source of the requirement being breached, as well as the person to be sanctioned. On the basis of these criteria, the SSMR itself makes a distinction between three types of penaltie,³³ which is subject to a formal classification by the SSM Framework Regulation.³⁴ On the basis of this formal classification, three types of penalties will be discussed below in the following order: fines and periodic penalty payments, administrative pecuniary penalties, and penalties for “other breaches”. This order presents the sanctioning power of the ECB in a decreasing way, from direct sanctioning powers to indirect sanctioning powers. This order has been preferred for the present contribution, because the cases where the ECB only has an indirect sanctioning power, are negatively defined, starting from a definition of the cases where the ECB does have a direct sanctioning power. A special mention should also be made of the publicity of the aforementioned penalties, which in some cases could be considered as presenting a supplementary punitive character.

i. Fines and periodic penalty payments

Pursuant to Art. 18(7) SSMR, in cases of a breach of regulations or decisions of the ECB itself, by natural or legal persons,³⁵ the ECB may impose sanctions in accordance with Council Regulation (EC) No 2532/98 of 23 November 1998 concerning the powers of the European Central Bank to impose sanctions (hereinafter “Regulation 2532/98”). When breaches of ECB regulations or decisions are concerned, the SSMR falls back on the previous legal framework applicable to the sanctioning powers of the ECB. However, this does not mean that there are no novelties to be discovered. In fact, Regulation 2532/98 has recently been modified by Council Regulation (EU) 2015/159 of 27 January 2015,³⁶ in order to adapt the ECB’s sanctioning power to its new competences in the field of banking supervision.

According to Regulation 2532/98, both fines and periodic penalty payments fall under the notion of “sanctions”.³⁷ While fines are defined as “a single amount of money which an undertaking is obliged to pay as a sanction”,³⁸ periodic penalty payments are “amounts of money which, in case of a continued infringement, an undertaking is obliged to pay either as a punishment, or with a view to forcing the persons concerned to comply with the ECB supervisory regulations and decisions”.³⁹ It is worth stressing that this second part of the provision seems to allow the ECB to apply periodic penalty payments as a mere measure, excluding the regime that is usually applicable to penalties.⁴⁰

Regulation 2532/98 also foresees procedural rules to be respected when the ECB imposes fines or periodic penalty payments. These rules reflect the right of a supervised entity to be informed in writing about the findings of the investigation,⁴¹ the right to make submissions in writing within a reasonable time limit,⁴² the right to be represented by lawyers or other qualified persons at closed oral hearings,⁴³ the right to have access to the file,⁴⁴ and the right of internal⁴⁵ as well as judicial review.⁴⁶

The SSM Framework Regulation classifies the ECB’s fines and periodic penalty payments imposed under Regulation 2532/98 as administrative penalties.⁴⁷ It provides also that the aforementioned procedural rules contained in Regulation 2532/98 are further complemented by the procedural rules for the imposition of administrative penalties laid down by the SSM Framework Regulation itself.⁴⁸ When it comes to fines, these rules are embedded in Arts. 123 to 127 of the SSM Framework Regulation, which are briefly presented below, as they are also applicable to administrative pecuniary penalties that are not fines and periodic penalty payments. For periodic penalty payments, Art. 129 of the SSM Framework Regulation provides for separate rules to complement those of Regulation 2532/98. These rules reflect the right to be heard,⁴⁹ the right of access to the file,⁵⁰ and the right to be represented.⁵¹

ii. Administrative pecuniary penalties

Art. 18(1) SSMR provides the ECB with a direct sanctioning power. Indeed, the ECB has the power to impose specific pecuniary penalties if a legal person under its supervision, intentionally or negligently, breaches a directly applicable act of Union law, in relation to which relevant Union law makes administrative pecuniary penalties available to NCAs. The material scope of this direct sanctioning power is represented by Art. 67(1) CRD IV, which requires the Member States to make administrative penalties available to NCAs in case of violations of specific CRR requirements.

Furthermore, Art. 18(1) SSMR does not limit the direct sanctioning power of the ECB to the “significant” banks. As a consequence, the allocation of powers between the European and the national level seems unclear. Scholars are divided: on one hand they consider Art. 18(1) fully applicable toward any credit institution, regardless of their significance.⁵² On the other hand, the application of the significance criterion would be more consistent with the rules governing supervision. Furthermore, despite the silence of Art. 18(1) SSMR, Art. 124(1)(a) SSM Framework Regulation, dealing with the duty to referral of alleged breaches to the investigating unit, mentions only breaches “committed by a significant supervised authority”.

It must be highlighted that the direct sanctioning power of the ECB is limited to “credit institutions, financial holding companies or mixed financial holding companies”. When individuals are concerned, the ECB has no direct power to impose sanctions but it has to request the NCAs to impose sanctions on natural persons.⁵³ Furthermore, it is worth stressing that Art. 18(1) does not only limit the direct sanctioning power of the ECB to breaches by legal persons, but also to a specific structure of their conduct: the infringement should be intentional or, at least, negligent.⁵⁴

The SSM Framework Regulation classifies the sanctions pronounced by the ECB under Art. 18(1) SSMR as administrative penalties, and gives them the specific title of “administrative pecuniary penalties”, in order to distinguish them from the “fines and periodic penalty payments” that the ECB can impose in case of breaches of ECB regulations and decisions.

Mirroring the sanctioning regime of Regulation 2532/98, the pecuniary penalties that the ECB can impose under Art. 18(1) SSMR amount to twice the amount of the profits gained or losses avoided because of the breach where these can be determined, or to 10% of the total annual turnover of a legal person in the preceding business year, or such other pecuniary penalties as may be provided for in relevant Union law.

Art. 18(3) further guides the sanctioning power of the ECB, by stipulating that all the penalties have to be “effective, proportionate and dissuasive”. In line with the previous approach, it is to be expected that the ECB will consider a range of factors, among them the level of cooperation shown by the supervised entity, the seriousness, the repetition, the frequency and the duration of the offence, any potential profits obtained through it, the size of the supervised entity and – potentially – prior sanctions imposed by other authorities based on similar facts.⁵⁵

Furthermore, in order to determine whether to impose a penalty and in determining the appropriate penalty, the ECB must cooperate closely with the NCAs.⁵⁶ The latter requirement will be facilitated by the fact that direct ECB supervision of significant entities will be conducted through close cooperation within JSTs, as explained above.

Arts. 123 to 127 of the SSM Framework Regulation provide for procedural rules that are applicable to the imposition of administrative penalties.⁵⁷ They foresee that alleged breaches that are subject to administrative penalties – be they fines, periodic penalty payments, or administrative pecuniary penalties – must be referred to an internal investigation unit (hereinafter IIU) that is independent from the ECB Supervisory Board and Governing Council.⁵⁸ The establishment of the IIU, foreseen by Art. 123 of the SSM Framework Regulation, reflects the requirement of a separation between the investigating and decision taking phase for imposing administrative sanctions,⁵⁹ as required by the Dubus jurisprudence of the ECtHR.⁶⁰ Prior to the adoption of the SSM Framework Regulation, the Executive Board of the ECB cumulated the investigative and decision making functions under Council Regulation 2532/98, as this Regulation came into existence before the Dubus judgment.⁶¹ This problem has been overcome, since Arts. 123 to 127 of the SSM Framework Regulation apply not only to the imposition of administrative pecuniary penalties, but also to fines and periodic penalty payments imposed under the 2532/98 Regulation.

While Art. 125 Framework Regulation further describes the powers of the independent investigation unit, Art. 126 Framework Regulation is devoted to the procedural rights of the supervised entity under investigation. These rights include the right to be informed of the findings of the investigation unit,⁶² the right to make written submissions within a reasonable time limit set by the investigating unit,⁶³ the right to be assisted and represented by lawyers or other qualified persons at closed oral hearings organised at the initiative of the investigating unit,⁶⁴ and the right of access to the file.⁶⁵ Others are lacking, as it is the case for the right not to incriminate oneself. As stated in the Orkem case,⁶⁶ the “Commission may not compel an undertaking to provide it with answers which might involve an admission on its part of the existence of an infringement which it is incumbent upon the Commission to prove”. The case referred to fines applicable in competition law but the principle should apply also in the banking sector when it comes to ‘punitive’ penalties. As scholars already observed, “it would have been wise if the ECB obligation to ensure compliance with the right not to incriminate oneself would have been codified in the SSM Regulation or SSM Framework Regulation. For reasons of legal certainty of individuals, but also to prevent possible non-compliance with the right by the investigation unit”.⁶⁷

iii. Penalties for other breaches: Art. 18(5)

The ECB has not been left without powers where natural persons or banks under its supervision breach other requirements than those that fall under the scope of Art. 18(1) SSMR. In cases not covered by Art. 18(1) SSMR, the ECB maintains an indirect sanctioning power. Art. 18(5) SSMR entrusts the ECB with the power to “require the NCAs to open proceedings with a view to taking action in order to ensure that appropriate penalties are imposed”.

Art. 134(1) of the SSM Framework Regulation frames this power, starting from a list of those cases that are not covered by Art. 18(1). To summarise, this list comprises all cases in which a breach is attributed to a natural person, in which a non pecuniary penalty is to be imposed, or in which the breach does not concern CRR requirements. In addition, Art. 134(1) SSM Framework Regulation also foresees the scenario where pecuniary or non-pecuniary penalties are to be imposed in accordance with relevant national legislation which confers specific powers to the NCAs in Eurozone Member States which are currently not required by the relevant Union law.

In all these cases, as pointed out above, the ECB can request the NCAs to open proceedings. Art. 134(1) SSM Framework Regulation further clarifies that in respect of significant supervised entities, an NCA shall open proceedings only at the request of the ECB where necessary for the purpose of carrying out its task under the SSMR. This implies that the ECB can decide on the possibility of a sanction itself, even in case of a breach of national prudential requirements. This provision of the SSMR confirms that when it comes to significant entities, it is the ECB which has the power of direct supervision within the SSM, and for that purpose it can apply directly applicable Union law as well as national law implementing Union law. Even though NCAs can only open penalty proceedings upon request of the ECB, the mechanic nature of the SSM stays reflected through the fact that NCAs may ask the ECB to request it to open proceedings.⁶⁸

While the ECB can require the NCAs to open proceedings, the NCAs are not obliged to sanction. This can be deducted from their obligation to inform the ECB, upon completion of a penalty procedure initiated at the request of the ECB, of the penalties that have been imposed, “if any”.⁶⁹ Consequently, only if the ECB decides not to request the NCAs to sanction, this decision can be considered to be final and binding, as the NCAs will be without power to open proceedings. On the contrary, if the ECB decides to request the NCAs to open penalty proceedings, the NCAs maintain their discretion to decide on the existence and, a fortiori, the type and level of the sanction.⁷⁰

Since it is up to the NCAs to decide on the type and the level of the sanction, these questions will be appreciated at the national level and depends on the powers that NCAs enjoy under European as well as national legislation.⁷¹ If upon completion of a penalty procedure, an NCA decides to sanction, the Art. 18(5) SSMR requires the penalty to be effective, proportionate and dissuasive. As the penalty proceedings are conducted by the NCAs, they fall within the sphere of national procedure.

iv. Publicity as an additional form of punishment?

According to Art. 18(6) SSMR, the ECB shall publish any administrative pecuniary penalty directly applicable according to Art. 18(1) SSMR “whether it has been appealed or not, in the cases and in accordance with the conditions set out in relevant Union law”, including information on the type and nature of the breach and the identity of the supervised entity concerned.

This practice, called “naming and shaming” amplifies the effects of the sanctions making it public and affecting the reputation of the financial entity or credit institution.

As highlighted by the Commission, the aim of publishing financial and banking sanctions is twofold: on one hand, it has a strong deterrent effect on credit institutions, mainly because they will incur reputational damage. On the other hand, it helps the consumers and investors to be better informed and it would ‘punish’ any wrongdoers by avoiding the use of their services.

To these aims, the publication of banking administrative sanctions is a duty also for the Member States. Art. 68 CRD IV introduced new rules on the publication of administrative sanctions, according to which “Member States shall ensure that the competent authorities publish on their official website at least any administrative penalties against which there is no appeal and which are imposed for breach of the national provisions transposing this Directive or of Regulation (EU) No. 575/2013, including information on the type and nature of the breach and the identity of the natural or legal person on whom the penalty is imposed, without undue delay after that person is informed of those penalties”. Publication of penalties against which there is an appeal is not excluded, but in this case competent authorities “shall, without undue delay, also publish on their official website information on the appeal status and outcome thereof”.

A few exceptions to the duty to publish the name of the entity submitted to the administrative penalties, authorising anonymised data, are (a) the risk to jeopardise the stability of the financial markets or an on-going criminal investigation; or (b) to cause a disproportionate damage to the supervised entity concerned.

Neither the CRD IV nor the SSMR address the question of “what form this publication should take in relation to the presumption of innocence”.⁷² In other words, does the publication of a sanction which is made when the case is under appeal scrutiny constitute a violation of the presumption of innocence?

A possible answer to this question can be found in the draft directive of the Commission on the presumption of innocence. This Proposal requires that Member States must ensure that, before a final conviction, public statements and official decisions from public authorities do not refer to suspects or accused persons as if they have already been convicted. According to the Commission, the presumption of innocence should be without prejudice to the possibility of the publication, according to national law, of decisions imposing sanctions following administrative proceedings. This raises the question of what the role of the presumption of innocence is in case of naming and shaming in administrative proceedings. The European legal framework is uncertain because until now, neither the ECJ, nor the ECtHR has given any ruling on the question of whether naming and shaming in the national financial market regulations of the EU Member States violates the presumption of innocence. However, the ECHR clearly states that, even though anticipate enforcement in administrative proceedings cannot be radically excluded, “the Member States are required to confine such enforcement within reasonable limits that strike a fair balance between the mutual interests involved”.⁷³

III. Judicial Review of Measures and Penalties

Previous paragraphs have listed coercive measures and administrative sanctions that the ECB may use in carrying out its centralised supervisory tasks, autonomously or in cooperation with the national authorities. The system of administering EU banking supervisory law based on the interplay of two legal systems leads to intriguing questions with regard to judicial review and the legal protection of the supervised entity.

Nevertheless, effective judicial protection is a fundamental right of the EU legal order. Judicial review is the means by which courts exercise their supervisory control over the administrative measures or penalties applied by a State enforcement agency.⁷⁴ It represents a structural component of any system pretending to be respectful of the rule of law. It is protected by Arts. 6 and 13 of the ECHR and now fully codified in Art. 41, 47(2) and 48 of the EU Charter. This right covers:

• The right for the individuals to enforce their rights before a court.

• The fact that the court should comply with several structural requirements such as impartiality and independence, fair trial, reasonable time, etc.

In an interconnected multi-layered system like the SSM the issue needs to be analysed in a multilevel dimension, including the EU and the national level. The first question to be addressed concerns the ‘formal’ statute of judicial review as to whether acts and decisions in the supervisory process of credit institutions can be challenged before a court and, if so, which court, European or national. The second question concerns the “substantial” statute of judicial review: what is the content of such control? Which requirements are subject to judicial control?

Legal protection against banking supervision measures and sanctions may thus become quite complex. A supervised entity can be affected by decisions taken by the ECB of by the NCAs and for each decision it should rely on a different judicial review mechanism, being it at the European or at the national level.

At the European level, Art. 24 SSMR confers the internal control over the legality of the ECB decisions to an Administrative Board of Review, a board with the task to carry out an internal administrative review of the decisions taken by the ECB in the exercise of its powers. The internal review can be introduced by a natural or legal person concerned within one month from the notification of the decision. The request has no suspensory effect and it “shall pertain to the procedural and substantive conformity with this Regulation of such decisions”,⁷⁵while the nature of such a board is uncertain: Art. 12(4) states that it “should act independently and in the public interest” but its direct connection with the ECB, being a part of it, justifies some scepticism on its capacity to fulfil the requirements of impartiality and independence set up by the ECHR case law.

Furthermore, the board cannot overrule the ECB decision under scrutiny; it can only express a reasoned opinion that the Supervisory Board should “take into account” when adopting a new decision.⁷⁶ In this light, its decisional powers are so limited as to exclude that it might satisfy the requirements of “judicial review”.

Nevertheless, when it comes to administrative penalties, it is sufficient for the ECHR that the person concerned should have had at least one chance to have the final decision to be reviewed by a Court. This possibility is given by Art. 24(11) providing that the existence of the internal board “is without prejudice to the right to bring proceedings before the CJEU in accordance with the Treaties”.

Nevertheless, one should consider that the ECJ case law has held that when the application of an act of Union law by a Union institution requires complex assessments, the authority enjoys a wide measure of discretion, the exercise of which is subject to limited judicial review. “The judicature will only scrutinize the authority’s decision for a manifest error or misuse of powers and whether it clearly did not exceed the bounds of its discretion”.⁷⁷ In this light, the possibility to challenge the ECB decision before the Court of Justice may not always prove sufficient.

Furthermore, as previously analysed, the ECB is applying also national law in it supervisory tasks. How can the judicial review of ECB decisions based on national law be organised? Indeed, in order to respect the fundamental right of effective judicial protection, ECB decisions must be subject to judicial review. It should be stressed that the Court of Justice of the EU (CJEU) has exclusive jurisdiction to decide on the validity of ECB decisions. This implies that in case of an ECB decision based on national law, the CJEU would have to adjudicate on the basis of national law. In terms of European law, this result is striking. According to today’s legal framework, the ECJ can only adjudicate on the basis of applicable EU law, while the application and interpretation of national law is exclusively reserved to national judges.

Issues also arise when it comes to the national level, especially when penalties are applied by NCAs under request of the ECB. In these cases, the natural or legal persons affected by the decision are entitled to lodge an appeal before the competent national court. But which are the powers of national courts in these cases? To what extent they may assess the legality or the appropriateness of the measure? These questions remain for the time being unanswered.

IV. Conclusions

The purpose of this contribution has been to give an overview on how supervision of the largest banks in the Eurozone has been designed, to unpack the toolbox, to shed light on the ECB’s enforcement powers, to raise concerns and to identify challenges.

The framework suggests scholars must address basically three issues.

First, how to grant an effective enforcement of such a complex legal and institutional design? The complexity of the supervisory system and the partly unclear division of tasks between the European and the national level justifies a certain scepticism about its effectiveness. How the ECB and the NCAs will manage their forced cooperation in order to enforce such a complex machine is to be seen in the coming years?

Second, the SSM relies more and more on administrative penalties as regulatory measures. The reform packages in the banking sector increased enormously the number of administrative sanctions and their severity. The nature of these sanctions seems to be questionable. Boundaries between administrative and criminal penalties are becoming hazy because are taking on the elements of each other creating a third kind of phenomenon, a greyzone of “criministrative law”.⁷⁸ If analysed in the light of the case law of the ECHR, banking sanctions seem to be criminal in their essence.⁷⁹

And, thirdly, if this is the case, what kind of procedural safeguards should apply? Are the procedural safeguards provided by the banking regulations adequate to the standards set up by the European court of human rights? Judicial protection seems highly problematic and several fundamental rights are not sufficiently protected.

The SSM entered into force only one year ago and for the time being concrete case law is lacking. It might prove that the incorporation in regulatory law on banking supervision of principles and safeguards belonging to criminal law is recommended and maybe overdue.

Prof. Dr. Silvia Allegrezza – Associate Professor of Criminal Law, Director of the Master I Program, University of Luxembourg,

Principal investigator on “The Enforcement Dimension of European Banking Union Regulations (EUBAR)”, FNR research project

silvia.allegrezza@uni.lu

Olivier Voordeckers – PhD Candidate on the Legal framework of the EU banking supervision at the University of Luxembourg, FNR scholarship holder

Member of the working group on “The Enforcement Dimension of European Banking Union Regulations (EUBAR)”, FNR research project

olivier.voordeckers@uni.lu