COMMISSION IMPLEMENTING REGULATION (EU) 2025/1339

| Official Journal of the European Union | EN L series ---|---|--- * * * | 2025/1339 | 11.7.2025 ---|---|--- COMMISSION IMPLEMENTING REGULATION (EU) 2025/1339 of 10 July 2025 laying down implementing technical standards for the application of Regulation (EU) 2023/2859 of the European Parliament and of the Council with regard to certain tasks of the collection bodies (Text with EEA relevance) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2023/2859 of 13 December 2023 of the European Parliament and of the Council establishing a European single access point providing centralised access to publicly available information of relevance to financial services, capital markets and sustainability (1), and in particular Article 5(11), third subparagraph thereof, Whereas: (1) | It is important to ensure that collection bodies make information available on the European Single Access Point (ESAP) in a harmonised fashion, drawing to the extent possible upon existing collection procedures and infrastructures in place at Union and at national level. ---|--- (2) | Given that the aim of the technical automated validations required by Article 5(1), point (c), of Regulation (EU) 2023/2859 is to ensure a uniform quality of information in the ESAP, the collection bodies should perform those technical automated validations in a consistent manner, having regard to Article 5(10) point (a) of Regulation (EU) 2023/2859. Specifically, it is important that entities that submit information receive any rejection notification in a timely manner. The maximum period within which collection bodies should make their best efforts to notify the entities of the rejection of information should therefore be set out. In exceptional circumstances, including major accidents and errors, deliberate attacks and natural events, collection bodies should be entitled to notify the entities beyond that maximum period. ---|--- (3) | In accordance with Article 5(9) of Regulation (EU) 2023/2859, Member States may permit the collection bodies to require a qualified electronic seal to ensure appropriate levels of authenticity, integrity and non-repudiation of the information submitted to the ESAP. To facilitate the cross-border interoperability of the qualified electronic seals accompanying the information submitted to the ESAP, those seals required by a collection body should comply with the specifications set out in Commission Implementing Decision (EU) 2015/1506 (2). To ensure that the qualified electronic seal remains valid over a long period of time, it should be at conformance level Long-Term (LT) or higher. To further strengthen the authentication of the information submitted to the ESAP, the digital certificate accompanying that seal should contain, where available, the legal entity identifier code identifying the entity using that seal when such identifier complies with ISO 17442. Such information might be available in European Digital Identity Wallets as provided by Regulation (EU) No 910/2014 of the European Parliament and of the Council (3). ---|--- (4) | Directive (EU) 2019/1024 of the European Parliament and of the Council (4) aims to promote the use of standard public licences available online for re-using public sector information. The Commission’s Guidelines on recommended standard licences, datasets and charging for the re-use of documents (5) identify Creative Commons (‘CC’) licences, and in particular the most recent version (4.0) as an example of recommended standard public licences. CC licences are developed by a non-profit organisation and have become a leading licensing solution for public sector information, research results and cultural domain material across the world. Therefore, to facilitate the use and re-use of information available, it is appropriate to refer to CC public domain dedication (CC0) for all information made available by a collection body to the ESAP, except where copyright and other related rights are attached. Accordingly, with regard to the type of information covered by copyrights or other related rights, the CC Licence BY-NC-ND should be applied, in order to restrict the commercial use of that information. Collection bodies may use a licence equivalent to CC suite. ---|--- (5) | In order for the information that is collected by collection bodies to be made available to the ESAP via an application programming interface (API), certain elements of the API should be specified. Those elements include the data exchange method through which information should be provided to the ESAP, the data formats supported, the type of protocols on which the API relies, the access control applied to enable the ESAP to collect data from the designated collection bodies and the ownership of the API update or modification process. For that reason, any changes to the API should be communicated in due time, together with a clear timetable for implementation. ---|--- (6) | For any processing of personal data in the context of collecting the information for the purpose of making it accessible on ESAP, ESMA, in its capacity as data controller of ESAP, and the collection bodies, should ensure compliance with Regulations (EU) 2016/679 (6) and (EU) 2018/1725 (7) of the European Parliament and of the Council. ---|--- (7) | Directive (EU) 2023/2864 of the European Parliament and of the Council (8) and Regulation (EU) 2023/2869 of the European Parliament and of the Council (9) specify the metadata elements which entities should make available to collection bodies when submitting information. All collection bodies should make available such metadata to the ESAP, so that the relevant metadata is available for the ESAP search function. To ensure the functioning of the ESAP, collection bodies may also have to provide additional metadata, which are technical in nature, to the ESAP. To ensure convergence and facilitate implementation, the characteristics of all metadata provided to the ESAP, should be specified. ---|--- (8) | The Global Legal Entity Identifier Foundation (GLEIF) database is an online global source for open, standardised and high-quality legal entity reference data maintained by GLEIF. To ensure that the ESAP can provide a search function on the basis of the criteria set out in Article 7(3) of Regulation (EU) 2023/2859 without creating an additional burden on entities, the European Securities and Markets Authority (ESMA) and collection bodies should be able as far as possible to derive certain metadata from the GLEIF Database on the basis of the legal entity identifier referred to in Article 2 of Commission Implementing Regulation (EU) 2025/1338 (10) which is provided to them. That would limit the burden of reporting, since entities would make available metadata to the Global LEI Index and update it only where relevant, rather than providing those metadata alongside each submission to collection bodies. Those metadata include the names of the entity that submitted the information, the names of the legal person to which the information relates, and the country of the registered office of the legal person to which the information relates. ---|--- (9) | Article 5(6) Regulation (EU) 2023/2859 requires entities to identify and indicate the inclusion of personal data in the information that they submit to a collection body. The indication that the information contains personal data is to be provided to ESAP by means of metadata accompanying the submitted information; ESMA should ensure that such information is not retained or made accessible on ESAP for more than five years, unless otherwise specified in the relevant Union law. ---|--- (10) | To ensure that the information is valuable to users, it should be available on the ESAP as soon as possible. Therefore, the time limit for collection bodies to make available the information to the ESAP should be as short as possible and strive to limit the delay between the information being available to the public and it being accessible on the ESAP. For that purpose, the point of reference for the start of the time limit should always be the moment when information has been submitted to the collection body by an entity for the purpose of making that information accessible on the ESAP and the submission of the information has passed the technical automated validations. That time limit should be triggered only when the purpose of the submission of the information is making that information accessible on the ESAP. Therefore, where information is submitted to the competent authority for other purposes, including approval of that information or where a document cannot be made available to the public before a specified point in time in the future, that information should not be deemed to have been submitted to the collection body for the purpose of making it accessible on the ESAP. The time limits should be without prejudice to other obligations that might apply to collection bodies stemming from other Union legislative acts, including the obligation to perform additional data validations or the obligation to make information accessible to ESMA within other time limits than those specified in this Regulation. In duly justified exceptional circumstances, including major accidents, errors, deliberate attacks and natural events, collection bodies should be entitled to provide the information beyond the specified time limits, provided that ESMA is duly informed. Since that process cannot be carried out fully automatically, collection bodies should not be required to inform ESMA of such circumstances outside of their working hours. ---|--- (11) | In light of the current technological options and of the formats used for the preparation of the information in scope of the ESAP, the collection bodies should accept information in HTML, PDF and txt format as data extractable as long as the text contained therein can be extracted. The collection bodies should accept information in XBRL, XBRL-xml, XBRL-csv and XML and Inline XBRL formats as machine readable because software applications can easily identify, recognise and extract specific data contained therein. Those formats should be included in the indicative list of acceptable formats because those are the formats currently required for disclosure frameworks in scope of the ESAP. That list is, however, not restrictive and therefore additional data extractable and machine-readable formats should be accepted for information in the scope of the ESAP. Since machine-readable formats also fulfil the requirements of data extractability, all machine-readable formats should also be accepted as data extractable formats. ---|--- (12) | This Regulation is based on the draft implementing technical standards submitted to the Commission by ESMA, the European Banking Authority and the European Insurance and Occupational Pensions Authority. ---|--- (13) | ESMA, the European Banking Authority and the European Insurance and Occupational Pensions Authority have conducted open public consultations on the draft implementing technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the advice of the Banking Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1093/2010 of the European Parliament and of the Council (11), the Insurance and Reinsurance Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1094/2010 of the European Parliament and of the Council (12), and the Securities and Markets Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council (13). ---|--- (14) | The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered formal comments on 29 April 2025. ---|--- (15) | Having regard to Article 23a of Directive 2004/109/EC, Article 11a of Regulation (EU) No 236/2012 of the European Parliament and of the Council (14) and Article 21a of Regulation (EU) 2017/1129 of the European Parliament and of the Council (15), this Regulation should apply at the latest from 10 July 2026, ---|--- HAS ADOPTED THIS REGULATION: Article 1 Technical automated validations 1\. Where a specific machine-readable format is required by any of the acts referred to in Article 1(1), point (a), of Regulation (EU) 2023/2859, collection bodies shall verify that the information submitted to them pursuant to that act is compliant with the machine-readable format specified in those acts. 2\. Where no specific machine-readable format is required by any of the acts referred to in Article 1(1), point (a), of Regulation (EU) 2023/2859, collection bodies shall verify that the information submitted to them: (a) | is submitted in one of the formats referred to in Article 7(1) or in other data extractable format required by any binding Union legislative act; ---|--- (b) | contains text that can be extracted by a machine. ---|--- 3\. Collection bodies shall verify that: (a) | the data submitted is complete and compliant with the metadata specification set in the Annex to this Regulation; ---|--- (b) | the metadata is consistent with any other metadata provided otherwise by the same entity; ---|--- (c) | where provided by the submitting entity, the metadata indicating the legal entity identifier of the submitting entity complies with the specifications laid down in Article 2 of Implementing Regulation (EU) 2025/1338 at the moment of submitting the information to the ESAP; and ---|--- (d) | where provided by the submitting entity, the metadata indicating the legal entity identifier of the entity to which information relates complies with the specifications laid down in Article 2 of Implementing Regulation (EU) 2025/1338 at the date or period to which the information relates. ---|--- 4\. Where a qualified electronic seal is required in accordance with Article 5(9) of Regulation (EU) 2023/2859, collection bodies shall: (a) | perform the validations set out in Article 32(1) of Regulation (EU) No 910/2014; and ---|--- (b) | verify that the qualified electronic seal accompanying the information submitted to them complies with Article 2 of this Regulation. ---|--- 5\. Collection bodies shall reject information that does not comply with any one of the requirements set out in paragraphs 1 to 4. 6\. Collection bodies shall undertake their best efforts to provide the submitting entities with detailed information on the results of the automated validations referred to in paragraphs 1 to 4 within 60 minutes after they have received the information. 7\. In duly justified exceptional circumstances, including major accidents and errors, deliberate attacks and natural events, collection bodies may provide the results of the automated validations beyond the time limit set out in paragraph 6. In that case, collection bodies shall undertake their best efforts to provide the results of the automated validations to the submitting entities within 60 minutes after the resolution of the relevant exceptional circumstance. Article 2 Characteristics of the qualified electronic seal 1\. Where Member State require a qualified electronic seal, that seal accompanying the information shall comply with the list of technical specifications set out in the Annex to Implementing Decision (EU) 2015/1506 and shall be at conformance level LT or higher. 2\. Where the submitting entity is identified with a legal entity identifier compliant with ISO 17442, the qualified electronic seal shall be based on the qualified certificate in which the submitting entity is identified with that legal entity identifier. Article 3 Open standard licence The use and re-use of the information made available to the ESAP by the collection bodies shall be subject to the conditions of the Creative Commons public domain dedication (CC0) or any equivalent open licence allowing for unrestricted use and re-use of data. That is without prejudice to information covered by copyright and other related rights, the use and re-use of which shall be governed by the conditions of the Creative Commons Licence BY-NC-ND or any equivalent open license. Article 4 Characteristics of the data collection API The application programming interface (API) for the collection of ESAP data from collection bodies shall: (a) | allow collection bodies to make available the information, the accompanying metadata for that information and, where required, the qualified electronic seal to the ESAP and receive feedback on the data exchanged; ---|--- (b) | support the formats for the information specified in Article 7; ---|--- (c) | support the formats for the metadata specified in Article 5; ---|--- (d) | rely on secure internet protocols, including SFTP or HTTPS to exchange data via the transfer of files; ---|--- (e) | allow the European Securities and Markets Authority (ESMA) to implement access control procedures; and ---|--- (f) | incorporate any changes or update requested by ESMA to ensure compliance with points (a) to (e). ---|--- Article 5 Characteristics of metadata 1\. When providing the ESAP with information referred to in Article 1(1), point (a), of Regulation (EU) 2023/2859, collection bodies shall make available to the ESAP the relevant accompanying metadata in accordance with the table of the Annex to this Regulation. 2\. Collection bodies shall provide the metadata in a common format in accordance with the ISO 20022 methodology. Where the information is prepared in a machine-readable format pursuant to any of the Union legislative acts referred to in Article 1(1), point (a), of Regulation (EU) 2023/2859, collection bodies shall ensure that the metadata for that information is provided either in accordance with the ISO 20022 methodology or in the same format as the information. Article 6 Time limits for collection bodies 1\. Without prejudice to other legal obligations stemming from Union legislative acts, collection bodies shall provide to the ESAP the information, the metadata for that information and, where required, the qualified electronic seal as soon as possible, and no later than 60 minutes after the information has been submitted to the collection body for the purpose of making it accessible on the ESAP and the submission of the information has passed the technical automated validations referred to in Article 1. 2\. In duly justified exceptional circumstances, including major accidents and errors, deliberate attacks and natural events, collection bodies may provide the relevant information beyond the time limits set out in paragraph 1. In that case, collection bodies shall inform ESMA as soon as possible during their working hours and undertake their best efforts to provide the information within 60 minutes after the resolution of the relevant exceptional circumstance. Article 7 Indicative list and characteristics of acceptable data formats 1\. HTML, PDF and txt formats shall be deemed to constitute data extractable formats, where those formats allow extraction of text by a machine and are human-readable. 2\. XML, XBRL, XBRL-csv, XBRL-xml and inline XBRL formats shall be deemed to constitute machine-readable formats, where those formats are structured so that software applications can easily identify, recognise and extract specific data, including individual statements of fact, and their internal structure contained therein. Article 8 Entry into force and application This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 10 July 2026. This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, 10 July 2025. For the Commission The President Ursula VON DER LEYEN * * * (1) OJ L, 2023/2859, 20.12.2023, ELI: http://data.europa.eu/eli/reg/2023/2859/oj. (2) Commission Implementing Decision (EU) 2015/1506 of 8 September 2015 laying down specifications relating to formats of advanced electronic signatures and advanced seals to be recognised by public sector bodies pursuant to Articles 27(5) and 37(5) of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market (OJ L 235, 9.9.2015, p. 37, ELI: http://data.europa.eu/eli/dec_impl/2015/1506/oj). (3) Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC (OJ L 257, 28.8.2014, p. 73, ELI: http://data.europa.eu/eli/reg/2014/910/oj). (4) Directive (EU) 2019/1024 of the European Parliament and of the Council of 20 June 2019 on open data and the re-use of public sector information (OJ L 172, 26.6.2019, p. 56, ELI: http://data.europa.eu/eli/dir/2019/1024/oj). (5) Commission notice – Guidelines on recommended standard licences, datasets and charging for the reuse of documents (OJ C 240, 24.7.2014, p. 1). (6) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj). (7) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). (8) Directive (EU) 2023/2864 of the European Parliament and of the Council of 13 December 2023 amending certain Directives as regards the establishment and functioning of the European single access point (OJ L, 2023/2864, 20.12.2023, ELI: http://data.europa.eu/eli/dir/2023/2864/oj). (9) Regulation (EU) 2023/2869 of the European Parliament and of the Council of 13 December 2023 amending certain Regulations as regards the establishment and functioning of the European single access point (OJ L, 2023/2869, 20.12.2023, ELI: http://data.europa.eu/eli/reg/2023/2869/oj). (10) Commission Implementing Regulation (EU) 2025/1338 of 10 July 2025 laying down implementing technical standards for the application of Regulation (EU) 2023/2859 of the European Parliament and of the Council with regard to the functionalities of the European single access point (OJ L, 2025/1338, 11.7.2025, ELI: http://data.europa.eu/eli/reg_impl/2025/1338/oj). (11) Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12, ELI: http://data.europa.eu/eli/reg/2010/1093/oj). (12) Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48, ELI: http://data.europa.eu/eli/reg/2010/1094/oj). (13) Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84, ELI: http://data.europa.eu/eli/reg/2010/1095/oj). (14) Regulation (EU) No 236/2012 of the European Parliament and of the Council of 14 March 2012 on short selling and certain aspects of credit default swaps (OJ L 86, 24.3.2012, p. 1, ELI: http://data.europa.eu/eli/reg/2012/236/oj). (15) Regulation (EU) 2017/1129 of the European Parliament and of the Council of 14 June 2017 on the prospectus to be published when securities are offered to the public or admitted to trading on a regulated market, and repealing Directive 2003/71/EC (OJ L 168, 30.6.2017, p. 12, ELI: http://data.europa.eu/eli/reg/2017/1129/oj). * * * ANNEX Table Metadata Number | Field | Format ---|---|--- 1. | Name(s) of the entity that submitted the information | Free text field up to 500 alphanumeric characters 2. | Name(s) of the natural or legal person to which the information relates | Free text field up to 500 alphanumeric characters 3. | Legal entity identifier of the entity that submitted the information | ISO 17442 Legal Entity Identifier (LEI) 20 alphanumeric character code 4. | Legal entity identifier of the legal person to which the information relates | ISO 17442 Legal Entity Identifier (LEI) 20 alphanumeric character code 5. | Type of information submitted by the entity | Taxonomy in accordance with the common list of types of information as set out in Table 1 of Annex to Implementing Regulation (EU) 2025/1338 6. | Size of the entity by category that submitted the information | Taxonomy in accordance with the common list of categories of entities by size as set out in Table 2 of Annex to Implementing Regulation (EU) 2025/1338 7. | Size of the legal person to which the information relates | Taxonomy in accordance with the common list of categories of entities by size as set out in Table 2 of Annex to Implementing Regulation (EU) 2025/1338 8. | Country of registered office of the legal person to which the information relates | ISO 3166 – 2-character country code 9. | Industry sector(s) of the economic activities of the natural or legal person to which the information relates | Taxonomy in accordance with the common list of industry sectors as set out in Table 3 of Annex to Implementing Regulation (EU) 2025/1338 10. | Personal data flag | ‘true’ – the information submitted contains personal data ‘false’ – information submitted does not contain personal data 11. | Voluntary or mandatory nature of the information submitted | ‘true’ – voluntary ‘false’ – mandatory 12. | Date and time when the data was submitted by the entity to the collection body | ISO 8601 date in the Coordinated Universal Time (UTC) time format YYYY-MM-DDThh:mm:ssZ 13. | Date or beginning of the period to which the information relates | ISO 8601 date in the Coordinated Universal Time (UTC) format YYYY-MM-DD 14. | Date or end of the period to which the information relates | ISO 8601 date in the Coordinated Universal Time (UTC) format YYYY-MM-DD 15. | Collection body responsible for the collection of the information | Name of the collection body designated for the collection of the data as published on ESMA’s website pursuant to Article 4 of Regulation (EU) 2023/2859 16. | Home Member State, where applicable | ISO 3166 – 2-character country code 17. | Host Member State, where applicable | ISO 3166 – 2-character country code 18. | Instrument or product identifier, where applicable | ISIN or up to 52 alphanumeric characters 19. | Unique data record identifier | Free text up to 140 alphanumeric characters 20. | Data file reference | Free text up to 500 alphanumeric characters 21. | Qualified electronic seal file reference, where applicable | Free text up to 500 alphanumeric characters 22. | Type of submission | NEWT = New (to be used for new information) MODI = Modify (to be used for modifications in light of newly available information) EROR = Error (to be used in case of errors leading to removal of the entire record) CORR = Correction (to be used when information previously reported is found to be incorrect and should be corrected) 23. | Version of the dataset (data and metadata) | Integer number 24. | Legal framework | Taxonomy in accordance with list of Union legislative acts referred to in Article 1(1) point (a), of Regulation (EU) 2023/2859 25. | Historical information flag | ‘true’ – Yes ‘false’ – No 26. | Language in which the information was submitted | ISO 639-1 – 2-character language code * * * ELI: http://data.europa.eu/eli/reg_impl/2025/1339/oj ISSN 1977-0677 (electronic edition) * * *