Reform of the EU Securitisation Framework—Part 5: Amendments to the Due Diligence and Risk Retention Regime

Background

The current Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation and creating a specific framework for simple, transparent, and standardised securitisation (the "EU Securitisation Regulation") takes a dual approach to ensuring compliance with the requirements for risk retention and, if applicable, "simple, transparent, and standardised" ("STS") securitisations. On the one hand, the EU Securitisation Regulation imposes a direct obligation on so-called "sell-side entities" (a term used by the Commission to refer to originators, original lenders, sponsors, and special purpose entities) to actively comply with these requirements; on the other hand, it further requires institutional investors to verify, prior to holding a securitisation position, that the relevant sell-side entity complied with these requirements. This results in a duplicative and overly burdensome due diligence process, as sell-side entities that are established in the EU are already subject to supervision by the EU authorities and can be sanctioned in case of a breach. Some may remember that, before the EU Securitisation Regulation came into force, only the investor-side was subject to a (risk retention) due diligence requirement, and an investment in a securitisation position was only permitted if the investor could verify that the relevant sell-side entity had complied with the risk retention requirement.

The Proposals

The Commission's proposed amendments to Articles 5 and 6 of the EU Securitisation Regulation include the following changes to the due diligence and risk assessment obligations for institutional investors:

Prior to the investment in a securitisation position:

• Removal of the obligation to verify sell-side entities' compliance with the risk retention and reporting requirements (under Articles 6 and 7 of the EU Securitisation Regulation).
• Removal of the obligation to carry out a risk assessment of a detailed list of structural features that need to be checked, thereby reducing the risk assessment to what is considered proportionate to the risk profile of the securitisation position.
• With respect to an STS securitisation, removal of the obligation to carry out a risk assessment of sell-side entities' compliance with the STS criteria.

During the investment in a securitisation position:

• Removal of the obligation to establish appropriate written procedures for the close monitoring of the securitised exposures (including with respect to exposure type, percentage of delinquent and defaulted exposures, default rates, and prepayment rates).
• With respect to secondary market investments, extension of the deadline for documenting the due diligence assessment and verifications (to a maximum of 15 calendar days after the investment, rather than prior to making the investment).

Furthermore, in cases where the securitisation positions are considered very low-risk—allowing investors to invest in such positions without doing (extensive) checks—the Commission proposes to remove entirely the existing investor due diligence requirements (both prior and during the investment phase). This would apply to two scenarios: (i) where the securitisation position is fully guaranteed by a multilateral development bank listed in Article 117(2) of Regulation (EU) 575/2013 (CRR); or (ii) where the first loss tranche of the securitisation represents at least 15% of the nominal value of the securitised exposures and is either held or guaranteed by the EU or by national promotional banks or institutions (being legal entities carrying out financial activities on a professional basis with a mandate by a Member State or Member State entity (at central, regional, or local level) to carry out development or promotional activities). With respect to scenario (ii), the Commission has also proposed to remove the risk retention requirement for sell-side entities under Article 6(1) of the EU Securitisation Regulation.

Finally, the proposals would change who is ultimately liable for a failure to perform delegated due diligence obligations. Under the current framework, where an investor delegates performance of its due diligence obligations to another institutional investor, the delegate assumes responsibility for fulfilling them; in the event of a breach, it is the delegate who therefore may be subject to sanctions. However, under the Commission's proposals, a delegating institutional investor would retain ultimate responsibility for complying with their due diligence and risk assessment obligations (and potentially face sanctions where they fail to do so), despite having delegated performance of these obligations.

Analysis of the Proposed Changes

An EU-based sell-side entity will, by its nature, be: (i) established and subject to regulatory supervision in the EU and (ii) already directly subject to risk retention, reporting, and, where applicable, STS requirements under the EU Securitisation Regulation. These factors, in the Commission's view, justify a reduced due diligence and risk assessment level for institutional investors, a more principles-based due diligence approach, and a reduced risk retention requirement for such sell-side entities. In particular, the Commission considers it appropriate in such circumstances that investors no longer be required to (duplicatively) verify compliance by the relevant sell-side entity with its regulatory requirements.

The industry certainly welcomes this proposal, as it avoids a duplication of time and cost-intensive due diligence work, without compromising on existing supervision standards. However, the proposal further promotes a discrimination of EU institutional investors to invest in non-EU securitisations (including the United Kingdom). Because third-country sell-side entities are not subject to supervision in the EU—and therefore not subject to the risk retention and reporting obligations under the EU Securitisation Regulation—EU investors are required to perform a full-fledged due diligence and risk assessment on such entities (pursuant to Article 5 of the EU Securitisation Regulation). From the Commission's perspective, this is understandable, since reduced due diligence and risk assessment requirements for non-EU securitisations would compromise existing supervision standards (in contrast with softened requirements for EU securitisations).

However, the Commission's approach is not in line with the March 2025 Joint Committee of European Supervisory Authorities (the "Joint Committee") report on the implementation and functioning of the EU Securitisation Regulation. As the Joint Committee's report recognised, there is scope for improving the current due diligence regime for third-country securitisations without sacrificing supervisory standards (for example, through the introduction of a third-country equivalence regime). Further, as noted above, the Commission has proposed to extend the existing sanctions regime to institutional investors who breach their due diligence and risk assessment obligations under Article 5 of the EU Securitisation Regulation. This, combined with retention of the existing requirements for investors in non-EU securitisations, will most likely have a slow-down effect on the global securitisation market.

The proposed principles-based due diligence approach would certainly help to reduce the due diligence burden for institutional investors—replacing a highly granular and detailed risk assessment with the concept that the due diligence and risk assessment should be "proportionate to the risk profile of the securitisation positions" (see Recital 4 of the legislative proposal). However, simply removing parts of the due diligence provisions (which currently work as a sort of checklist) seems not to do the trick. Neither "proportionate" nor "risk profile", as used in (nonbinding) Recital 4 of the legislative proposal, is not defined, and therefore these concepts remain open to interpretation and legal uncertainty. In light of the Commission's proposal for an extended sanctions regime, this might prompt even more extensive due diligence than is currently required, in order to avoid becoming subject to sanctions under the proposed extended regime.

Finally, while the proposed amendments continue to allow institutional investors to delegate their due diligence and risk assessment obligations to other institutional investors, the ultimate responsibility remains with the investor itself. Unlike before, delegating investors would now need to be able to demonstrate full compliance with their due diligence and risk assessment obligations—and face liability for failures to comply fully. This is likely to have a significant impact on securitisation investments by smaller institutional investors who, due to the lack of personnel and appropriate monitoring system, currently outsource their due diligence and risk assessment obligations to bigger institutional investors.

Looking Ahead

The Commission's proposed amendments have been submitted to the European Parliament and the Council of the EU for review and approval. Changes to the current draft amendments should be expected as part of the legislative negotiation process, though it is unclear at the present stage how extensive such changes may be. There is no defined timeline for the process, though it is expected to be at least 18-24 months before the proposals would become law. The proposed amendments also give rise to certain practical issues, which might challenge the success of the legislative proposals.

Further, it is unclear whether the United Kingdom will seek to minimise regulatory divergence by adopting similar changes to its "on-shored" version of the EU regime. Market participants are advised to conduct a thorough legal analysis of the evolving regulatory landscape, including the interplay between EU and UK regimes, to ensure compliance and to capitalise on new investment opportunities that may arise from a harmonised or divergent approach.

Sneak preview: In part six of this series, we will look at the Commission's proposed changes to the supervisory framework (including with respect to third-party verifiers of STS transactions).