FIS and Brexit

UK-incorporated financial services providers lost EU passporting rights on 1 January 2021. From the outset of the negotiations, the EU ruled out continuing to extend passporting rights to the UK. Instead, the European Commission highlighted the importance of “respecting the Parties’ regulatory and decision-making autonomy” and stated that financial services would be subject to unilateral equivalence decisions. Equivalence decisions are unilateral decisions of the parties and not covered in the UK-EU agreement. The EU and the UK can unilaterally recognise a third-country regulatory regime as equivalent to their own, respectively, for market access and other purposes.

Financial services in the EU are not governed by a single set of regulations, and it is therefore not possible for the EU to issue one equivalence decision that would maintain the parties’ current level of market access. Coming under an EU equivalence regime is very different to benefiting from passporting rights; the existing equivalence regimes under EU law differ significantly in their scope, operation and impact. We will continue to monitor this situation closely.

For our impacted regulated businesses, we have embarked on the implementation of alternative arrangements, such as authorisation from the required regulatory authorities or provision of service from another legal entity under an exemption or authorisation or reliance on third-country equivalence regimes.

For our business units providing services to clients not requiring regulatory authorization, we believe there is no such regulatory impact.

As from 1 January 2021, transfers of personal data from the European Economic Area to the UK should be treated like transfers of personal data to any other third country, in accordance with the General Data Protection Regulation. The EU is currently considering whether to grant the UK an “adequate country” status. As the UK does not (yet) have an adequacy decision, this would mean using “appropriate safeguards” such as standard contractual clauses or relying on a derogation to the restrictions such as individual consent.

However, the EU-UK Agreement offers some respite on this point. Data transfers to the UK from the EU and EEA are not to be treated as made to a third country. This position lasts until an adequacy decision is granted or (if earlier) until 1 May 2021. If no adequacy decision has been issued by that date, then there is a further automatic extension, until 1 July 2021, unless either party objects to that.

The UK government has confirmed that it will permit transfers to the EEA and also that it will recognise the existing adequacy decisions taken by the EU in respect of other third countries. Data transfers from the UK to the EEA and other non-EEA countries with adequacy decisions will be largely unaffected.

The UK-EU Agreement does cover digital trade and contains a series of measures seeking to facilitate it. The UK and EU have agreed that there will be no data localisation provisions. The UK-EU Agreement also contains provisions on electronic signatures, consumer protection and machine-readable public sector data and guarantees against the mandatory transfer of source code.

The UK and EU have entered a “zero tariff, zero quota” agreement. It avoids the introduction of customs duties, export duties, taxes or other charges on goods moving between the EU and UK which are produced in the EU or UK, as long as those goods comply with the appropriate “Rules of Origin”. There will be no quantitative restrictions either, i.e., there will be no quota limits in terms of the volume of imports or exports between the UK and EU. However, new customs controls and other requirements apply from 1 January 2021.