Article 127 Disclosure of information from third countries

This article governs how EBA can handle and disclose information it has received from supervisory authorities outside the EU.

The core rule is that EBA cannot freely share such information — it must first have the express agreement of the third-country authority that originally provided it, and any disclosure must stay within the purposes for which that agreement was granted.

The article then carves out an important exception to this consent requirement, which applies when the information is being requested by other EU supervisory authorities for their own tasks, or by courts handling criminal proceedings.

Important points:

• EBA may only disclose information received from third-country supervisory authorities if express agreement has been obtained from the authority that transmitted it.
• Any disclosure must be limited to the purposes for which the third-country authority gave its agreement, unless the disclosure is necessary for judicial proceedings.
• The express agreement requirement does not apply when other EU supervisory authorities need the information to fulfil their tasks, or when courts require it for investigations or proceedings related to criminal penalties.