Court of Justice of the European Communities (including Court of First Instance Decisions)

JUDGMENT OF THE GENERAL COURT (Ninth Chamber, Extended Composition)

6 October 2021 (*)

(Economic and monetary policy – Prudential supervision of credit institutions – Specific supervisory tasks assigned to the ECB – Decision to withdraw a credit institution’s authorisation – Breach of legislation on combating money laundering and the financing of terrorism – Admissibility – Powers of the national competent authorities (NCAs) of participating Member States and of the ECB under the Single Supervisory Mechanism (SSM) – Equal treatment – Proportionality – Protection of legitimate expectations – Legal certainty – Misuse of powers – Rights of the defence – Obligation to state reasons)

In Cases T‑351/18 and T‑584/18,

Ukrselhosprom PCF LLC, established in Solone (Ukraine),

Versobank AS, established in Tallinn (Estonia),

represented by O. Behrends, lawyer,

applicants,

v

European Central Bank (ECB), represented by C. Hernández Saseta and G. Marafioti, acting as Agents, and by B. Schneider, lawyer,

defendant,

supported by

European Commission, represented by A. Steiblytė, D. Triantafyllou and A. Nijenhuis, acting as Agents,

intervener,

APPLICATION under Article 263 TFEU seeking annulment, first, of decision ECB_SSM_2018_EE_1 WHD_2017‑0012 of the ECB of 26 March 2018, secondly, of decision ECB_SSM_2018_EE_2 WHD_2017‑0012 of 17 July 2018, replacing decision ECB_SSM_2018_EE_1 WHD_2017‑0012, by which the ECB withdrew Versobank’s authorisation to operate as a credit institution, and, thirdly, of decision ECB/SSM/2018‑EE‑3 of 14 August 2018 on the costs relating to the review procedure,

THE GENERAL COURT (Ninth Chamber, Extended Composition),

composed of M.J. Costeira (Rapporteur), President, D. Gratsias, M. Kancheva, B. Berke and T. Perišin, Judges,

Registrar: P. Cullen, Administrator,

having regard to the written part of the procedure and further to the hearing on 25 September 2020,

gives the following

Judgment

I.      Background to the dispute

1        Versobank AS, the second applicant, is a credit institution established in Estonia. Its main shareholder is Ukrselhosprom PCF LLC, the first applicant, which has an equity holding of 85.2622% in Versobank.

2        The second applicant was classified as a less significant institution for the purposes of Article 6 of Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ 2013 L 287, p. 63; ‘the Basic SSM Regulation’).

3        As a less significant credit institution, the second applicant was placed under the prudential supervision of Finantsinspektsioon (FSA, Estonia), acting as the national competent authority (NCA), within the meaning of Article 2(2) of the Basic SSM Regulation. Moreover, the latter was also competent in relation to, inter alia, the monitoring of compliance with rules intended to combat money laundering and the financing of terrorism (‘AML/CFT’).

4        From 2015 onwards, the FSA identified recurring breaches by the second applicant in connection with, first, the ineffectiveness of its AML/CFT regime as regards the management of the risks stemming from its business model and, secondly, the inadequacy of the AML/CFT governance arrangements which it had in place.

5        The FSA carried out a number of on-site inspections. The first took place between 13 April and 12 June 2015.

6        In the light of the recurrence of the breaches identified, the FSA, after sending the second applicant a number of notices to comply with the legal requirements, adopted a precept dated 8 August 2016.

7        The precept at issue, under which the shortcomings identified during the 2015 on-site inspection were to be immediately remedied, required the second applicant to take certain steps: first, the application of existing, but not properly applied, AML/CFT policies and procedures, secondly, the application of the due diligence measures laid down in Article 13(1)(3) to (5) of the Rahapesu ja terrorismi rahastamise tõkestamise seadus (Estonian law on AML/CFT) of 19 December 2007 transposing Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ 2015 L 141, p. 73), in the version in force at the material time in the present case, thirdly, verification of the proper application of the due diligence measures laid down in Article 13(1)(3) to (5) of the Estonian law on AML/CFT, fourthly, refusal to carry out transactions if Article 27(2) of that law, in the version in force at the material time in the present case, obliged it to exercise that right and, fifthly, immediate compliance with the notification obligation laid down in Article 32 of that law, in the version in force at the material time in the present case, which imposed an obligation to report suspicions of money laundering or terrorist financing in cases where the relevant conditions were met. In addition, that precept required that applicant to submit information in writing by 9 December 2016, at the latest, regarding the manner in which it fulfilled those obligations.

8        The FSA carried out a second on-site inspection between 13 September and 11 November 2016.

9        In addition, between 5 September and 14 November 2016, a third on-site inspection was carried out by the FSA, which related to breaches identified in connection with the operation by the second applicant of an allegedly unlawful branch or subsidiary in Latvia.

10      By letter of 9 December 2016, the second applicant sent the FSA its written observations on the precept at issue.

11      By letter of 28 February 2017, the FSA notified the second applicant that it had still not complied with all of the obligations imposed by the precept at issue. On 10 April 2017, the FSA adopted, in relation to that applicant, a failing or likely to fail declaration (‘the FOLTF decision’).

12      In the light of information received from the second applicant, the FSA considered it necessary to conduct an in-depth investigation. It carried out a fourth on-site inspection between 4 and 22 September 2017. In the course of that inspection, the FSA identified material and severe breaches of the AML/CFT legislation similar to those which it had identified in two of the previous inspections, and found that that applicant’s internal control system was weak and inadequate.

13      On 8 February 2018, the ECB received a proposal from the FSA to withdraw the authorisation of the second applicant, in accordance with Article 80 of Regulation (EU) No 468/2014 of the ECB of 16 April 2014 establishing the framework for cooperation within the SSM between the ECB and NCAs and with national designated authorities (‘the SSM Framework Regulation’) (OJ 2014 L 141, p. 1).

14      In the context of the obligation to cooperate laid down in Article 80(2) of the SSM Framework Regulation, the FSA also acted, pursuant to Article 3 of the Finantskriisi ennetamise ja lahendamise seadus (Estonian Law on the prevention and resolution of financial crises) of 18 February 2015, as the national resolution authority responsible for credit institutions, through its resolution department. On 7 February 2018, the board of directors of the FSA approved its resolution department’s assessment that there was no public interest in exercising resolution powers under Article 39(1), (3) and (4) of that law, which transposes Article 32(1)(c) and 32(5) of Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012 of the European Parliament and of the Council (OJ 2014 L 173, p. 190).

15      On 6 March 2018, the ECB’s Supervisory Board approved the draft decision withdrawing authorisation from the second applicant and gave it five days to submit its observations on the draft decision, pursuant to Article 31 of the SSM Framework Regulation. After the authorisation withdrawal, liquidation proceedings were opened with respect to that applicant and liquidators were appointed.

16      On 14 March 2018, the second applicant submitted its observations, which were taken into account in the final decision. After examining those observations, the ECB concluded that it was necessary to withdraw its authorisation from that applicant.

17      On the basis of Articles 4(1)(a) and 14(5) of the Basic SSM Regulation, Article 83 of the SSM Framework Regulation and Article 17 of the Krediidiasutuste seadus (Estonian Law on Credit Institutions) of 9 February 1999, transposing Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ 2013 L 176, p. 338), the ECB adopted and notified to the second applicant its decision of 26 March 2018 withdrawing the latter’s authorisation (‘the decision of 26 March 2018’).

18      On 27 March 2018, the competent Estonian court adopted a decision opening the proceedings for the liquidation of the second applicant.

19      On 26 April 2018, the Administrative Board of Review of the ECB (‘the ABoR’) received an application from the first applicant for review of the decision of 26 March 2018. It held that request for review to be admissible, taking the view that that applicant was directly and individually concerned by that decision.

20      On 22 June 2018, the ABoR adopted and communicated to the ECB’s Supervisory Board Opinion AB/2018/03, by which it proposed that the Supervisory Board take the view that the substantive and procedural infringements relied on were unfounded and that it adopt a decision identical in content to the decision of 26 March 2018.

21      The ECB’s Governing Council followed that opinion and adopted the decision of 17 July 2018 (‘the decision of 17 July 2018’). That decision was notified to the liquidators of the second applicant, which had in the meantime been placed in liquidation.

22      By decision of 26 March 2018, the ECB withdrew the second applicant’s authorisation as a credit institution. By decision of 17 July 2018, it repealed and replaced its decision of 26 March 2018. In the decision on costs, it also ordered the first applicant to pay the costs relating to the review proceedings.

23      In paragraph 3.2 of the decision of 17 July 2018, the ECB observes, first, that the proposal to withdraw the second applicant’s authorisation to operate as a credit institution was adopted at the conclusion of a long and continuous period of deficiencies and breaches of applicable legal provisions on its part, secondly, that the NCA had conducted four on-site inspections since 2015 and had adopted a precept in 2016 and, thirdly, that, as that applicant had not complied either with the relevant informal requests or with the precept, it could not come to a positive assessment regarding the future compliance of that applicant with the regulatory requirements imposed on it.

24      Also, in paragraph 3.2 of the decision of 17 July 2018, the ECB expressed the view that, on the basis of the evidence gathered and the findings of the on-site inspections carried out by the FSA, the grounds for withdrawal set out in Article 18(f) of Directive 2013/36, as transposed into Estonian law, had to be regarded as being satisfied in relation to the second applicant. The grounds for that withdrawal of authorisation were as follows:

–        that applicant’s failure to have in place the governance arrangements required by the FSA, in accordance with the national provisions transposing Article 74 of Directive 2013/36;

–        that applicant’s lack of an effective AML/CFT regime to manage the risks stemming from its business model, in spite of three on-site AML/CFT inspections, several meetings and notices, the precept and a letter concerning non-compliance with the precept;

–        that applicant’s failure to implement the precept within the period and to the extent prescribed;

–        that applicant’s submission of misleading and incorrect documents and information to the FSA and its breach of conditions laid down by the legislation of a Member State of the European Economic Area (namely, the Republic of Latvia).

25      In particular, as regards the first ground on which the withdrawal of authorisation was based, namely the second applicant’s failure to have in place the governance arrangements required by the FSA, in accordance with the national provisions transposing Article 74 of Directive 2013/36, the ECB stated, in paragraph 3.3.1(a) of the decision of 17 July 2018, that the control system was weak and inadequate for the type, scope and complexity of that applicant’s business model.

26      As regards the second ground justifying the withdrawal of authorisation, the ECB stated, in paragraph 3.3.1(b) of the decision of 17 July 2018, that the second applicant’s business model focused on providing services to high-net-worth non-resident corporate customers and that, during the first three on-site inspections carried out by the FSA between 2015 and 2017, a large number of unusual transactions had been observed.

27      Furthermore, according to the ECB, the activities of the second applicant’s board of directors and supervisory board with regard to AML/CFT and risk management had been considered to be inadequate, in so far as that board had not determined that applicant’s risk tolerance, or put in place a separate risk assessment system for AML/CFT, or prepared an operational risk analysis, including a detailed analysis of the risks in that regard, in breach of Article 55(2)(2) and (3) of the Estonian Law on Credit Institutions.

28      Thus, according to the ECB, the second applicant did not have the governance arrangements required by Article 67(1)(o) of Directive 2013/36 and therefore fulfilled the condition for withdrawal of the authorisation, as laid down in Article 18(f) of that directive. Furthermore, in view of that applicant’s previous performance, the ECB shared the FSA’s view that it was highly unlikely that the applicant’s new board of directors, the fourth since 2015, would introduce, in a strict manner, the announced changes concerning its AML/CFT risk management system.

29      As regards the third ground justifying the withdrawal of authorisation, the ECB observed, in paragraph 3.3.1(c) of the decision of 17 July 2018, that the second applicant had not complied with the precept at issue within the set time limit of 9 December 2016. According to the Commission, by that precept, the FSA required, inter alia, that applicant, first, to apply the procedural rules, secondly, to apply correctly, in the future, Article 13(1)(3) to (5) of the Estonian law on AML/CFT, in the version in force at the time of the adoption of that precept, and to avoid initiating commercial relations where that proved necessary, thirdly, to verify whether those provisions had been correctly applied to existing commercial relations and, if necessary, to apply customer due diligence measures once again, fourthly, to avoid, where appropriate, carrying out transactions under the terms of Article 27(2) of that law, in the version in force at the time of the adoption of the precept at issue, fifthly, to refer to the financial intelligence unit when an activity or other circumstance could be an indication of the commission or attempted commission of money laundering or terrorist financing, or where that applicant had reason to believe or knew that money laundering or terrorist financing was taking place and, sixthly, to provide the FSA with a report of the actions taken to implement the above obligations. However, during the third on-site inspection, the FSA found that the abovementioned obligations had not been fully complied with and that the shortcomings identified were ongoing. Accordingly, the ECB concluded that the failure to comply with the precept at issue constituted another ground justifying the withdrawal of authorisation under Article 18(f) of Directive 2013/36.

30      As regards the fourth ground justifying the withdrawal of authorisation, the ECB noted, in paragraph 3.3(d) of the decision of 17 July 2018, that the second applicant had submitted misleading and inaccurate information and documents to the FSA concerning its activities in Latvia, stating, first, that it did not own a subsidiary there and, secondly, in its communication of 9 February 2016 to that NCA, that it had closed its establishment in Latvia, even though the latter was still operational. According to the ECB, the results of the on-site inspection carried out by that NCA between 5 September and 14 November 2016 had, in fact, demonstrated that that applicant had provided financial services in Latvia without interruption since October 2013. It observed that, according to the information communicated by the Latvian national supervisory authority to the FSA, that applicant had created its ‘subsidiary’ in Latvia in breach of the Latvian legislative provisions which transposed Articles 35 to 38 of Directive 2013/36 on the ‘passporting’ procedure. In its view, such conduct constituted an infringement of Article 17(1)(2) and (15) of the Estonian Law on Credit Institutions. It therefore concluded that that conduct constituted an additional ground for withdrawal of authorisation under Article 18(e) of that directive.

31      As regards the examination of the proportionality of the withdrawal of authorisation and, in the first place, of the appropriateness of such a withdrawal, the ECB stated that the purpose of withdrawing the authorisation granted to a credit institution was to put an end to that institution’s infringements of the applicable legal provisions and that the need for such an institution to have an appropriate system of governance in place stemmed from the fact that weaknesses in such a system could lead to the insolvency of that institution and to systemic problems in Member States and globally. It was of the opinion that, in view of the long-term breaches of the anti-money laundering legislation by the second applicant, the FSA had to intervene and that, in the present case, the latter had first adopted a precept, and it was only after infringement of that precept that the FSA had proposed withdrawal of authorisation, which, in those circumstances, had to be regarded as an appropriate and proportionate measure. It considered that that measure was also appropriate in relation to the infringement of the notification procedure, known as the ‘passporting’ procedure, which must be followed in order to establish a branch in another Member State.

32      In the second place, as regards the examination of the necessity of withdrawing authorisation, the ECB took into account not only the seriousness of the breaches observed, but also all the less onerous measures which had already been taken to remedy the shortcomings of the second applicant. In view of the continuing nature of the unlawful conduct of that applicant, the incorrect information which it provided in relation to its activities in Latvia and the fact that the extensive supervisory and inspection activities already carried out by the FSA had failed to put an end to the breaches, the ECB found, after analysing not only the actions already undertaken by the FSA but also all the other measures available under the applicable national legislation, namely the Estonian Law on Credit Institutions, that there were no less onerous measures capable of restoring legality.

33      In particular, the ECB found that the ‘forced sale’ option was not legally available in relation to the second applicant. It went on to set out the various alternative measures it had considered and explain why it did not believe that they would be effective in terms of restoring legality. First, a new change in the composition of the board of directors of that applicant was not regarded as an effective measure, since (i) that applicant had already made a number of changes in the board of directors without that having produced any effects in terms of compliance with the legal obligations at issue, (ii) the applicant had announced several times, from 2015 onwards, a change in its commercial strategy without those announcements being followed by concrete changes, (iii) under Estonian law, although the board of directors has the power to influence the commercial strategy of a credit institution, it does not have the power to define that strategy autonomously as its responsibility is limited to the management of the day-to-day business of the institution, and (iv) in the present case, the chances that a change in the board of directors would lead to a change in strategy were low, given that the two key positions on the board of directors are held by the two main shareholders of the credit institution, who would be in a position informally to influence the strategy and thus maintain the status quo.

34      Secondly, as regards the cessation or suspension of the voting rights of certain shareholders, pursuant to the provision of Estonian law transposing Article 26(2) of Directive 2013/36, the ECB stated that, since the shareholdings in the second applicant were highly concentrated, that measure would have resulted in the management of the bank being left to minority shareholders, who had a lower degree of involvement in the running of the credit institution and, moreover, who were very closely linked to the controlling shareholders via family ties or common financial interests, which could have resulted in an indirect influence of those same shareholders on the strategic management of that applicant, despite the measure adopted.

35      Thirdly, as regards the adoption of another precept, prohibiting the second applicant from providing financial services, at least to non-resident high-risk customers, the ECB considered that measure to be inadequate since (i) the failure to comply with the previous precept raised questions as to the applicant’s ability and willingness to comply with a potential second precept, and (ii) restriction of the bank’s activities would have resulted in very large monthly operating losses, thereby jeopardising its liquidity and thus its customers’ savings.

36      Fourthly, with regard to self-liquidation, the ECB acknowledged that such a solution had been proposed by the second applicant in its observations on the draft decision of 26 March 2018, that such a possibility existed under Estonian law and that it would have resulted in the withdrawal of authorisation in any event, but that, nevertheless, the ECB decided not to opt for it, since (i) self-liquidation would have obfuscated the substantive reasons for which the FSA had proposed the withdrawal of authorisation, (ii) such a withdrawal of authorisation would have been based on Article 16(3) of the Estonian Law on Credit Institutions and not on Article 17 of that law, (iii) self-liquidation would thus have given an inaccurate view of the severity of the applicant’s breaches of the applicable law, which, in the ECB’s view, justified a non-voluntary withdrawal of the authorisation and (iv) under Article 20(5) of Directive 2013/36, the communication regarding the withdrawal of authorisation must concern not only the withdrawal itself but also the grounds on which it is based.

37      Fifthly, as regards acquisition by another Estonian company, the ECB did not accept that solution because (i) no documentary evidence had been provided in relation to there being a specific commitment on the part of any of the investors and (ii) the second applicant’s business plan did not provide sufficient information to determine whether the transaction would have led to a change in commercial strategy. Furthermore, despite the additional period allowed to that applicant to submit the documentation, it had failed to provide the necessary information.

38      In the third place, as regards the examination of the reasonableness of the withdrawal of authorisation, the ECB considered that, in view of the severity and duration of the breaches, the fact that the second applicant had repeated its unlawful conduct despite the various warnings received, and the damage to public confidence in the Estonian and European financial system, caused by its conduct, the public interest in restoring legality outweighed the applicant’s private interest in maintaining its authorisation.

39      As regards the compatibility of the withdrawal of authorisation with the principle of the protection of legitimate expectations, the ECB took the view that the second applicant could not rely on that principle, since, first, although it had received numerous warnings on several occasions (four on-site inspections, a precept and a number of warnings), it had failed to take appropriate measures to cease its unlawful conduct, secondly, the FSA had never communicated to it that its authorisation would not be withdrawn and, thirdly, no one may rely on legitimate expectations in order to engage in or maintain unlawful conduct.

40      Having regard to all of the foregoing, the ECB concluded that there were grounds for withdrawing the second applicant’s authorisation under Article 18 of Directive 2013/36, and that such a measure was proportionate (in the sense that it was suitable, necessary and reasonable) in the light of the circumstance of the case, and was in line with the principle of protection of legitimate expectations.

II.    Procedure and forms of order sought

A.      Beginning of the proceedings and forms of order sought by the parties in Case T‑351/18

41      The applicants brought an action by application lodged at the Court Registry on 5 June 2018.

42      The ECB lodged its defence on 21 September 2018.

43      By document lodged at the Court Registry on 9 October 2018, the European Commission applied for leave to intervene in support of the form of order sought by the ECB.

44      By decision of 26 November 2018, the President of the Second Chamber of the General Court granted the application for leave to intervene.

45      The applicants lodged the reply on 12 December 2018. The ECB lodged its rejoinder on 18 February 2019.

46      The Commission lodged its statement in intervention on 20 December 2018. The applicants submitted their observations on that statement on 25 February 2019.

47      By document lodged at the Court Registry on 1 April 2019, the applicants requested a hearing, the summoning of witnesses and certain measures of inquiry.

48      By document lodged at the Court Registry on 29 April 2019, the ECB and the Commission submitted their observations on the applicants’ request for the summoning of witnesses and measures of inquiry.

49      The applicants claim that the Court should:

–        annul the decision of 26 March 2018;

–        order the ECB to pay the costs.

50      The ECB contends that the Court should:

–        dismiss the action as inadmissible as regards the first applicant;

–        in the alternative, dismiss the application as unfounded as regards the first applicant;

–        dismiss the action as unfounded as regards the second applicant;

–        order the applicants to pay the costs.

51      The Commission contends that the Court should:

–        dismiss the action as inadmissible as regards the first applicant;

–        in any event, dismiss the action as unfounded;

–        order the applicants to pay the costs.

B.      Beginning of the proceedings and forms of order sought by the parties in Case T‑584/18

52      The applicants brought an action by application lodged at the Court Registry on 27 September 2018.

53      The ECB lodged its defence on 20 December 2018.

54      By document lodged at the Court Registry on 23 January 2019, the Commission applied for leave to intervene in support of the ECB.

55      By decision of 25 February 2019, the President of the Second Chamber of the General Court granted the application for leave to intervene.

56      The applicants lodged the reply on 28 March 2019. The ECB lodged its rejoinder on 3 June 2019.

57      The Commission lodged its statement in intervention on 5 April 2019. The applicants submitted their observations on that statement on 27 May 2019.

58      The applicants claim that the Court should:

–        annul the decision of 17 July 2018;

–        annul the decision on costs;

–        order the ECB to pay the costs.

59      The ECB contends that the Court should:

–        dismiss the action as inadmissible as regards the first applicant;

–        in the alternative, dismiss the application as unfounded as regards the first applicant;

–        reject the twenty-fifth plea as inadmissible, in so far as it was raised by the second applicant;

–        dismiss the action as unfounded as regards the second applicant, including the twenty-fifth plea, if the Court does not declare it inadmissible;

–        order the applicants to pay the costs.

60      The Commission contends that the Court should:

–        dismiss the action as inadmissible as regards the first applicant;

–        in any event, dismiss the action as unfounded;

–        order the applicants to pay the costs.

61      In their written pleadings, the applicants made requests for measures of inquiry and, in particular, requested the production of a number of documents and the summoning of witnesses.

C.      Continuation of the proceedings in both cases

62      Following a change in the composition of the Chambers of the General Court, pursuant to Article 27(5) of that Court’s Rules of Procedure, the Judge-Rapporteur was assigned to the Ninth Chamber, to which the present cases were consequently allocated.

63      On a proposal from the Ninth Chamber, the Court decided on 5 February 2020, pursuant to Article 28 of the Rules of Procedure, to refer the present cases to a formation sitting in an extended composition.

64      On a proposal from the Judge-Rapporteur, the Court (Ninth Chamber, Extended Composition) decided to open the oral part of the procedure and, by way of measures of organisation of procedure provided for in Article 89 of the Rules of Procedure, put written questions to the parties, to which the Commission, the ECB and the applicants replied by documents lodged at the Court Registry on 13 March and 16 and 17 April 2020 respectively.

65      By decision of the President of the Ninth Chamber of 27 April 2020, the present cases were joined for the purposes of the oral procedure.

66      At the hearing on 25 September 2020, the parties presented oral argument and answered questions put to them by the Court. The parties were also heard on the possibility of those cases being joined for the purpose of the decision closing the proceedings.

67      Following the death of Judge Berke on 1 August 2021, the three judges whose signatures appear on the present judgment continued the deliberations in accordance with Article 22 and Article 24(1) of the Rules of Procedure.

68      By decision of the President of the General Court of 13 August 2021, the present case was assigned to a new Judge-Rapporteur, sitting in the Ninth Chamber.

III. Law

69      The Court joins Cases T‑351/18 and T‑584/18 for the purpose of the judgment.

A.      Whether the subject matter of the dispute in the main proceedings still obtains and the legal interest of the applicants in bringing proceedings in Case T‑351/18

70      According to settled case-law, an action for annulment brought by a natural or legal person is admissible only in so far as that person has an interest in having the contested act annulled. Such an interest, which is an essential and fundamental prerequisite for any legal proceedings, requires that the annulment of that measure must be capable, in itself, of having legal consequences and that the action, if successful, may procure an advantage for the party which has brought that action (see judgment of 17 September 2015, Mory and Others v Commission, C‑33/14 P, EU:C:2015:609, paragraphs 55 and 58 and the case-law cited).

71      An applicant’s interest in bringing proceedings must, in the light of the purpose of the action, exist at the stage of lodging the action, failing which the action will be inadmissible. That purpose must, like the interest in bringing proceedings, continue until the final decision, failing which there will be no need to adjudicate; this presupposes that the action must be capable, if successful, of procuring an advantage for the party bringing it (see judgment of 7 June 2007, Wunenburger v Commission, C‑362/05 P, EU:C:2007:322, paragraph 42 and the case-law cited).

72      The EU Courts may raise, of their own motion, the question as to whether there is a need to adjudicate on the ground that there is no continuing interest in bringing proceedings (judgment of 6 September 2018, Bank Mellat v Council, C‑430/16 P, EU:C:2018:668, paragraph 49).

73      In that regard, by way of a measure of organisation of procedure of 3 March 2020, the Court asked the parties to state their views on the applicants’ continuing interest in bringing proceedings, following the adoption by the ECB of the decision of 17 July 2018, by which the ECB had revoked the decision of 26 March 2018 with retroactive effect.

74      The applicants take the view that they retain their legal interest in bringing proceedings against the decision of 26 March 2018, after the adoption of the decision of 17 July 2018. According to the applicants, first, the repeal of a measure cannot invariably be equated with annulment by the EU Courts since, by definition, it does not amount to recognition of the decision’s illegality. Secondly, the ECB cannot be allowed to avoid a judicial determination of the illegality of a decision by means of a new decision and an abrogation of the previous decision. An ability to do so could be abused in a manner which is contrary to the rule of law. Thirdly, the alleged deemed replacement of the original decision by the subsequent decision at some date in the past is a fiction that is inconsistent with the law. Fourthly, the applicants seek the annulment of the decision of 26 March 2018, inter alia, to protect their reputational interests and because of their interest in obtaining financial compensation. The legitimacy of those interests was recognised in the order of 12 September 2017, Fursin and Others v ECB (T‑247/16, not published, EU:T:2017:623, paragraphs 17 to 23), and that part of the order of the General Court was not appealed and is therefore legally valid. The Court of Justice upheld that part of the order of the General Court. The fact that the Court of Justice did not examine that aspect explicitly is irrelevant. It was not necessary to do so, since that part of the order was not appealed by either the ECB or the Commission. Fifthly, a decision altering the legal position of the addressee with an ex tunc effect is authorised only in very limited circumstances, in particular where it has a positive effect on the addressee. Consequently, withdrawal of authorisation with a purported effect prior to the date of the decision is never possible.

75      The ECB submits that there is no interest on the part of the applicants which cannot be satisfied in the context of the judicial review of the decision of 17 July 2018. Accordingly, the applicants have lost their interest in bringing proceedings against the decision of 26 March 2018.

76      As is apparent from Article 24(1) of the Basic SSM Regulation, the ECB is required to establish an ABoR responsible for carrying out an internal administrative review of decisions taken by the ECB in the exercise of the powers conferred on it by that regulation. According to paragraph 2 of that article, the ABoR is to be composed of five individuals of high repute, from Member States and having a proven record of relevant knowledge and professional experience, excluding current staff of the ECB, as well as current staff of competent authorities or of other national or EU institutions, bodies, offices and agencies. By Decision 2014/360/EU of 14 April 2014 concerning the establishment of an Administrative Board of Review and its Operating Rules (OJ 2014 L 175, p. 47), adopted on the basis of Article 24 of the Basic SSM Regulation, the ECB established the ABoR.

77      It is also apparent from Article 24(7) of the Basic SSM Regulation that the internal administrative review of ECB decisions in the area of prudential supervision consists of three stages. In the first place, the ABoR issues an opinion to the Supervisory Board for the purpose of drawing up a new draft decision. In the second place, the Supervisory Board takes account of the opinion of the ABoR and submits a new draft decision to the Governing Council within the time limits laid down in Article 17(2) of Decision 2014/360. The new draft decision is to ‘abrogate the initial decision, replace it with a decision of identical content, or replace it with an amended decision’. In the third place, the new draft decision is to be deemed adopted unless the Governing Council objects within a maximum period of 10 working days.

78      Lastly, according to Article 24(1) of the Basic SSM Regulation, the scope of the internal administrative review is to pertain to the procedural and substantive conformity, with that regulation, of decisions taken by the ECB in the exercise of the powers conferred on it by that regulation. It is true that, under Article 10(2) of Decision 2014/360, the ABoR’s review is limited to examination of the grounds relied on by the applicant as set out in the request for review. However, according to Article 17(1) of that decision, the assessment of the Supervisory Board is not be limited to examination of the grounds relied upon by the applicant as set forth in the request for review, but may also take other elements into account in its proposal for a new draft decision.

79      It is apparent from a combined reading of the provisions mentioned in paragraphs 76 to 78 above that the internal administrative review of decisions taken by the ECB in the exercise of the powers conferred on it by the Basic SSM Regulation consists, taken as a whole, of a complete reassessment of the case, which is not limited to the grounds relied on in support of the request for review. This feature of the administrative review procedure is reflected in the fact that, under Article 17(1) of Decision 2014/360, the Supervisory Board, after taking into account the opinion of the ABoR, established for the purposes of a review of ECB decisions with increased independence and expertise (see paragraph 76 above), is itself endowed with a wider competence.

80      In that context, Article 24(7) of the Basic SSM Regulation provides that the review procedure may lead to three outcomes. The first consists in the simple abrogation of the initial decision. The second consists in replacing the initial decision with an identical decision. The third consists in replacing the initial decision with an amended decision.

81      For the reasons to be set out in paragraphs 82 to 85 below, Article 24(7) of the Basic SSM Regulation establishes an obligation on the part of the ECB to adopt a decision, following the review, that is retroactive to the time at which the original decision took effect, whatever the outcome of that review.

82      In particular, if the Supervisory Board and the Governing Council consider that the initial decision, pursuant to which the credit institution’s authorisation was withdrawn, is valid, the Governing Council does not simply reject the request for review on the merits, but rather, in accordance with Article 24(7) of the Basic SSM Regulation, adopts a decision that is identical to the one subject to that review. Nevertheless, in such a case, it is not possible to withdraw the same authorisation a second time. A decision identical in content to the reviewed decision can therefore only replace the latter with retroactive effect to the time at which the reviewed decision took effect.

83      That interpretation, which results from the nature of the measures at issue, is also valid where the Supervisory Board and the Governing Council consider that withdrawal of authorisation is not justified or that the shortcomings identified can be remedied by less onerous measures. In such a situation, the act repealing the withdrawal of authorisation or imposing those measures must have retroactive effect so as to cancel ex tunc the withdrawal of the credit institution’s authorisation and, where appropriate, replace it with the measure considered to be the most appropriate. In the absence of such retroactive effect, the review decision could only have effect if a new authorisation was granted in accordance with the procedure laid down in Article 14 of the Basic SSM Regulation.

84      That assessment is, indirectly but necessarily, confirmed by Article 24(8) of the Basic SSM Regulation and by Article 9(1) of Decision 2014/360, according to which the request for review is not to have suspensory effect on the application of the contested decision. It follows that the replacement of the reviewed decision by an amended decision must be made with retroactive effect to the time at which the reviewed decision took effect, as otherwise the final decision cannot have any practical effect.

85      It is also apparent from the foregoing analysis that the replacement of the initial decision by an identical or amended decision at the end of the review procedure results in the definitive disappearance of the original decision from the legal order.

86      In the present case, first, according to the introductory part of the decision of 26 March 2018, the measure contested in Case T‑351/18 took effect at 23.00 CEST on the date of its notification to the second applicant, in accordance with the third subparagraph of Article 297(2) TFEU. Secondly, according to the introductory part of the decision of 17 July 2018, namely the measure contested in Case T‑584/18, ‘the [decision of 26 March 2018] is hereby abrogated and replaced by this Decision with effect as from 23:00 CEST on the date of the notification of the [decision of 26 March 2018]’.

87      The decision of 17 July 2018 was adopted following the administrative review of the decision of 26 March 2018 and was identical in content to that decision, within the meaning of Article 24(7) of the Basic SSM Regulation.

88      It follows that, by virtue of the decision of 17 July 2018, the ECB, in accordance with the legal framework governing the administrative review procedure (see paragraphs 76 to 81 above), replaced the decision of 26 March 2018 with retroactive effect to the time at which the latter took effect and did not, as the applicants appear to maintain, merely abrogate that decision for the future.

89      The disappearance of the subject matter of the proceedings can, inter alia, result from the withdrawal or replacement of the contested act in the course of the proceedings (see, to that effect, judgment of 1 June 1961, Meroni and Others v High Authority, 5/60, 7/60 and 8/60, EU:C:1961:10, pp. 109 to 111; orders of 17 September 1997, Antillean Rice Mills v Commission, T‑26/97, EU:T:1997:131, paragraphs 14 and 15, and of 12 January 2011, Terezakis v Commission, T‑411/09, EU:T:2011:4, paragraph 15).

90      An act which is withdrawn and replaced disappears completely and with ex tunc effect from the legal order of the European Union and therefore a judgment annulling a withdrawn act would not entail any additional legal consequences by comparison with that withdrawal (see, to that effect, orders of 28 May 1997, Proderec v Commission, T‑145/95, EU:T:1997:74, paragraph 26; of 6 December 1999, Elder v Commission, T‑178/99, EU:T:1999:307, paragraph 20; and of 9 September 2010, Phoenix-Reisen and DRV v Commission, T‑120/09, not published, EU:T:2010:381, paragraph 23).

91      It follows that, in the event of withdrawal of the contested act, the applicant retains no interest in obtaining its annulment and the action against it becomes devoid of purpose, with the result that there is no longer any need to adjudicate (judgment of 1 June 1961, Meroni and Others v High Authority, 5/60, 7/60 and 8/60, EU:C:1961:10, pp. 109 to 111; orders of 6 December 1999, Elder v Commission, T‑178/99, EU:T:1999:307, paragraph 21 and 22; of 9 September 2010, Phoenix-Reisen and DRV v Commission, T‑120/09, not published, EU:T:2010:381, paragraphs 24 to 26; and of 24 March 2011, Internationaler Hilfsfonds v Commission, T‑36/10, EU:T:2011:124, paragraphs 46, 50 and 51).

92      That conclusion is even more evident where, as in the present case, the contested act has been replaced, with retroactive effect, by an identical act, which would not be affected by the potential annulment of the first act.

93      Furthermore, the applicants cannot validly rely on the order of 12 September 2017, Fursin and Others v ECB (T‑247/16, not published, EU:T:2017:623). That order was set aside by the judgment of 5 November 2019, ECB and Others v Trasta Komercbanka and Others (C‑663/17 P, C‑665/17 P and C‑669/17 P, EU:C:2019:923), without the disappearance of the applicants’ interest in bringing proceedings by reason of the replacement of the contested act, with retroactive effect, by a new decision with identical content, adopted following an administrative review, being the subject of the appeals.

94      Consequently, contrary to what is claimed by the applicants, in a legal context which organises an administrative review giving rise to the adoption of acts intended to replace, with retroactive effect, the acts which were the subject of that review, the interests of the affected parties are fully protected by the possibility of seeking annulment of the act adopted following the review in question and compensation for any damage caused by the adoption of that review.

95      It follows that the action in Case T‑351/18 became devoid of purpose after the action had been brought and that, consequently, the applicants have lost their interest in seeking annulment of the decision contested in that case. There is therefore no longer any need to rule on the action.

B.      Admissibility in Case T‑584/18

96      The ECB, while not formally raising a plea of inadmissibility, disputes, first, the admissibility of the actions only in so far as they were brought by the first applicant and, secondly, in the context of Case T‑584/18, the standing of the second applicant as regards the twenty-fifth plea seeking annulment of the decision on costs relating to the review procedure. The Commission supports that position.

97      In the first place, the applicants claim that the first applicant has standing to challenge the decisions of 26 March 2018 and of 17 July 2018, as the second applicant’s main shareholder with 85% of the voting rights, invoking the order of 12 September 2017, Fursin and Others v ECB (T‑247/16, not published, EU:T:2017:623).

98      Furthermore, the applicants submit that, in so far as the ECB accepts that the first applicant has standing in relation to the application for annulment of the decision on costs, since that decision is based on the unlawfulness of the decisions of 26 March 2018 and of 17 July 2018, it cannot be ruled out that it has standing to challenge the decision on costs. They then list the other separate interests that they claim the first applicant has, such as, inter alia, the interest in avoiding mandatory liquidation, the interest in having an opportunity to sell the bank to another investor, the interest in its own reputation as distinct from that of the bank, in addition to the financial impact that the withdrawal of the authorisation has on that applicant itself, which is distinct from that produced on the bank.

1.      Admissibility of the claim for annulment of the decision of 17 July 2018

99      In the first place, it should be noted that the second applicant has standing to bring the application for annulment of the decision of 17 July 2018. That applicant is the holder of the authorisation which has been withdrawn and the addressee of that decision. In addition, power of attorney has been given to the representatives by the former director general of the second applicant, without its validity being called into question by its liquidators. Furthermore, the ECB does not dispute the admissibility of the application for annulment of that decision in so far as it was brought by that applicant.

100    In the second place, as regards the first applicant, it should be recalled that the Court of Justice has ruled that the shareholders of a credit institution were not entitled to bring an action against a decision of the ECB withdrawing authorisation in so far as they were not directly affected by that decision. First, the Court of Justice considered that, following the withdrawal of authorisation, the credit institution was no longer in a position to continue its activity and, consequently, its ability to distribute dividends was questionable, but that this negative effect of the withdrawal was of an economic nature, whereas the right of the shareholders to receive dividends, just like their right to participate in the management of the company, was not affected by the withdrawal decision (see, to this effect, judgment of 5 November 2019, ECB and Others v Trasta Komercbanka and Others, C‑663/17 P, C‑665/17 P and C‑669/17 P, EU:C:2019:923, paragraph 111). Secondly, the Court of Justice found that, although the liquidation directly affected the shareholders’ right to participate in the management of the company, it did not constitute implementation of the decision of 17 July 2018, which is purely automatic and results from EU rules alone, for the purposes of the applicable case-law (see, to that effect, judgment of 5 November 2019, ECB and Others v Trasta Komercbanka and Others, C‑663/17 P, C‑665/17 P and C‑669/17 P, EU:C:2019:923, paragraphs 113 and 114).

101    Accordingly, the application for annulment of the decision of 17 July 2018 is admissible only as regards the second applicant.

2.      Admissibility of the application for annulment of the decision on costs

102    As regards the admissibility of the application for annulment of the decision on costs, it must be held that the first applicant has standing to bring such an action for annulment since it is the sole addressee of that decision which imposes on it an obligation to pay the costs of the review proceedings which it initiated and in which it alone participated. Moreover, the ECB does not dispute the admissibility of that application for annulment in so far as it was brought by that applicant.

103    By contrast, the second applicant, which chose not to bring a request for review before the ABoR, although it was entitled to do so, has no legal interest in bringing proceedings for annulment of the decision on costs, since that decision has no effect on it. Moreover, that applicant is not the addressee of that decision and cannot be regarded as being directly and individually concerned.

104    Accordingly, the application for annulment of the decision on costs is admissible only as regards the first applicant.

C.      Substance

105    In support of the action brought in Case T‑584/18, the applicants rely on 25 pleas in law: the first to twenty-fourth pleas in law are put forward in support of the application for annulment of the decision of 17 July 2018 and the twenty-fifth plea in law alleges the unlawfulness of the decision of 17 July 2018, in support of the application for annulment of the decision on costs. Having regard to their substance and nature, it is appropriate to group those pleas as follows:

–        the first, second, fourteenth, fifteenth and nineteenth pleas, alleging that the ECB had no power to adopt a decision concerning the withdrawal of authorisation and liquidation; to assess the issues relating to money laundering and the financing of terrorism; to refuse to permit self-liquidation, or to refuse to permit the second applicant to be sold to other potential investors. The nineteenth plea, which alleges misuse of powers, can also be included in this group of pleas, as its supporting arguments are the same as those put forward in the other abovementioned pleas alleging lack of power on the part of the ECB;

–        the third plea, alleging that the ECB failed in its duty to conduct a careful and impartial assessment;

–        the fourth and fifth pleas, alleging errors of assessment or failure to take into account certain relevant aspects of the case;

–        the sixth, twelfth and eighteenth pleas, alleging an error of assessment in so far as the ECB wrongly based its decision on breach of the FSA precept and infringement of the principle of legal certainty;

–        the seventh to eleventh, thirteenth to fifteenth and seventeenth pleas, alleging breach of the principle of proportionality;

–        the sixteenth and eighteenth pleas, alleging infringement of the principles of equal treatment, non-discrimination, the protection of legitimate expectations and legal certainty;

–        the twentieth to twenty-second pleas, alleging breaches of essential procedural requirements, and, more specifically, the right to be heard, the rights of the defence, and the duty to give reasons;

–        the twenty-third and twenty-fourth pleas in law, alleging, inter alia, infringement of the right of access to the second applicant’s file and of the shareholder’s rights in the context of the review procedure;

–        the twenty-fifth plea in law, advanced in support of the application for annulment of the decision on costs, alleging that the decision of 17 July 2018 was unlawful.

1.      The first, second, fourteenth, fifteenth and nineteenth pleas

106    In the first place, in their first, fourteenth and fifteenth pleas, the applicants claim that the ECB went beyond its powers in so far as it did not give the applicants the opportunity to liquidate the second applicant voluntarily, as is apparent in paragraph 3.3.2(b)(i) of the decision of 17 July 2018, when, given the fundamental allocation of responsibilities between NCAs and the ECB under the Single Supervisory Mechanism (SSM) and the Single Resolution Mechanism (SRM), it had no power to do so. The same submission is made in respect of the ECB’s refusal to permit the sale of the second applicant to another investor which had expressed a potential interest, as is apparent in paragraph 3.3.2(b)(ii) of that decision.

107    In the second place, the ECB was not competent to adopt a decision to withdraw authorisation since the FSA had already adopted, on 7 February 2018, the FOLTF decision, determining whether the credit institution was in a situation of ‘failing or likely to fail’, and had thus opted for resolution measures rather than withdrawal of authorisation, this decision being a matter for the FSA alone. The applicants also dispute the ECB’s assertion that that decision is irrelevant and confidential and therefore did not need to be communicated to them.

108    Furthermore, the applicants dispute the ECB’s argument that there was no formal request for self-liquidation of the second applicant. In their view, the ECB, in the decision of 17 July 2018, irrespective of such a request, refused to authorise self-liquidation, whereas it could have invited them to submit such a request or could have asked the FSA to take a decision on that issue. They submit that the only obstacle to self-liquidation was the preference expressed by the ECB for this not to take place. According to the applicants, the new ‘SSM/SRM’ regime has introduced a system of intervening early, well ahead of a bank actually failing, under which NCAs have an opportunity to determine whether the credit institution is failing or likely to fail. They then have to consider the availability of supervisory alternatives and, as their next step, whether resolution measures are in the public interest. The applicants submit that, if those NCAs considered that that was not the case, because the bank’s insolvency would not constitute a systemic problem, the analysis would end there as far as the current resolution regime is concerned. It then remains to be seen by the NCAs whether the entity judged likely to fail will actually do so. If it does, then the failure (that is, insolvency) can be dealt with appropriately by means of national insolvency proceedings. There is therefore no room for mandatory liquidation. On the other hand, that system does not affect the possibility of self-liquidation, which is recognised under all national law, provided that the company concerned is solvent.

109    In the third place, the applicants maintain that the ECB had no power to adopt the decision of 17 July 2018, on the basis that it rested entirely on alleged non-compliance with AML/CFT rules, for which the ECB is not the competent authority. The withdrawal of authorisation in the present case cannot be justified on prudential grounds, but served only to meet the desire of the FSA and the ECB for easy publicity.

110    In the fourth place, in the context of the second and, by implication, the third plea, the applicants criticise the ECB on the ground that it failed to assess the AML/CFT issues underlying the decision of 17 July 2018 and failed to verify the FSA’s assessments. The ECB cannot be responsible for the stability of credit institutions but artificially exclude from consideration entire areas that are sources of potential risk. In addition, any flaws in that decision which are due to the draft prepared by the FSA should be capable of being relied on in the context of an action for annulment of that decision.

111    Furthermore, the objective of restoring legality, pursued by the ECB in the decision of 17 July 2018, is not a legitimate objective as regards withdrawal of authorisation since authorisation may be withdrawn only in pursuit of prudential objectives. Nevertheless, while it is theoretically possible that AML/CFT issues may be relevant in connection with withdrawal of authorisation, to the extent that such issues give rise to prudential risks, the allocation of responsibilities between the NCAs and the ECB, as well as the principle of proportionality, require that the full range of AML/CFT measures (fines, prohibition on carrying out certain types of activity, criminal proceedings) has first been exhausted.

112    The ECB, supported by the Commission, disputes the applicants’ arguments.

113    It should be noted that, in the context of the present group of pleas, the applicants invoke, in essence, two pleas in law alleging, first, the lack of power on the part of the ECB to adopt the decision of 17 July 2018 and, secondly, misuse of powers. Before examining these, the Court considers it appropriate to recall the division of powers between the ECB and the NCAs.

(a)    The division of powers between the ECB and the NCAs of the Member States participating in the SSM concerning withdrawal of authorisation for infringement of AML/CFT rules

114    It is apparent from recitals 15 and 28 of the Basic SSM Regulation that the powers that are not conferred on the ECB remain vested in the NCAs.

115    In particular, recital 28 of the Basic SSM Regulation lists, among the ‘supervisory tasks not conferred on the ECB’ and which should remain with the national authorities, ‘the prevention of the use of the financial system for the purpose of money laundering and terrorist financing and consumer protection’.

116    However, Article 4(1) of the Basic SSM Regulation states that, ‘within the framework of Article 6, the ECB shall … be exclusively competent to carry out, for prudential supervisory purposes, the following tasks in relation to all credit institutions established in the participating Member States’. There follows a list of nine tasks, including authorisation and withdrawal of authorisation from credit institutions. Thus, under Article 4(1)(a) of that regulation, the power to withdraw authorisation is reserved exclusively to the ECB.

117    Article 4(3) of the Basic SSM Regulation provides that ‘for the purpose of carrying out the tasks conferred on it by [that] Regulation, and with the objective of ensuring high standards of supervision, the ECB shall apply all relevant Union law, and where the Union law is composed of Directives, the national legislation transposing those Directives. Where the relevant Union law is composed of Regulations and where currently those Regulations explicitly grant options for Member States, the ECB shall apply also the national legislation exercising those options’.

118    Article 6(2) of the Basic SSM Regulation states that ‘both the ECB and [NCAs] shall be subject to a duty of cooperation in good faith, and an obligation to exchange information’.

119    It is apparent from Article 6(4) of the Basic SSM Regulation that, with regard to the tasks defined in Article 4, with the exception of paragraph 1(a) and (c) of that regulation, the ECB and the NCAs are to have the responsibilities set out in paragraphs 5 and 6 of that article respectively. Under paragraph 6 of that article, NCAs are to carry out directly the supervision of less significant credit institutions, in accordance with the criteria laid down in that paragraph, and to inform the ECB, according to the framework referred to in paragraph 7 of that article, of measures taken pursuant to paragraph 6, and closely to coordinate those measures with the ECB.

120    However, it is apparent from Article 6(5)(b) to (d) of the Basic SSM Regulation that, first, ‘when necessary to ensure consistent application of high supervisory standards, the ECB may at any time, on its own initiative after consulting with [NCAs] or upon request by [an NCA], decide to exercise directly itself all the relevant powers for one or more credit institutions referred to in paragraph 4’, secondly, that the ECB is to exercise oversight over the functioning of the system, based on the responsibilities and procedures set out in that article and, thirdly, that it may at any time make use of the powers referred in Articles 10 to 13 of that regulation relating to the investigatory powers that the ECB may exercise directly.

121    Article 6(7) of the Basic SSM Regulation provides that the ECB is to adopt and make public a framework to organise the practical arrangements for the implementation of that article, constituting the legal basis for the adoption of the SSM Framework Regulation.

122    Article 14(5) of the Basic SSM Regulation provides:

‘Subject to paragraph 6, the ECB may withdraw the authorisation in the cases set out in relevant Union law on its own initiative, following consultations with the [NCA] of the participating Member State where the credit institution is established, or on a proposal from such [NCA]. These consultations shall in particular ensure that, before taking decisions regarding withdrawal, the ECB allows sufficient time for the national authorities to decide on the necessary remedial actions, including possible resolution measures, and takes these into account.

Where the [NCA] which has proposed the authorisation in accordance with paragraph 1 considers that the authorisation must be withdrawn in accordance with the relevant national law, it shall submit a proposal to the ECB to that end. In that case, the ECB shall take a decision on the proposed withdrawal taking full account of the justification for withdrawal put forward by the [NCA].’

123    Article 14(6) of the Basic SSM Regulation provides that ‘as long as national authorities remain competent to resolve credit institutions, in cases where they consider that the withdrawal of the authorisation would prejudice the adequate implementation of or actions necessary for resolution or to maintain financial stability, they shall duly notify their objection to the ECB explaining in detail the prejudice that a withdrawal would cause’, that ‘in those cases, the ECB shall abstain from proceeding to the withdrawal for a period mutually agreed with the national authorities’ and that ‘the ECB may extend that period if it is of the opinion that sufficient progress has been made. If, however, the ECB determines in a reasoned decision that proper actions necessary to maintain financial stability have not been implemented by the national authorities, the withdrawal of the authorisations shall apply immediately’.

124    Article 80 of the SSM Framework Regulation, entitled ‘NCAs’ proposal to withdraw an authorisation’, is worded as follows:

‘1.      If the relevant NCA considers that a credit institution’s authorisation should be withdrawn in whole or in part in accordance with relevant Union or national law, including a withdrawal at the credit institution’s request, it shall submit to the ECB a draft decision proposing the withdrawal of the authorisation (hereinafter a “draft withdrawal decision”), together with any relevant supporting documents.

2.      The NCA shall coordinate with the national authority competent for the resolution of credit institutions (hereinafter the “national resolution authority”) with regard to any draft withdrawal decision that is relevant to the national resolution authority.’

125    Under Article 81 of the SSM Framework Regulation:

‘1.      The ECB shall assess the draft withdrawal decision without undue delay. In particular, it shall take into account reasons for urgency put forward by the NCA.

2.      The right to be heard, as provided for in Article 31, shall apply.’

126    Article 83 of the SSM Framework Regulation provides:

‘1.      The ECB shall take a decision on the withdrawal of an authorisation without undue delay. In doing so it may accept or reject the relevant draft withdrawal decision.

2.      In taking its decision, the ECB shall take into account all of the following: (a) its assessment of the circumstances justifying withdrawal; (b) where applicable, the NCA’s draft withdrawal decision; (c) consultation with the relevant NCA and, where the NCA is not the national resolution authority, the national resolution authority (together with the NCA, the “national authorities”); (d) any comments provided by the credit institution pursuant to Articles 81(2) and 82(3).

3.      The ECB shall also take a decision in the cases described in Article 84 if the relevant national resolution authority does not object to the withdrawal of the authorisation, or the ECB determines that proper actions necessary to maintain financial stability have not been implemented by the national authorities.’

127    Article 84 of the SSM Framework Regulation provides:

‘1.      If the national resolution authority notifies its objection to the ECB’s intention to withdraw an authorisation, the ECB and the national resolution authority shall agree on a time period during which the ECB shall abstain from proceeding with the withdrawal of the authorisation. The ECB shall inform the NCA immediately after initiating contact with the national resolution authority in order to reach this agreement.

2.      After the expiry of the agreed time period, the ECB shall assess whether it intends to proceed to withdraw the authorisation or to extend the agreed time period in accordance with Article 14(6) of the [Basic] SSM Regulation, taking into account any progress made. The ECB shall consult with both the relevant NCA and the national resolution authority, if different from the NCA. The NCA shall inform the ECB of the measures taken by these authorities and its assessment of the consequences of a withdrawal.

3.      If the national resolution authority does not object to the withdrawal of an authorisation, or the ECB determines that proper actions necessary to maintain financial stability have not been implemented by national authorities, then Article 83 shall apply.’

128    Article 18 of Directive 2013/36, which sets out the cases in which NCAs may propose withdrawal of authorisation in respect of less significant institutions, is worded as follows:

‘The competent authorities may only withdraw the authorisation granted to a credit institution where such a credit institution:

…

(e)      falls within one of the other cases where national law provides for withdrawal of authorisation; or

(f)      commits one of the breaches referred to in Article 67(1).’

129    Article 67(1) of Directive 2013/36 provides:

‘This Article shall apply at least in any of the following circumstances:

…

(d)      an institution fails to have in place governance arrangements required by the competent authorities in accordance with the national provisions transposing Article 74;

(e)      an institution fails to report information or provides incomplete or inaccurate information on compliance with the obligation to meet own funds requirements set out in Article 92 of Regulation (EU) No 575/2013 [of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (OJ 2013 L 176, p. 1)] to the competent authorities in breach of Article 99(1) of that Regulation;

…

(o)      an institution is found liable for a serious breach of the national provisions adopted pursuant to Directive 2005/60/EC [of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing (OJ 2005 L 309, p. 15)];

…’

130    Article 74(1) of Directive 2013/36 provides that ‘institutions shall have robust governance arrangements, which include a clear organisational structure with well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks they are or might be exposed to, adequate internal control mechanisms, including sound administration and accounting procedures, and remuneration policies and practices that are consistent with and promote sound and effective risk management’.

131    It is apparent from the provisions referred to in paragraphs 115 to 118 above that the SSM centralises functions relating to prudential supervision with the ECB, while providing for decentralised implementation by the NCAs of the participating Member States, under the supervision of the ECB, to which they provide their cooperation and assistance. Thus, within the SSM, first, the ECB exercises certain exclusive powers: ‘direct’ prudential supervision of significant credit institutions and the powers reserved to it under Article 4 of the Basic SSM Regulation with regard to all institutions, irrespective of their size. Secondly, the prudential supervision of less significant institutions is part of the decentralised exercise of power by those NCAs and is overseen and supervised, as a last resort, by the ECB, whose task is to ensure the proper functioning and effectiveness of the prudential supervision system and the consistent and uniform application of prudential rules in all participating Member States. The ECB carries out ‘indirect’ supervision of less significant institutions and, in that context, NCAs provide their cooperation and assistance to the ECB. In addition, the same NCAs remain competent in respect of matters not covered by the Basic SSM Regulation: consumer protection, markets in financial instruments, AML/CFT, and the fight against corruption.

132    More specifically, within the SSM, the overall scheme of Article 6(4) to (6) of the Basic SSM Regulation establishes a differentiation between prudential supervision of ‘significant’ entities and that of entities classified as ‘less significant’ in relation to seven of the nine tasks listed in Article 4(1) of that regulation.

133    It follows therefrom, in the first place, that the exclusive competence for the prudential supervision of ‘significant’ entities falls to the ECB. The same holds true for the prudential supervision of ‘less significant’ entities in relation to the task listed in Article 4(1)(a) of the Basic SSM Regulation concerning the authorisation and withdrawal of authorisation to credit institutions.

134    In the second place, regarding ‘less significant’ entities and the other tasks listed in Article 4(1) of the Basic SSM Regulation, it is apparent from a combined reading of Article 6(5) and (6) of that regulation that their implementation is conferred, under the ECB’s control, on the NCAs of participating Member States, which thus carry out the direct prudential supervision of those entities.

135    The Court has previously held that it was apparent from the examination of the interaction between Article 4(1) and Article 6 of the Basic SSM Regulation, as discussed in paragraphs 116 to 121 above, that the logic of the relationship between them consisted in allowing the exclusive powers delegated to the ECB to be implemented within a decentralised framework, rather than having a distribution of powers between the ECB and the NCAs of participating Member States in the performance of the tasks referred to in Article 4(1) of that regulation. That finding is supported by a reading of the recitals of that regulation. First, it is apparent from recitals 15 and 28 of the Basic SSM Regulation that only those tasks explicitly entrusted to the ECB fall outside the competence of the Member States and that prudential supervision of financial institutions on grounds other than those listed in Article 4(1) of that regulation continues to come within the competence of the Member States. It necessarily follows that it is at the stage of the definition of the tasks entrusted to the ECB by Article 4(1) of the Basic SSM Regulation that the distribution of powers between the ECB and the NCAs was carried out. Secondly, it should be noted that, although recital 28 of the Basic SSM Regulation provides a list of the supervisory tasks that are to remain within the remit of the national authorities, it does not include any of the tasks listed in Article 4(1) of that regulation. Nor does that recital present direct supervision of less significant entities as constituting the exercise of a competence coming within the remit of the national authorities (see, to that effect, judgment of 16 May 2017, Landeskreditbank Baden-Württemberg v ECB, T‑122/15, EU:T:2017:337, paragraphs 54 to 57).

136    In the third place, within the SSM composed of the ECB and the NCAs of participating Member States, first, it is apparent from the scheme of Article 6(2) and (3) of the Basic SSM Regulation that both the ECB and those NCAs are bound by the duty of cooperation and the obligation to exchange information. In particular, under the second subparagraph of Article 6(2) of that regulation, ‘the [NCAs] shall in particular provide the ECB with all information necessary for the purposes of carrying out the tasks conferred on the ECB by [that] Regulation’. In addition, under paragraph 3 of that article, it is for those NCAs to assist the ECB in preparing and implementing any acts relating to the tasks mentioned in Article 4 of that regulation and related to all credit institutions, inter alia by assisting it in its verification activities.

137    It has previously been held that the supervision of institutions classified as ‘less significant’ was referred to in recitals 38 to 40 of the Basic SSM Regulation, more specifically directly after recital 37 thereof, which states that ‘[NCAs] should be responsible for assisting the ECB in the preparation and implementation of any acts relating to the exercise of the ECB supervisory tasks’ and that ‘this should include, in particular, the ongoing day-to-day assessment of a credit institution’s situation and related on-site verifications’. The arrangement of the recitals of the Basic SSM Regulation suggests that direct prudential supervision by the NCAs under the SSM was envisaged by the Council of the European Union as a mechanism of assistance to the ECB rather than as the exercise of autonomous competence (judgment of 16 May 2017, Landeskreditbank Baden-Württemberg v ECB, T‑122/15, EU:T:2017:337, paragraph 58).

138    Secondly, the exercise of that direct prudential supervision by the NCAs is overseen by the ECB, which, under Article 6(5)(a) and (b) of the Basic SSM Regulation, has the competence to communicate to those authorities ‘regulations, guidelines or general instructions to [NCAs] according to which the tasks defined in Article 4 [of that regulation] are performed’ and to ‘decide to exercise directly itself all the relevant powers for one or more credit institutions’. Moreover, the overseeing by the ECB of the direct supervision exercised by the NCAs gives rise (i) to the supervisory powers provided for in Article 6(5)(c) of that regulation, which refers to Article 6(7)(c) thereof and (ii) to the supervisory and investigatory powers, provided for in Articles 10 to 13 of that regulation, which the ECB may decide to exercise directly in respect of less significant credit institutions under Article 4(6)(d) of that regulation.

139    Thus, it should be noted that the ECB retains important prerogatives even when the NCAs perform the supervisory tasks laid down in Article 4(1)(b) and (d) to (i) of the Basic SSM Regulation, and that the existence of such prerogatives is indicative of the subordinate nature of the intervention by the national authorities in the performance of those tasks (judgment of 16 May 2017, Landeskreditbank Baden-Württemberg v ECB, T‑122/15, EU:T:2017:337, paragraph 59).

140    In the fourth place, as regards, in particular, the withdrawal of authorisation from a credit institution, provided for in Article 4(1)(a) of the Basic SSM Regulation, the cooperation between the ECB and NCAs is expressed, in accordance with Article 14(5) of that regulation, first, by the obligation to consult those NCAs, in the event that the ECB withdraws the authorisation on its own initiative and, secondly, in the possibility that those authorities have to propose such a withdrawal to the ECB.

141    Where an NCA, pursuant to Article 14(5) of the Basic SSM Regulation, proposes the withdrawal of authorisation, the ECB, in accordance with the second subparagraph of that provision and Article 83(2) of the SSM Framework Regulation, must take full account of the justification for withdrawal put forward by that NCA, of consultations with the NCA and, where appropriate, with the national resolution authority, as well as the observations of the credit institution in question. It must also carry out its own examination as to whether there are circumstances justifying the withdrawal and thus decide whether to accept or reject the draft decision withdrawing the NCA’s authorisation.

142    In the fifth place, it should be noted that it is apparent from recitals 28 and 29 of the Basic SSM Regulation that the task of preventing the use of the financial system for the purposes of money laundering and terrorist financing remains a national competence and that the ECB has, in that regard, a duty of cooperation vis-à-vis the national authorities.

143    In the sixth place, as regards the link between AML/CFT and prudential supervision, it should be noted that, among the circumstances justifying withdrawal of a banking authorisation, first, Article 18(f) of Directive 2013/36 mentions the breaches referred to in Article 67(1) of that directive, which include serious breaches of the national provisions adopted pursuant to Directive 2005/60 on the prevention of the use of the financial system for the purposes of money laundering and terrorist financing. Secondly, Article 18(e) of that directive mentions the other cases in which national law provides for withdrawal of authorisation.

144    In that regard, it should be noted that, although Article 18 of Directive 2013/36 refers to the power of NCAs to withdraw authorisations, in view of the distribution of tasks between those NCAs and the ECB, provided for in Article 4 of the Basic SSM Regulation, and particularly in view of the fact that the power to withdraw authorisation has become an exclusive competence of the ECB, which the ECB may exercise, pursuant to Article 14(5) of that regulation, on a proposal from an NCA, Article 18 of that directive must be understood as referring to the power to propose the withdrawal of authorisation, which remains with the NCAs.

145    In the seventh place, as regards the interactions between the SSM and the SRM, it is apparent from recital 11 of Regulation (EU) No 806/2014 of the European Parliament and of the Council of 15 July 2014 establishing uniform rules and a uniform procedure for the resolution of credit institutions and certain investment firms in the framework of a Single Resolution Mechanism and a Single Resolution Fund and amending Regulation (EU) No 1093/2010 (OJ 2014 L 255, p. 1; ‘the SRM Regulation’) that supervision and resolution are two complementary aspects of the European Banking Union and, therefore, as a matter of principle, are not alternatives.

146    It should be noted that the objectives of the SSM and of the SRM are different. As recital 7 of the SRM Regulation states, the SSM seeks to ensure a policy of micro-prudential supervision of credit institutions at European level and its coherent and effective implementation in all euro area Member States and in Member States which are not part of the euro area but which wish to participate. It also relates to macro-prudential supervision and, ultimately, to the financial stability of the European Union. By contrast, the essential tasks of the SRM are managing crisis situations that have already arisen and creating more efficient resolution mechanisms in order to prevent the harmful consequences of bank failures from spreading, following uniform rules and procedures, as is apparent from recitals 6 and 8 and Article 1 of that regulation. Thus, while the two systems work together towards the ultimate goal of soundness and stability of the EU financial system, the SSM acts to prevent crises, whereas the SRM acts to resolve crises.

147    In the eighth place, the failing or likely to fail declarations which may be issued by the ECB or by the Single Resolution Board (SRB), in the case of significant credit institutions, or by NCAs or by national resolution authorities, in the case of less significant credit institutions, as is apparent from Article 7(3) of the SRM Regulation, are preparatory acts which precede, but which do not necessarily entail the adoption of, a resolution scheme. The adoption of the latter comes within the exclusive competence of the SRB or the national resolution authorities, depending on the size of the credit institution.

148    Moreover, the failing or likely to fail assessments do not in any way constitute formal decisions on the failure of a credit institution to fulfil its regulatory obligations, but are preparatory acts which do not alter the legal situation of the credit institution in question. Those acts set out a factual assessment carried out by the ECB (or by the NCA) as to whether that institution is failing or likely to fail, which is in no way binding, but which constitutes the basis for the adoption, by the SRB (or by the national resolution authority), of resolution schemes or decisions establishing that resolution is not in the public interest (see, to that effect, order of 6 May 2019, ABLV Bank v ECB, T‑281/18, EU:T:2019:296, paragraphs 36, 48 and 49).

149    It is apparent from Article 18(1) of the SRM Regulation that such a scheme is to be adopted only if certain conditions are met. In particular, not only must the credit institution be in a situation where it is failing or likely to fail, but there must be no reasonable prospect that other private measures or supervisory action would prevent its failure within a reasonable time frame. Moreover, a resolution measure must be necessary in the public interest.

150    In that regard, according to the case-law, pursuant to recital 26 of the SRM Regulation, although the ECB (and by analogy, the NCAs) and the SRB (and, by analogy, the national resolution authorities) must be in a position to assess whether a credit institution is failing or likely to fail, it is for the SRB alone (and, by analogy, the national resolution authorities) to assess the conditions required for a resolution and to adopt a resolution scheme if it considers that all the conditions are met, as is also explicitly stated in Article 18(1) of the SRM Regulation. While the ECB (and, by analogy, the NCAs) has the power to communicate an assessment relating to the first condition, namely whether the entity is failing or likely to fail, this nevertheless constitutes a mere assessment, which does not in any way bind the SRB (and, by analogy, the national resolution authorities) (see, to that effect, order of 6 May 2019, ABLV Bank v ECB, T‑281/18, EU:T:2019:296, paragraph 34).

151    In the ninth place, it is apparent from recital 57 of the SRM Regulation, first, that the fact that an entity does not fulfil the conditions for authorisation should not in itself justify the opening of a resolution procedure, especially if the entity remains or is likely to remain viable. Secondly, an entity must be considered to be failing or likely to fail if it infringes or is likely, in the near future, to infringe the requirements for continuing authorisation.

152    There is no functional equivalence between a failing or likely to fail assessment and a withdrawal of authorisation. While it is true that such an assessment may be based on a finding that the conditions for continuing authorisation are no longer satisfied under Article 18(4)(a) of the SRM Regulation, those two acts are in no way equivalent. In that regard, it is sufficient to note that the conditions for withdrawal of authorisation set out in Article 18 of Directive 2013/36 differ clearly from the considerations underlying the failing or likely to fail assessment, as set out in Article 18(4) of that regulation (order of 6 May 2019, ABLV Bank v ECB, T‑281/18, EU:T:2019:296, paragraph 46).

153    It is in the light of those considerations that the present group of pleas in law must be examined.

(b)    The first part, concerning the ECB’s lack of competence to withdraw authorisation from a credit institution, where the NCA had already issued a failing or likely to fail declaration

154    In the present case, in the first place, it should be noted that the decision of 17 July 2018 concerns the withdrawal of the second applicant’s authorisation to operate as a credit institution due to breaches of the provisions of Estonian national law which penalise, by that measure, a lack of AML/CFT governance arrangements and an effective AML/CFT system, failure to comply with an instruction issued by the NCA and the communication of misleading information or documents.

155    In the second place, it should be noted that the ECB adopted the decision of 26 March 2018, then the decision of 17 July 2018, on a proposal from the FSA, the Estonian NCA, pursuant to Articles 4(1)(a) and 14(5) of the Basic SSM Regulation and Article 83(1) of the SSM Framework Regulation.

156    In the third place, in the context of such a decision and the decentralised implementation of its exclusive competence to withdraw authorisation, given that the second applicant is a less significant credit institution, the ECB was required, under Article 14(5) of the Basic SSM Regulation and Article 83(2)(b) and (c) of the SSM Framework Regulation, to take full account of the justification for withdrawal, put forward by that NCA, and to cooperate with the NCA through consultations regarding any resolution measures that the national resolution authority considered necessary.

157    In the fourth place, it is apparent from paragraph 3.2(d) of the decision of 17 July 2018 that the FSA, which is, in Estonia, both the NCA under the SSM and the national resolution authority under the SRM (Article 3 of the Estonian Law on the prevention and resolution of financial crises), adopted, on 10 April 2017, the FOLTF decision on the ground that the second applicant had committed a number of breaches of the conditions required for authorisation, meaning that the authorisation could have been withdrawn, as provided for in recital 57 of the SRM Regulation.

158    According to recital 57 of the SRM Regulation, an entity must be considered to be failing or likely to fail if it infringes or is likely to infringe the requirements for continuing authorisation.

159    Next, it is apparent from paragraph 3.1(b) of the decision of 17 July 2018 that, on 7 February 2018, the FSA, acting in its capacity as national resolution authority, adopted a decision establishing that a resolution was not in the public interest. It is that decision that the applicants refer to in their written submissions as the ‘second FOLTF decision’.

160    Thus, although the FSA adopted the FOLTF decision, for which it was competent, and, consequently, the first condition laid down in Article 18(1)(a) of the SRM Regulation for the adoption of a resolution scheme was satisfied, there was considered to be no public interest in implementing resolution measures and, therefore, the third condition laid down in Article 18(1)(c) of that regulation was not satisfied. Accordingly, in the present case, that decision did not lead the national resolution authority (the FSA) to adopt a resolution scheme, since the conditions required were not cumulatively satisfied.

161    By contrast, it is apparent from paragraph 3.1(c) of the decision of 17 July 2018 that, on 6 March 2018, the FSA adopted a proposal for a decision withdrawing authorisation and that, following receipt of that proposal, the ECB gave the second applicant the opportunity to submit its observations on that proposal, before then adopting the decision of 26 March 2018, and then that of 17 July 2018, which is based on justifications and factual assessments and the results of verifications and inspections carried out by the FSA.

162    First, the ECB was correct to take the view, in paragraph 2.1 of the decision of 17 July 2018, that it was exclusively competent to adopt a decision on the withdrawal of authorisation. Such a conclusion is consistent with, on the one hand, Articles 4(1)(a) and 14(5) of the Basic SSM Regulation and Article 83 of the SSM Framework Regulation and, on the other, the case-law referred to in paragraph 135 above.

163    Secondly, it was in accordance with the division of powers between the NCAs of the participating Member States and the ECB under the SSM, the applicable provisions and the case-law, as referred to in paragraphs 136, 137, 140 and 141 above, that the FSA submitted to the ECB a proposal for a decision to withdraw authorisation and that the ECB relied on the grounds set out in that proposal as the basis for its own decision.

164    Since the second applicant is a less significant credit institution, on the one hand, it was for the FSA, that is to say, the Estonian NCA, to carry out the necessary factual verifications and to assist the ECB in the preparation and implementation of any acts related to the tasks referred to in Article 4 of the SSM Regulation, including the decision to withdraw authorisation.

165    On the other hand, in accordance with the provisions and case-law referred to in paragraphs 138 and 139 above, the ECB had the power to oversee the direct supervision carried out by the FSA, which the ECB exercised, in the present case, by carrying out a number of consultations with the FSA, particularly from April 2017 onwards, and after the last inspection, as the ECB confirmed at the hearing.

166    Thirdly, the ECB certainly had the power to adopt the decision of 17 July 2018, notwithstanding and independently of the decisions relied on by the applicants.

167    In that regard, the applicants’ arguments that the ECB lacked competence to adopt the decision of 17 July 2018, since the NCA had adopted a decision that the second applicant was failing or likely to fail, are based on a misreading of the interaction between the SSM, on the one hand, and the SRM, on the other hand, and from certain factual errors.

168    The applicants submit, in essence, that the SSM and the SRM are alternative systems, that, contrary to what was previously provided for under national law, the failure to adopt a resolution measure does not mean that the credit institution is to be liquidated under national law and that the ECB, following a FOLTF decision, does not have the power to decide to withdraw authorisation.

169    However, contrary to what the applicants claim, the FSA did not adopt two decisions, but rather, on the one hand, the FOLTF decision, namely a failing or likely to fail declaration, on 10 April 2017 and, on the other hand, in its role as the national resolution authority, a decision establishing that a resolution was not in the public interest, on 7 February 2018, as is clear from the decision of 17 July 2018, the passages of which are referred to in paragraphs 157 and 159 above.

170    The acts in question are distinct, with a failing or likely to fail declaration being one of the preconditions for adopting a final resolution decision, namely a resolution scheme under Article 18(6) of the SRM Regulation. That condition is, however, a necessary, but not sufficient, condition for the adoption of a resolution measure, as is apparent from paragraph 149 above.

171    That interpretation has been confirmed by the case-law referred to in paragraph 148 above, according to which a failing or likely to fail declaration contains an assessment of the facts by the NCA as to whether that institution is failing or likely to fail, which is in no way binding, but which forms the basis for the adoption, by the national resolution authority, of resolution mechanisms or decisions establishing that a resolution is not in the public interest.

172    It is a decision of that second type that the FSA, acting in its capacity as national resolution authority, adopted in this case.

173    Contrary to what is claimed by the applicants, such a decision in no way prohibits the ECB from subsequently adopting a decision withdrawing authorisation.

174    On the contrary, it must be held that, in so far as the failing or likely to fail declaration, which may be adopted, inter alia, where the conditions for withdrawal of authorisation are satisfied, as is apparent from recital 57 of the SRM Regulation and as also acknowledged by the second applicant, and which may be used as the basis for the adoption of a resolution measure, does not give rise to such a measure, according to the national resolution authority, which is competent to adopt it under Article 7(3)(e) of that regulation (in respect of a less significant credit institution), the ECB may decide to withdraw the authorisation of the credit institution which no longer meets the conditions for continuing authorisation.

175    Although the SRM shares the same task as that referred to under the SSM of protecting the stability and safety of the European Union’s financial system, and is therefore complementary to the latter, as is apparent from recital 11 of the SRM Regulation, it is nevertheless intended to be applied where an entity is insolvent or at risk of becoming insolvent and is aimed at managing financial crises once they have arisen, as is apparent from recital 7 of that regulation.

176    That conclusion is confirmed, moreover, by recital 57 of the SRM Regulation, according to which ‘the fact that an entity does not meet the requirements for authorisation should not justify per se the entry into resolution, especially if the entity remains or is likely to remain viable’ and by the case-law referred to in paragraph 152 above.

177    The measures adopted under the SSM and the SRM could be mutually exclusive, as claimed by the applicants, only where an entity no longer satisfies the conditions for continuing authorisation and, in addition, is no longer solvent.

178    In that case alone, the ECB would have to give priority to a resolution measure adopted by the SRB or by a national resolution authority (depending on the size of the credit institution), under the coordination and cooperation mechanism with those other authorities, outlined in Article 14(5) and (6) of the Basic SSM Regulation and in Articles 83(3) and 84 of the SSM Framework Regulation. In addition, the ECB is required, under Article 83(2) of that framework regulation, to take due account of consultations with national resolution authorities before adopting its decision to withdraw authorisation.

179    The coexistence of the SSM and the SRM cannot be understood as precluding the possibility for the competent authority for prudential supervision, namely the ECB, to withdraw authorisation, in the absence of the conditions required for adopting a resolution measure, namely where the credit institution in question is not at risk of becoming unviable.

180    That would amount to exempting credit institutions which are financially sound from the obligation to comply with the other prudential rules imposed on them for the purposes of maintaining their authorisation.

181    As regards the applicants’ argument that the ‘FOLTF decisions’ should have been communicated to them, suffice it to note that the final decision by which the national resolution authority established that there was no public interest in a resolution and the failing or likely to fail declaration of the FSA form part of a procedure that is distinct from that which led to the decision of 17 July 2018 and, therefore, the absence of notification of the FOLTF decision to the second applicant has no bearing on the lawfulness of the decision of 17 July 2018. Moreover, in so far as the grounds on which the FOLTF decision is based are the same as the grounds given in the FSA’s proposal for a decision to withdraw authorisation, as set out again in the decision of 17 July 2018, those grounds must be regarded as being known to that applicant, which is the addressee of those decisions.

182    Furthermore, in view of the precisions provided in paragraphs 173 to 180 above relating to the interactions between the SSM and SRM systems, it must be held that the applicants’ arguments concerning the reference in the decision of 17 July 2018 to a provision of national law allegedly repealed by the entry into force of those two systems, and in particular to Article 118 of the Estonian Law on Credit Institutions, are ineffective.

183    It follows from all of the foregoing that the present part cannot be upheld.

(c)    The second part, concerning the ECB’s lack of competence to assess matters relating to AML/CFT

184    The applicants challenge, in essence, the ECB’s power to adopt a decision withdrawing authorisation on the ground of infringement of AML/CFT provisions, an area in which it lacks competence. By contrast, withdrawal of authorisation may be justified solely on prudential grounds.

185    In the first place, as can be seen from Article 67 of Directive 2013/36, withdrawal of authorisation is also provided for where a credit institution fails to comply with AML/CFT requirements. Thus, compliance with such obligations is clearly relevant in the context of prudential supervision, since, as underlined in recitals 1 and 2 of Directive 2005/60, the use of the financial system for money laundering purposes is likely to threaten the stability, integrity and reputation of the financial system and of the single market.

186    The fact that the wording of Article 18 of Directive 2013/36 also mentions the power of national supervisory authorities to withdraw authorisation cannot call into question the intention of the EU legislature as reflected in the provisions of the Basic SSM Regulation currently in force.

187    Although the Member States remain competent to implement the AML/CFT provisions, as expressly provided for in recital 28 of the Basic SSM Regulation, the ECB has exclusive competence to withdraw authorisation, for all credit institutions, irrespective of their size, even where such competence is based, as in the present case, on the grounds set out in Article 67(1)(d), (e) and (o) of Directive 2013/36, to which Article 18 of that directive refers, since Article 14(5) of that regulation lays down, as a condition for the withdrawal of authorisation, the existence of one or more grounds justifying withdrawal under Article 18 of that directive. Thus, the applicants cannot properly question, on that ground, the ECB’s competence to adopt the decision of 17 July 2018.

188    In the second place, as regards the grounds for the withdrawal of authorisation in the present case, the applicants cannot validly dispute that those grounds correspond to some of the grounds justifying the withdrawal of authorisation, in particular those set out in Article 18(e) and (f) of Directive 2013/36, as required by Article 14(5) of the Basic SSM Regulation. In particular, Article 18(f) of that directive concerns breaches by a credit institution, as referred to in Article 67(1) of that directive.

189    In the present case, the second applicant was found, in the decision of 17 July 2018, to have committed the infringements listed in Article 67(1)(d), (e) and (o) of Directive 2013/36. Those breaches concern, respectively, the absence of governance arrangements required by the NCAs in accordance with the national provisions transposing Article 74 of that directive, failing to report information or providing incomplete or inaccurate information concerning compliance with the obligation to meet own funds requirements to the NCAs, and the commission of a serious breach of the national provisions adopted under Directive 2005/60 concerning AML/CFT.

190    Consequently, and also in the light also of the considerations set out in paragraphs 185 and 187 above, the applicants’ arguments concerning the ECB’s lack of competence to withdraw an authorisation on grounds of AML/CFT infringements must be rejected.

191    Furthermore, it is appropriate to reject the applicants’ more specific argument that, owing to the division of powers between the NCAs of the participating Member States and the ECB under the SSM, together with the principle of proportionality, the full range of other available measures (fines, prohibition on carrying out certain types of activity, criminal proceedings) must first be exhausted before an authorisation is withdrawn on grounds of infringements of the AML/CFT legislation.

192    It is apparent from the documents before the Court that the FSA gave the second applicant a number of opportunities to comply with the AML/CFT regulatory requirements, as is apparent from paragraphs 25, 26 and 29 above, including the FSA’s adoption of a precept, with which that applicant also failed to comply. In those circumstances, the applicants cannot validly claim that the ECB adopted a decision to withdraw authorisation prematurely or in breach of the principle of proportionality.

193    In the third place, in so far as the implementation and monitoring of a credit institution’s compliance with the AML/CFT provisions undoubtedly come within the competence of the national authorities, and since, in the present case, it was the FSA which exercised that competence, the applicants cannot validly claim that the ECB infringed the powers of the FSA.

194    First, it is in accordance with the division of powers between the NCAs of the participating Member States and the ECB under the SSM, as highlighted in paragraphs 131, 136, 137 and 140 above and, in particular, with the decentralised exercise of exclusive powers in relation to withdrawal of authorisation, recognised by the case-law referred to in paragraph 135 above, that the FSA fulfilled its duty to provide cooperation and assistance to the ECB, as provided for in the second subparagraph of Article 6(2) and in Article 6(3) of the Basic SSM Regulation, (i) by carrying out the necessary physical checks and inspections, (ii) by entering into communication with the credit institution in question in order to resolve the problems at an early stage, including by consulting the FSA in its role as the national resolution authority, and (iii) by preparing a draft decision on the withdrawal of authorisation, pursuant to Article 14(5) of the Basic SSM Regulation.

195    Secondly, the applicants cannot validly claim that the ECB based the decision of 17 July 2018 on that proposal, by the FSA, for a decision withdrawing authorisation, since, when an NCA proposes the withdrawal of authorisation to the ECB, it is apparent from the second subparagraph of Article 14(5) of the Basic SSM Regulation and from Article 83(2) of the SSM Framework Regulation, that the ECB is required to take full account of the grounds put forward by the NCA to justify that withdrawal.

196    Furthermore, it should be noted that the ECB also requested the second applicant’s observations on the FSA’s draft decision withdrawing authorisation and took those observations into account, in accordance with Article 83(2)(d) of the SSM Framework Regulation.

197    It was therefore without disregarding the division of powers between the NCAs of the participating Member States and the ECB under the SSM that, in the present case, the facts constituting breaches of the AML/CFT legislation were established by the FSA, whereas the legal assessment of whether those facts justified withdrawal of authorisation and the assessment of proportionality were reserved for the ECB.

198    Furthermore, in the light of the foregoing, the arguments, put forward by the applicants in the context of the present group of pleas, concerning the lack of organised institutional expertise within the ECB in relation to AML/CFT matters, are ineffective.

199    In the light of the foregoing, the present part must be rejected.

(d)    The third part, concerning the lack of power of the ECB to refuse to permit self-liquidation or sale of the second applicant to another investor

200    The applicants complain, in essence, that the ECB adopted a decision refusing to permit the self-liquidation of the second applicant or the sale of the credit institution to other investors.

201    As a preliminary point, as regards the self-liquidation of the second applicant, it should be noted that, under Article 117 of the Estonian Law on Credit Institutions, in order to self-liquidate, a credit institution must submit an application for voluntary liquidation to the FSA, which is therefore the authority competent to either accept or reject such an application.

202    It is apparent from the documents before the Court, first, that the second applicant does not claim to have lodged an application for self-liquidation and, secondly, that it criticises the ECB for not having given it the opportunity to do so. The fact remains that that applicant did not submit such an application. Furthermore, the ECB is certainly not required to encourage a credit institution to submit an application for self-liquidation to a national authority and the ECB is not competent to take a formal decision accepting or rejecting such a self-liquidation application, as the parties acknowledge.

203    It follows that the applicants’ arguments are relevant only in so far as they are directed at the ECB’s assessment, in paragraph 3.3.2 of the decision of 17 July 2018, of the proportionality of the decision to withdraw authorisation, and will be considered in the context of the analysis of the proportionality of that withdrawal (see paragraphs 306 to 344 below). The same applies to the arguments relating to the ECB’s lack of competence to prevent the sale of the credit institution to other investors, put forward in the context of the fifteenth plea in the application.

204    In the light of the foregoing, the present part must be rejected.

(e)    The fourth part, concerning misuse of powers

205    In support of the present part, the applicants submit, in essence, that the ECB did not allow the self-liquidation of the second applicant (or its sale to other investors or other less onerous measures) and withdrew that applicant’s authorisation for reasons unrelated to prudential supervision, and did so, in particular, for the positive publicity which it allegedly created for the ECB and the FSA, in disregard of recital 75 and Article 19 of the Basic SSM Regulation, which require the ECB to perform its tasks independently of any political influence.

206    The ECB, supported by the Commission, contends that the present plea is manifestly unfounded.

207    As a preliminary point, it should be noted that, according to recital 75 of the Basic SSM Regulation, ‘in order to carry out its supervisory tasks effectively, the ECB should exercise the supervisory tasks conferred on it in full independence, in particular free from undue political influence and from industry interference which would affect its operational independence’.

208    It is apparent, moreover, from recital 15 of the Basic SSM Regulation that specific supervisory tasks which are crucial to ensuring a consistent and effective implementation of EU policy relating to the prudential supervision of credit institutions should be conferred on the ECB, including the adoption of measures taken in pursuance of macro-prudential stability, subject to specific arrangements reflecting the role of national authorities. Article 19(1) of that regulation is worded as follows:

‘When carrying out the tasks conferred on it by this Regulation, the ECB and the [NCAs] acting within the SSM shall act independently. The members of the Supervisory Board and the steering committee shall act independently and objectively in the interest of the Union as a whole and shall neither seek nor take instructions from the institutions or bodies of the Union, from any government of a Member State or from any other public or private body.’

209    Furthermore, it is apparent from settled case-law that the concept of misuse of powers refers to cases where an administrative authority has used its powers for a purpose other than that for which they were conferred on it. A decision may amount to a misuse of powers only if it appears, on the basis of objective, relevant and consistent factors, to have been taken for such a purpose. In addition, where more than one aim is pursued, even if the grounds of a decision include, in addition to proper grounds, an improper one, that would not make the decision invalid for misuse of powers, provided that the decision does not cease to pursue the main aim (see judgment of 13 December 2017, Crédit mutuel Arkéa v ECB, T‑52/16, EU:T:2017:902, paragraph 210 and the case-law cited).

210    In the present case, it is sufficient to note that the applicants have failed to prove that, in adopting the decision of 17 July 2018, the ECB pursued an aim other than the performance of its task of prudential supervision of credit institutions. In addition, they have not submitted any evidence capable of demonstrating a possible lack of independence on the part of the ECB, in breach of Article 19 of the Basic SSM Regulation.

211    In any event, the decision of 17 July 2018 is based on a number of the grounds for withdrawal of authorisation provided for in Article 18 of Directive 2013/36, which relate to serious breaches of AML/CFT legislation. It follows that the statement of reasons for that decision is consistent with the objectives pursued by the supervisory tasks entrusted to the ECB.

212    Consequently, the present part must also be rejected.

213    The present group of pleas must therefore be rejected in its entirety.

2.      The third plea, alleging that the ECB failed in its duty to conduct a careful and impartial assessment

214    According to the applicants, the ECB failed carefully and impartially to assess all the relevant aspects of the case. However, they merely complain that the ECB simply accepted the conclusions of the FSA, which were based on misleading information provided by that NCA, without carrying out its own examination of the reasons underlying the draft decision to withdraw authorisation.

215    The ECB disputes the applicants’ arguments.

216    According to settled case-law, the duty of diligence entails an obligation on the part of the institution concerned to examine carefully and impartially all the relevant aspects of the individual case (see, to that effect, judgments of 21 November 1991, Technische Universität München, C‑269/90, EU:C:1991:438, paragraph 14, and of 16 September 2013, ATC and Others v Commission, T‑333/10, EU:T:2013:451, paragraph 84).

217    In the present case, first, it must be noted, as observed by the ECB, that the decision of 17 July 2018 contains a full and clear statement of the reasons justifying the withdrawal which (i) is based on the FSA’s assessments as the NCA for the prudential supervision of the second applicant (as a less significant credit institution) and (ii) relates to an independent assessment on the part of the ECB regarding compliance with the other conditions for deciding to withdraw authorisation, including the assessment of the proportionality of the withdrawal measure.

218    Secondly, such a criticism formulated in general terms with regard to an alleged lack of diligence and impartiality on the part of the ECB cannot be upheld unless it challenges in detail any alleged shortcomings of the ECB in the adoption of the decision of 17 July 2018.

219    Thirdly, it should be noted, as observed by the ECB, that the FSA’s findings regarding breaches, which have not been properly challenged by the second applicant, had to be treated by the ECB as established facts and as not requiring, for that reason, a review by the ECB. Thus, the Commission rightly confined itself to verifying whether those breaches did indeed constitute grounds justifying the withdrawal of authorisation. That examination was carried out in paragraphs 3.3.1 and 3.3.2 of the decision of 17 July 2018.

220    Fourthly, the applicants’ mere allegations that the ECB simply relied on the NCA’s conclusions must also be rejected for the same reasons as those set out in paragraphs 194 to 198 above.

221    Furthermore, it must be stated that the applicants’ assertion that the decision of 17 July 2018 is based on misleading information provided by the FSA is a bald assertion which is not supported by any evidence and must therefore be rejected.

222    It follows from the foregoing that the third plea must be rejected.

223    In so far as the third plea alleges errors of assessment in the FSA’s proposed decision, it should be recalled that the Court of Justice has recently held that, where EU law does not aim to establish a division between two powers – one national and the other of the European Union – with separate purposes, but, on the contrary, lays down that an EU institution is to have an exclusive decision-making power, it falls to the EU Courts, by virtue of their exclusive jurisdiction to review the legality of EU acts on the basis of Article 263 TFEU, to rule on the legality of the final decision adopted by the EU institution at issue and to examine, in order to ensure effective judicial protection of the persons concerned, any defects vitiating the preparatory acts or the proposals of the national authorities that would be such as to affect the validity of that final decision (see judgment of 19 December 2018, Berlusconi and Fininvest, C‑219/17, EU:C:2018:1023, paragraph 44 and the case-law cited).

224    In such circumstances, the Courts of the European Union must verify whether there are any defects vitiating the legality of the FSA’s draft decision as reproduced in the decision of 17 July 2018, in so far as those defects are disputed by the applicants in the context of their other pleas.

225    It is therefore necessary to examine whether the second applicant has succeeded in casting doubts on the assessments made in the decision of 17 July 2018.

3.      The fourth and fifth pleas, alleging errors of assessment or failure to take into account certain relevant aspects of the case

(a)    The fifth plea, alleging failure to take into account the positive impact of the new management team of the second applicant

226    The applicants claim that the decision of 17 July 2018 does not take account of the positive impact achieved by the new management team of the second applicant and that, in view of the expertise and good reputation of that team, established in November 2017, the ECB should not have withdrawn its authorisation in March 2018.

227    The ECB disputes the applicants’ arguments.

228    In the first place, in so far as the applicants claim that the ECB failed to take into account a relevant factor, it must be stated that, in paragraph 3.3.1(b)(ii) of the decision of 17 July 2018, the change of management of the second applicant was duly taken into account and that the reasons why that change was not considered sufficient to remedy the problems identified in the AML/CFT risk management system were analysed in detail in that decision.

229    First, in the decision of 17 July 2018, the ECB took the view, inter alia, that, although the new management of the second applicant, which had been in place since 1 November 2017, had agreed with the FSA’s objections concerning that applicant’s inability to present an unambiguous strategy as regards its customers, a detailed definition of the risks to those customers and a financial assessment of the operational risks, and that that management team had undertaken to change the applicant’s commercial strategy during the period from 2018 to 2021, that management team also confirmed that it would continue to target the Russian and Ukrainian markets as its core business.

230    Secondly, it was noted in the decision of 17 July 2018 that, under the applicable national law (Articles 52(4) and 55(1) of the Estonian Law on Credit Institutions), the commercial strategy of a credit institution was determined by the supervisory board and not by the board of directors.

231    Thirdly, it was also noted in the decision of 17 July 2018 that, despite the changes in the membership of the supervisory board of the second applicant, which also took place between 2012 and 2018, the two controlling shareholders of that applicant continued to be members of the supervisory board and the FSA had not identified any change in strategy with regard to risk management principles, reasonably leading to the conclusion that those principles were influenced by those two shareholders. That influence could also be confirmed by the fact that, notwithstanding three changes of management between 2012 and 2017, that applicant had never changed its business model or its attitude regarding non-compliance with AML/CFT regulatory requirements.

232    For all of those reasons, the FSA in its draft decision and the ECB in the decision of 17 July 2018 concluded that the improvements observed following the change in the management of the second applicant were not sufficient to ensure that the latter was compliant with the AML/CFT legislation.

233    Those grounds, which, moreover, have not been challenged in detail by the applicants in the action brought in Case T‑584/18, first, show that the ECB did indeed take that applicant’s new management into account as a relevant factor in the case and, secondly, are not vitiated by an error of assessment.

234    In the second place, in so far as the applicants claim that the ECB made an error of assessment as regards the decision of 17 July 2018, it must be pointed out that the withdrawal of the second applicant’s authorisation was not based on any shortcoming as regards the board of directors, pursuant to Article 18(c) of Directive 2013/36, read in conjunction with Article 13(1) of that directive, but rather on that applicant’s failure to adopt the measures necessary to comply with the regulatory requirements relating to AML/CFT, a ground which, as noted in paragraph 231 above, the applicants have not successfully challenged, despite the changes to that applicant’s management.

235    In the third place, in so far as the applicants’ arguments relate to an error of assessment by the ECB in its assessment of the proportionality of the decision of 17 July 2018 in comparison with other measures less onerous than withdrawal of authorisation, reference should be made to the examination of the assessment of proportionality (see paragraphs 306 to 344 below).

236    In the light of the foregoing considerations, the fifth plea must be rejected.

(b)    The fourth plea, alleging an error of assessment concerning the erroneous nature of the information on the second applicant’s activities in Latvia

237    The applicants claim that the ECB was not entitled to base the decision of 17 July 2018 on the communication of incorrect information to the FSA concerning the second applicant’s cross-border activities in Latvia. According to the applicants, first, the allegedly incorrect factual statements have not been concretely identified or substantiated, while the applicants have never concealed the second applicant’s activities in Latvia, which were openly communicated on the latter’s website. Secondly, those statements relate only to a terminological distinction between ‘representative offices’ and ‘cross-border service/office’ or between ‘support offices’ and ‘branch’. Thirdly, the passporting procedure for undertaking cross-border financial activities in other countries, which the second applicant failed to follow, is a purely formal process and the same applicant complied with it as regards its activities in Germany, Sweden and the United Kingdom. Fourthly, that issue is now irrelevant as it was the subject of a settlement agreement before a Latvian administrative court and neither the FSA nor the Latvian NCA imposed sanctions on the second applicant in that regard. Fifthly, in order for such declarations to lead to the withdrawal of authorisation, they must be particularly serious.

238    Furthermore, the applicants consider that the FSA had an ambivalent attitude from the time of the adoption of the FOLTF decision and did not make it clear to the second applicant that it considered the matter still to be open. They rely in that regard on that applicant’s press release of 28 July 2017, in which the settlement agreement before the Latvian NCA is summarised and from which it is apparent that the case concerning the activities of the second applicant in Latvia was closed. They add that it would be absurd to regard a mere inaccuracy as a ground for withdrawing the authorisation of a credit institution. They request the Court to order the FSA and the ECB to identify the allegedly misleading representations and to disclose the documents in which they had allegedly raised the matter as still being suspended, despite the settlement agreement before the Latvian administrative court. They also request that the representatives of the FSA and the ECB be ordered to provide evidence on this point.

239    The ECB disputes the applicants’ arguments.

240    As a preliminary point, it should be recalled that recital 19 of Directive 2013/36 states that ‘credit institutions authorised in their home Member States should be allowed to carry out throughout the Union any or all of the activities referred to in the list of activities subject to mutual recognition by establishing branches or by providing services’.

241    According to recital 20 of Directive 2013/36, ‘it is appropriate to extend mutual recognition to those activities where they are carried out by financial institutions which are subsidiaries of credit institutions, provided that such subsidiaries are covered by the consolidated supervision of their parent undertakings and meet certain strict conditions’.

242    In Chapter 2 of Title V of Directive 2013/36 on the right of establishment of credit institutions, Articles 35 and 36 provide for a notification requirement and govern relations between the competent authorities.

243    Article 35 of Directive 2013/36 provides that a credit institution wishing to establish a branch within the territory of another Member State is required to notify the competent authorities of its home Member State (paragraph 1). That notification must be accompanied by information concerning, inter alia, the Member State within the territory of which it plans to establish a branch, a programme of operations setting out the types of business envisaged and the structural organisation of the branch, the address in the host Member State from which documents may be obtained, and the names of those to be responsible for the management of the branch (paragraph 2).

244    Article 35(4) of Directive 2013/36 provides that ‘where the competent authorities of the home Member State refuse to communicate the information referred to in paragraph 2 to the competent authorities of the host Member State, they shall give reasons for their refusal to the credit institution concerned within three months of receipt of all the information’.

245    Article 36(1) to (4) of Directive 2013/36 is worded as follows:

‘1.      Before the branch of a credit institution commences its activities the competent authorities of the host Member State shall, within two months of receiving the information referred to in Article 35, prepare for the supervision of the credit institution in accordance with Chapter 4 and if necessary indicate the conditions under which, in the interests of the general good, those activities shall be carried out in the host Member State.

2.      On receipt of a communication from the competent authorities of the host Member State, or in the event of the expiry of the period provided for in paragraph 1 without receipt of any communication from the latter, the branch may be established and may commence its activities.

3.      In the event of a change in any of the information communicated pursuant to points (b), (c) or (d) of Article 35(2), a credit institution shall give written notice of the change in question to the competent authorities of the home and host Member States at least one month before making the change in order to enable the competent authorities of the home Member State to take a decision following a notification under Article 35, and the competent authorities of the host Member State to take a decision setting out the conditions for the change pursuant to paragraph 1 of this Article.

4.      Branches which have commenced their activities, in accordance with the provisions in force in their host Member States, before 1 January 1993, shall be presumed to have been subject to the procedures set out in Article 35 and in paragraphs 1 and 2 of this Article. They shall be governed, from 1 January 1993, by paragraph 3 of this Article and by Articles 33 and 52 and Chapter 4.’

246    Article 39 of Directive 2013/36, entitled ‘Notification procedure’, provides as follows in paragraphs 1 and 2:

‘1.      Any credit institution wishing to exercise the freedom to provide services by carrying out its activities within the territory of another Member State for the first time shall notify the competent authorities of the home Member State of the activities on the list in Annex I which it intends to carry out.

2.      The competent authorities of the home Member State shall, within one month of receipt of the notification provided for in paragraph 1, send that notification to the competent authorities of the host Member State.’

247    Article 67(1) of Directive 2013/36 is worded as follows:

‘This Article shall apply at least in any of the following circumstances:

(a)      an institution has obtained an authorisation through false statements or any other irregular means;

…

(e)      an institution fails to report information or provides incomplete or inaccurate information on compliance with the obligation to meet own funds requirements set out in Article 92 of Regulation (EU) No 575/2013 to the competent authorities in breach of Article 99(1) of that Regulation;

(f)      an institution fails to report or provides incomplete or inaccurate information to the competent authorities in relation to the data referred to in Article 101 of Regulation (EU) No 575/2013;

(g)      an institution fails to report information or provides incomplete or inaccurate information about a large exposure to the competent authorities in breach of Article 394(1) of Regulation (EU) No 575/2013;

(h)      an institution fails to report information or provides incomplete or inaccurate information on liquidity to the competent authorities in breach of Article 415(1) and (2) of Regulation (EU) No 575/2013;

(i)      an institution fails to report information or provides incomplete or inaccurate information on the leverage ratio to the competent authorities in breach of Article 430(1) of Regulation (EU) No 575/2013;

…

(m)      an institution fails to disclose information or provides incomplete or inaccurate information in breach of Article 431(1), (2) and (3) or Article 451(1) of Regulation (EU) No 575/2013;

…’

248    In paragraph 3.3.1(d) of the decision of 17 July 2018, the ECB took the view, on the basis of the FSA’s draft decision withdrawing authorisation, that the second applicant had infringed the Latvian legislation transposing Articles 35 to 38 of Directive 2013/36 by establishing itself in Latvia by means of a branch, without having complied with the procedures laid down and thus unlawfully, and by providing false information to the FSA in respect of its establishment in Latvia. First, the FSA had relied on two letters received from that applicant: in the first letter, that applicant denied operating a branch in Latvia, whereas the contrary had been proven, and, in the second letter, the applicant stated that it had closed its branch in Latvia, whereas it was still operational. Secondly, the FSA had taken into account the evidence gathered during an on-site inspection which it had carried out between 5 September and 14 November 2016, which concluded that that applicant had provided financial services through a branch established in Latvia since October 2013.

249    The applicants dispute, in essence, the mandatory nature of the notification procedure (‘passporting’) referred to in Articles 35 and 36 of Directive 2013/36.

250    In that regard, it must be observed that the purpose of Directive 2013/36 is to harmonise the conditions for granting authorisation for pursuing financial activities to credit institutions throughout the European Union in order to enable an institution authorised in its own Member State to be allowed to carry out all or part of its activities throughout the European Union by establishing a branch or by providing services, with mutual recognition, as is also apparent from recital 19 of that directive.

251    Furthermore, it is apparent from Articles 35 to 38 of Directive 2013/36 that the EU legislature intended to set up, for credit institutions wishing to establish a branch in another Member State, a system of notification to the competent authority of the home Member State. The latter is therefore the competent authority for assessing whether the conditions are met in order for that branch to carry out financial activities in another Member State.

252    The decision-making power of the competent authority of the home Member State relates in particular to whether the information listed in Article 35(2) of Directive 2013/36, which must be communicated to the NCA of the host Member State, is sufficient and complete, and to monitoring the adequacy of the administrative structure or the financial situation of the credit institution which wishes to establish a branch in another Member State. In case of doubt, that information is not communicated and the credit institution concerned is informed of the reasons for the refusal.

253    The power to refuse communication and the discretion of the competent authority of the home Member State to assess the information which must be provided by a credit institution wishing to establish a branch in another Member State demonstrate that the notification procedure, known as a ‘passporting’, is not purely a formality.

254    Furthermore, it is apparent from Article 36(1) of Directive 2013/36 that the NCA of the host Member State is not to prepare for supervision of the branch until the information referred to in Article 35 of that directive has been received. It follows that notification of that information is an essential procedural requirement for that NCA to be able to carry out its supervisory activity in respect of the branch of a credit institution of another Member State.

255    That conclusion is supported by a teleological and systematic reading of Directive 2013/36 and, in particular, of Chapters 2 and 3 of Title V of that directive. The rationale behind those provisions is to reconcile the possibility for a credit institution authorised in one Member State to exercise its freedom to provide services and its right of establishment in other Member States, with the requirement of prudential supervision of any branches of that institution in other Member States. With a view to facilitating the exercise of this right and the mutual recognition of authorisations within the European Union, at a time when the competence for granting such authorisations lay with the national authorities, the legislature chose, in Directive 2013/36, to concentrate in the hands of the competent authority of the home Member State the responsibility for verifying whether the conditions are satisfied for the exercise of financial activities by a branch of a credit institution. That authority is best placed to know the organisational structure and commercial policy of the latter and to assist, by providing that information, the competent authority of the host Member State in its task of supervising the branch established on its territory.

256    In the light of the foregoing, it must be held that the notification procedure, known as the ‘passporting’ procedure, is binding.

257    The applicants do not dispute the fact that the second applicant failed to initiate the notification procedure, but merely call into question the seriousness of such conduct, which they consider to be a mere failure to comply with purely formal requirements. However, it is apparent from the arguments set out in paragraphs 248 to 256 above that the notification procedure with which that applicant failed to comply is not a mere formality, but a legal obligation. Accordingly, that applicant established a branch in Latvia and carried out financial activities unlawfully.

258    Furthermore, in so far as the FSA provided the ECB with a detailed explanation of the results of its investigations into that question and from which it is apparent, moreover, that the second applicant provided financial services in Latvia to customers from both Latvia and third countries, and that those customers recruited in Latvia had generated, between November 2013 and August 2016, 66% of the total income from services provided by the second applicant, and that those results were not in any way called into question in a detailed manner by the mere unsubstantiated allegations of the second applicant, those facts must be regarded as established.

259    The provision of financial services to Latvian customers and the significant portion which that represented in the second applicant’s income show that the branch in Latvia could not constitute a mere representative or support office.

260    In those circumstances, the view cannot be taken that the FSA’s findings concerning the false nature of the information provided to it in the two letters of 26 September 2013 and 9 February 2016 are incorrect. Indeed, while the applicants claim that the activities of that branch were not directed at Latvians, but at customers from third countries, it appears from the detailed evidence gathered by the FSA during its on-site inspection that 66% of that applicant’s income was derived from the activities of that branch and that 3% of the accounts opened with that branch were held by Latvian residents. It must be stated that the applicants have not even attempted to challenge the figures provided by the FSA to the ECB.

261    Finally, it is necessary to reject the arguments by which the applicants criticise the ECB for not having analysed the gravity of the second applicant’s conduct.

262    In that regard, first, it should be noted that the communication of false information to a national supervisory authority is inherently serious in so far as it is liable to call into question the reliability of the information provided by the credit institutions subject to supervision, necessary to ensure the effectiveness and efficiency of their task and the system of mutual trust between NCAs, which the creation of the notification procedure, known as ‘passporting’, is designed to ensure within the SSM.

263    The importance for NCAs of having the necessary information and of being able to rely on correct information in order to carry out their prudential supervision functions, and hence the seriousness of the conduct of a credit institution which fails to comply with its obligations to provide information, is also confirmed by the wording of Article 67(1)(a),(e) to (i) and (m) of Directive 2013/36, which lays down, as grounds for withdrawal of authorisation (by virtue of the reference to that provision in Article 18(f) of that directive), the omission of information in the cases under points (e) to (i) and (m) of the latter article and the communication of incorrect information for the purpose of obtaining an authorisation in the case under point (a) of the same article.

264    Secondly, it is true that the ECB was required, in the context of its assessment of the proportionality of the measure withdrawing authorisation, to take into account the existence of an ‘administrative judicial settlement’ between the credit institution and the competent authority of the host Member State in which that institution undertook to put an end to the breaches in question, and, for that purpose, it is not sufficient to state that those breaches constitute grounds for such withdrawal under Estonian national law (Article 17(1)(2) and (15) of the Estonian Law on Credit Institutions).

265    However, it must be stated that, in the context of the ‘administrative judicial settlement’ at issue, the second applicant undertook to comply fully with the Latvian NCA’s decision prohibiting it from providing financial services in Latvia and from recruiting new clients in Latvia, and which required it to terminate its contractual relations with existing clients in Latvia and its business relations with customers recruited under the principle of freedom to provide services in Latvia.

266    Furthermore, first, the ‘administrative judicial settlement’ at issue is not capable of legalising the second applicant’s unlawful conduct in the past, but only of preventing any further measures, including penalties, in the future.

267    Secondly, it is apparent from the Latvian NCA’s press release that, in order to continue providing its services in Latvia, the second applicant ought first to have obtained authorisation in accordance with the procedures laid down in the legislation. This shows that the situation was not fully resolved, since that applicant had not yet initiated a procedure for obtaining authorisation.

268    In the light of the foregoing, the fourth plea cannot succeed. The present group of pleas must therefore be rejected.

4.      The sixth, twelfth and eighteenth pleas in law, alleging an error of assessment in so far as the ECB wrongly based its decision on breach of the FSA precept and infringement of the principle of legal certainty

269    By their eighteenth plea, the applicants claim infringement of the principle of legal certainty in so far as, in the precept, the FSA did not specify clearly which AML/CFT requirements it expected to be met. That precept imposed, in its operative part, a fine of EUR 32 000 in the event of failure to comply with those requirements, which was capable of giving rise to the legitimate expectation, on the part of the second applicant, that, prior to a withdrawal of authorisation, that NCA would proceed to less onerous supervisory measures. In the context of the sixth plea, the applicants note that that NCA, in its draft decision to withdraw authorisation, and the ECB, in the decision of 17 July 2018, did not define the legislative requirements and standardised criteria which that applicant had allegedly failed to meet and by reference to which the finding of non-compliance had been made.

270    In the twelfth plea, the applicants submit that the breach of an NCA precept does not constitute a valid ground for withdrawal of authorisation, particularly where, as in the present case, the precept is formulated in a vague manner, without specifying what concrete remedial measures are to be adopted. The text of the FSA’s precept, annexed to the ECB’s defence, refers to the content of a report of the on-site inspection carried out between 13 April and 12 June 2015, which is not, however, included in the file. The applicants claim that the onus is on the ECB to show that the instruction had specific content. The decision of 17 July 2018 vaguely suggests that that precept was not complied with in full or that it was not complied with within the prescribed period. Such a ground does not justify the most onerous supervisory measure, namely withdrawal of authorisation. Lastly, the applicants state that the second applicant requested clarification as to the specific content of the AML/CFT regulatory requirements, but did not receive any such clarification.

271    The ECB disputes the applicants’ arguments.

272    It is appropriate to recall the wording of Article 74(1) and (2) of Directive 2013/36:

‘1.      Institutions shall have robust governance arrangements, which include a clear organisational structure with well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks they are or might be exposed to, adequate internal control mechanisms, including sound administration and accounting procedures, and remuneration policies and practices that are consistent with and promote sound and effective risk management.

2.      The arrangements, processes and mechanisms referred to in paragraph 1 shall be comprehensive and proportionate to the nature, scale and complexity of the risks inherent in the business model and the institution’s activities. The technical criteria established in Articles 76 to 95 shall be taken into account.’

273    According to case-law, the principle of legal certainty makes it necessary to refer to the state of the law in force when the provision in question was applied (judgment of 14 July 1971, Henck, 12/71, EU:C:1971:86, paragraph 5) and requires that every measure of the institutions having legal effects must be clear and precise and must be brought to the notice of the person concerned in such a way that he or she can ascertain exactly the time at which the measure comes into being and starts to have legal effects (see judgment of 22 January 1997, Opel Austria v Council, T‑115/94, EU:T:1997:3, paragraph 124 and the case-law cited).

274    In the present case, in paragraph 3.3.1(c) of the decision of 17 July 2018, the ECB noted, on the basis of the FSA’s draft decision, that the second applicant had failed to comply with the precept at issue, adopted on 8 August 2016, by which the second applicant was required, first, to apply the procedural rules, secondly, to apply correctly Article 13(1)(3) to (5) of the Estonian Law on AML/CFT, in the version applicable at the time of the adoption of the precept, and to avoid entering into commercial relations, as necessary, thirdly, to verify that those provisions had been correctly applied to commercial relations and, if necessary, to apply customer due diligence measures once again, fourthly, to avoid, where appropriate, carrying out transactions under the terms of Article 27(2) of that law, in the version in force at the time of the adoption of the precept at issue, fifthly, to refer to the financial intelligence unit when an activity or other circumstance could be an indication of the commission or attempted commission of money laundering or terrorist financing, or where that applicant had reason to believe or knew that money laundering or terrorist financing was taking place, and, sixthly, to provide the FSA with a report, before 9 December 2016, on how that applicant had complied with the precept. The ECB concluded that, by failing to comply in full with the precept at issue within the prescribed period, the second applicant had infringed Article 17(1)(14) of the Estonian Law on Credit Institutions and that that breach of national law constituted another ground for withdrawal of authorisation under Article 18(f) of Directive 2013/36.

275    The applicants submit, in essence, that the precept at issue could not be complied with because it merely recalled the provisions with which the second applicant was required to comply and that the objective of restoring legality is not a legitimate objective for withdrawing authorisation from a credit institution.

276    In the first place, contrary to the applicants’ submission, the objective of a measure withdrawing authorisation is to put an end to repeated infringements of the regulatory requirements with which all credit institutions are required to comply. In that context, the adoption by the NCA of a precept merely confirms that its addressee has had several opportunities to comply with such requirements and that the most onerous measure, the withdrawal of authorisation, was adopted only as a last resort.

277    In the second place, it is not plausible that, following several warnings by and numerous exchanges with the NCA on the subject, including the opportunity to comment on the inspection reports provided to it and to request information formally or informally in the course of the procedure, a credit institution would not understand how to implement legal provisions, such as those in force regarding AML/CFT. Furthermore, the applicants’ allegation that the FSA and the ECB refused to provide them with the information which they requested must be rejected, as it is not substantiated in any way.

278    In that regard, it should be pointed out that the FSA carried out four on-site inspections. The precept at issue was adopted on 8 August 2016, following the first on-site inspection in 2015. During the second on-site inspection in autumn 2016, the FSA found that the shortcomings identified were continuing and that the second applicant had not yet complied with that precept. Following that second on-site inspection, the applicant had the opportunity to submit observations and several meetings were held with the FSA during autumn 2016. The FSA conducted a third on-site inspection in September 2017, the report on which was communicated on 4 October 2017 to that applicant, which was given the opportunity to submit observations. In addition to the fact that it was always open to that applicant to ask the FSA for explanations if it found that the indications given to it repeatedly were not sufficient, concerning the structural units that needed to be created, the staffing required, the internal procedural rules required, the rules providing for the separation of specific units which had to be maintained and the information flows that needed to be put in place, it must be noted that that applicant had 14 months between that precept and the communication of that report and a further 6 months until the withdrawal of authorisation in order to understand and comply with the regulatory requirements.

279    In the third place, although the ECB observes that the precept at issue should be read in conjunction with the report on the second on-site inspection, communicated to the second applicant, it must be noted that the decision of 17 July 2018 is sufficiently clear and precise as to the regulatory requirements with which that applicant had to comply.

280    As regards the alleged shortcomings in the governance arrangements, the decision of 17 July 2018 states that, despite the fact that the second applicant had organisational units and appropriate procedural rules, those units were understaffed and overburdened with duties, and the internal procedural rules were not correctly applied. Those shortcomings had been observed in respect of three lines of defence relating respectively to: the following of individual transactions carried out by customer relationship managers; the detection, management and monitoring of risks, in addition to the lack of effective separation between the first and second lines of defence (taking risks and managing risks) giving rise to serious conflict of interests; and internal audit functions. Although the persons responsible for the detection, management and monitoring of risks had already identified and reported to the board of directors in 2013 and 2014 that the internal provisions were not being complied with, the board of directors did not react adequately, in breach of Article 55(2)(3¹) of the Estonian Law on Credit Institutions, which transposes Article 88 of Directive 2013/36. Furthermore, the board of directors failed to provide the necessary staffing to the compliance officers, as the second line of defence, in breach of Article 31(2) of the Estonian Law on AML/CFT transposing Directive 2015/849, in the version applicable at the time of the adoption of the precept at issue.

281    As regards the alleged shortcomings with regard to AML/CFT, the decision of 17 July 2018 states that a large number of unusual transactions had been observed. The second applicant’s average disbursement in 2015 had been four times higher and the average deposit seven times higher than the average of the Estonian banking system. Those payments had been made mainly by high-risk clients and represented approximately 97% of all transfers made in Estonia in 2015. Despite the FSA’s repeated warnings of the need for that applicant to implement a new commercial strategy to address the concerns expressed, and despite the announcements of the applicant’s three different boards of directors regarding the desire to change its business model, the results of the third on-site inspection had shown that the applicant’s commercial strategy had not changed significantly and that it was therefore still operating in a market segment characterised by higher risks in that regard.

282    It was further stated that the absence of effective AML/CFT rules for managing the risks linked to the second applicant’s business model was observed, first, as regards customer due diligence measures at the time of the introduction of a new contractual relationship and the absence of constant supervision of existing commercial relations and, secondly, as regards the supervision of transactions carried out and the risk profile of the customers in question. The failures observed were considered to be structural in nature and not solely isolated cases.

283    In addition, despite certain changes in the AML/CFT controls and the second applicant reducing its number of high-risk customers, those measures were considered ineffective, in so far as they did not guarantee constant supervision of existing commercial relations, including as regards the origin of the funds used in the transactions carried out, and did not identify or verify transactions that were complex, related and involved unusually high amounts or transactions with no clear economic purpose.

284    Furthermore, the activities of the second applicant’s board of directors and Supervisory Board with regard to AML/CFT and risk management were considered to be inadequate, in so far as that board had not determined that applicant’s risk tolerance, or put in place a separate risk assessment system for AML/CFT, or prepared an operational risk analysis, including a detailed analysis of the risks in that regard, in breach of Article 55(2)(2) and (3) of the Estonian Law on Credit Institutions.

285    The ECB did indeed take into account the change of the second applicant’s board of directors, which took place in November 2017, as well as the statements by which that board of directors distanced itself from previous commercial policies, acknowledged the persistent absence of an unambiguous strategy with regard to its customers and announced its intention to develop a new commercial strategy for the years 2018 to 2021. However, it observed, first, that the new board of directors confirmed that applicant’s intention to pursue its previous commercial strategy, which cast doubt on whether that applicant was actually in a position to implement the announced changes.

286    Secondly, the ECB noted that, although a change of board of directors could influence the strategy of a credit institution, the approval of its strategic decisions, under Article 52(4) of the Estonian Law on Credit Institutions, was rather the responsibility of the supervisory board. In the present case, however, the change in the composition of the board did not affect two members, the two controlling shareholders of the second applicant, who probably had an influence on the strategy and risk management principles of the applicant, with the result that no radical and substantial change could be introduced or reasonably envisaged for the future. In that regard, the improvements to the system, put forward by that applicant to the FSA, were considered insufficient in terms of full compliance with the statutory provisions applicable to AML/CFT.

287    Thus, it is clear that the infringed regulatory requirements are described in great detail with regard to concrete situations, relating in particular to, first, the lack of governance arrangements appropriate to the business model of the second applicant, which focused on the provision of financial services to high-net-worth non-resident corporate customers with a high-risk profile, as required by the national provisions transposing Article 74 of Directive 2013/36, secondly, the shortcomings of the organisational units responsible for implementing the AML/CFT procedural rules of defence and risk management, in particular regarding the detection, management and monitoring of risks, the identification of clients before the start of contractual relations as well as during contractual relations, the checks on individual transactions carried out by customer relationship managers, the lack of separation between the functions of reviewing risk-taking, on the one hand, and risk management, on the other, which might give rise to conflicts of interests, thirdly, failures regarding internal audit functions, fourthly, lack of internal procedures or non-compliance with existing internal procedures, fifthly, a significant number of unusual transactions related to high-risk customers, which accounted for approximately 97% of all transfers in Estonia (in 2015), sixthly, lack of customer due diligence when establishing a new contractual relationship as well as lack of constant monitoring of existing commercial relations, including the origin of funds and the identification of transactions that were complex, involved unusually high amounts or had no clear economic purpose and, seventhly, the inadequate AML/CFT risk management activities of the board of directors and supervisory board, which had failed to determine the tolerable risk level of the second applicant, to establish a separate risk assessment system for AML/CFT, or to prepare an operational risk analysis.

288    Consequently, in those circumstances, the second applicant cannot validly invoke any infringement of the principle of legal certainty, within the meaning of the case-law referred to in paragraph 273 above.

289    In the fourth place, it must be stated that the second applicant did not at any time contest the finding that it had not complied with the entire precept in question within the prescribed period or that, under Estonian national law, failure to comply with a precept of the FSA is a ground justifying withdrawal of authorisation.

290    In that regard, it is apparent from the file that all those shortcomings with regard to AML/CFT, referred to in paragraph 287 above, in view of their persistence and extent over several years, were considered to be structural in nature and had not been duly remedied by the improvement measures that the second applicant had adopted. In particular, the mere ‘reduction’ of high-risk customers could not resolve all of the abovementioned issues. In addition, the successive changes in the board of directors had not produced the desired effects, since the second applicant’s commercial strategy had not changed substantially and it did not seem likely that it would change within a reasonable period, for the reasons set out in paragraphs 229 to 232 above.

291    With the exception of the references to the improvements made in relation to the reduction of high-risk customers and to the change in the board of directors, the second applicant does not dispute in detail all the shortcomings referred to in paragraph 287 above.

292    It follows that, since failure to comply with the precept at issue does indeed constitute a ground for withdrawal of authorisation under national law, and therefore under Article 18(f) of Directive 2013/36, and since the second applicant did not comply with the entire precept in question within the prescribed period, it must be concluded that the ECB did not make any error of assessment in also relying on that ground as justification for withdrawing authorisation.

293    In the fifth place, in so far as the applicants complain that the ECB failed to define the regulatory requirements in the light of which the second applicant’s failure to comply with the precept at issue was assessed, it must be observed that those requirements are laid down in the statutory provisions contained in Estonian national law transposing the AML/CFT directives. Those provisions are to be implemented according to the specific characteristics of each credit institution. The manner of compliance must therefore be adapted to the latter and comes under the discretion of the credit institution itself. Where the competent supervisory authority, in this case the FSA, considers that the detailed rules adopted by the credit institution concerned are not appropriate, it is to communicate that to that institution and suggest remedial measures. In the present case, as was pointed out in paragraph 278 above, that applicant had the opportunity to understand, in the context of its numerous exchanges with the FSA, the appropriate remedial measures that it could and should have taken in order to comply with those requirements.

294    In the sixth place, in so far as the applicants claim that the precept at issue did not make it clear that the withdrawal of the second applicant’s authorisation was a possibility in the event of non-compliance with the AML/CFT regulatory requirements and, in essence, that the second applicant faced only the possibility of fines, it should be noted, as observed by the ECB, that point 4.8 of the precept at issue explicitly states that ‘account must be taken of the provisions of Article 17(2) of the [Estonian Law on Credit Institutions], which states that, prior to deciding on the withdrawal of authorisation pursuant to Article 17(1) of the [Estonian Law on Credit Institutions], the [FSA] may issue a precept to the credit institution and set a term for elimination of the deficiencies that are the basis for the withdrawal’.

295    It must be concluded that the second applicant, as a result of the precept at issue, was aware of the shortcomings found, of what it needed to do in order to remedy them, and of the risk that, in the event of non-compliance, its authorisation would be in jeopardy.

296    Consequently, the present group of pleas must be rejected.

5.      The seventh to eleventh, thirteenth to fifteenth and seventeenth pleas, alleging breach of the principle of proportionality

297    By their seventeenth plea, the applicants allege infringement of the principle of proportionality, claiming that the decision of 17 July 2018 applies a measure of last resort, namely withdrawal of authorisation, which is disproportionate to the failure to comply with the regulatory requirements. First, the applicants challenge that the objective of such a measure being to ‘restore legality’ constitutes a legitimate objective, since it is too abstract. Such a measure should, on the contrary, be justified by a specific legitimate regulatory objective. Secondly, the applicants object to the analysis of the appropriateness of the measure in question, arguing, on the one hand, that, since the FSA is the NCA in matters relating to AML/CFT, compliance with the AML/CFT rules should primarily be enforced by measures adopted under AML/CFT regulations rather than by banking supervisory measures. On the other hand, withdrawal is not an appropriate means of punishing past misconduct, since regulatory measures should address only present situations or be intended to prevent non-compliance in the future. Given that the issue of the second applicant’s activities in Latvia was resolved by a judicial settlement, the measure withdrawing authorisation is clearly disproportionate in relation to that alleged past infringement. Thirdly, according to the applicants, the ECB misinterpreted the criterion that the measure must be necessary. Fourthly, the applicants submit that the examination of the reasonableness of the measure carried out by the ECB is also abstract and serves no purpose, because it merely made an abstract comparison of the public interest in upholding legality with the private interests of a bank, whereas it ought to have compared a concrete regulatory objective, such as the prevention of a specific risk, with those private interests. In addition, they submit that the ECB should have substantiated its claim that instances of non-compliance were serious, by comparing them with other instances of non-compliance in the banking industry. Lastly, the applicants claim that the ECB failed to take into account other, less severe, alternative measures, such as the imposition of concrete measures concerning particular matters within specific deadlines, or the imposition of penalties or fines, or measures against the directors of the credit institution or the appointment of a competent person to monitor the efforts being made by the second applicant to comply with the regulatory requirements which had been infringed.

298    By their seventh, eighth and ninth pleas, the applicants essentially mount a general challenge to the ECB’s assessment, arguing that it did not attach sufficient weight to the fact that substantial parts of the second applicant’s business did not give rise to any significant AML/CFT risks, or to the substantial reduction of customers in higher risk categories, and wrongly concluded that, in spite of the progress made by the second applicant, it could not reasonably be expected to remedy the breaches that had been identified within a reasonable time.

299    In particular, under the seventh plea, the applicants submit that, as the breach was confined to part of their business, the ECB ought only to have required cessation of those activities which involved the greatest risk, instead of withdrawing its authorisation.

300    In the eighth plea, the applicants submit that the ECB did not give sufficient weight to the substantial reduction of customers in higher risk categories, and that, while it is true that any non-compliance must be corrected, it would be manifestly incorrect to assert that every instance of non-compliance justifies withdrawal of authorisation.

301    In the context of the ninth plea, the applicants submit that compliance with the regulatory requirements has always been possible and therefore that the ECB could not conclude that any remedy other than the withdrawal of authorisation would have been unrealistic.

302    In their tenth and eleventh pleas, the applicants take issue with the discussion of a change in the board of directors and suspension of the voting rights of shareholders as alternatives to withdrawal of authorisation, in the course of the ECB’s examination, in paragraph 3.3.2(b)(ii) of the decision of 17 July 2018, of whether withdrawal was proportionate. They submit that the board which had been appointed in November 2017 should simply have been left to do its job, and that the shareholders had already withdrawn from any direct involvement in the management of the second applicant.

303    In the thirteenth plea, challenging the assessment made by the ECB in paragraph 3.3.2(b)(iv) of the decision of 17 July 2018, as regards the alternative of the FSA adopting a second precept prohibiting the provision of financial services, the applicants submit that such a general prohibition would have been the de facto equivalent of a withdrawal of authorisation, and that the FSA would not have had the power to do so. On the other hand, they reiterate that a second precept from the FSA relating to part of the second applicant’s business, and prohibiting only the provision of financial services to non-resident customers, would have been possible, and less onerous than withdrawal of authorisation. They do not accept that the second applicant would have ceased to be financially viable as a result of such a prohibition.

304    Lastly, by their arguments put forward under the fourteenth and fifteenth pleas in law, alleging that the ECB had no power to refuse to permit self-liquidation or sale of the second applicant to another investor, the applicants also challenge the conclusion, reached by the ECB when considering whether withdrawal of authorisation was proportionate, that such measures would be inappropriate. The applicants also argue that the ECB acted arbitrarily in not allowing the time necessary for a sale. They also submit that self-liquidation was excluded on the sole ground that the ECB wished to obtain positive publicity.

305    The ECB disputes the applicants’ arguments.

306    As a preliminary point, it should be borne in mind that, according to Article 5(4) TEU, under the principle of proportionality, the content and form of European Union action is not to exceed what is necessary to attain the objectives of the Treaties. The EU institutions are required to apply the principle of proportionality as laid down in Protocol No 2 on the application of the principles of subsidiarity and proportionality, annexed to the FEU Treaty.

307    It is settled case-law that, in accordance with the principle of proportionality, which is one of the general principles of EU law, the acts adopted by EU institutions must be appropriate for attaining the legitimate objectives pursued by the legislation at issue and must not exceed the limits of what is necessary in order to achieve those objectives; where there is a choice between several appropriate measures, recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued (see judgment of 16 May 2017, Landeskreditbank Baden-Württemberg v ECB, T‑122/15, EU:T:2017:337, paragraph 67 and the case-law cited).

308    In addition, according to the Court of Justice, the assessment of the proportionality of a measure must be reconciled with compliance with the discretion that may have been conferred on the EU institutions at the time when it was adopted (see judgment of 8 May 2019, Landeskreditbank Baden-Württemberg v ECB, C‑450/17 P, EU:C:2019:372, paragraph 53 and the case-law cited).

309    In the present case, after having established that there were several grounds which provided justification on the basis of the applicable provisions, in paragraph 3.3.2 of the decision of 17 July 2018, the ECB analysed the proportionality of the measure withdrawing authorisation.

310    In the first place, the ECB examined whether the measure withdrawing authorisation was appropriate to achieve the objective of bringing an end to the serious and prolonged breaches committed by the second applicant, concluding that, in view of the breaches relating to the lack of solid corporate governance arrangements, infringement of the AML/CFT provisions, failure to comply with a binding decision of a national supervisory authority, the submission of misleading information to that authority and the unlawful operation of a branch in another Member State, the withdrawal of authorisation was capable of attaining that objective.

311    In the second place, the ECB examined whether the measure withdrawing authorisation was necessary, and in particular whether there were other, less onerous, alternative measures that could similarly achieve the objective of restoring legality. It considered the following options: first, recalling the second applicant’s board of directors, concluding that that measure was not appropriate, since the previous changes in commercial strategy, which took place under three different boards of directors, had not ensured compliance with the applicable legislation; secondly, the cessation or suspension of the voting rights of certain of that applicant’s shareholders, concluding that that measure would not have been effective, given that the controlling shareholders were members of the supervisory board and could have continued to exert a decisive influence on the applicant’s strategy, even if they had been deprived of their voting rights; thirdly, the issuance of a new precept by the FSA, which the ECB rejected given that (i) that applicant had not complied with the first precept and there was therefore no reasonable expectation that it would comply with the second and (ii) a precept designed to impose the cessation of high-risk activities would not have been viable for the applicant in question, whose commercial strategy was focused precisely on high-risk customers; fourthly, the self-liquidation of the applicant in question, concluding, however, that that measure could not have achieved the objective of restoring legality and protecting the rights of depositors and that, in such a case, the decision to exit the market would have been left to the shareholders; and, fifthly, the sale of that applicant to another investor, which was rejected on the ground that there appeared to be no concrete commitment in that regard and that the business plan submitted by the potential purchaser did not provide sufficient information to assess whether the transaction would have resulted in a significant change in the business model of that applicant.

312    In the third place, the ECB analysed the reasonableness of the measure withdrawing authorisation and weighed the public interest in restoring legality against the second applicant’s private interest in avoiding the withdrawal measure and pursuing its activities.

313    It must be held that the examination carried out by the ECB as to the proportionality of the measure withdrawing authorisation was structured and conducted in a comprehensive manner. That examination is not vitiated by illegality and is free of errors of assessment. In any event, that reasoning is not called into question by the applicants’ complaints.

314    The applicants unsuccessfully dispute all the stages of the ECB’s analysis of the proportionality of the measure withdrawing authorisation.

315    In the first place, the applicants contest the view that the objective of restoring legality was a legitimate objective for adopting a measure withdrawing authorisation. In support of their arguments, however, they simply reiterate that mere unlawfulness should not result in the most onerous measure. In that regard, it must be stated that the breaches and failures listed on pages 5, 6 and 10 to 20 of the decision of 17 July 2018 and referred to in paragraph 279 above, which, moreover, are not disputed in detail by the applicants, as is apparent from paragraph 289 above, cannot be regarded as ‘mere unlawfulness’ or minor unlawfulness, in view also of the number of breaches, their gravity, their duration and the numerous opportunities that the second applicant had to remedy them and yet failed to do so.

316    In the second place, the applicants challenge the ECB’s examination of the appropriateness of the measure withdrawing authorisation. In that regard, first, their argument that that measure is not appropriate for remedying AML/CFT infringements must be rejected for the same reasons as those set out in paragraphs 185 to 195 above. Secondly, it is true that such a measure should not be used to penalise past breaches, as stated in paragraph 267 above. Thus, if the ECB had based its assessment of the proportionality of the measure in question solely on the breach relating to the establishment of a ‘branch’ in Latvia without observing the ‘passporting’ procedure, that measure could be challenged. However, in the present case, such an error cannot render unlawful the entire reasoning of the ECB concerning the proportionality of the measure at issue since the ECB considered the measure to be proportionate in the light of all the breaches alleged against the second applicant.

317    In view of the ECB’s discretion in adopting a measure withdrawing authorisation, the assessment of the appropriateness of that measure cannot, in the present case, be regarded as manifestly incorrect in the light of the case-law referred to in paragraph 308 above, of the number, gravity and duration of the breaches committed by the second applicant and of the low probability that that applicant would comply fully with the regulatory requirements within an acceptable period of time, which justify the application of the most onerous measure and do not allow the conclusion that a possible error in the assessment of proportionality with regard to the infringements of the ‘passporting’ procedure could have had a decisive influence on the outcome of the overall assessment made by the ECB.

318    In the third place, the applicants call into question the ECB’s conclusions as to the reasonableness of the measure withdrawing authorisation. In that regard, first, the claim that the ECB carried out an excessively vague examination because it made an abstract comparison of the public interest in upholding legality with the private interests of that applicant has no factual basis, since it has been established, in paragraph 315 above, that the ECB analysed the gravity of the breaches, their long-term duration, the multiple opportunities that the second applicant had to remedy the situation but failed to take and the loss of public confidence in the Estonian and European financial markets and concluded that the public interest in restoring legality outweighed the private interest of that applicant in avoiding the withdrawal of authorisation. Secondly, the argument that the ECB did not substantiate the seriousness of the allegations of non-compliance by means of a comparative examination of the situation of other credit institutions with regard to their compliance with AML/CFT standards must be rejected for the same reasons as those set out in paragraph 315 above, as well as those set out in the analysis of the plea alleging breach of the principle of equal treatment (see paragraph 353 below).

319    In the fourth place, the applicants challenge the analysis of whether the measure withdrawing authorisation was necessary. First, they dispute the ECB’s interpretation of the criterion that the measure must be necessary.

320    In that regard, it is true that, in accordance with the case-law cited in paragraph 307 above, when there is a choice between several appropriate measures, recourse must be had to the least onerous. Nevertheless, in order for alternative measures to be considered appropriate, they must be equally effective (see, to that effect, judgments of 16 December 2010, Commission v France, C‑89/09, EU:C:2010:772, paragraph 80, and of 6 September 2017, Slovakia and Hungary v Council, C‑643/15 and C‑647/15, EU:C:2017:631, paragraph 236).

321    Since the ECB took into account only the alternative measures capable of being as effective as the measure withdrawing authorisation, it must be held, contrary to what the applicants claim, that the ECB correctly interpreted the criterion that the measure must be necessary.

322    Secondly, the applicants dispute the analysis of the various alternative measures to the measure withdrawing authorisation and claim that the ECB failed to take into account other, less onerous, alternative measures, such as the imposition of concrete measures concerning particular matters within specific deadlines, or the imposition of penalties or fines, or measures against the directors of the credit institution or the appointment of a competent person to monitor the efforts being made by the second applicant to comply with the regulatory requirements which had been infringed.

323    As regards, first, the imposition of concrete measures within strict time limits, that argument is essentially the same as the argument concerning the imposition of a second precept, which will be dealt with in paragraphs 331 to 333 below. As regards, secondly, penalties or fines, it should be noted, as observed by the ECB, that administrative pecuniary penalties do not form part of the prudential measures that the ECB could have regarded as alternatives to withdrawal of authorisation. As regards, thirdly, the other measures suggested by the applicants, in particular with regard to the directors of the credit institution, it must be held that those measures had the same disadvantages as other measures excluded by the ECB, namely that they would not have made it possible to achieve the objective of restoring confidence in the Estonian and European financial markets within the shortest possible period of time, given the long duration of the previous breaches, as was noted in paragraph 3.3.2(b) of the decision of 17 July 2018.

324    In that regard, it is necessary to take into account the gravity, the structural and irremediable nature and the persistence of the breaches over a long period, as well as the loss of confidence in the second applicant’s capacity and genuine desire to remedy the shortcomings identified, as manifested by its failure to comply with the regulatory requirements and by the commission of subsequent breaches following the various interventions of the FSA between 2015 and 2018. That applicant’s conduct was also taken into consideration in assessing the reasonable prospect for each of the alternative measures to bring an end to the breaches committed. Failure to comply with a precept of the FSA, the absence of any change in commercial strategy, despite the various changes in the board of directors, the influence (even indirect) exercised by the controlling shareholders who sat on that applicant’s supervisory board, which was not likely to cease, even in the event of the suspension or cessation of their voting rights, the central and persistent focus of that applicant’s activities on non-resident and high-risk customers, combined with the absence of governance arrangements and procedural rules for risk management appropriate to such a business model, were all factors capable of calling into question the effectiveness of the alternative measures analysed. That was particularly true, at the very least, of all the measures that were not likely to result in the total cessation of the applicant’s activities (namely, recalling the board of directors, the suspension or cessation of the voting rights of certain shareholders and the issuance of a new precept by the FSA).

325    In those circumstances, the withdrawal of authorisation did not go beyond what was appropriate and necessary to attain the objectives of putting an end to the breaches committed by the second applicant.

326    It is true that the self-liquidation of the second applicant or its sale to another investor were measures that could also have resulted in such an effect. Those options, which were not prohibited, could have been exercised by the applicants before the adoption of the decision of 26 March 2018.

327    However, it must be stated, first, that the ‘time’ factor was taken into account, in the context of the assessment of the proportionality and the capacity of those measures to resolve the breaches found, by the ECB, which clearly considered those proposals made by the applicants to be belated and made only in the context of their observations on the FSA’s draft decision withdrawing authorisation, which had been notified to them by the ECB, and the implementation of which was not imminent. Moreover, the veracity of those breaches has not been called into question by the various pleas put forward by the applicants before the Court.

328    Secondly, the ECB’s adoption, in the present case, of the measure withdrawing authorisation also pursued an objective of deterrence, an objective of ‘general prevention’ of the recurrence in the financial services market of conduct such as the AML/CFT breaches. Indeed, it is apparent from paragraph 3.3.2(b)(i), entitled ‘self-liquidation’, of the decision of 17 July 2018, in which the ECB considered that the second applicant’s self-liquidation would have obfuscated the substantive reasons for which its authorisation was withdrawn and that such self-liquidation should be based on Article 16(3) of the Estonian Law on Credit Institutions, rather than on Article 17 of that law, which would have obscured the fact that the second applicant had committed serious breaches, justifying that the termination of its activities be forced and not voluntary. According to the ECB, that constitutes a legitimate objective in the application of the law that the legal basis of its action should also be communicated, as provided for in Article 20(5) of Directive 2013/36.

329    Thus, in the present case, the options of self-liquidation and sale to another investor did not constitute alternative measures to the withdrawal of authorisation for the purposes of achieving the objectives legally pursued by the ECB, within the meaning of the case-law referred to in paragraph 320 above.

330    As regards the seventh and thirteenth pleas, it is appropriate that they be examined together given that they are closely linked. By the seventh plea, the applicants complain that the ECB failed to take into account the fact that the second applicant also carried out activities that were not high-risk. They take the view that the ECB could therefore have adopted the less onerous measure of ending only the part of its activities that were high-risk. Although formulated as a failure to take account of a relevant element of the case, this plea actually seeks to call into question the proportionality of the measure withdrawing authorisation, given the existence of other, less onerous, measures, including the cessation of only the part of its activities that were unlawful. In the thirteenth plea, the applicants challenge the ECB’s exclusion of such an option, namely the adoption of a second precept by the FSA which would have required only the cessation of their activities aimed at non-resident, high-risk customers.

331    As the ECB correctly observes, it is apparent from paragraph 3.2.2(b)(iv) of the decision of 17 July 2018 that the possibility of the FSA adopting another precept (constituting a binding administrative measure) prohibiting the second applicant from providing financial services or limiting that prohibition to the provision of services to non-resident, high-risk customers, which would have amounted to the cessation of its unlawful activities, was taken into account by the ECB.

332    The ECB rejected that measure as not being appropriate because, first, the second applicant had already been the addressee of the precept at issue and the applicant had failed to comply with it, which cast doubt on that applicant’s ability or genuine willingness to comply and, secondly, the high-risk activities constituted the most important part of that applicant’s revenue and, consequently, cessation of such activities would have caused significant monthly operating losses resulting in a risk to its viability and therefore a risk for its depositors.

333    Accordingly, first, the applicants cannot validly complain that the ECB failed to take sufficient account of the fact that the second applicant had activities that were not high-risk and cannot maintain that the ECB could therefore have adopted the less onerous measure of ceasing only part of its activities, since it had previously been considered that that measure would be ineffective. Secondly, it must be noted that the applicants, by their general and unsupported assertion seeking to deny that that option would lead to a viability risk, as maintained by the ECB, have not succeeded in challenging that assessment, which is entirely reasonable.

334    Moreover, as regards the applicants’ arguments seeking to dispute the finding that the second applicant was not willing to comply with the precept at issue, by merely asserting that that precept was vague and that it had not been possible to comply with it, those arguments must be rejected for the same reasons as those set out in paragraphs 276 to 288 above. Furthermore, it should be noted that the applicants do not dispute the failure to comply with that precept, as found in the decision of 17 July 2018, nor do they provide any arguments capable of demonstrating how that applicant could, in practice, have complied with a second FSA precept prohibiting its high-risk activities.

335    Accordingly, the seventh and thirteenth pleas must be rejected.

336    In the context of the eighth plea, the applicants complain, in essence, that the ECB did not give sufficient weight to the second applicant’s substantial reduction of customers in high-risk categories.

337    In the present case, it is sufficient to note that, in paragraph 3.3.1(b)(i) of the decision of 17 July 2018, the ECB did indeed take into account the reduction of the second applicant’s customers in high-risk categories and the closure of their bank accounts, in particular concerning the accounts relating to acquaintances and associates of that applicant’s shareholders, together with other measures effectively adopted by that applicant in order to comply with the infringed regulatory requirements. However, it must be stated that the ECB emphasised, on the basis of the FSA’s findings, that the problem was not limited to that group of customers, but was structural in nature. In addition, other infringements of a number of regulatory requirements concerning the lack of adequate governance arrangements adapted to the business model, that is to say, its own business model which remained substantially unchanged, even where there was a reduction in high-risk customers or changes to the board of directors, continued to exist, a fact which the applicants do not dispute.

338    The applicants merely challenge the fact that the ECB had to require full compliance, taking the view that it should have contented itself with partial compliance and the efforts made by the second applicant, even after all the warnings which the FSA had already sent to that applicant and the opportunities which the latter had had to comply with it, before the adoption of the draft decision to withdraw authorisation. In addition, it must be stated that the applicants do not call into question the ECB’s conclusion that other infringements continued to exist. Moreover, the argument that full compliance with the regulatory requirements was not possible contradicts the complaint that the ECB did not grant the second applicant sufficient time to achieve such full compliance.

339    In those circumstances, the eighth plea must also be rejected.

340    As regards the ninth plea, it must be observed that this is stated in general terms and is not sufficiently clear and precise, with the result that it does not meet the minimum formal requirements laid down by Article 76 of the Rules of Procedure. In any event, even if this plea were admissible, in so far as it concerns the failure to take into account any other measure, without specific identification of such a measure, it is sufficient to recall, as observed by the ECB, that the latter is not obliged to analyse every theoretically possible measure, but only those that are relevant and have a reasonable prospect of achieving the same objectives. It is apparent from paragraph 311 above (and from paragraph 3.3.2(b) of the decision of 17 July 2018) that the ECB carried out such an examination in detail. If, on the other hand, the second applicant wishes to criticise the ECB’s conclusions rejecting the other alternative measures taken into account and analysed, reference must be made to the considerations developed in the context of the analysis of the other pleas, in which the second applicant sets out more specific criticisms of the assessment of each of those other alternative measures.

341    Accordingly, the ninth plea must be rejected as inadmissible or, in any event, unfounded.

342    By the tenth and eleventh pleas in law, the applicants challenge the ECB’s consideration of alternative measures to the measure withdrawing authorisation relating to the recall of the board of directors of the second applicant and the cessation of the voting rights of certain shareholders of that applicant.

343    In that respect, it is sufficient to note that the alternative measures in question were taken into account and subsequently rejected by the ECB. Accordingly, they cannot adversely affect the second applicant. It follows that the tenth and eleventh pleas in law must be rejected as inoperative.

344    Lastly, the fourteenth and fifteenth pleas in law, in so far as, rather than claiming lack of competence on the part of the ECB (see paragraph 203 above), they seek to call into question the ECB’s assessment of proportionality with regard to the alternative measures to the withdrawal of authorisation relating to self-liquidation of the second applicant and its sale to another investor, must be rejected on the same grounds as those set out in paragraphs 326 to 329 above.

345    In the light of all of the foregoing, it must be concluded that the analysis of the proportionality of the measure withdrawing authorisation is not vitiated by errors of assessment.

346    The present group of pleas must therefore be rejected.

6.      The sixteenth and eighteenth pleas, alleging infringement of the principles of equal treatment and non-discrimination, the protection of legitimate expectations and legal certainty

347    By their sixteenth plea, the applicants argue that the decision of 17 July 2018 infringes the principle of equal treatment and non-discrimination in that it does not contain any comparative analysis between the situation of the second applicant, in terms of AML/CFT, and that of other comparable banks, either in Estonia or elsewhere. They assert that that decision does not contain any relevant information from the FSA in that regard and that the FSA chose to make an example of the second applicant, not because of the seriousness of its breaches, but because of its small size, its financial strength, which facilitated liquidation, and the fact that it was owned by foreigners, who would have found it more difficult to oppose the action taken.

348    The ECB disputes the applicants’ arguments.

349    It is apparent from settled case-law that the principle of equal treatment is a general principle of EU law, now enshrined in Articles 20 and 21 of the Charter of Fundamental Rights of the European Union, which requires that comparable situations must not be treated differently and that different situations must not be treated in the same way unless such treatment is objectively justified (see judgment of 9 March 2017, Milkova, C‑406/15, EU:C:2017:198, paragraph 55 and the case-law cited, and Opinion 1/17 (EU-Canada CET Agreement) of 30 April 2019, EU:C:2019:341, paragraph 176 and the case-law cited).

350    Furthermore, it is appropriate to recall that the principle of equal treatment must be reconciled with the principle of legality and thus a person may not rely, in support of his or her claim, on an unlawful act committed in favour of a third party (see judgment of 16 May 2017, Landeskreditbank Baden-Württemberg v ECB, T‑122/15, EU:T:2017:337, paragraph 84 and the case-law cited).

351    Moreover, it has been held, in particular in relation to sanctions for competition infringements, that an institution’s previous decision-making practice does not itself serve as a legal framework for the fines imposed in competition matters and that decisions in other cases can give only an indication for the purpose of determining whether there is discrimination (see, to that effect and by analogy, judgment of 11 July 2013, Ziegler v Commission, C‑439/11 P, EU:C:2013:513, paragraph 134 and the case-law cited).

352    In the present case, it must be noted that the applicants allege a breach of the principle of equal treatment by merely invoking the absence of a comparative analysis between the breaches alleged against the second applicant and those committed by other credit institutions.

353    In the first place, it must be stated that an analytical comparison between the person responsible for an unlawful act and other persons who have committed other similar unlawful acts is not necessary in order to take action against a natural or legal person in respect of unlawful conduct. The only analysis that must be carried out is an assessment as to the veracity of the facts constituting infringements in relation to a legal provision requiring a certain line of conduct. The gravity of conduct does not need to be assessed in relation to the gravity of the conduct of other persons, but only in relation to the legal standards required by the applicable legal provisions, with that gravity being relevant only for determining the appropriate sanction. Furthermore, it is apparent from the case-law referred to in paragraph 351 above that, even if there had been other decisions concerning the withdrawal of authorisation of other credit institutions for infringements of AML/CFT regulatory requirements, the ECB would not be bound by such decisions.

354    In the second place, in so far as the applicants reiterate that the ECB was not entitled to use the AML/CFT standards for prudential purposes, on the ground that it lacked competence in that regard, that argument must be rejected for the reasons set out in paragraphs 185 to 190 above, and it should be recalled that the infringement of AML/CFT standards constitutes a ground for withdrawal of authorisation provided for in Article 18(f) of Directive 2013/36, read in conjunction with Article 67(1) of that directive.

355    Lastly, the applicants’ bald and entirely unsubstantiated allegations concerning the alleged reasons why the ECB chose the second applicant as the first credit institution to be penalised in Estonia for infringement of AML/CFT standards must also be rejected.

356    It follows that the present plea cannot succeed either.

357    In the eighteenth plea, the applicants allege that the decision of 17 July 2018 also infringes the principles of legitimate expectations and legal certainty, in that the FSA avoided any concrete discussion of the concerns alleged and misled the second applicant’s new management team by failing to disclose the assessments allegedly made as to whether the credit institution was failing or likely to fail. Moreover, that applicant was not in a position to expect that authorisation would be withdrawn following the FSA’s precept.

358    The ECB, supported by the Commission, disputes the applicants’ arguments.

359    According to settled case-law, the right to rely on the principle of the protection of legitimate expectations extends to any person in a situation where an EU authority has caused him or her to have justified expectations. Nevertheless, the right to rely on that principle requires that three conditions be satisfied cumulatively. First, precise, unconditional and consistent assurances originating from authorised and reliable sources must have been given to the person concerned by the EU authorities. Secondly, those assurances must be such as to give rise to a legitimate expectation on the part of the person to whom they are addressed. Thirdly, the assurances given must be consistent with the applicable rules (see judgment of 7 October 2015, Accorinti and Others v ECB, T‑79/13, EU:T:2015:756, paragraph 75 and the case-law cited).

360    Furthermore, it should be borne in mind that, while the possibility of relying on the protection of legitimate expectations, as a fundamental principle of EU law, is available to any economic operator whom an institution has caused to have justified expectations, the fact remains that, where a prudent and circumspect economic operator is able to foresee the adoption of an EU measure likely to affect his or her interests, he or she cannot rely on that principle if the measure is adopted. Nor can economic operators have a legitimate expectation that an existing situation which is capable of being altered by the EU institutions in the exercise of their discretion will be maintained, especially in an area such as monetary policy, the subject matter of which is constantly being adjusted according to variations in the economic situation (see judgment of 7 October 2015, Accorinti and Others v ECB, T‑79/13, EU:T:2015:756, paragraph 76 and the case-law cited).

361    Lastly, the principle of the protection of legitimate expectations cannot be relied on by a person who has infringed the legislation in force (see judgment of 23 January 2019, Fallimento Traghetti del Mediterraneo, C‑387/17, EU:C:2019:51, paragraph 68 and the case-law cited).

362    In the present case, as a preliminary point, it should be noted that the applicants allege infringement of the principle of the protection of legitimate expectations solely on the basis of the same arguments as those put forward in support of their allegation of infringement of the principle of legal certainty, without in any way claiming that the second applicant received precise and unconditional assurances from the FSA or the ECB as regards maintenance of its authorisation. Moreover, the conduct complained of is the conduct of the NCA and not that of the ECB.

363    In addition, in the first place, it must be stated that not only did the second applicant not receive any precise assurances, within the meaning of the case-law referred to in paragraph 359 above, that its authorisation would not be withdrawn, but it also received sufficient warnings to the contrary from the FSA.

364    It is apparent from paragraph 3.2(d) of the decision of 17 July 2018 that, first, the FSA had two meetings with the second applicant’s supervisory board and board of directors on 2 September and 30 October 2015, and a meeting with the owner and board of directors on 30 November 2015, during which the FSA gave warning that that applicant had to change its governance arrangements and customer due diligence procedures and that, if the AML/CFT breaches continued, any supervisory measure could be adopted. Secondly, after the adoption of the precept, on 9 August 2016, the FSA had another meeting with a member of that applicant’s supervisory board, during which the FSA discussed the unlawful establishment of a branch in Latvia and made it clear that it considered that the breaches found were serious and that it would envisage withdrawing that applicant’s authorisation if it did not remedy the problems identified. Thirdly, the FSA also held two meetings in November 2016 and one in January 2017 with that applicant’s board of directors, during which it stressed the need to change that applicant’s governance arrangements and again stated that, if the breaches did not cease, any supervisory measure could be adopted. Fourthly, on 28 February 2017, the FSA informed the applicant concerned that it considered that that precept had been partly infringed and, on 5 April 2017, it sent the applicant a request for information concerning its possible involvement in a money-laundering plan referred to by the media as the ‘Russian Laundromat’. Fifthly, the FSA issued, on 10 April 2017, a declaration that that applicant was failing or likely to fail. On 7 February 2018, it adopted the FOLTF decision, according to which there was no public interest in taking resolution measures. Sixthly, on 7 August 2017, it refused to notify 23 countries of that applicant’s intention to continue providing cross-border financial services. Seventhly, in a final on-site inspection between 4 and 22 September 2017, it detected further AML/CFT breaches. Lastly, it was not until 8 February 2018 that the FSA proposed to the ECB that that applicant’s authorisation be withdrawn.

365    In the second place, even if the second applicant had received such assurances, it could not rely on them, given that, first, in the circumstances described in paragraph 362 above, it was in a position where it was able to foresee the adoption of an EU measure likely to affect its interests, within the meaning of the case-law referred to in paragraph 360 above, and, secondly, it was in an unlawful situation for the purposes of the case-law referred to in paragraph 361 above.

366    It follows from the foregoing that the present group of pleas must be rejected.

7.      The twentieth to twenty-second pleas, alleging infringement of essential procedural requirements

367    By the twentieth and twenty-first pleas, alleging infringement of the rights of the defence and of the right to be heard, the applicants submit, first, that the period of five days which was granted to the second applicant to submit its observations on the draft withdrawal of authorisation was insufficient and, secondly, that the failing or likely to fail declarations were not communicated to them during the procedure and that they were relevant, contrary to what the ECB asserts. Thirdly, they claim that the ECB has not explained why the matter was urgent. Lastly, the applicants claim that the provisions of the SSM Framework Regulation which provide for a period of three days for the submission of observations on the draft withdrawal of authorisation constitute a disproportionate and arbitrary limitation on the right of credit institutions to an effective remedy and are therefore unlawful.

368    In their twenty-second plea, the applicants invoke a breach of the duty to give reasons, arguing that the reasoning underlying the decision of 17 July 2018 is superficial and vague, and does not identify clearly the especially serious breaches which justified the withdrawal of authorisation of the second applicant, by reference to industry-wide compliance standards.

369    The ECB, supported by the Commission, disputes the applicants’ arguments.

(a)    Infringement of the right to be heard

370    As a preliminary point, it should be noted that Article 31 of the SSM Framework Regulation, entitled ‘Right to be heard’, is worded as follows:

‘1.      Before the ECB may adopt an ECB supervisory decision addressed to a party which would adversely affect the rights of such party, the party must be given the opportunity of commenting in writing to the ECB on the facts, objections and legal grounds relevant to the ECB supervisory decision. …

…

3.      The party shall, in principle, be given the opportunity to provide its comments in writing within a time limit of two weeks following receipt of a statement setting out the facts, objections and legal grounds on which the ECB intends to base the ECB supervisory decision.

On application of the party, the ECB may extend the time limit as appropriate.

In particular circumstances, the ECB may shorten the time limit to three working days. The time limit shall also be shortened to three working days in the situations covered by Articles 14 and 15 of the [Basic] SSM Regulation.

4.      Notwithstanding paragraph 3, and subject to paragraph 5, the ECB may adopt an ECB supervisory decision addressed to a party which would adversely affect the rights of such party without giving the party the opportunity to comment on the facts, objections and legal grounds relevant to the ECB supervisory decision prior to its adoption if an urgent decision appears necessary in order to prevent significant damage to the financial system.

5.      If an urgent ECB supervisory decision is adopted in accordance with paragraph 4, the party shall be given the opportunity to comment in writing on the facts, objections and legal grounds relevant to the ECB supervisory decision without undue delay after its adoption. The party shall, in principle, be given the opportunity to provide its comments in writing within a time limit of two weeks from receipt of the ECB supervisory decision. On application of the party, the ECB may extend the time limit; however, the time limit may not exceed six months. The ECB shall review the ECB supervisory decision in the light of the party’s comments and may either confirm it, revoke it, amend it or revoke it and replace it by a new ECB supervisory decision.

…’

371    According to settled case-law, an integral part of respect for the rights of the defence is the right to be heard, which guarantees every person the opportunity to make known his or her view effectively during an administrative procedure and before the adoption of any decision liable to affect his or her interests adversely. In accordance with the case-law of the Court of Justice, the purpose of the rule that the addressee of an adverse decision must be placed in a position to submit his or her observations before that decision is taken is to put the competent authority in a position effectively to take all relevant information into account (see judgment of 16 October 2019, Glencore Agriculture Hungary, C‑189/18, EU:C:2019:861, paragraph 41 and the case-law cited).

372    In the present case, it is apparent from paragraph 3.1(a) of the decision of 17 July 2018 that, since that decision was adopted on the basis of Article 14(5) of the Basic SSM Regulation, the prescribed period for submitting observations should have been three days and that the ECB decided to exercise its discretion to extend that period to five working days.

373    First, it should be noted that the ECB correctly applied the relevant provisions of the SSM Framework Regulation relating to the right of credit institutions to which a decision of the ECB is addressed to be heard, namely Article 31(3) of that framework regulation.

374    Secondly, it must be held, as observed by the ECB, that the EU legislature carried out an assessment as to the reasonableness of the period laid down by those provisions by weighing the relevant opposing interests, on the one hand, the private interests of the credit institutions in having as much time as possible to make their observations and, on the other, the public interest in having legality restored as quickly as possible. The applicants cannot therefore call into question the reasonableness of the periods laid down in the SSM Framework Regulation, unless they raise a formal plea of illegality against the provisions concerned.

375    In so far as the applicants raise a plea of illegality in respect of the provisions of the SSM Framework Regulation, in relation to the disproportionate nature of the period prescribed for submitting observations on a proposed withdrawal of authorisation, it must be rejected as inadmissible since it was raised out of time. The applicants raised that plea only at the stage of the reply. It is clear from the case-law that the subject matter of the dispute is to be stated in the application and a plea of illegality is inadmissible at the stage of the reply. Furthermore, the plea of illegality, in the present case, is not based on any matter of law or of fact which came to light in the course of the procedure, within the meaning of Article 84(2) of the Rules of Procedure (see, to that effect and by analogy, judgment of 27 September 2005, Common Market Fertilizers v Commission, T‑134/03 and T‑135/03, EU:T:2005:339, paragraph 51 and case-law cited).

376    Thirdly, the applicants’ claim concerning the lack of urgency is ineffective, in so far as the ECB did not apply, in the present case, the relevant provisions of the SSM Framework Regulation, namely Article 31(4) and (5) thereof. In reality, the ECB correctly applied the third subparagraph of Article 31(3) of that framework regulation, given that it adopted its decision on the basis of Article 14 of the Basic SSM Regulation, a situation in which the time allowed for the parties to be heard is reduced to three working days.

(b)    The breach of the rights of the defence

377    As regards the breach of the rights of the defence, the applicants add only that the failing or likely to fail declarations were not communicated to them.

378    In that regard, it is sufficient to recall that, as is apparent from the considerations set out in paragraphs 147 to 152 above, the failing or likely to fail declarations are merely non-binding preparatory acts preceding possible resolution measures, the adoption of which does not necessarily entail the adoption of such a measure under the SRM Regulation and that there is no functional equivalence between a failing or likely to fail assessment and a withdrawal of authorisation, even if the facts underlying the two acts may overlap, since the conditions for withdrawal of authorisation are clearly different from the considerations underlying a failing or likely to fail assessment.

379    Thus, in the present case, as the ECB rightly points out, the failing or likely to fail declarations were based on grounds different from the grounds of the decision to withdraw authorisation. On the other hand, in so far as they overlapped, those grounds were included in the FSA’s draft decision withdrawing authorisation, the only one relevant to the present case, on which the second applicant was given the opportunity to submit observations. Consequently, the complaint that the failing or likely to fail declarations were not communicated is to be rejected as inoperative.

380    Furthermore, the applicants cannot criticise the FSA for not having engaged in a dialogue with the management and shareholders of the supervised entity with a view to achieving full compliance. It is apparent from paragraphs 23, 39 and 278 above that the second applicant was undeniably given several warnings and opportunities to engage in dialogue with the FSA and that the FSA cooperated sufficiently to explain throughout the procedure in what ways the shortcomings identified were continuing.

(c)    The breach of the duty to state reasons

381    It should be noted, as a preliminary point, that, according to the second subparagraph of Article 22(2) of the Basic SSM Regulation, decisions of the ECB must state the reasons on which they are based.

382    Under Article 33(1) and (2) of the SSM Framework Regulation, an ECB supervisory decision must be accompanied by a statement of the reasons for that decision. The statement of reasons must contain the material facts and legal reasons on which the ECB supervisory decision is based.

383    Article 39(1) of the same SSM Framework Regulation provides that ‘a supervised entity shall be considered a significant supervised entity if the ECB so determines in an ECB decision addressed to the relevant supervised entity …, explaining the underlying reasons for such decision’.

384    It should be noted that the provisions referred to in paragraphs 381 to 383 above merely reiterate, in the body of the Basic SSM Regulation and of the SSM Framework Regulation, the obligation to state reasons by which EU institutions and bodies are bound under the second paragraph of Article 296 TFEU (judgment of 16 May 2017, Landeskreditbank Baden-Württemberg v ECB, T‑122/15, EU:T:2017:337, paragraph 121).

385    The obligation to state reasons laid down in Article 296 TFEU is an essential procedural requirement, as distinct from the question whether the reasons given are correct, which goes to the substantive legality of the contested measure (see judgment of 16 May 2017, Landeskreditbank Baden-Württemberg v ECB, T‑122/15, EU:T:2017:337, paragraph 122 and the case-law cited).

386    In that vein, first of all, the statement of reasons required under Article 296 TFEU must be appropriate to the measure in question and must disclose in a clear and unequivocal fashion the reasoning followed by the institution which adopted that measure, in such a way as to enable the persons concerned to ascertain the reasons for the measure and to enable the competent court to carry out its review. As regards, in particular, the reasons given for individual decisions, the purpose of the obligation to state the reasons on which an individual decision is based is, therefore, in addition to permitting review by the Courts, to provide the person concerned with sufficient information to know whether the decision may be vitiated by an error enabling its validity to be challenged (see judgment of 16 May 2017, Landeskreditbank Baden-Württemberg v ECB, T‑122/15, EU:T:2017:337, paragraph 123 and the case-law cited).

387    Furthermore, the requirements to be satisfied by the statement of reasons depend on the circumstances of each case, in particular the content of the measure in question, the nature of the reasons given and the interest which the addressees of the measure, or other parties to whom it is of direct and individual concern, may have in obtaining explanations. It is not necessary for the statement of reasons to specify all the relevant matters of fact and law, since the question whether the statement of reasons meets the requirements of Article 296 TFEU must be assessed with regard not only to its wording but also to its context and to all the legal rules governing the matter in question (see judgment of 16 May 2017, Landeskreditbank Baden-Württemberg v ECB, T‑122/15, EU:T:2017:337, paragraph 124 and the case-law cited).

388    In the present case, it is sufficient to note that the decision of 17 July 2018 is very clearly structured (it contains a procedural part, a part recalling the facts giving rise to the case, a part summarising the shortcomings identified based on the FSA’s draft decision to withdraw authorisation, and a part analysing the proportionality of the measure withdrawing authorisation based on the ECB’s own analysis) and exhaustively sets out the factual and legal elements on which each part is based. In addition, it should be pointed out that that decision was taken in the context of a multi-year dialogue between the second applicant and the FSA, as described in paragraph 364 above, from which it may be concluded that the second applicant was undoubtedly aware of the factual and procedural context referred to in that decision, within the meaning of the case-law referred to in paragraph 387 above. Furthermore, it should be noted that the statement of reasons for that decision enabled the second applicant to understand the reasons justifying its adoption and to formulate its challenges and enabled the Courts of the European Union to exercise their power of review, in accordance with the case-law referred to in paragraph 386 above.

389    It follows from all the foregoing that the present group of pleas must be rejected.

8.      The twenty-third and twenty-fourth pleas, alleging, inter alia, infringement of the right of access to the second applicant’s file and of the shareholder’s rights in the context of the review procedure

390    In the twenty-third plea, the applicants allege a breach of the right of access to the second applicant’s file. In their view, the ECB unlawfully refused the access requested before the request for review was submitted, even though the documents requested by the first applicant were necessary for it to prepare that request. Conversely, the ECB granted such access after the ABoR declared the request for review to be admissible, although it, in effect, denied access by supplying only 23 out of the 230 documents in the file, as it considered all the others to be confidential.

391    By their twenty-fourth plea, the applicants allege several infringements of the first applicant’s rights in connection with the review procedure, which, it is claimed, vitiate the lawfulness of the decision of 17 July 2018, to the point of justifying its annulment.

392    In the first place, they submit, the ECB erred in its decision of 26 March 2018 in so far as that decision contained incorrect information to the effect that the credit institution alone was entitled to submit a request for review, whereas the ABoR’s decision considered that the shareholder was also entitled to submit such a request. Moreover, the ECB did not notify that decision to the first applicant, even though it had the right to request a review of the decision.

393    In the second place, the applicants complain that the ECB did not grant the first applicant access to the file before the hearing before the ABoR, thereby preventing it from properly formulating and adequately substantiating its request for review, on the basis of purported confidentiality.

394    In the third place, the first applicant’s right to be heard was limited because of the unduly short period it was granted to make additional observations after being given access to the file.

395    In the fourth place, the applicants claim that the ECB did not grant the ABoR access to the full version of the decision of 26 March 2018, which was only lodged by the first applicant in the redacted version it had available, having found it on the FSA’s website. The possibility of obtaining an impartial and objective review was further undermined by limiting the ABoR’s assessment to the legal issues and complaints raised in the request for review, a limitation provided for in Article 10(2) of Decision 2014/360, which has no basis in Article 24 of the Basic SSM Regulation.

396    In the fifth place, the applicants criticise the ECB for not involving in the review procedure the representatives, such as the liquidators or former directors, of the second applicant, which is manifestly contrary to the principles of a fair hearing and infringes the right to be heard of that applicant, the subject of that decision.

397    In the sixth place, the applicants allege failure to state reasons in the decision of 17 July 2018, in so far as it does not include the reasons for rejecting the request for review. The possibility of also taking into account the reasoning contained in that committee’s opinion cannot compensate for the lack of reasoning in that decision, since the requirement laid down in Article 24(9) of the Basic SSM Regulation cannot be satisfied by per relationem reasoning.

398    The ECB, supported by the Commission, disputes the applicants’ arguments.

399    As a preliminary point, it should be recalled that, under Article 22(2) of the Basic SSM Regulation, Article 32 of the SSM Framework Regulation and Article 20 of Decision 2014/360, the rights of defence of the persons concerned are to be fully respected in the procedure. They are entitled to have access to the ECB’s file, subject to the legitimate interest of other persons in the protection of their business secrets. The right of access to the file does not extend to confidential information.

400    In addition, under Article 24(5) of the Basic SSM Regulation, any natural or legal person may request a review of a decision of the ECB which is addressed to that person, or is of a direct and individual concern to that person.

401    In the present case, it should be noted, in the first place, that the second applicant did not submit a request for review under Article 24 of the Basic SSM Regulation, even though it was entitled to do so. In the second place, with regard to the first request for access made by the first applicant, on 15 April 2018 that applicant submitted a request for access, after the end of the initial supervisory procedure that had led to the decision of 26 March 2018.

402    The decision of 26 March 2018 was not addressed to the first applicant and the latter cannot be regarded as having been directly and individually concerned by it, in accordance with the case-law of the Court of Justice (see, to that effect, judgment of 5 November 2019, ECB and Others v Trasta Komercbanka and Others, C‑663/17 P, C‑665/17 P and C‑669/17 P, EU:C:2019:923, paragraphs 108 to 114 and 119).

403    In those circumstances, the ECB did not err in not granting access to the file to the first applicant, which was not a party concerned, for the purposes of Article 22(2) of the Basic SSM Regulation and Articles 26 and 32 of the SSM Framework Regulation, at the time of submitting its first application.

404    As regards the second request for access, submitted on 26 April 2018 in conjunction with the request for review of the decision of 26 March 2018, and the other complaints concerning the conduct of the procedure, it must be pointed out that the ABoR accepted as admissible the first applicant’s request for review on the basis of Article 24(5) of the Basic SSM Regulation. The admissibility criteria laid down by that provision, which are the same as those laid down in Article 263 TFEU for judicial proceedings, were considered to be met in the case of that applicant on the basis of the order of 12 September 2017, Fursin and Others v ECB (T‑247/16, not published, EU:T:2017:623). Accordingly, the ABoR also accepted that applicant’s application for access to the file, in its capacity as an applicant for review, pursuant to Article 20 of Decision 2014/360.

405    However, in that regard, it should be noted that the first applicant would not have been found to be entitled to submit a request for review in the absence of the order of 12 September 2017, Fursin and Others v ECB (T‑247/16, not published, EU:T:2017:623), and that that order has since been set aside by the Court of Justice by the judgment of 5 November 2019, ECB and Others v Trasta Komercbanka and Others (C‑663/17 P, C‑665/17 P and C‑669/17 P, EU:C:2019:923). Consequently, that applicant was in fact granted possibilities, such as the review procedure, which is an additional remedy to judicial remedy, and access to the file, which it should not, in fact, have had.

406    In those particular circumstances, which are not likely to recur, since the order of 12 September 2017, Fursin and Others v ECB (T‑247/16, not published, EU:T:2017:623), on which the ABoR relied, was set aside by the Court of Justice, and in view of the fact that the first applicant was not entitled to bring the present action, in so far as it concerns the application for annulment of the decision of 17 July 2018, as is evident from paragraph 100 above, and the fact that the second applicant is not entitled to raise such pleas, since it was not a party to the review procedure, having chosen not to submit such a request, although it was entitled to do so, the pleas alleging infringement of the rights of the defence in the review procedure must be rejected as inadmissible.

407    In any event, even if those pleas were to be regarded as admissible, they could not lead to annulment of the decision of 17 July 2018, since, even in the absence of those procedural irregularities, the outcome of the decision would have been the same (see, to that effect, judgment of 14 February 1990, France v Commission, C‑301/87, EU:C:1990:67, paragraph 31), as is apparent from the analysis in paragraphs 105 to 389 above.

9.      The twenty-fifth plea in law, advanced in support of the application for annulment of the decision on costs, alleging that the decision of 17 July 2018 was unlawful

408    The twenty-fifth plea in law, advanced in support of the application for annulment of the decision on costs, alleges that the decision of 17 July 2018 was unlawful.

409    The ECB, supported by the Commission, disputes the applicants’ arguments.

410    In the present case, none of the pleas put forward in Case T‑584/18 supports the conclusion that the decision of 17 July 2018 is unlawful.

411    Consequently, the present plea in law must be rejected.

10.    The application for measures of inquiry

412    The applicants have requested, on a number of occasions in their written pleadings, that the Court adopt various measures of inquiry concerning: first, an order that the ECB and the FSA produce documents, including the FOLTF decisions; secondly, an order to produce documents proving that the ECB took a decision on self-liquidation and the witness statements of the ECB officials concerned; thirdly, an order that the ECB and the Republic of Estonia disclose the findings that AML/CFT legislation had been infringed and the witness statement of the FSA chairman and the ECB officials concerned; and, fourthly, an order that the ECB identify the specific misleading statements which were allegedly made by the applicants and disclose the documents establishing that the ECB and the FSA exchanged correspondence concerning the issue of the branch in Latvia, which remained an unresolved issue in the Latvian administrative settlement, and to summon the FSA chairman and the ECB officials concerned as witnesses.

413    The ECB opposes the applicants’ request for measures of inquiry, since it does not satisfy the conditions imposed by the case-law and by Article 88 of the Rules of Procedure, relating, in particular, to the relevance and necessity of the information requested for the purpose of establishing certain facts and resolving the dispute.

414    As a preliminary point, it should be noted that the applicants’ request constitutes a request for measures of inquiry, within the meaning of Article 91(b) to (d) of the Rules of Procedure, proposed under Article 88(1) of those rules.

415    It is apparent from Article 88(2) of those rules of procedure that the application referred to in paragraph 1 thereof must state precisely the purpose of the measures sought and the reasons for them. In addition, that provision states that, where the application is made after the first exchange of pleadings, the party submitting that application must state the reasons for which he or she was unable to submit it earlier.

416    In the present case, most of the requests for measures of inquiry, with the exception of the request for production of the ‘FOLTF decisions’, were made for the first time at the reply stage. The applicants do not in any way explain in their application the reasons for this delay. Consequently, those applications must be rejected as inadmissible.

417    In any event, it must be held that the requests for measures of inquiry are not sufficiently precise as to their purpose or the relevance of the testimonies and documents requested.

418    It should be noted, as observed by the ECB and the Commission, in the first place, that the matters in regard to which the applicants request that witnesses be heard are not intended to establish the facts, but to confirm a series of mere unsubstantiated allegations made by the applicants. Even if those allegations were confirmed, they would not be relevant to the outcome of the case. Furthermore, it must be noted that the application to hear witnesses is also partially imprecise as regards the persons to be heard.

419    In the second place, so far as the requests for the production of documents are concerned, first, as regards the ‘FOLTF decisions’ (the only application for measures of inquiry lodged at the application stage and therefore not out of time), it must be rejected on the basis of the considerations set out in paragraph 181 above. Secondly, as has been established in paragraph 279 above, the findings of infringement of the AML/CFT legislation are sufficiently clear from the decision of 17 July 2018. Thirdly, it is apparent from paragraph 267 above that the determination of whether or not the issue of the branch in Latvia was still an open question for the FSA and the ECB is not a necessary element for the resolution of the dispute.

420    It follows from the foregoing that the applications for measures of inquiry must be rejected as being out of time and partially unfounded or, in the alternative, as unfounded in their entirety.

421    In the light of all of the foregoing, the action in Case T‑584/18 must be dismissed in its entirety.

 Costs

422    Under Article 137 of the Rules of Procedure, where a case does not proceed to judgment the costs are to be in the discretion of the Court.

423    In view of the considerations which have led the Court to find that there is no longer any need to adjudicate in Case T‑351/18, it is fair in the circumstances of the case to order that each party is to bear its own costs.

424    Under Article 134(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the applicants have been unsuccessful in Case T‑584/18, they must be ordered to bear their own costs and to pay those of the ECB, in accordance with the form of order sought by the latter.

425    In accordance with Article 138(1) of the Rules of Procedure, the institutions which have intervened in the proceedings are to bear their own costs. The Commission must therefore bear its own costs in Case T‑584/18.

On those grounds,

THE GENERAL COURT (Ninth Chamber, Extended Composition)

hereby:

1.      Orders that Cases T‑351/18 and T‑584/18 be joined for the purposes of the judgment;

2.      Declares that there is no longer any need to adjudicate on the action in Case T‑351/18;

3.      Dismisses the action in Case T‑584/18;

4.      Orders Ukrselhosprom PCF LLC, Versobank AS, the European Central Bank (ECB) and the European Commission each to bear their own costs in Case T‑351/18;

5.      Orders Ukrselhosprom PCF and Versobank, in Case T‑584/18, to bear their own costs and to pay those of the ECB;

6.      Orders the Commission to bear its own costs in Case T‑584/18.

Delivered in open court in Luxembourg on 6 October 2021.

Table of contents

I. Background to the dispute

II. Procedure and forms of order sought

A. Beginning of the proceedings and forms of order sought by the parties in Case T351/18

B. Beginning of the proceedings and forms of order sought by the parties in Case T584/18

C. Continuation of the proceedings in both cases

III. Law

A. Whether the subject matter of the dispute in the main proceedings still obtains and the legal interest of the applicants in bringing proceedings in Case T351/18

B. Admissibility in Case T584/18

1. Admissibility of the claim for annulment of the decision of 17 July 2018

2. Admissibility of the application for annulment of the decision on costs

C. Substance

1. The first, second, fourteenth, fifteenth and nineteenth pleas

(a) The division of powers between the ECB and the NCAs of the Member States participating in the SSM concerning withdrawal of authorisation for infringement of AML/CFT rules

(b) The first part, concerning the ECB’s lack of competence to withdraw authorisation from a credit institution, where the NCA had already issued a failing or likely to fail declaration

(c) The second part, concerning the ECB’s lack of competence to assess matters relating to AML/CFT

(d) The third part, concerning the lack of power of the ECB to refuse to permit self-liquidation or sale of the second applicant to another investor

(e) The fourth part, concerning misuse of powers

2. The third plea, alleging that the ECB failed in its duty to conduct a careful and impartial assessment

3. The fourth and fifth pleas, alleging errors of assessment or failure to take into account certain relevant aspects of the case

(a) The fifth plea, alleging failure to take into account the positive impact of the new management team of the second applicant

(b) The fourth plea, alleging an error of assessment concerning the erroneous nature of the information on the second applicant’s activities in Latvia

4. The sixth, twelfth and eighteenth pleas in law, alleging an error of assessment in so far as the ECB wrongly based its decision on breach of the FSA precept and infringement of the principle of legal certainty

5. The seventh to eleventh, thirteenth to fifteenth and seventeenth pleas, alleging breach of the principle of proportionality

6. The sixteenth and eighteenth pleas, alleging infringement of the principles of equal treatment and non-discrimination, the protection of legitimate expectations and legal certainty

7. The twentieth to twenty-second pleas, alleging infringement of essential procedural requirements

(a) Infringement of the right to be heard

(b) The breach of the rights of the defence

(c) The breach of the duty to state reasons

8. The twenty-third and twenty-fourth pleas, alleging, inter alia, infringement of the right of access to the second applicant’s file and of the shareholder’s rights in the context of the review procedure

9. The twenty-fifth plea in law, advanced in support of the application for annulment of the decision on costs, alleging that the decision of 17 July 2018 was unlawful

10. The application for measures of inquiry

Costs

*      Language of the case: English.

© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.