Navigating Public International Law: ECB Banking Supervision and Cross-border On-site Inspections

Table of Contents: 1. Introduction. – 2. ECB supervision of banks. – 3. On-site visits, extraterritorial enforcement and international law. – 4. International agreements concerning extraterritorial inspections. – 4.1. Memoranda of Understanding and on-site visits. – 4.2. Qualifying the ECB MoUs under international law. – 5. The legal status of MoUs and their consequences. – 6. Extraterritorial on-site visits without State consent. – 7. Means of obtaining information short of inspections. – 8 Understanding the power differential between the ECB and third States. – 9. Concluding observations.

Abstract: Since the establishment of the Single Supervisory Mechanism (SSM), the European Central Bank (ECB) has exercised wide-ranging supervisory and investigatory powers over significant banks in participating Member States. These powers extend, at least textually, to foreign subsidiaries and third-country providers, raising acute tensions with the prohibition of extraterritorial enforcement jurisdiction under public international law. This article examines the legality of such extraterritorial inspections, situating the ECB’s mandate within the constraints of customary international law and the sovereignty of third (non-EU) States. We assess the legal basis provided by the international agreements – Memoranda of Understanding (MoUs) – concluded by the ECB with foreign supervisory authorities, and interrogate their sufficiency as instruments of consent. We argue that while MoUs facilitate cooperation in practice, their non-binding nature renders them a fragile legal basis, leaving the ECB and its inspectors exposed to potential international responsibility and diplomatic friction. Next, we evaluate alternative foundations for inspections, including inferred consent, contractual arrangements with third-country banks, countermeasures and indirect enforcement via EU-based affiliates. Moreover, the asymmetrical character of these arrangements underscores the broader political economy of extraterritorial enforcement, in which the ECB’s market power enables it to project regulatory authority beyond EU borders. The article concludes that although pragmatic cooperation currently mitigates conflict, the lack of a robust legal framework creates uncertainty for both States and supervised entities, warranting further institutional and doctrinal clarification.

Keywords: Single Supervisory Mechanism – extraterritorial enforcement – public international law – banking regulation – Memorandum of Understanding – on-site inspections.

1.   Introduction

Since the establishment of the Single Supervisory Mechanism (SSM) in 2014, the European Central Bank (ECB), an independent institution of the European Union (EU), is responsible for carrying out banking supervision in the euro area and other participating EU Member States, alongside national supervisors.[1] For the purpose of carrying out its tasks, the ECB is entrusted with supervisory and investigatory powers, including the power to conduct on-site visits (inspections) among others at the business premises of supervised banks.[2] Relevant banks (credit institutions) subject to direct supervision by the ECB are significant banks established in participating Member States (SSM banks).[3] The SSM Regulation however also confers on the ECB supervisory powers regarding third parties to whom these banks have outsourced functions or activities, as well as subsidiaries of SSM banks not (directly) supervised by the ECB.[4] Such third parties and subsidiaries might be based outside SSM participating States, and thus outside ECB jurisdiction. This implies that the ECB may, at least on the basis of the SSM Regulation, be entitled to conduct on-site visits in relation to foreign subsidiaries of SSM banks, or third-country providers to which SSM banks have outsourced functions and activities.

The exercise of such investigatory powers on the territory of a State which is not a SSM participating State,[5] is in tension with the prohibition of extraterritorial enforcement jurisdiction in international law. Indeed, international law prohibits the exercise of sovereign powers by a State or regional international organisation on the territory of a third State without the latter’s consent.[6] For EU Member States outside the SSM, this tension might be resolved through the TEU and TFEU, which could be argued to create the relevant consensual basis between EU Member States and their institutions.[7] This basis however does not exist regarding on-site inspections in non-EU States (referred to hereinafter as ‘third States’), which is what this contribution focuses on. This is where the tension is the strongest, in the absence of a treaty such as TEU and TFEU, and the potential (political) fallout is the greatest. The aim of the contribution is to inquire how this tension could be resolved from the viewpoint of public international law, if at all; as without a proper legal basis, these on-site visits in third States could expose both the ECB and its individual inspectors to diplomatic friction. This contribution discusses both existing policies and practices, as well as possible alternative jurisdictional bases the ECB could rely upon.

The contribution opens with a brief introduction to the system of banking supervision and the specific role played by the ECB (section 2). We then highlight the ECB’s investigatory powers in relation to banks established in third States – i.e. outside the EU –, and address the possible incompatibility between the exercise of such powers and the international law of jurisdiction (section 3). We argue that this incompatibility could, in principle, be resolved by concluding internationally binding agreements with third States.[8]We then inquire whether the agreements or MoUs (Memoranda of Understanding) which the ECB has concluded thus far could be sufficient to cover extraterritorial inspections (section 4). This section pays specific attention to whether treaty law governs such agreements, and what issues may arise from the current practice of (non-binding) MoUs insofar as they are not covered by international treaty law. We then proceed to examine the circumstances under which the ECB, in the absence of an agreement with a third State, may still lawfully carry out extraterritorial inspections (e.g., by securing the consent of the third-country bank, or via the doctrine of countermeasures - section 5). We also inquire whether, short of inspections, the ECB could exercise enforcement jurisdiction over third-country banks by directing orders to such a bank or a related EU bank to produce information, under threat of a periodic penalty payment (section 6 and section 7). Zooming out in the last section, we draw attention to a broader political-economic context of global power imbalance in which extraterritorial enforcement takes place, and examine how this affects the ECB’s projection of extraterritorial power both regarding its current policies and practices, and regarding the proposed alternatives (section 8). We end our analysis with a brief conclusion (section 9).

2.   ECB supervision of banks

The Single Supervisory Mechanism (SSM) is an integrated system of the ECB and national competent (banking supervisory) authorities. The SSM specifically addresses Member States, both inside and outside the euro area. The primary objective of the SSM is to contribute to the safety and soundness of credit institutions and the stability of the financial system within the EU and each Member, with full regard to the unity and integrity of the internal market based on equal treatment of banks.[9] The SSM allows exclusive competences given to the ECB to be implemented within a decentralized framework,[10] which comprises the ECB and national competent authorities (NCAs). The competences of the ECB are to serve the internal market for banking services and the stability of the financial system in the euro area and the EU as a whole. For the functioning of the SSM, the primary legal sources are a) the SSM Regulation (SSMR), which confers tasks and powers upon the ECB in the area of banking supervision, and b) the SSM Framework Regulation (SSM FR),[11] establishing the framework for cooperation between the ECB and national authorities.[12]The ECB applies all other relevant Union law,[13] and is exclusively responsible for the micro-prudential supervision of the euro area’s banks.

The ECB is competent to carry out its tasks in relation to banks established in ‘participating Member States’, meaning Member States whose currency is the euro and Member States whose currency is not the euro which have established close cooperation with the ECB.[14] If a Member State is not participating, the ECB and the competent authorities of such States are under a legal duty to conclude a memorandum of understanding (MoU) describing in general terms how they will cooperate with one another in the performance of their supervisory tasks.[15] This memorandum has been concluded in 2022,[16] which provides inter alia for cooperation and information exchange.[17]

The SSM Regulation classifies banks as ‘significant’ and as ‘less significant’, to divide supervising competencies between the ECB and NCAs. This classification is based on a number of criteria, such as size, importance for the economy and the significance of the banks’ cross-border activities.[18] The ECB directly supervises significant banks, while its national counterparts carry out the day-to-day supervision of less significant banks.[19] Daily supervision of significant banks by the ECB is carried out by Joint Supervisory Teams (JSTs), i.e. teams composed of ECB staff and staff from the relevant NCA. The JST must refer under certain conditions suspicions concerning infringements of directly applicable EU law or of ECB decisions or regulations to the independent investigation unit of the ECB (IIU).

For the purpose of carrying out its tasks, the ECB is entrusted with investigatory powers.[20] This includes the power to request information from supervised banks based in participating Member States,[21] to require the submission of documents, to examine books and records of banks, and to interview persons.[22] These powers form the ECB toolbox of directly applicable powers to perform ‘effective risk-based supervision’.[23] As part of its investigatory powers, the ECB also has the power to conduct all necessary on-site inspections at the business premises of banks established in the participating Member States, with or without prior announcement.[24] On-site inspections must be conducted on the basis of an ECB decision, which shall at a minimum specify the subject matter and the purpose of the on-site inspection. Any obstruction to the on-site inspection by an entity subject to supervision constitutes a breach of the relevant ECB decision.[25]

In exercising its powers, the ECB works closely together with the national competent authorities (NCAs) designated by the participating Member States. The ECB and NCAs have a duty of cooperation and an obligation to exchange information. In particular, the NCAs provide the ECB with all information necessary for the purpose of carrying out the tasks conferred on it.[26] The obligations for national counterparts are very broad in scope. Subject to a purpose limitation, virtually any type of information can be transferred from NCAs to the ECB. Exchange of information can be at recurring intervals, such as reporting on a regular basis on the performance of their activities, or spontaneously when the NCA receives an application for authorizing a bank in a euro area Member State, or when an authorization must be withdrawn.[27] The ECB can always request the NCAs to transmit any information necessary to carry out its tasks. Due to their long experience and their proximity to the credit institutions in question, NCAs can provide the ECB with information that the latter may not have access to. The ECB can instruct the NCAs to use strictly ‘national’ powers if necessary to carry out the tasks conferred on the ECB in the SSMR. Through this stream of information, even though the power to access recorded telecommunications and information on bank accounts are not per se provided for in the EU legal framework, the ECB can use this national power indirectly and may eventually receive relevant information if the NCAs do have these powers on the basis of their national law.[28]

As to NCAs’ cooperation specifically with the ECB’s on-site inspections, officials of NCAs of participating Member States have a duty to assist the ECB, including when a person opposes inspection; such officials also have the right to participate in the inspections.[29] If required by national law, authorization to conduct inspections or to obtain assistance may have to be sought from a national judicial authority.[30] Such an authority may however not review the necessity for the inspection or demand to be provided with the information on the ECB’s file; also, only the Court of Justice of the European Union (CJEU) can review the lawfulness of the ECB’s decision.[31]

In principle, the ECB and the NCAs do not have jurisdiction over third States, or banks established in third States. However, they can exercise supervisory powers over all activities of third-country branches and groups in the EU (or at least in the participating Member States), for which purpose a Memorandum of Cooperation (MoC) between the ECB and the NCAs has been concluded in 2024.[32] More importantly for the purpose of our analysis, under the SSM Regulation, the ECB may require any entities belonging to banks established in a participating Member State, as well as any third parties to whom these banks have outsourced functions or activities, to provide all information that is necessary in order to carry out its tasks.[33] The ECB may also conduct investigations regarding these persons, and conduct on-site inspections at their business premises.[34] The relevant paragraph in the SSM Regulation is not subject to a geographical limitation, which arguably implies that the ECB can exercise investigatory powers, including the power to carry out on-site inspections, in relation to foreign subsidiaries of ‘SSM banks’, or third-country providers to which SSM banks have outsourced functions.

3.   On-site visits, extraterritorial enforcement and international law

This next section now qualifies the ECB’s investigatory powers in terms of public international law. First, it should be noted that where the ECB makes use of its investigatory powers in (relation to) third States, it can be seen to be performing a ‘sovereign task’ in another jurisdiction,[35] and to exercise extraterritorial enforcement jurisdiction. ‘Enforcement’ in this sense should be understood to cover any coercive State act, also covering investigations, interviews, requisition of documents from inspected parties, et cetera, in addition to issuing sanctions; as such it is distinct from the narrower concept of ‘enforcement’ in European law, which primarily refers to sanctions. It does not cover any action that a foreign actor can freely refuse: for example, asking another national supervisory authority to share information,[36] sharing information with that authority, offering or requesting (legal) aid, or asking foreign actors to coordinate activities are all not coercive in this respect and thus are not considered enforcement.

Under customary international law, States are not allowed to exercise their enforcement jurisdiction outside their territory, except, as the Permanent Court of Justice held in the Lotus case, ‘by virtue of a permissive rule derived from international custom or from a convention’.[37] This means that States cannot enforce their laws extraterritorially, i.e., use physical coercion abroad, by, e.g., arresting a person abroad, seizing property abroad, or conducting inspections,[38] unless they can obtain the prior consent of the territorial State. This rule also applies to international institutions, such as the ECB, to which States have transferred competences. The CJEU has held in this respect that the EU, ‘when it adopts an act, it is bound to observe international law in its entirety, including customary international law, which is binding upon the institutions of the European Union’.[39] By the same token, when adopting acts and exercising its powers, the ECB, just like a State, is bound to observe customary international law constraints on enforcement jurisdiction.[40]

The prohibition of extraterritorial enforcement jurisdiction thus entails that the ECB cannot carry out inspections of facilities abroad without securing the consent of the territorial State. Such inspections amount to the exercise of sovereign/institutional authority on the territory of another State, and without consent would infringe upon the latter’s sovereign prerogatives to regulate and inspect facilities on its own territory. States can however consent to other States exercising enforcement powers – including investigations – on their territory. This can be done ad hoc, but is more regularly done through inter-State agreements. These can constitute an ongoing legal basis for extraterritorial enforcement jurisdiction,[41] and preclude its wrongfulness.[42] Such agreements can also be concluded by any State agency acting on behalf of the State, and with the necessary competences. 

To ensure both parties consent to the same thing, relevant bilateral instruments and follow-up arrangements should outline the precise conditions for inspections, in relation to who can inspect and is inspected, what can be inspected, and when inspections can take place. Inspections cannot lawfully take place outside the four corners of the agreement: from the perspective of international law, exceeding the scope of the agreement (and thus the limits of host State consent) may constitute an internationally wrongful act. 

Indeed, the ECB concludes agreements (memoranda of understanding or cooperation) with its counterparts in third States, which can include the possibility of on-site visits. The remainder of this article will thus assess these agreements under public international law. It will examine their legal status, primarily discussing whether or not they create binding obligations, and secondly, what the ensuing consequences of this status are for the specific agreements made by the ECB, and thus the legality of the inspections.

4.   International agreements concerning extraterritorial inspections

The European Union enters into various agreements with third countries,[43] such as trade agreements, association agreements, or cooperation agreements.[44] The EU can enter into binding international agreements on all the policy areas in which it has competence, and where it is necessary to reach goals of EU policies.[45] Also the ECB (the sole EU institution with separate international legal personality)[46] has the legal capacity to enter into international agreements, albeit of an administrative nature. 

Article 8 of the SSM Regulation provides the (internal) legal basis for the ECB to ‘enter into administrative arrangements with supervisory authorities, international organisations and the administrations of third countries’. Based on this provision, since 2021, the ECB has concluded multiple international administrative agreements, usually with foreign financial services authorities.[47]These agreements are reciprocal in nature, meaning that the stipulated rights and obligations apply to both the ECB and the third-country authority, as is discussed more extensively below. The agreements cover all supervised entities, i.e., ‘entities that fall within the supervisory remit of the [ECB and the third-country authority] … including their cross-border establishments’.[48] They govern several forms of cross-border cooperation, including relating to exchange of information, mutual assistance, authorization and assessment, and indeed on-site visits.

Agreements on cross-border cooperation and extraterritorial inspections are increasingly commonplace in other fields too. They vary in nature and scope: they can be inter-state, or inter-agency like the ECB’s agreements with foreign supervisory authorities, and can be on a permanent or ad hoc basis. With regard to financial funding by the EU, also awarded to third countries, several EU bodies investigate the alleged fraudulent use of these funds.[49] For instance the Anti-Fraud Office (OLAF), competent to conduct administrative investigations[50] based on ‘Administrative Cooperation Arrangements (ACAs), signed between OLAF and competent authorities in third countries.[51] According to OLAF officials, these ACAs are not legally binding, but help to overcome practical challenges by setting up contact persons and exchanging information.[52] In section 4.2., we will further discuss cross-border cooperation between the ECB, the European Securities and Market Authority (ESMA) and the Bank of England regarding the regulation of derivatives and other financial instruments, as a point of comparison. Agreements providing for extraterritorial inspections have also been used for a long time in the area of food and drug regulation, where the import of certain food, medicinal drugs or preparations can be conditional on the existence of cooperation and/or inspection agreements.[53] This approach is not exclusive to the EU, for that matter: the US Food and Drug Administration (FDA) has a standing practice of on-site visits authorized by inter-agency agreements, under the US Food and Drug Act.[54]

4.1.  Memoranda of Understanding and on-site visits

Zooming in on agreements including the possibility for on-site visits, a typical provision regarding on-site visits is Article 8 of the recent MoU between the ECB and its Canadian counterpart, the Office of the Superintendent of Financial Institutions (2023),[55]which reads as follows:

1. The Authorities will assist each other, as far as practicable, with the conduct of on-site inspections of cross-border establishments situated in the other Authority’s jurisdiction. Where assistance cannot be provided, the Authority requested to provide assistance will notify it to the other Authority as soon as deemed practical.

2. The Authorities will duly notify each other, in advance, of plans to inspect a cross-border establishment or to appoint a third party to conduct an inspection on its behalf. This notification will detail the purposes, scope, expected starting and ending dates of the inspection, the cross-border establishment to be inspected, and the names of the persons leading the inspection. [Before conducting an on-site visit, the Authorities will communicate those plans with each other and reach a common recognition of the terms regarding the on-site visit with full respect to each other’s sovereignty and laws. Cited from the MoC ECB-Japan[56] The Authorities reserve the right to accompany each other’s inspections team on such an inspection. Following the inspection, an exchange of views will take place between the inspections team and the other Authority within a reasonable timeframe.

A similar provision can also be found in the MoU between the ECB and the competent authorities of non-SSM EU Member States,[57] but these are not the subject of this contribution.

By way of comparison, it bears notice that other EU agencies also have the authority to conclude MoUs with third States allowing for extraterritorial inspections. Under the revised European Market Infrastructure Regulation (EMIR 2.2),[58] the European Security and Markets Authority (ESMA) is empowered to conclude MoUs with its regulatory counterparts to arrange monitoring and on-site inspections of Tier 2 (systemically important) central counterparties (CCPs) ‘shall be conducted pursuant to the cooperation arrangements established with the relevant third-country competent authority’.[59]

On this basis, the ESMA concluded an MoU with the Bank of England in 2020 – after Brexit – on arrangements for cooperation on the monitoring and supervision of CCPs in the United Kingdom.[60] This MoU provides for extraterritorial on-site inspections of Tier 2 CCPs by ESMA officers conducted separately from Bank of England supervisory visits (Tier 1 CCPs being exclusively subjects to visits by the Bank of England),[61] and subject to notification and after clarification of the respective roles and responsibilities of ESMA and the Bank of England.[62] This arrangement will be discussed in more detail below, in section 5.

As regards the agreements, a few things are notable with respect to the inspections. Article 8 of the MoU with Canada, as well as its counterparts in other MoUs/MOCs,[63] allows the ECB to conduct on-site inspections regarding covered entities in third States, and, vice versa, allow third States (foreign authorities) to conduct such inspections in the territory of the ECB participating Member States. This is quid pro quo not explicitly covered by this article, nor by any other provisions of the agreement, but could be inferred from the fact that it does set safeguards for how these inspections can take place. This would imply that both parties understand there to be mutual consent and certain conditions to the inspections a priori. These safeguards are as follows: a notification requirement, a mandatory exchange of views between the ECB and the foreign authority, and the right of one party to accompany the inspections team of the other party. These safeguards should go a long way to uphold the parties’ consent to the exercise of extraterritorial enforcement jurisdiction.

As our contribution primarily takes an ‘outbound’ perspective, i.e., it focuses on the power of the ECB to conduct inspections in third States under international law, we will not address in-depth the EU law intricacies of ‘inbound’ inspections, i.e., inspections conducted by third country authorities in ECB participating Member States on the basis of the respective MoUs. We do note, however, that a key question of EU law is whether, under EU external relations law, the ECB can consent to third country inspections on the territory of a Member State, or whether also the consent of the Member State is to be secured. Given our focus on public international law, we will not elaborate on this.[64]

Another thing to note with respect to the MoUs concluded by the ECB is that they explicitly state that they are not intended to confer any enforceable obligations on the parties to the agreement. As Article 10 of the MoU with Canada, for instance, states:

1. This Memorandum of Understanding sets forth a statement of intent and does not modify or supersede any laws, regulations and requirements in force in, or applying to, Canada or the European Union. Nor does this Memorandum of Understanding create any directly or indirectly enforceable rights or legally binding obligations for the Authorities or any third party.

2. This Memorandum of Understanding is without prejudice to other cooperation arrangements that each Authority might conclude and can be supplemented with more specific memoranda of understanding between the same Authorities agreed upon for the purpose of cooperating for the supervision of a specific cross-border establishment.

This provision is again fairly typical of MoUs and MoCs concluded by the ECB, that cover on-site inspections, as they are included in at least all publicly available agreements at the time of writing.[65] This is a consequence of the last section of Article 8 of the SSM Regulation, which holds that any agreements concluded between the ECB and foreign agencies ‘shall not create legal obligations in respect of the Union and its Member States’, and reflects both the division of competences between the Union and the Member States, and the limited powers of the ECB. It affects the legal qualification of MoUs under public international law.[66] This will be addressed in the next section (4.2).

4.2.   Qualifying the ECB MoUs under public international law

This all raises two central issues under international law, which are the focus of this section and form the gateway to the subsequent analysis of this contribution. Firstly, the question is how such agreements should be qualified under international law, especially given their non-binding nature; and second, whether they indeed express consent as required for extraterritorial enforcement actions. From these issues flow a number of specific problems, to be discussed in section 5.

Public international law does not recognize an ‘administrative agreement’, MoU or MoC as a distinct category of sources.[67]However, if such agreements are concluded between State representatives and intended to create binding obligations, ‘administrative agreements’ can be classified as treaties under the Vienna Convention on the Law of Treaties (VCLT) regardless of how they are formally named.^[68] Whether agencies like the ECB or central banks can represent the State and have a mandate to conclude binding agreements is ultimately a question for the State itself to decide, but is certainly not prohibited under international law, and also not uncommon in practice. In other words, in principle administrative agencies can conclude agreements that qualify as treaties under the VCLT, and thus create binding obligations that are governed by public international law.

There are however additional issues with agreements between foreign States or foreign administrative agencies acting on behalf of the state, and the ECB. The ECB is not a State agent in the sense of the VCLT as it acts on behalf of the Union, which is an international organisation under public international law and not a state. While there exists a Convention governing agreements between States and IOs that mirrors mutatis mutandis the relevant provisions of the VCLT, this instrument is not in force.[69] But even if we were to look at this Convention, or apply the provisions of the VCLT itself analogously, it becomes clear that the specific inter-agency agreements concluded by the ECB cannot be considered treaties at all. That is primarily because they are generally not intended to create international obligations, as noted in the previous section. This appears also to be the case with most agreements concluded by the ECB, which as mentioned, hold that the agreement ‘does not create any directly or indirectly enforceable rights or legally binding obligations for the Authorities or any third party’.[70] Moreover, as discussed, in some respects, they potentially exceed the agency’s competences under domestic law, meaning they are unlikely to bind the State.[71]

In summary, MoUs such as the one cited above have no legal status in international law, and are not governed by the provisions of the VCLT, including the rules on treaty application and interpretation. Nor can breaching these agreements on their own be considered an internationally wrongful act, under the law of international responsibility. At best, these MoUs can be considered to aid in the interpretation of other, primary sources of law. This includes any treaty concluded between the Union and third States, or any rule of customary law applicable between them.

5.     The legal status of MoUs and their consequences

From this somewhat indeterminate legal status of agreements as concluded by the ECB follow several more specific issues, as outlined further in this section. First and foremost is the legality of extraterritorial on-site inspections itself. Section 4.1 noted that the MoUs do not explicitly express State consent to on-site visits, but rather assume there is such consent and state the conditions under which such visits should take place. Should the agreement indeed create legal obligations to cooperate with foreign on-site visits, it could be argued that this creates some sort of ‘tacit’ consent on the basis that a State cannot agree to conditions and safeguards for on-site visits, if it does not agree to the visits in the first place. But if an agreement does not create any obligations at all, the basis for even such ‘tacit’ consent becomes thin.

Therefore, while MoUs provide the general framework for practical cooperation between the ECB and third States, actual consent to extraterritorial on-site visits must be assessed on a case-by-case basis. In practice, such visits will often be preceded by extensive communication between the ECB, their third State counterparts and relevant other State agencies that indicate State consent, but not necessarily. Absent explicit expressions of consent or agreements between the EU and third States which the ECB wishes to visit, consent may be inferred from other actions or decisions by third State authorities, such as allowing ECB personnel to enter the country, and functionally cooperating with the visit in line with the MoU. This would preclude the unlawfulness of the visit in general, from a public international law perspective. Whether the consent then covers all aspects of the visit is however uncertain; that should also be derived from the same State actions signalling implicit consent. These may or may not relate to any of the terms of the MoU on which ECB personnel relies.

Moreover, it is a rather fickle basis for the ECB’s work as consent could be easily revoked. As also indicated by Article 1(3) of the aforementioned EU-Canada agreement,[72] again common to most MoUs studied: cooperation (including on-site) visits can be withdrawn or limited for a wide variety of reasons, including ‘national laws, regulations and requirements’. This would be impossible had there been a legal basis in international law, as national law cannot be invoked as a defence against violating an international agreement.[73] Similarly, lack of a treaty basis for this inspection means there can be no reliance on good faith or any established rule of treaty interpretation, in case of disagreement on the scope of the planned visit.

The issue of competence on behalf of the parties to the agreement has been raised above.[74] Per Article 46 VCLT, treaties concluded in excess of the authority of the State agents involved can still bind the State, unless it was ‘objectively evident’ to any State acting in good faith that the entity was not empowered under internal law to conclude the agreement. This can for example be an issue when a State has multiple regulatory agencies whose competences overlap or compete.[75] This presumption is however not applicable to MoUs concluded by the ECB, so if a foreign supervisory authority exceeds its competence under national law when assisting the ECB, ECB inspections can easily be curtailed by other authorities.

Similarly, disputes regarding the scope and content of the MoU should be resolved by negotiations between the parties;[76] but absent any external governing framework, there is neither an obligation for other party to comply with the agreement in good faith, nor any principles of interpretation that would help interpret the agreement.[77] Regular methods of interpretation of international law would mean that parties look at the plain meaning, legal context and subsequent practice,[78] and crucially that internal law cannot be invoked as a defence against non-compliance.[79] But as these are not necessarily applicable to non-binding agreements like the MoUs, there can be significant legal uncertainty regarding how they should then be interpreted. Should negotiations fail to achieve a mutually satisfactory result, there is also no recourse to a dispute settlement body to resolve the disagreements.

The mirror image of these issues concerns the agreements’ reciprocity, also highlighted in section 4. The MoUs studied commit to allowing foreign supervisory authorities to conduct on-site visits in the EU, with ECB cooperation. In spite of the ERTA pre-emption doctrine,[80] cooperation can hardly be guaranteed: since the MoUs are not binding, if a Member State disagrees with a planned inspection, the ECB has little to no authority to induce compliance with the MoU.

The upshot of these issues is that the current practice of concluding non-binding MoUs has significant potential for friction between the ECB and its partner agencies in third States, other agents of that State, and/or the State itself issuing formal protests, and even EU participating Member States. It should be noted here that the authors have thus far not found any case of these risks actually manifesting; as emphasised by the agreements themselves, on-site inspections are always preceded by notifications, negotiations and extensive exchange of information. This diplomatic and practical approach means that in practice, on-site visits in third States do not generate significant controversy yet. That said, should irreconcilable differences arise between the ECB, its inspectors and third States, the agreements themselves offer little (legal) protection. Even if the visits themselves are handled properly and diplomatically, ECB inspectors can potentially be targeted by unscrupulous actors wishing to make a political point – for example, regarding the lack of reciprocity in practice of these agreements. This can especially be a risk if a new government comes into power that is less amenable to cooperating with the EU and its institutions; whereas any treaties concluded by previous governments would remain applicable, this is not true for non-binding agreements like MoUs, even if the partner agency and its personnel have not changed. It should also be reiterated here that without proper State consent, extraterritorial on-site inspections constitute an internationally wrongful act. Translated into domestic law and practice, this may expose ECB personnel to arrest, detention or other penalties in third States, without the agreement offering any basis for diplomatic protection or other international recourse. As mentioned, these non-binding agreements do not create obligations under primary sources of international law, breach of which can amount to internationally wrongful acts. It may also lead to diplomatic tensions between the EU and third States, eroding rather than strengthening international banking supervision as intended by the SSM framework.

All this can be contrasted against the MoU concluded between ESMA and Bank of England, mentioned in section 4.1. The legal arrangement upon which this MoU rests differs from that underpinning the previously discussed ECB MoUs, not just from a EU law perspective but also from a public international law perspective. Contrasting the two in fact illustrates the legal twilight zone in which the ECB MoUs exist very well. First, the ESMA-Bank of England MoU is predicated on the European Commission designating the UK framework regulating CCPs as equivalent to the EU framework.[81] CCPs established in an equivalent country can then apply for recognition from ESMA, which once given means they can be used by EU-based parties (and non-EU parties already subject to EMIR) to clear derivatives obligations.[82] The equivalence decision is what triggers an obligation for ESMA to negotiate an MoU with its regulatory counterpart in that particular state,[83] as it did with the Bank of England. The MoU is expected to establish cooperation arrangements to monitor compliance of CCPs, including the aforementioned on-site visits.[84] It should also ensure continuing equivalence between the EMIR and the third country’s legal and supervisory framework, by requiring ESMA to monitor regulatory and supervisory developments in the third country. 

The difference with the MoUs concluded between the ECB and its foreign counterparts is apparent. Whereas under the SSMR, the ECB has the competence to conclude MoUs, ESMA has an obligation pursuant to the Commission’s equivalence decision.[85]This does not so much change the qualification of the MoU itself under international law, which in this case is still not a treaty for the same reasons the ECB MoUs are not treaties. Rather, it points to the relevant exercise of authority on behalf of the Union, which is done by the Commission, not ESMA.[86] Moreover, it reduces the chance of lack of clarity regarding the scope of ESMA’s mandate when negotiating the MoU. This creates a much stronger argument for the existence of implicit consent between the EU and third states as to the subject of inspections; first, because the Commission can be expected by third states to have the mandate to speak on behalf of the Union. Second, because ESMA is explicitly required in the EMIR (and by the Commission) to conclude MoUs that also include monitoring and compliance mechanisms, it is much clearer for third states what they are consenting to.

This means the position of ESMA is different from that of the ECB when it comes to negotiating MoUs, as it can point to its relative lack of discretionary power, as well as to the much clearer mandate given by the Commission through the EMIR. It should be noted that the decision to revoke equivalence status is also done by the Commission, thus leaving a much clearer division of authority: the Commission creates the legal grounds for ESMA to exercise its supervisory authority, to which foreign states and/or their representative agencies can consent. ESMA is primarily tasked with negotiating how this authority gets exercised, and how the collaboration with third state supervisory agencies is shaped – within the boundaries of the EMIR and the task given to it by the Commission. Similarly, the agreement is clear that continued performance of the agreement is subject to the continuing approval and consent of the respective (national) authorities.[87]

This also translates into how the MoU is phrased. While it does not differ so much in its substance from the previously cited ECB MoUs, it is much clearer in comparison as to its language. For one, the preliminary paragraphs set out the division of competence between the Parliament, Commission and ESMA, how ESMA operates pursuant to Commission mandate and expectations, and the place of the MoU therein.[88] It also more explicitly outlines the limits of ESMA authority and competence. One notable aspect of this concerns the reciprocity of the agreement. Like the ECB MoUs, the agreement between the ESMA and Bank of England are expected to be reciprocal. Unlike the ECB MoUs however, it explicitly notes that ESMA cannot speak on behalf of other authorities within the Union. Rather, it references an expectation that other Union agencies (including national supervision agencies) may want to engage in similar reciprocal arrangements.[89] Lastly for the purposes of this contribution, the agreement is more explicit about how on-site visits are conducted. As mentioned, ESMA can only conduct on-site inspections for Tier 2 CCPs, relying on the supervision of the Bank of England for Tier 1 CCPs only. The conditions and procedure of such visits are outlined in much more detail, especially when such visits are done outside of the Bank of England’s own supervisory reviews.[90]

While these more specific provisions still do not create binding obligations, they do matter for how this agreement can function under international law. As mentioned, the MoU is backed by a Commission decision that gives a more robust basis for consent between States, at least on behalf of the Union. The content of the agreement then helps to demonstrate what the foreign State (in casu the United Kingdom) is consenting to, and what the scope of its consent is. This is further solidified by the requirement of prior notification, and the elaborate conditions under which such notification needs to be given and to whom. This specificity not only lessens the chance of misunderstandings, but also gives ESMA inspectors a stronger legal basis in case of disputes over whether there was an international legal basis for actions taken pursuant to the visit. Similarly, there can be little misunderstanding about the extent of reciprocity, and thus no complaints in hindsight that ESMA could not consent to reciprocal visits on behalf of the Member States. 

6.     Extraterritorial on-site visits without State consent

In section 4, it has been discussed that, in principle, the international legal basis for the ECB to carry out extraterritorial inspections ought to be an international agreement, as such an agreement expresses the consent of the host State. We have also concluded that the MoUs currently concluded by the ECB with third State supervisory authorities may not be a sufficient legal basis in that regard. We have pointed out that consent may nevertheless be inferred (ad hoc) from other actions or decisions by third State authorities. The question may also arise whether, in the absence of clear third-country consent, the ECB can directly seek the consent of the third-country bank that is to be inspected, thereby bypassing the third State itself. In principle, the answer to this question is negative.[91]The international law of enforcement jurisdiction is inter-State in nature, and is aimed at safeguarding States’ sovereign regulatory spheres. Accordingly, private entities cannot waive a sovereign right that accrues to the State, by entering into contractual arrangements with the ECB.[92] At most, one can countenance the legality of a notification of the territorial State by the inspecting State, inviting the former to accept or object to the inspection within a reasonable time; in case the territorial State does not respond on time, it could be argued that it has implicitly consented to the extraterritorial inspection.

Another issue is whether the ECB can, in the absence of an international agreement, ground the legality of its extraterritorial inspections on the failure of the third State to enter into an agreement. Again, the answer is likely to be negative. Given the principle of voluntarism underlying the international legal system,[93] third States are not required to enter into treaty relations. Also, exercising their exclusive enforcement jurisdiction, they have the sovereign right under international law to refuse consent to extraterritorial inspections. Accordingly, a failure to consent does not, as such, constitute an internationally wrongful act.

This also implies that the ECB cannot resort to the doctrine of countermeasures to justify its non-consent-based extraterritorial inspections. This doctrine authorises an injured State or international organisation to take countermeasures against a State which is responsible for a prior internationally wrongful act.[94] Admittedly, it could be argued that third States, by tolerating on their territory banks whose activities cause harm in SSM participating Member States, violate due diligence obligations under international law, which would in turn trigger the right of the injured organisation, in casu the ECB, to take countermeasures against the third State, e.g., by carrying out extraterritorial inspections in violation of the prohibition of enforcement jurisdiction. This argument can take its cue from the dictum of the International Court of Justice in 1949 Corfu Channel case, in which the Court referred to ‘every State’s obligation not to allow knowingly its territory to be used for acts contrary to the rights of other States’.[95]It is contested, however, whether this dictum grounds general due diligence obligations of States.[96] And even if one were to agree that it does, it may be questioned whether violations of such obligations can trigger countermeasures, in light of the restrictive conditions governing such measures. In particular, countermeasures can only be taken in order to induce the State to comply with its obligations; in addition, they should be temporary and reversible.[97] Carrying out inspections as a countermeasure arguably does not meet these requirements, as they may not be aimed at bringing pressure to bear on the third State, and may lead to the ECB obtaining evidence with permanent and irreversible (financial-economic) effects. Also from a practical perspective, one has difficulties imagining how ECB inspectors could, in the absence of any third State cooperation, have unimpeded access to the third State’s territory (‘sovereignty of the state threshold’) and access to the premises of the inspected entity (‘premise threshold’).[98]

7.     Means of obtaining information short of inspections

In case the ECB is barred from conducting inspections of the premises of third-country operators, e.g., because the third State withholds consent, the ECB may have other means at its disposal to obtain relevant information in the possession or under the control of third-country banks. In particular, the ECB could request the third State to provide information on these banks, on the basis of a prior international agreement (even if not legally binding),[99] or ad hoc. If such information is not forthcoming, the ECB, using its investigatory and sanctioning powers, could possibly direct an order to the third-country bank, or a related entity in the EU (e.g., the parent company based in the euro area) to produce information, under threat of a periodic penalty payment.[100] There is no evidence that the ECB has already used these powers, arguably because banks normally provide the requested information, but it is not excluded that, one day, the ECB may direct such ‘production orders’ at non-cooperating banks.

The international lawfulness of production orders has not fully crystallised yet.[101] In one notable case, the Dutch Trade and Industry Appeals Tribunal, the highest tribunal for economic public law in the Netherlands, ruled in 2018 that the Dutch Central Bank (DNB) is allowed to order a foreign financial institution to produce information, under threat of a penalty payment, insofar as such institution carries out activities on the Dutch financial market.[102] Unlike the lower court,[103] the Appeals Tribunal found that a DNB production order and penalty payment do not create effects outside the Dutch legal order, and hence do not violate the sovereignty of a third State.[104] According to the Tribunal, DNB exercises its supervisory powers in the Netherlands, not extraterritorially.[105] This approach is not universally shared, however. For instance, in a 2023 decision, the United Kingdom Competition Appeal Tribunal and High Court of Justice ruled that the UK Competition & Markets Authority does not have the legal power to order German companies to provide information relating to an ongoing investigation.[106] It bears notice that this decision was based on the presumption against extraterritoriality, a canon of statutory construction, rather than on international law proper.[107] Still, it indicates that some courts may consider orders for the production of information held abroad to be in violation of the territoriality principle.[108]

Accordingly, for the ECB to order a foreign bank to produce documents under threat of penalty payment is legally risky, in light of the territorial limitations of enforcement jurisdiction. The ECB could try to circumvent these limitations, however, by directing its orders to a euro area-based business partner, parent company, subsidiary, or branch of the foreign bank. These persons are subject to the full territorial jurisdiction of the ECB. Such ‘indirect’ enforcement is in fact part of a larger trend. In the field of law-enforcement in cyberspace, for instance, US and EU legislation allows States to order locally present operators to produce evidence located in a third State – without third State consent being needed per se.[109] Similarly, in civil litigation States, notably the US, have allowed courts to order litigants over whom the US has personal jurisdiction, to produce documents held abroad (‘discovery’).[110]Importantly, in a case pertaining to the European Commission’s investigations into foreign subsidies distorting the internal market, the President of the General Court of the EU held in August 2024 that the Commission is legally allowed to order local employees of a Polish and a Dutch company controlled from a third State to hand over digital evidence stored on a non-EU server belonging to the corporate group.[111] Also the upcoming EU Corporate Sustainability Due Diligence Directive (CSDDD) allows for indirect enforcement jurisdiction.[112] The Directive obliges companies within its scope to adopt human rights policies, conduct risk assessments regarding human rights, labour rights, environmental and climate risks in their operations, take measures to prevent or mitigate risks, or to cease or mitigate ongoing impacts, track outcomes and communicate results. The Directive targets parent companies or lead firms, but the intended effect is lower in supply chains where the most salient risks occur – outside Europe. The Directive is backed by administrative enforcement[113] and civil liability.[114] The available enforcement measures can only directly affect EU-domiciled companies (or certain companies entering the EU market directly) but could have the indirect effect of forcing foreign subsidiaries or business partners. Their parent companies or contract partners can leverage their own stake or level of control to force their business partners to release certain information or change their way of operating, in conformity with EU standards, to make sure the EU-based company is not exposed to liability. This form of transnational private enforcement then effectively functions as an extended arm of EU-based public agents.

These examples show that States and the EU may be willing to order entities over whom they have personal jurisdiction to produce information held in third countries. Arguably, such enforcement measures eliminate the adverse effects of international non-cooperation,[115] and contribute to the effectiveness of the law.[116] Because this practice is relatively new, there have not been explicit State protest yet against such measures. This may be explained by the fact that, formally speaking, the relevant measures are not directed at the foreign State or foreign regulatory agency. Indeed, for the ECB, the final objective of requesting or ordering information is not to decide whether to take measure against a third country entity but against the supervised SSM entity in the euro area (i.e. the parent or outsourcing bank). Nevertheless, an intermediate objective is to force the entity in the third country to provide the information. Coercive effects can be felt in the territory of that State, and can undermine the authority of the local agency. In addition, these measures may be seen to circumvent cooperation agreements, insofar as the latter do not explicitly allow this type of enforcement. Even if the measures are separate from the agreement, they work to undermine its purpose and render local enforcement powers less relevant. This explains why not all States support a liberal approach to indirect enforcement jurisdiction.[117] Non-supportive third States may then forcefully reassert their sovereignty in the face of foreign enforcement orders considered as extraterritorial in nature. They could refuse to abide by the terms of an existing cooperation agreement. Also, they could adopt blocking legislation to limit the extraterritorial effects of foreign orders. Such legislation may put the objects of inspection in a bind, catching them between the ‘extraterritorial’ obligation to produce documentation, and the territorial prohibition of disclosing documentation to foreign States or agencies.

8.     Understanding the power differential between the ECB and third States

In this final section, we reflect on our findings regarding the formal legal basis for on-site inspections and other enforcement measures, and draw attention to the fact that the conclusion of cooperation agreements and the exercise of enforcement jurisdiction do not take place in a political-economic vacuum. Scholars of international law have highlighted that international agreements tend to be skewed in favour of more powerful parties, and that especially powerful States exercise extraterritorial jurisdiction, in ways that further their political and economic interests, to the detriment of weaker parties.[118] The ECB may want to keep this in mind when engaging in enforcement cooperation, whether through negotiating agreements on extraterritorial inspections, or when otherwise exercising types of (indirect) enforcement jurisdiction.

The platonic ideal of enforcement cooperation is that States share a common goal and agree on facilitating enforcement actions in pursuance of that common goal. In reality, they are often a product of politically charged negotiations and compromises, to align different parallel and sometimes competing interests. These interests may relate to the Union's single market and economic opportunities for financial service providers in third States. Moreover, the increased integration of global financial markets means it is increasingly difficult to operate without somehow having to deal with the SSM, or impacting the European banking system in other ways. That may expose third State actors to potential sanctions by the ECB in case of non-compliance, and provides another incentive to ‘play ball’.

Holding the key to the European financial market is a powerful tool that the Union has, and that it can use to impose its view of banking supervision, its rules and underlying values, and secure relevant concessions by third States. We can witness similar dynamics in other areas where foreign on-site visits are common. For instance, the aforementioned FDA visits to foreign production facilities are possible because the US market for food and especially drugs is exceptionally lucrative and primarily serviced by non-US suppliers – mostly from India and China. Similarly, the EU has relied on its market power to impose obligations regarding air travel, minerals and other raw materials, corporate human rights and sustainability impacts, and of course data protection.[119] The ECB’s competence to conclude agreements with (bodies similar to) national competent authorities in third States under the SSM has to be seen in this light was well. Nominally, the relevant obligations are imposed through a territorial connection (the presence of certain goods, establishment of a branch or subsidiary, et cetera) and only apply to actors voluntarily entering the EU market. In practice, foreign providers of goods and services have little choice but to submit to the EU’s regimes if they want to benefit from the single market. Moreover, the Union is not passive in this regard: integration into various regulatory regimes is often raised when the EU negotiates any form of economic or geopolitical cooperation; while also nominally consensual, this is another way in which the EU projects its power and interests externally. 

The net effect is that while the formal basis for the EU’s imposition is both territorial and consensual, it can in practice be perceived as unilateral imposition of EU standards on foreign states by virtue of economic power.[120] While strictly speaking not an exercise of extraterritorial jurisdiction per se, or an infringement of foreign sovereignty, it is not hard to see how it can beperceived that way by whomever it affects – individuals, businesses and their home States. The standards applied by the Union moreover reflect the EU’s own interests as much as they reflect international community interests, and the two can be hard to separate. This approach has consequently been controversial, and some measures have been squarely opposed by other States.[121]Some have led to blocking measures and international complaints, prompting retraction of certain measures.[122]

While the ECB’s supervision powers have not been subject to as much controversy yet, this context is an important one to keep in mind when exploring the limits of cooperation agreements and extraterritorial sanctions orders. As to cooperation agreements, while formally speaking, the ECB and States are free to decide on their content, the ECB may well turn out to be the more powerful party depending on which authority the agreement is concluded with, and may have a stronger voice in setting the terms of the agreement. Here we should recall the discussion on reciprocity: while the agreements may provide for reciprocal rights to obtain information and conduct on-site visits, the division of competences within the Union and the non-binding character of MoUs could practically exclude the other party from exercising its rights with respect to the ECB’s jurisdiction. Indeed, no visits from third State supervisory agencies to EU Member States have taken place as of yet. This may create the perception that these MoUs, and the broader practice of transnational supervision is yet another part of the EU’s asymmetrical projection of regulatory power, not a fully mutual agreement between equals – and a potential encroachment on third State sovereignty. As a point of comparison, a study on EU extraterritorial inspections regarding food safety, climate change, and port state control has warned that, by exerting pressure on third States, the EU may artificially generate third State consent to conduct inspections worldwide, thereby interfering in the internal affairs of third States.[123]

In terms of legal consequences, at the extreme end, agreements concluded under duress would be null and void. However, appeals to duress in international law are rare and seldom accepted, especially outside threats of use of force, and are thus very unlikely to be relevant to the context of ECB site visits. More likely is that third States may more quickly assert their sovereignty and limit the scope and content of inspections if the agreement itself is perceived not to be in the interest of the territorial State.[124]

Finally, attention should not only be drawn to the possible impact of extraterritorial inspections on third States, sovereignty, but also on individual rights. Extraterritorial inspections may apply foreign, unfamiliar law to individuals and corporations. In addition, the latter may lack judicial protection vis-à-vis foreign inspectors.[125] Current agreements mainly govern inter-agency cooperation, outlining rights and obligations of the respective authorities. Next generation agreements could possibly pay more attention to individual rights, e.g., by outlining remedies for harm ensuing from wrongful inspections.[126] In the meantime, in the interest of legal certainty, any existing agreements should be brought to the attention of the potential foreign addressees of inspections, if this has not yet been done. Similar observations apply in respect of indirect enforcement measures short of inspections, in particular orders to produce documents or information backed up penalty payments. Foreign operators may have no choice but to comply with such orders, and may not be in position to easily access equally lucrative non-ECB-supervised financial markets. This puts the ECB in a particularly powerful position, and it may want to use its enforcement powers sparingly.

9.     Concluding observations

This contribution has sought to square the ECB’s powers to carry out on-site visits in relation to foreign subsidiaries of SSM banks or third-country providers to which SSM banks have outsourced functions and activities, with the prohibition of extraterritorial enforcement jurisdiction in international law. We have argued that the exercise of such jurisdiction by the ECB is unlawful in case it is done unilaterally, i.e., without obtaining the consent of the third State. Third State consent could be secured, however, via an international agreement. We have highlighted that the ECB has concluded a number of such agreements with third-country supervisory authorities, which provide for the reciprocal right to conduct extraterritorial inspections of premises in the parties’ respective jurisdictions. While the exact legal status of such agreements may not be fully clear, they evidence the ECB’s and the third State’s qualified consent to extraterritorial inspections. We have also inquired whether, short of inspections, the ECB could direct an order to a third-country bank or a related EU bank to produce such information under threat of a period penalty payment. We submit that an argument could be made that such orders are territorial in nature and thus that they are presumptively valid. Nevertheless, we warn that they may bypass the consent of the third State and thus raise international law concerns. Finally, we have observed that the ECB exercises its extraterritorial enforcement jurisdiction against a backdrop of global power imbalances. Even if international agreements provide for reciprocal rights and obligations, actual enforcement practices may still be skewed in favour of the ECB, to the detriment of the interests of the third State or the rights of third-country banks.

Going forward, we suggest that future, more empirically-oriented research ascertain how agreement-based extraterritorial on-site inspections of cross-border establishments by the ECB and their third-country counterparts unfold in practice. Such research may address mutual assistance offered by the parties, the purposes and scope of inspections, the depth of the exchange of views between the parties after inspection, and the actors actually conducting the inspections (the parties themselves, or an independent third party).