EU Securitisation Regulation: Risk Retention, STS Label, and Sanctions

The EU Securitisation Regulation, formally Regulation (EU) 2017/2402, is the single rulebook governing how loans, receivables, and other financial assets can be pooled and sold to investors across the European Union. It took effect in January 2019 and binds every institutional investor, originator, sponsor, original lender, and special purpose entity involved in a securitisation.¹ The regulation was a direct response to the 2008 financial crisis, when opaque bundled-debt products fed systemic instability. It imposes risk retention, transparency, and due diligence duties on market participants, prohibits re-securitisation, and creates a voluntary quality label — “simple, transparent, and standardised,” or STS — for deals that clear a stricter bar.

Who the Regulation Applies To

Your obligations depend on the role you play in the deal. An originator is the entity that was involved in creating the underlying obligations, such as issuing the original loans, or that bought the exposures from a third party before securitising them. A sponsor is a credit institution or investment firm that establishes and manages the securitisation programme or vehicle, even where it did not originate the debt. The original lender is the entity that entered into the credit agreement with the borrower in the first place.²

A securitisation special purpose entity (SSPE) is a corporation, trust, or other legal vehicle created solely to carry out the securitisation. Its structure isolates its obligations from those of the originator, so that if the originator becomes insolvent, the pooled assets remain protected. Institutional investors include insurance companies, pension funds, banks, and alternative investment fund managers, and they carry a separate set of duties whenever they hold a securitisation position.²

The regulation only bites when a transaction meets its definition of securitisation: the credit risk of a pool is divided into tranches, payments depend on how the underlying exposures perform, and the ranking of the tranches determines how losses fall. If credit risk is not tranched in that way, the regulation does not apply.

The 5% Risk Retention Rule

Article 6 requires the originator, sponsor, or original lender to keep a material net economic interest of at least 5% in the securitisation on an ongoing basis. This is the “skin in the game” rule: whoever puts the deal together must remain financially exposed to how it performs. The retained interest cannot be hedged, split between different types of retainers, or subjected to credit-risk mitigation.¹

The 5% requirement can be satisfied in five ways:

A vertical slice: holding at least 5% of the nominal value of each tranche sold to investors.
The originator’s interest in revolving securitisations: retaining at least 5% of the nominal value of each securitised exposure in the revolving pool.
Random selection: keeping randomly selected exposures equivalent to at least 5% of total nominal value, provided the pool contains at least 100 exposures at origination.
The first loss tranche: retaining the most junior tranche and, if that is not enough to reach 5%, topping it up with tranches of equal or greater risk.
First loss on every exposure: holding a first-loss position of at least 5% on each individual securitised exposure.¹

The retention rule does not apply where the securitised exposures are obligations of, or fully guaranteed by, central governments, central banks, regional governments, certain public sector entities, qualifying credit institutions, national promotional banks, or multilateral development banks. It also does not apply to transactions based on a clear, transparent, and widely traded index whose reference entities match that index.¹ An entity created solely to securitise exposures cannot qualify as an originator for retention purposes, closing off the use of shell companies to meet the rule on paper.

The Ban on Re-Securitisation

Article 8 prohibits using other securitisation positions as underlying exposures in a new securitisation. In plain terms, you cannot securitise a pool that already contains securitised debt. This structural safeguard directly targets the layered complexity that amplified losses in the crisis.³

A competent authority can grant narrow exceptions where the re-securitisation serves a legitimate purpose: facilitating the orderly wind-down of a financial institution, preventing an institution from having to be wound up, or preserving investors’ interests where the underlying exposures are non-performing.³ Fully supported ABCP programmes are not treated as re-securitisations, provided no individual transaction within the programme is itself a re-securitisation and the programme’s credit enhancement does not add a second layer of tranching.

Transparency and Reporting

Article 7 requires the originator, sponsor, and SSPE to make specified information available to investors and competent authorities. That includes the final offering document or prospectus, periodic reports on the credit quality and performance of the underlying exposures, and details of any significant events affecting the deal’s structure.⁴

Reporting is quarterly for most asset classes and monthly for asset-backed commercial paper.⁴ Since 30 June 2021, all reporting must flow through securitisation repositories, centralised data hubs registered and supervised by ESMA. ESMA publishes and maintains a list of registered repositories, updating it within five working days of any new registration decision.⁵ Public securitisations produce broadly accessible data. Private transactions involve more restricted disclosure, but the underlying data structure and reporting obligations are the same.

Due Diligence for Institutional Investors

Article 5 places significant obligations on institutional investors before they take a position. You must verify that the originator or original lender granted the underlying credits using sound, well-defined criteria and established approval processes. You must confirm that the originator, sponsor, or original lender is meeting its 5% retention obligation, and that the required transparency reports are available.⁶

You must also carry out a risk assessment covering the risk characteristics of the position itself and of the underlying exposures, plus every structural feature that could materially affect performance: payment priority, credit enhancements, liquidity support, and any triggers that could redirect cash flows.⁶

These duties continue for the life of the investment. You need to monitor the credit quality and performance of the underlying pool, run stress tests on cash flows, and check that the structural protections still hold up. Falling short can lead to regulatory action, including a requirement to hold additional capital against the position.

Buying into a deal originated outside the EU does not lighten the load. The investor must still verify the same credit-granting standards, confirm at least 5% risk retention, and obtain the same reporting templates required for domestic transactions.⁶

The STS Quality Label

Under Articles 18 to 22, a securitisation can earn the STS designation by meeting a stricter set of criteria organised around three themes.

Simplicity

The pool must be homogeneous, made up of a single asset type with similar cash flow characteristics, credit risk, and prepayment profiles. Title to the underlying exposures must transfer to the SSPE by true sale or an equivalent assignment enforceable against the seller and any third party, insulating the pool from the originator’s insolvency.⁷

Severe clawback provisions that allow a liquidator to void the sale purely because it occurred within a window before insolvency will disqualify the deal, though ordinary rules on fraudulent transfers or transactions unfairly prejudicing creditors do not. At selection, the pool cannot include defaulted exposures or exposures to borrowers who have been declared insolvent, been subject to material enforcement judgments, or undergone debt restructuring within the prior three years, with a narrow carve-out for restructured exposures that have performed cleanly for at least one year.⁷

Transparency

The originator must supply at least five years of historical default and loss performance data on exposures substantially similar to those in the pool, so investors can model losses against real outcomes. A sample of the underlying exposures must also be independently verified before closing.

Standardisation

Interest rate and currency mismatches must be addressed through appropriate hedging. Transaction documents must clearly define the payment waterfall, the servicer’s duties, and any triggers that could change how cash flows are distributed.

Synthetic and ABCP Variants

Regulation (EU) 2021/557, in force from April 2021, extended STS to on-balance-sheet synthetic securitisations, where the assets remain on the originator’s balance sheet but credit risk moves to a third party through a derivative or financial guarantee. To qualify, the exposures must be originated as part of the originator’s core business and held on its balance sheet at closing, the originator cannot hedge its credit risk beyond the protection obtained under the securitisation, and the pool cannot contain defaulted exposures or other securitisation positions. Losses must be allocated from the most junior tranche upward, amortisation must flow sequentially from the senior tranche down, and the originator must appoint a third-party verification agent. The five-year historical performance data requirement also applies.⁸

Asset-backed commercial paper programmes have their own STS criteria under Articles 23 to 26, layered across the programme, the sponsor, and the individual transactions within it. For ABCP programmes, the sponsor rather than the originator is responsible for notifying ESMA of STS compliance.⁹¹⁰

STS Notification and Third-Party Verification

Before a deal can carry the STS label, the originator and sponsor must jointly notify ESMA using a standardised template that explains how each criterion is met, inform their competent authority, and designate one entity as the primary contact point for investors and regulators. If the deal later stops complying, they must immediately notify ESMA.¹⁰

Article 28 allows the originator and sponsor to engage an authorised third party to assess STS compliance. The notification must then identify that third party, its place of establishment, and its authorising authority.¹⁰ Third-party verifiers must be independent. They cannot be a regulated financial entity or a credit rating agency, and cannot provide advisory, audit, or equivalent services to the originator, sponsor, or SSPE on the same transaction. Their fees must be cost-based and cannot depend on the outcome of the assessment. Their management body must include at least two independent directors and demonstrate relevant professional qualifications, and their authorisation can be withdrawn if they materially fail these conditions.¹¹ Using a verifier does not shift legal responsibility. The originator and sponsor remain fully liable for the accuracy of the STS notification.

Capital Treatment for STS Deals

STS status pays off through capital requirements. Under the Capital Requirements Regulation, the minimum risk-weight floor for a senior STS position is 10%, compared with 15% for a non-STS senior position.¹² Lower risk weights mean banks have to set aside less regulatory capital, which is the main economic reason issuers pursue the label.

In October 2025, the European Commission proposed further reforms to the CRR’s securitisation framework, including a “dynamic,” more risk-sensitive risk-weight floor and reduced scaling factors (p-factors) for certain STS positions retained by originators and sponsors. The Commission described the aim as removing “undue barriers to issuance and investment.”¹³ As of mid-2026, these amendments are still in the legislative process.

Sanctions for Non-Compliance

Article 32 gives national competent authorities a broad enforcement toolkit:

A public statement identifying the responsible person or entity and the nature of the breach.
A cease-and-desist order requiring the party to stop the conduct and not repeat it.
A temporary ban on individuals responsible for the infringement from holding management functions.
A temporary ban preventing the originator and sponsor from notifying new STS securitisations.
Fines for individuals of up to at least €5,000,000.
Fines for legal entities of up to at least €5,000,000 or 10% of total annual net turnover based on the most recent approved accounts, whichever is higher; for subsidiaries, the turnover figure is drawn from the ultimate parent’s consolidated accounts.
Disgorgement-based fines of up to at least twice the benefit gained from the infringement, even where that exceeds the standard caps.¹⁴

When sanctions are imposed on an STS deal, the competent authority must notify ESMA immediately, and ESMA flags the deal on its public STS list.⁵ For third-party verifiers that materially fail their authorisation conditions, the competent authority can withdraw authorisation entirely.¹⁴

1
EUR-Lex. Regulation (EU) 2017/2402 of the European Parliament and of the Council
2
European Securities and Markets Authority. Article 2 Definitions
3
European Securities and Markets Authority. Article 8 Ban on Resecuritisation
4
legislation.gov.uk. Regulation (EU) 2017/2402 – Article 7 Transparency Requirements for Originators, Sponsors and SSPEs
5
European Securities and Markets Authority. Securitisation
6
European Securities and Markets Authority. Article 5 Due-Diligence Requirements for Institutional Investors
7
European Securities and Markets Authority. Article 20 Requirements Relating to Simplicity
8
EUR-Lex. Regulation (EU) 2021/557 of the European Parliament and of the Council
9
European Securities and Markets Authority. Article 23 Simple, Transparent and Standardised ABCP Securitisation
10
European Securities and Markets Authority. Article 27 STS Notification Requirements
11
European Securities and Markets Authority. Article 28 Third Party Verifying STS Compliance
12
EUR-Lex. Proposal for a Regulation Amending the Capital Requirements Regulation
13
European Commission. Commission Proposes Measures to Revive the EU Securitisation Framework
14
European Securities and Markets Authority. Article 32 Administrative Sanctions and Remedial Measures