1. Without prejudice to the application of criminal law, any confidential information received by the Secretariat while performing its duties may not be divulged to any person or authority outside the ESRB whatsoever, except in summary or aggregate form, such that individual financial institutions cannot be identified.

2. The Secretariat shall ensure that documents are submitted to the ESRB in a manner which ensures their confidentiality.

3. The ECB shall ensure the confidentiality of the information received by the Secretariat for the performance of the tasks of the ECB under this Regulation. The ECB shall establish internal mechanisms and adopt internal rules to ensure the protection of information collected by the Secretariat on behalf of the ESRB. The ECB staff shall comply with the applicable rules relating to professional secrecy.

4. Information acquired by the ECB as a result of the application of this Regulation shall only be used for the purposes mentioned in Article 2.