(1) An application for registration as a securitisation repository shall contain a detailed description of the internal policies, procedures and mechanisms preventing:

(a) any use of the information maintained by the applicant for illegitimate purposes;

(b) disclosure of confidential information;

(c) the commercial use of information maintained by the applicant where such use is prohibited.

(2) The description referred to in paragraph 1 shall contain a description of the internal procedures on staff permissions for using passwords to access the information, specifying the staff purpose and the scope of the information being viewed and any restrictions on the use of information.

(3) Applicants shall provide ESMA with information on the processes to keep a log identifying each staff member accessing the information maintained by the applicant, the time of access, the nature of the information accessed and the purpose.