Where there is no available information on the specific exposures to be securitised, including where exposures accumulate before their securitisation or where they may be substituted into an existing revolving securitisation, an institution is deemed to fulfil its due diligence obligations referred to in Article 406 of Regulation (EU) No 575/2013, for each of its individual securitisation positions, on the basis of the relevant eligibility criteria for such exposures.

When outsourcing certain tasks of the process for the fulfilment of the obligations set out in Article 406 of Regulation (EU) No 575/2013, including record keeping, institutions becoming exposed to the risks of a securitisation shall retain full control of that process.