Article 21 2.

issue recommendations;

order obliged entities to comply, including to implement specific corrective measures;

issue a public statement which identifies the natural or legal person and the nature of the breach;

issue an order requiring the natural or legal person to cease the conduct and to desist from repetition of that conduct;

restrict or limit the business, operations or network of institutions comprising the selected obliged entity, or require the divestment of activities;

require changes in the governance structure;

where a selected obliged entity is subject to authorisation, propose the withdrawal or suspension of that authorisation to the authority that has granted it; where the authority which has granted that authorisation does not follow the Authority’s proposal to suspend or withdraw, the Authority shall request it to provide the reasons thereof in writing.