5.3. Risk culture and business conduct

In assessing the institution’s risk culture and business conduct, competent authorities should assess institution’s compliance with the EBA Guidelines on internal governance. In this context, competent authorities should consider inter alia whether:

• a. the institution has consistent corporate values and a sound risk culture, which (i) are supported by effective and robust policies and procedures, communication and training to all staff, including a code of conduct and an appropriate framework for managing conflicts of interests and reporting mechanisms to foster responsible, ethical behaviour and to monitor and manage related party exposures, and (ii) promote an environment of open communication and effective challenge;
• b. the management body, senior management and key function holders are committed to promoting a strong risk and corporate culture and responsible business conduct;
• c. a strong level of risk awareness is demonstrated across the institution;
• d. the institution integrates risk awareness into its decision-making processes, including appropriate risk ownership.

Competent authorities should assess whether the institution has an appropriate framework in place to identify, document and manage related party transactions, including an approval process, exposure limits, arm’s length terms, monitoring and reporting mechanisms. Competent authorities should also evaluate the level of oversight by the management body.