2 Management of third-party risks by financial entities within groups and institutions that are members of an institutional protection scheme

In accordance with Article 109(2) of Directive 2013/36/EU, these Guidelines should also apply on a consolidated and sub-consolidated basis taking into account the prudential scope of consolidation (³⁸ ). For this purpose, the EU parent undertaking or the parent undertaking in a Member State should ensure that internal governance arrangements, processes and mechanisms in their subsidiaries, including payment institutions, investment firms and issuers of ARTs are consistent, well integrated and adequate for the effective application of these Guidelines at all relevant levels.

³⁸ See Article 4(1) points (47) and (48) of Regulation (EU) No 575/2013 regarding the scope of consolidation.

Where applicable, financial entities, in accordance with paragraph 26, and institutions that, as members of an institutional protection scheme, use centrally provided governance arrangements should comply with the following:

• a. where those financial entities have third-party arrangements with TPSPs within group or institutional protection scheme (IPS) (³⁹ ), the management body of those financial entities retains, also for such third-party arrangements, full responsibility for compliance with all regulatory requirements and the effective application of these Guidelines;
• b. where those financial entities partially or fully rely for the operational tasks of internal control functions on a TPSP within the group- or institutional protection scheme (IPS), for the monitoring and auditing of third-party arrangements, financial entities should ensure that, also for these arrangements, those operational tasks are effectively performed, including through the receiving of appropriate reports.

³⁹ In accordance with Article 113(7) of the CRR, institutional protection scheme means a contractual or statutory liability arrangement which protects those institutions that are a member of the scheme and in particular ensures their liquidity and solvency to avoid bankruptcy where necessary.

In addition to paragraph 27, financial entities within a group for which no waivers have been granted on the basis of Article 109 of Directive 2013/36/EU and Article 7 of Regulation (EU) No 575/2013, institutions that are a central body or that are permanently affiliated to a central body for which no waivers have been granted on the basis of Article 21 of Directive 2013/36/EU, or institutions that are members of an institutional protection scheme should take into account the following:

• a. where the operational monitoring of third-party arrangement is centralised (e.g. as part of a master agreement for the monitoring of third-party arrangements), financial entities should ensure that, at least for services supporting critical or important functions provided by TPSPs, both independent monitoring of the TPSP and appropriate oversight by each financial entity is performed, including by receiving, at least annually and upon request from such centralised function, reports that include, at least, the risk assessment and performance monitoring. In addition, financial entities should receive from the centralised function a summary of the relevant audit reports for services supporting critical or important functions provided by TPSPs and, upon request, the full audit report;
• b. financial entities should ensure that their management body will be duly informed of relevant planned changes regarding TPSPs that are monitored centrally and the potential impact of these changes on the services supporting critical or important functions provided, including a summary of the risk analysis, including legal risks, compliance with regulatory requirements and the impact on service levels, in order for them to assess the impact of these changes;
• c. where those financial entities within the group, institutions affiliated to a central body or institutions that are part of an institutional protection scheme rely on a central pre-contractual analysis of the third-party arrangements, referred to in Section 12, each financial entity should receive a summary of the assessment and ensure that it takes into consideration its specific structure and risks within the decision-making process;
• d. where the register of all existing third-party arrangements, as referred to in Section 10, is established and maintained centrally within the group or the institutional protection scheme (IPS), competent authorities and all financial entities should be able to obtain their individual register without undue delay. This register should include all third-party arrangements, including third-party arrangements with TPSPs within the group or institutional protection scheme;
• e. where those financial entities rely on an exit plan, as referred to in Section 14, for third party arrangement supporting critical or important function that has been established at group level, within the institutional protection scheme or by the central body, all financial entities should receive a summary of the plan and be satisfied that the plan can be effectively executed.

Where waivers have been granted pursuant to Article 21 of Directive 2013/36/EU or Article 109(1) of Directive 2013/36/EU in conjunction with Article 7 of Regulation (EU) No 575/2013, the provisions of these Guidelines should be applied by the parent undertaking in a Member State for itself and its subsidiaries or by the central body and its affiliates as a whole.

Financial entities that are subsidiaries of an EU parent undertaking or of a parent undertaking in a Member State to which no waivers have been granted based on Article 21 of Directive 2013/36/EU or Article 109(1) of Directive 2013/36/EU in conjunction with Article 7 of Regulation (EU) No 575/2013 should ensure that they comply with these Guidelines on an individual basis.