17 Internal control functions

The internal control functions should include an effective and permanent internal compliance function, and where appropriate and proportionate, taking into account the criteria listed in Title I, a risk management function and an internal audit function. The responsibilities of control functions also include ensuring compliance with AML/CTF requirements. Where investment firms do not establish and maintain a risk management function and an internal audit function, they should be able to demonstrate upon request that the policies and procedures adopted and implemented for an internal control framework effectively achieve the same outcome as the guidelines provided in this Title V.

Where the investment firm does not establish an internal risk management function (RMF) or internal audit function (IAF), the responsibilities of these functions as set out in these guidelines are with the staff in charge of the established procedures and ultimately the management body, who may delegate the operational tasks internally or externally.

Without prejudice to national law implementing Directive (EU) 2015/849, institutions should assign the r esponsibility for ensuring the institution’s compliance with the requirements of that directive and the institution’s policies and procedures to a staff member (e.g. head of compliance). Institutions may establish a separate AML/CTF compliance function as an independent control function. The person responsible for AML/CTF should, where necessary, be able to report directly to the management body in its management and its supervisory function.