6.2 Know your structure

The management body should fully know and understand the legal, organisational and operational structure of the institution ( ‘ know your structure ’ ) and ensure that it is in line with its approved business and risk strategy and risk appetite and covered by its risk management framework.

The management body should be responsible for the approval of sound strategies and policies for the establishment of new structures. Where an institution creates many legal entities within its group, their number and, in particular, the interconnections and transactions between them should not pose challenges for the design of its internal governance, and for the effective management and oversight of the risks of the group as a whole. The management body should ensure that the structure of an institution and, where applicable, the structures within a group, taking into account the criteria specified in Section 7, are clear, efficient and transparent to the institution ’ s staff, shareholders and other stakeholders and to the competent authority.

The management body should guide the institution ’s structure, its evolution and its limitations and should ensure that the structure is justified and efficient and does not involve undue or inappropriate complexity.

The management body of a consolidating institution should understand not only the legal, organisational and operational structure of the group but also the purpose and activities of its different entities and the links and relationships among them. This includes understanding group-specific operational risks and intra-group exposures as well as how the group's funding, capital, liquidity and risk profiles could be affected under normal and adverse circumstances. The management body should ensure that the institution is able to produce information on the group in a timely manner, regarding the type, the characteristics, the organisational chart, the ownership structure and the businesses of each legal entity, and that the institutions within the group comply with all supervisory reporting requirements on an individual, sub-consolidated and consolidated basis.

The management body of a consolidating institution should ensure that the different group entities (including the consolidating institution itself) receive enough information to get a clear perception of the general objectives, strategies and risk profile of the group and how the group entity concerned is embedded in the group’s structure and operational functioning . Such information and revisions thereof should be documented and made available to the relevant functions concerned, including the management body, business lines and internal control functions. The members of the management body of a consolidating institution should keep themselves informed about the risks the group’s structure causes , taking into account the criteria specified in Section 7 of the guidelines. This includes receiving:

• a. information on major risk drivers;
• b. regular reports assessing the institution ’ s overall structure and evaluating the compliance of individual entities ’ activities with the approved group-wide strategy; and
• c. regular reports on topics where the regulatory framework requires compliance at individual, sub-consolidated and consolidated levels.