9.1 General criteria

Competent authorities should perform a careful and comprehensive review of the arrangements, processes and mechanisms relating to the applicant credit institution’s internal governance, being mindful that pursuant to Article 10(2) CRD, in the case of failure to demonstrate sound and effective risk management by that institution, competent authorities have to refuse granting the authorisation.

The CAM laid down herein aims to guide the competent authorities’ assessment of the application documents relating to internal governance arrangements, operational structure, policies and processes. The CAM provides guidance on the main elements and aspects to be assessed by the competent authorities for the purpose of granting the authorisation and is without prejudice to the application of additional parts of the EBA Guidelines on internal governance (second revision)³⁵ , the EBA and ESMA Guidelines on the assessment of the suitability of members of the management body and key function holders (revised)³⁶ , the EBA Guidelines on remuneration (revised)³⁷ , the EBA Guidelines on outsourcing arrangements³⁸ and the EBA Guidelines on ICT and security risk management³⁹ . The competent authorities’ assessment should aim at ensuring the compliance of the credit institution with the EBA Guidelines referred to.

³⁵ EBA/GL/2021/05 of 2 July 2021, available at https://www.eba.europa.eu/guidelines-internal-governance-second-revision

³⁶ EBA/GL/2021/06 of 2 July 2021, available at https://www.eba.europa.eu/joint-esma-and-eba-guidelines-assessment-suitability-members-management-body-revised

³⁷ EBA/GL/2021/04 of 2 July 2021, available at https://www.eba.europa.eu/regulation-and-policy/remuneration/guidelines-on-sound-remuneration-policies-second-revision

³⁸ EBA GL/2019/02 of 25 February 2019, available at https://eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-outsourcing-arrangements

³⁹ EBA/GL/2019/04 of 29 November 2019, available at https://eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-ict-and-security-risk-management

For the purposes of this section, and consistently with paragraph 13, the governance framework, in particular the internal control framework, including the risk management framework, covers also the risk of ML/TF and should be assessed in line with the EBA ML/TF Risk Factors Guidelines⁴⁰ when assessing the adequacy of applicant credit institutions’ AML/CFT policies and procedures.

⁴⁰ EBA/GL/2021/02 of 1 March 2021, available at https://www.eba.europa.eu/regulation-and-policy/anti-money-laundering-and-e-money/revised-guidelines-on-ml-tf-risk-factors

Competent authorities should achieve a comprehensive understanding of how the credit institution is organised and a clear view on its governance and operational structure, as well as other arrangements, processes and mechanisms, which should be well designed. The applicant should be adequately equipped to be considered sufficiently able to perform the targeted activities in a sound and prudent manner.

Competent authorities should be satisfied that the application documents envisage arrangements, processes and mechanisms that adequately demonstrate the presence of a clear, transparent and robust governance structure ensuring effective decision-making and good governance, and that the powers and responsibilities are clearly allocated at all levels of the organisation and among the governing bodies.

The intensity of the competent authorities’ assessment of internal governance requirements should take into account proportionality criteria set out in paragraphs 17–21 of these Guidelines and the applicant’s individual risk profile.

The assessment should be based on the documents and information submitted by the applicant credit institution pursuant, in particular, to Article 1, letter l), Article 4, letters (g) and

• (h) and Article 5(1), letters (b) to (f) of the RTS on information for authorisation and any additional document the competent authority requests in accordance with Article 10(1) of those RTS.