135. Competent authorities should review the application, in particular the articles of association …

Competent authorities should review the application, in particular the articles of association or other equivalent constitutional documents⁴² and the terms of reference of the management body⁴³ , and be satisfied that the documents adequately cover the management body’s roles and responsibilities, distinguishing between the duties of the management (executive) function and of the supervisory (non-executive) function. In line with this, competent authorities should in particular:

• (a) verify that the management body has ultimate and overall responsibility of the institution and defines, oversees and is accountable for the implementation of the governance arrangements within the institution that ensure effective and prudent management of the institution⁴⁴ ;
• (b) be satisfied that the responsibilities entrusted to the management body⁴⁵ include setting, approving and overseeing the implementation of: a) the overall business strategy and the key policies of the credit institution; b) the overall risk strategy, including the credit institution’s risk appetite, its risk management framework and measures to ensure that the management body devotes sufficient time to risk issues and to performing its function; c) an adequate and effective internal governance and internal control framework that includes a clear organisational structure and well-functioning independent internal risk management, compliance and audit functions that have sufficient authority, stature and resources to perform their functions; d) an adequate and effective internal governance and internal control framework, to ensure compliance with applicable requirements, including in the context of the prevention of money laundering and terrorism financing; e) the amounts, types and distribution of both internal capital and regulatory capital to adequately cover the risks of the institution; f) targets for the liquidity management of the institution; g) a remuneration policy as described in paragraphs 170 and 171; h) arrangements on the individual and collective suitability, composition, effectiveness and succession planning of the management body; i) a selection and suitability assessment process for key function holders⁴⁶ ; j) arrangements aimed at ensuring the internal functioning of each committee of the management body, when established⁴⁷ ; k) a risk culture which addresses the institution’s risk awareness and risk-taking behaviour; l) a corporate culture and values which foster responsible and ethical behaviour, including a code of conduct or similar instrument; m) a conflict of interest policy at institutional and staff level; and n) arrangements aimed at ensuring the integrity of the accounting and financial reporting systems, including financial and operational controls and compliance with the law and relevant standards;
• (c) be satisfied that the application envisages that when setting, approving and overseeing the implementation of the tasks referred to in letter (b) above, the management body should aim at ensuring a sustainable business model that takes into account all risks, including environmental, social and governance risks;
• (d) be satisfied that the relevant application documents envisage arrangements aimed at ensuring that the individual and collective suitability assessments of the management body are carried out effectively, that the roles and responsibilities of the chair are clearly defined, that the composition and succession planning of the management body are appropriate, and that the management body will perform its functions effectively, in compliance with the EBA Guidelines on internal governance and EBA Guidelines on suitability assessment ;
• (e) assess that the management body in its management function will be entrusted with the responsibility for the implementation of the strategies set by the management body and discuss regularly the implementation and appropriateness of those strategies with the management body in its supervisory function. The management body in its management function should also be empowered to constructively challenge and critically review propositions, explanations and information received when exercising its judgment and taking decisions on the strategy of the institution⁴⁸ ;
• (f) be satisfied, without prejudice to the responsibilities assigned under the applicable national company law, that the tasks of the management body in its supervisory function should include⁴⁹ : a) overseeing and monitoring management decision-making and actions and providing effective oversight of the management body in its management function, including monitoring and scrutinising its individual and collective performance and the implementation of the institution’s strategy and objectives; b) ensuring and periodically assessing the effectiveness of the credit institution’s internal governance framework and taking appropriate steps to address any identified deficiencies; c) overseeing and monitoring whether the credit institution’s strategic objectives, organisational structure and risk strategy, including its risk appetite and risk management framework, as well as other policies (e.g. remuneration policy) and the disclosure framework are implemented consistently; d) monitoring whether the risk culture of the credit institution is implemented consistently; e) overseeing the implementation and maintenance of a code of conduct or similar and effective policies to identify, manage and mitigate actual and potential conflicts of interest; f) overseeing the integrity of financial information and reporting, and the internal control framework, including an effective and sound risk management framework;
• g) ensuring that the heads of internal control functions are able to and do act independently and, regardless of the responsibility to report to other internal bodies, business lines or units, can raise concerns and warn the management body in its supervisory function directly, where necessary, when adverse risk developments affect or may affect the institution; and h) monitoring the implementation of the internal audit plan, after the prior involvement of the risk and audit committees, where such committees are established;
• (g) verify that the relevant application documents relating to the committees that will be established include their combination, composition, role and allocation of duties and tasks between specialised committees of the management body, in accordance with the relevant provisions of the EBA Guidelines on internal governance .

⁴² Submitted pursuant to the RTS on information for authorisation.

⁴³ Submitted pursuant to the RTS on information for authorisation .

⁴⁴ Paragraph 19 of the EBA Guidelines on internal governance .

⁴⁵ See paragraph 22 of the EBA Guidelines on internal governance .

⁴⁶ As defined in the EBA Guidelines on internal governance , the expression ‘key function holder’ ‘means persons who have significant influence over the direction of the institution but who are not members of the management body and are not the CEO. They include the heads of internal control functions and the CFO, where they are not members of the management body, and, where identified on a risk-based approach by institutions, other key function holders. Other key function holders might include heads of significant business lines, European Economic Area/European Free Trade Association branches, third country subsidiaries and other internal functions’. See also Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders.

⁴⁷ In accordance with paragraph 22(i) of the EBA Guidelines on internal governance , such arrangements should detail ‘i. role, composition and tasks of each of them; ii. appropriate information flow, including the documentation of recommendations and conclusions, and reporting lines between each committee and the management body, competent authorities and other parties’.

⁴⁸ See paragraph 30 of the EBA Guidelines on internal governance .

⁴⁹ See paragraph 34 of the EBA Guidelines on internal governance .

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/