9.4 Internal control framework

Competent authorities should assess whether the applicant credit institution has an appropriate internal control framework which is commensurate with the credit institution’s envisaged activities, business model, complexity and associated risks (e.g. online onboarding of clients, cybersecurity protection and arrangements). Competent authorities should be satisfied of the adequacy of the allocated human resources both in terms of number of FTEs and qualifications, of the appropriateness of the systems and budget to support the conduct of the tasks.

Competent authorities should review the application documents and be satisfied that the allocation of tasks and responsibilities will allow the management body to fully know the structure of their credit institution⁵⁷ and ‘ensure that the internal control functions are independent of the business lines they control, including that there is an adequate segregation of duties, and that they have the appropriate financial and human resources as well as powers to effectively perform their role. The reporting lines and the allocation of responsibilities, in particular among key function holders, within the credit institution should be clear, well-defined, coherent, enforceable and duly documented’⁵⁸ .

⁵⁷ Paragraph 71of the EBA Guidelines on internal governance .

⁵⁸ Paragraph 68 of the EBA Guidelines on internal governance .

Competent authorities should achieve a clear view that the internal control framework covers all areas of the institution and reflects the three lines of defence model for the identification of the functions for addressing and managing risks.

For this purpose, competent authorities should verify that arrangements are in place to ensure that business and support units, the first line of defence, will be responsible in the first instance for identifying and managing the risks they incur in conducting their activities and for establishing and maintaining adequate processes and controls to ensure that such risks are analysed, measured, monitored, duly reported and kept within the limits of the credit institution’s risk appetite and that they are in compliance with internal and external regulatory requirements.

The risk management function and the compliance function, the second line of defence, together with the internal audit function, which is the third line of defence, form the internal control functions within the internal control framework. Competent authorities should verify that they will be established, taking into account the proportionality criteria set out in paragraphs 17–21, and that they will be endowed with appropriate and sufficient authority, stature and direct access to the management body to fulfil their mission.

To ensure that the internal control functions comply with independence requirements⁵⁹ , competent authorities should verify that, based on the application documents, it is envisaged that:

• (a) their staff do not perform any operational tasks falling within the scope of the activities the internal control functions are intended to monitor and control;
• (b) they are organisationally separate from the activities they are assigned to monitor and control;
• (c) notwithstanding the overall responsibility of members of the management body for the institution, the head of an internal control function should not be subordinate to a person who has responsibility for managing the activities the internal control function monitors and controls;
• (d) the remuneration of the internal control functions’ staff should not be linked to the performance of the activities the internal control function monitors and controls, and not otherwise likely to compromise their objectivity.

⁵⁹ See paragraph 175 of the EBA Guidelines on internal governance .

Competent authorities should verify that the heads of the internal control functions fulfil the following requirements: 9.4.1.1.1.1 will be established at an adequate hierarchical level that provides the head of the control function with the appropriate authority and stature needed to fulfil his or her responsibilities;

9.4.1.1.1.2 will be independent of the business lines or units they control;

9.4.1.1.1.3 will report and be directly accountable to the management body, and their performance should be reviewed by the management body;

9.4.1.1.1.4 where necessary, will have access and report directly to the management body in its supervisory function in order to raise concerns and warn the supervisory function, where appropriate, when specific developments affect or may affect the institution.

To ensure that internal control functions can be effectively exercised, competent authorities should be satisfied that they are allocated sufficient budgetary and human resources with adequate qualifications, having regard to the types of the targeted activities, and an appropriate ICT system and support at their disposal.

9.4.2 Risk management function

Competent authorities should be satisfied that, as part of the internal control framework, the credit institution will have a holistic credit-institution-wide risk management framework, recognising fully the economic substance of all the credit institution’s risk exposures.

Competent authorities should be satisfied that the risk management function (RMF) will facilitate the implementation of a sound risk management framework throughout the institution and that its role within the credit institution covers its involvement in: a) risk strategy and decision; b) evaluation of material changes; c) identifying, measuring, assessing, managing, mitigating, monitoring and reporting on risks; d) assessment of breaches of risk appetite or limits and recommendation of remedies. For this purpose, competent authorities should also review and assess the outline of the strategy for managing such risks and including a risk tolerance and appetite statement and measures to align the assessed risk with the risk appetite.

In respect of the RMF role in the risk strategy and decision-making, competent authorities’ review should aim at verifying that the application envisages the RMF’s active involvement at an early stage in the going concern in the elaboration of the credit institution’s risk strategy, in ensuring that the credit institution will have effective risk management processes in place and in providing the management body with all relevant risk-related information to enable the setting of the credit institution’s risk appetite level. Competent authorities should ensure that the RMF is envisaged to assess the robustness and sustainability of the risk strategy and appetite and that the latter is appropriately translated into specific risk limits, including at the business units level, and is involved before a decision is made by the management body concerning the risk strategies.

In respect of the RMF’s role in the evaluation of material changes, competent authorities should verify that the RMF’s involvement is envisaged before decisions on exceptional transactions are taken, so as to evaluate the impact of such changes and exceptional transactions on the credit institution’s overall risk, and to report its findings directly to the management body before a decision is taken.

As regards the RMF’s role in identifying, measuring, monitoring, mitigating and reporting risk and associated risk concentrations to be approved by the management body, competent authorities should make sure that policies and procedures are in place and that the RMF will have access to all business lines and other units which have the potential to generate risks.

The RMF’s role should also include the independent assessment of breaches of risk appetite or limits (including ascertaining the cause and undertaking a legal and economic analysis of the actual cost of closing, reducing or hedging the exposure against the potential cost of keeping it). It should be envisaged that the RMF will inform the business units concerned and the management body, and recommend possible remedies. For this purpose, it should be able to report directly to the management body in its supervisory function when the breach is material, without prejudice for the RMF to report to other internal functions and committees.

9.4.3 Remuneration policy

In respect of the outline of the remuneration policy, in addition to assessing compliance with the gender neutrality requirements under Article 92(2)(aa) CRD, competent authorities should have specific regard for verifying that the outline of the policy relating to staff members whose professional activities have a material impact on the credit institution’s risk profile⁶⁰ is in line with Article 94 CRD and the EBA Guidelines on remuneration policy .

⁶⁰ Submitted pursuant to the RTS on information for authorisation.

In particular, they should assess whether: a) the outline of the remuneration policy is in line with the institution’s envisaged risk appetite, its business strategy and its long-term interests, and it is envisaged to be maintained, approved and overseen by the management body; b) it envisages that staff who have a material impact on the institution’s risk profile will be appropriately identified in line with Article 92(3) and Article 94(3) CRD; c) it foresees specific remuneration requirements for those particular staff, inter alia (i) a ratio between variable and fixed remuneration in line with point (g) of Article 94(1) CRD and (ii) the pay-out in instruments, the deferral arrangements including malus and clawback in line with points (l), (m) and (n) of Article 94(1) CRD⁶¹ .

9.4.4 Compliance function

⁶¹ With specific regard to the derogations foreseen in Article 94 (3) and (4) CRD.

Competent authorities should verify that it is envisaged that the compliance function will manage compliance risk, provide advice to the management body on measures to be taken to ensure compliance with applicable laws, rules, regulations and standards, and implement, under the oversight of the management body, policies and processes to manage compliance risks and to ensure compliance. Competent authorities should verify that the compliance function is adequate to the types and geographical distribution of activities (e.g. compliance with the applicable national laws of various jurisdictions in the case of activities carried out on cross-border basis), risks and complexity in line with the business model and the business plan assessment conducted in accordance with section 7 of these Guidelines.

The compliance function should ensure that compliance monitoring is carried out through a structured and well-defined compliance monitoring programme and that the compliance policy is observed. It should also be envisaged that the compliance function and the RMF will cooperate and exchange information as appropriate to perform their respective tasks.

Competent authorities should also check that the compliance function will be entrusted with verifying, in close cooperation with the RMF and the legal unit, that new products and new procedures comply with the current legal framework and, where appropriate, with any known forthcoming changes to legislation, regulations and supervisory requirements.

Competent authorities should verify that an AML/CTF compliance function for compliance with the specific ML/TF regulation and internal policies is envisaged to be set up, either within or separate from the compliance function.

9.4.5 AML/CFT policy

Competent authorities should verify that the AML/CTF policy, submitted by the applicant credit institution pursuant to Article 5(1), letter c), no. (iii) of the RTS on information for authorisation , provides an overview of the key policies and procedures, as set out in Article 8(3) AMLD, that will be put in place to counter the ML/TF risk. For this purpose, competent authorities will take into account proportionality criteria set out in paragraphs 17–21.

Competent authorities should verify that the outline covers all elements set out in Article 8(4)⁶² AMLD and substantiate how the applicant credit institution will ensure it can mitigate and manage effectively the ML/TF risks to which it is exposed as of the day of access to the market.

9.4.6 Internal audit function

⁶² It reads: ‘The policies, controls and procedures referred to in paragraph 3 shall include: (a) the development of internal policies, controls and procedures, including model risk management practices, customer due diligence, reporting, record-keeping, internal control, compliance management including, where appropriate with regard to the size and nature of the business, the appointment of a compliance officer at management level, and employee screening; (b) where appropriate with regard to the size and nature of the business, an independent audit function to test the internal policies, controls and procedures referred to in point (a)’.

Competent authorities, taking into account the proportionality criteria set out in paragraphs 17–21, should assess the independent and effective internal audit function (‘IAF’) set up by the applicant credit institution. Competent authorities should gain a clear view that the IAF, following a risk-based approach, will be able to independently review and provide objective assurance of the compliance of all activities and units of the credit institution, including outsourced activities, with the institution’s policies and procedures and with other external (non-prudential) requirements.

For this purpose, competent authorities should assess whether the IAF has its organisational independence and the internal auditors' objectivity protected by direct reporting to the management body and adequate resources to perform its tasks. For this purpose, it should also be ensured that the IAF has unfettered institution-wide access to all the records, documents, information and buildings of the institution for the performance of its function.

Competent authorities should also assess whether the IAF is entrusted with at least the following:

• (a) the appropriateness of the internal control framework, including the adequacy of policy and procedures and the compliance with legal and regulatory requirements;
• (b) the development of an audit plan at least once a year on the basis of the annual internal audit control objectives and to be approved by the management body;
• (c) submitting recommendations based on the findings of their its activities.

They should also verify that the outline of the methodology and internal audit plan covering the first three years of activity, including the audit of externalised services, are consistent with the organisational structure, types of activities and risk profile resulting from the business plan assessed in accordance with section 7.

9.4.7 Operational resilience and business continuity policy and plan

The outlines of the business continuity policy and plan should ensure that the applicant will have a sound business continuity management plan to ensure its ability to operate on an ongoing basis and to limit losses in the event of severe business disruption. It should ensure that the business continuity policy and plan include an analysis of the main business disruption risks and an overview of the mitigation measures and ensure regular testing of the business continuity plan.

9.4.8 ICT policy and systems

Competent authorities should assess whether the ICT policy will provide the credit institution with reliable information and communication systems and whether the ICT systems will be able to fully support risk data aggregation capabilities at normal times as well as during times of stress. In particular, competent authorities should assess whether the credit institution will at least be able to:

• (a) generate accurate and reliable risk data;
• (b) capture and aggregate all material risk data across the institution;
• (c) generate aggregate and up-to-date risk data in a timely manner;
• (d) generate aggregate risk data to meet a broad range of on-demand requests from the management body or competent authorities;
• (e) ensure sound, reliable and secure functioning of information and communication systems supporting the targeted activities of institutions.

With regard to ICT and security risk⁶³ , competent authorities should be satisfied that the management framework will ensure the sound, reliable and secure functioning of information and communication systems supporting the activities of credit institutions as well as the adequate prevention, monitoring and mitigation of ICT risks at normal times and during times of stress. Competent authorities should assess, in particular:

• (a) whether the management body has overall accountability for setting, approving and overseeing the implementation of financial institutions’ ICT strategy, which should be aligned with financial institutions’ overall business strategy;
• (b) the clear definition and attribution of key roles and responsibilities, and relevant reporting lines, for the ICT and security risk management framework to be effective, including the allocation of appropriate budget to adequately support the ICT operational needs and the ICT and security risk management;
• (c) whether the management and oversight of ICT and security risks are entrusted to an independent and objective control function, appropriately segregated from ICT operational processes and not responsible for any internal audit, and an independent internal audit function;
• (d) the arrangements to ensure the identification, establishment and maintenance of updated mapping of business functions, roles and supporting processes to identify the importance of each and their interdependencies in relation to ICT and security risks;
• (e) to the extent that the information is held on ICT systems, whether the requirements for information security will be in place;
• (f) the scale, complexity and importance of ICT-related dependencies, if the outsourcing of operational functions of ICT services and any activity of ICT systems – including to group entities – or the use of third parties in relation to such functions and activity is envisaged.

⁶³ As defined in the EBA Guidelines on ICT security risk management , ‘ICT and security risk’ means: ‘Risk of loss due to breach of confidentiality, failure of integrity of systems and data, inappropriateness or unavailability of systems and data or inability to change information technology (IT) within a reasonable time and with reasonable costs when the environment or business requirements change (i.e. agility). This includes security risks resulting from inadequate or failed internal processes or external events including cyber-attacks or inadequate physical security’.