+4. Guidelines
---+Title I – proportionality
------+17. Where applying these guidelines, competent authorities and investment firms should have regard …
------+18. For the purposes of the previous paragraph, account should be taken of the variety of different …
------+19. Where applying the principle of proportionality as set out in Article 26 (3) of Directive (EU) …
------+20. For the purpose of the application of the principle of proportionality and in order to ensure …
------+21. Investment firms that are legal persons managed by a single natural person should have …
---+Title II – role and composition of the management body and committees
---+1 Role and responsibilities of the management body
------+22. The management body must have ultimate and overall responsibility for the investment firm and …
------+23. The duties of the management body should be clearly defined, distinguishing between the duties …
------+24. The management body in its supervisory function and its management function should interact …
------+25. Without prejudice to the tasks and responsibilities assigned to the management body under …
------+26. When setting up, approving and overseeing the implementation of the aspects listed in paragraph …
------+27. The management body should oversee the process of disclosure and communications with external …
------+28. All members of the management body should be informed about the overall activity, financial and …
------+29. A member of the management body may be responsible for an internal control function as referred …
------+30. The management body should monitor, periodically review and address any weaknesses identified …
------+31. Where investment firms are legal persons managed by a single natural person in accordance with …
---+2 Management function of the management body
------+32. In its management function, the management body should actively engage in the business of an …
------+33. In its management function, the management body should be responsible for the implementation of …
------+34. In its management function, the management body should constructively challenge and critically …
------+35. Without prejudice to the national transposition of Directive (EU) 2015/849 Anti-Money …
---+3 Supervisory function of the management body
------+36. The role of the members of the management body in its supervisory function should include …
------+37. Without prejudice to national law, in its supervisory function the management body should …
------+38. Without prejudice to the responsibilities assigned under the applicable national company law …
---+4 Role of the chair of the management body
------+39. The chair of the management body should lead the management body, contribute to an efficient …
------+40. The chair should encourage and promote open and critical discussion and ensure that dissenting …
------+41. Where the chair is permitted to assume executive duties, the investment firm should have …
------+42. The chair should set meeting agendas and ensure that strategic issues are discussed as a …
------+43. The chair of the management body should contribute to a clear allocation of duties between …
---+5 Committees of the management body in its supervisory function
---+5.1 Setting up committees
------+44. In accordance with Article 28 of the IFD and unless otherwise specified by national law …
------+45. Where no risk committee is established, the references in these guidelines to this committee …
------+46. Investment firms may, taking into account the criteria set out in Title I of these guidelines …
------+47. Investment firms should ensure a clear allocation and distribution of duties and tasks between …
------+48. Committees should support the supervisory function in specific areas and facilitate the …
---+5.2 Composition of committees
------+49. All committees should be chaired by a non-executive member of the management body who is able …
------+50. Independent members of the management body in its supervisory function should be actively …
------+51. Where committees have to be set up in accordance with Directive (EU) 2019/2034 or national law …
------+52. The risk committee should be composed of non-executive members of the management body in its …
------+53. The risk committee should be chaired, where possible, by an independent member. Members of the …
---+5.3 Committees’ p rocesses
------+54. Committees should regularly report to the management body in its supervisory function.
------+55. Committees should interact with each other as appropriate. Without prejudice to paragraph 51 …
------+56. Members of committees should engage in open and critical discussions, during which dissenting …
------+57. Committees should document the agendas of committee meetings and their main results and …
------+58. The risk committee should at least: a. have access to all the relevant information and data …
---+5.4 Role of the risk committee
------+59. Where established, the risk committee should at least: a. advise and support the management …
------+60. The risk committee should collaborate with other committees whose activities may have an impact …
---+Title III – governance framework
---+6 Organisational framework and structure
---+6.1 Organisational framework
------+61. The management body of an investment firm should ensure a suitable and transparent …
------+62. The management body should ensure that the internal control functions have the appropriate …
------+63. The structure of the investment firm should not impede the ability of the management body to …
------+64. The management body should assess whether and how material changes to the group ’ s structure …
---+6.2 Know your structure
------+65. The management body should fully know and understand the legal, organisational and operational …
------+66. The management body should be responsible for the approval of sound strategies and policies for …
------+67. The management body should guide the investment firm ’s structure, its evolution and its …
------+68. The management body of a Union parent undertaking should understand not only the legal …
------+69. The management body of a Union parent undertaking should ensure that the different group …
---+6.3 Complex structures and non-standard or non-transparent activities
------+70. Investment firms should avoid setting up complex and potentially non-transparent structures. …
------+71. In any case, investment firms should not set up opaque or unnecessarily complex structures that …
------+72. When setting up such structures, the management body should understand them and their purpose …
------+73. Investment firms should document their decisions and be able to justify their decisions to …
------+74. The management body should ensure that appropriate actions are taken to avoid or mitigate the …
------+75. These structures and activities, including their compliance with legislation and professional …
------+76. Investment firms should take effective risk management measures when they perform non-standard …
---+7 Organisational framework in a group context
------+77. In accordance with Article 25 of Directive (EU) 2019/2034 and Article 7 of Regulation (EU) …
------+78. The management body of a subsidiary that is subject to Directive (EU) 2019/2034 should adopt …
------+79. At the consolidated level, the Union parent undertaking should ensure adherence to the …
------+80. A Union parent undertaking should consider the interests of all its subsidiaries, and how …
------+81. A Union parent undertaking and its subsidiaries should ensure that the investment firms and …
------+82. The Union parent undertaking should ensure that subsidiaries established in third countries …
------+83. The governance requirements of Directive 2019/2034/EU and the provisions in these guidelines …
------+84. When establishing policies and documenting governance arrangements, investment firms should …
---+Title IV – risk culture and business conduct
---+8 Risk culture
------+85. A sound, diligent and consistent risk culture should be a key element of investment firms ’ …
------+86. Investment firms should develop an integrated and investment firm-wide risk culture, based on a …
------+87. Investment firms should develop a risk culture through policies, communication and staff …
------+88. Staff should be fully aware of their responsibilities relating to risk management. Risk …
------+89. A strong risk culture should include but is not necessarily limited to: a. Tone from the top …
---+9 Corporate values and code of conduct
------+90. The management body should develop, adopt, adhere to and promote high ethical and professional …
------+91. Investment firms should ensure that there is no discrimination towards staff based on gender …
------+92. Investment firms ’ policies should be gender-neutral. This includes, but is not limited to …
------+93. The standards implemented should aim to enhance the institution’s robust governance …
------+94. The management body should have clear and documented policies for how these standards should be …
------+95. Investment firms should monitor compliance with such standards and ensure staff awareness, e.g. …
---+10 Conflict of interest policy at firm level
------+96. The management body should be responsible for establishing, approving and overseeing the …
------+97. Investment firms ’ measures to manage or where appropriate mitigate conflicts of interest …
---+11 Conflict of interest policy for staff
------+98. Without prejudice to Article 23 of Directive 2014/65/EU and Section 3 of the Chapter 2 of the …
------+99. The policy should aim to identify conflicts of interest of staff, including the interests of …
------+100. Regarding conflicts of interest that may result from past relationships, investment firms …
------+101. The policy should cover at least the following situations or relationships where conflicts of …
------+102. Notwithstanding the above, investment firms should take into consideration that being a …
------+103. The policy should set out the processes for reporting and communication to the function …
------+104. The policy should differentiate between conflicts of interest that persist and need to be …
------+105. The policy should set out procedures, measures, documentation requirements and …
------+106. The policy should specifically cover the risk of conflicts of interest at the level of the …
------+107. When mitigating identified conflicts of interest of members of the management body, investment …
------+108. Actual or potential conflicts of interest that have been disclosed to the responsible function …
------+109. All actual and potential conflicts of interest at the management body level, individually and …
---+11.1 Conflicts of interest policy in the context of loans and other transactions with members of the management body and their related parties
------+110. As part of their conflicts of interest policies for staff (Section 11) and the management of …
------+111. Investment firms should consider additional categories of related parties to whom they apply …
------+112. The conflicts of interest framework should ensure that decisions regarding loans and entering …
------+113. The management body should set out the applicable decision-making processes for granting loans …
------+114. As part of the conflicts of interest framework, the management body should set appropriate …
------+115. The member of the management body benefiting from such a material loan or other material …
------+116. When deciding on a loan or other transaction with a member of the management body or their …
------+117. To ensure compliance with their conflicts of interest policies, investment firms should ensure …
---+11.2 Documentation of loans to members of the management body and their related parties and additional information
------+118. For the purposes of Article 26 of Directive (EU) 2019/2034, investment firms should document …
------+119. Investment firms should ensure that the documentation of all loans to members of the …
---+12 Internal alert procedures
------+120. Investment firms should put in place and maintain appropriate internal alert policies and …
------+121. To avoid conflicts of interest, it should be possible for staff to report breaches outside …
------+122. The alert procedures should be made available to all staff within an investment firm.
------+123. Information provided by staff through the alert procedures should, if appropriate, be made …
------+124. Investment firms should ensure that the person reporting the breach is appropriately protected …
------+125. Investment firms should also protect persons who have been reported from any negative effects …
------+126. In particular, internal alert procedures should: a. be documented (e.g. staff handbooks); b. …
---+13 Reporting of breaches to competent authorities
------+127. In accordance with article 22 of Directive (EU) 2019/2034, competent authorities should …
------+128. Without prejudice to the possibility of reporting breaches through the competent authorities’ …
---+Title V – internal control framework and mechanisms
---+14 Internal control framework
------+129. Investment firms should develop and maintain a culture that encourages a positive attitude …
------+130. The internal control framework of the investment firm concerned should be adapted on an …
------+131. Investment firms should implement appropriate processes and procedures to ensure that they …
------+132. The internal control framework should cover the whole organisation, including the management …
------+133. The internal control framework of an investment firm should ensure: a. effective and efficient …
---+15 Implementing an internal control framework
------+134. The management body should be responsible for establishing and monitoring the adequacy and …
------+135. An investment firm should have a clear, transparent and documented decision-making process and …
------+136. Investment firms should communicate these policies, mechanisms and procedures to all staff and …
------+137. The internal control functions should verify that the policies, mechanisms and procedures set …
------+138. Internal control functions should regularly submit to the management body written reports on …
---+16 Risk management framework
------+139. As part of the overall internal control framework, investment firms should have a holistic …
------+140. An investment firm ’s risk management framework should include policies, procedures, risk …
------+141. An investment firm ’ s risk management framework should provide specific guidance on the …
------+142. The risk management framework should be subject to independent internal review, e.g. performed …
------+143. When identifying and measuring or assessing risks, an investment firm should develop …
------+144. Investment firms should take into consideration that the results of quantitative assessment …
------+145. The ultimate responsibility for risk assessment lies solely with the investment firm, which …
------+146. Investment firms should be fully aware of the limitations of models and metrics and use not …
------+147. In addition to the investment firms ’ own assessments, investment firms may use external risk …
------+148. Regular and transparent reporting mechanisms should be established so that the management …
------+149. Effective communication and awareness regarding risks and the risk strategy is crucial for the …
---+17 Internal control functions
------+150. The internal control functions should include an effective and permanent internal compliance …
------+151. Where the investment firm does not establish an internal risk management function (RMF) or …
------+152. Without prejudice to national law implementing Directive (EU) 2015/849, institutions should …
---+17.1 Heads of the internal control functions
------+153. Heads of internal control functions should be established at an adequate hierarchical level …
------+154. Where necessary, the heads of internal control functions should be able to have access and …
------+155. Investment firms should have documented processes in place to assign the position of the head …
---+17.2 Independence of internal control functions
------+156. In order for the internal control functions to be regarded as operating independently, the …
---+17.3 Resources of internal control functions
------+157. Internal control functions should have sufficient resources. Taking into account the …
------+158. Internal control functions should have appropriate IT systems and support at their disposal …
---+18 Risk management function
------+159. The risk management function (RMF) should cover the whole investment firm. The RMF should have …
------+160. The RMF should have, where necessary, direct access to the management body in its supervisory …
------+161. The RMF should have access to all business lines and other internal units that have the …
------+162. Staff within the RMF should possess sufficient knowledge, skills and experience in relation to …
------+163. The RMF should be a central organisational feature of the investment firm, structured so that …
------+164. In a group, the RMF in the Union parent undertaking should be able to deliver a group-wide …
------+165. The RMF should provide relevant independent information, analyses and expert judgement on risk …
---+18.1 RMF’s role in risk strategy and decisions
------+166. The RMF should be actively involved at an early stage in developing the investment firm ’s …
------+167. The RMF’s involvement in decision -making processes should ensure that risk considerations are …
---+18.2 RMF’s role in material changes
------+168. Before decisions on material changes to processes or systems or exceptional transactions are …
------+169. The RMF should evaluate how the risks identified could affect the investment firm ’s or …
---+18.3 RMF’s role in identifying , measuring, assessing, managing, mitigating, monitoring and reporting on risks
------+170. The RMF should ensure that that there is an appropriate risk management framework and that all …
------+171. The RMF should ensure that identification and assessment are not based only on quantitative …
------+172. The RMF should ensure that transactions with related parties are reviewed and that the risks …
------+173. The RMF should ensure that all identified risks are effectively monitored by the business …
------+174. The RMF should regularly monitor the actual risk profile of the investment firm and scrutinise …
------+175. The RMF should analyse trends and recognise new or emerging risks and increases in risk …
------+176. The RMF should evaluate possible ways to mitigate risks. Reporting to the management body …
---+18.4 RMF’s role in limits
------+177. The RMF should independently assess breaches of risk appetite or limits (including …
------+178. The RMF should play a key role in ensuring that a decision on its recommendation is made at …
---+18.5 Head of the risk management function
------+179. Where established, the head of the RMF should be responsible for providing comprehensive and …
------+180. The head of the RMF should have sufficient expertise, independence and seniority to challenge …
------+181. The head of the RMF should be able to challenge decisions taken by the investment firm ’ s …
------+182. Investment firms should establish strengthened processes for the approval of decisions on …
---+19 Compliance function
------+183. Investment firms should establish a permanent and effective compliance function to manage …
------+184. The role of compliance officer, taking into account the principle of proportionality as set …
------+185. Staff within the compliance function should possess sufficient knowledge, skills and …
------+186. The management body in its supervisory function should oversee the implementation of a …
------+187. The compliance function should advise the management body on measures to be taken to ensure …
------+188. The compliance function should ensure that compliance monitoring is carried out through a …
------+189. Investment firms should take appropriate action against internal or external behaviour that …
------+190. Investment firms should ensure that their subsidiaries and branches take steps to ensure that …
---+20 Internal audit function
------+191. Where established, the IAF should be independent and have sufficient authority, stature and …
------+192. The IAF should be independent of the audited activities. Therefore, the IAF should not be …
------+193. The IAF should, following a risk-based approach, independently review and provide objective …
------+194. The IAF should not be involved in designing, selecting, establishing or implementing specific …
------+195. The IAF should assess whether the investment firm ’s internal control framework as set out in …
------+196. The IAF should verify, in particular, the integrity of the processes ensuring the reliability …
------+197. The IAF should have unfettered investment firm-wide access to all the records, documents …
------+198. The IAF should adhere to national and international professional standards. An example of the …
------+199. Internal audit work should be performed in accordance with an audit plan and a detailed audit …
------+200. An internal audit plan should be drawn up at least once a year on the basis of the annual …
------+201. All audit recommendations should be subject to a formal follow-up procedure by the appropriate …
---+Title VI – business continuity management
------+202. Investment firms should establish a sound business continuity management and recovery plan to …
------+203. Investment firms may establish a specific independent business continuity function.
------+204. An investment firm ’s business relies on several critical resources (e.g. IT systems …
------+205. In order to establish a sound business continuity management plan, an investment firm should …
------+206. On the basis of the abovementioned analysis, an investment firm should put in place: a. …
------+207. Contingency, business continuity and recovery plans should be documented and carefully …
---+Title VII – transparency
------+208. Strategies, policies and procedures should be communicated to all relevant staff throughout an …
------+209. Accordingly, the management body should inform and update the relevant staff about the …
------+210. Where parent undertakings are required by competent authorities under Article 44 of Directive …
------+211. The publication should include at least: a. an overview of the internal organisation of the …
|
4. Guidelines
4. Guidelines
1. Overview
| Summary |
Regulation |
|
Title I – proportionality
|
Title I – proportionality
|
|
Title II – role and composition of the management body and committees
|
Title II – role and composition of the management body and committees
|
|
1 Role and responsibilities of the management body
|
1 Role and responsibilities of the management body
|
|
2 Management function of the management body
|
2 Management function of the management body
|
|
3 Supervisory function of the management body
|
3 Supervisory function of the management body
|
|
4 Role of the chair of the management body
|
4 Role of the chair of the management body
|
|
5 Committees of the management body in its supervisory function
|
5 Committees of the management body in its supervisory function
|
|
5.1 Setting up committees
|
5.1 Setting up committees
|
|
5.2 Composition of committees
|
5.2 Composition of committees
|
|
5.3 Committees’ p rocesses
|
5.3 Committees’ p rocesses
|
|
5.4 Role of the risk committee
|
5.4 Role of the risk committee
|
|
Title III – governance framework
|
Title III – governance framework
|
|
6 Organisational framework and structure
|
6 Organisational framework and structure
|
|
6.1 Organisational framework
|
6.1 Organisational framework
|
|
6.2 Know your structure
|
6.2 Know your structure
|
|
6.3 Complex structures and non-standard or non-transparent activities
|
6.3 Complex structures and non-standard or non-transparent activities
|
|
7 Organisational framework in a group context
|
7 Organisational framework in a group context
|
|
Title IV – risk culture and business conduct
|
Title IV – risk culture and business conduct
|
|
8 Risk culture
|
8 Risk culture
|
|
9 Corporate values and code of conduct
|
9 Corporate values and code of conduct
|
|
10 Conflict of interest policy at firm level
|
10 Conflict of interest policy at firm level
|
|
11 Conflict of interest policy for staff
|
11 Conflict of interest policy for staff
|
|
11.1 Conflicts of interest policy in the context of loans and other transactions with members of the management body and their related parties
|
11.1 Conflicts of interest policy in the context of loans and other transactions with members of the management body and their related parties
|
|
11.2 Documentation of loans to members of the management body and their related parties and additional information
|
11.2 Documentation of loans to members of the management body and their related parties and additional information
|
|
12 Internal alert procedures
|
12 Internal alert procedures
|
|
13 Reporting of breaches to competent authorities
|
13 Reporting of breaches to competent authorities
|
|
Title V – internal control framework and mechanisms
|
Title V – internal control framework and mechanisms
|
|
14 Internal control framework
|
14 Internal control framework
|
|
15 Implementing an internal control framework
|
15 Implementing an internal control framework
|
|
16 Risk management framework
|
16 Risk management framework
|
|
17 Internal control functions
|
17 Internal control functions
|
|
17.1 Heads of the internal control functions
|
17.1 Heads of the internal control functions
|
|
17.2 Independence of internal control functions
|
17.2 Independence of internal control functions
|
|
17.3 Resources of internal control functions
|
17.3 Resources of internal control functions
|
|
18 Risk management function
|
18 Risk management function
|
|
18.1 RMF’s role in risk strategy and decisions
|
18.1 RMF’s role in risk strategy and decisions
|
|
18.2 RMF’s role in material changes
|
18.2 RMF’s role in material changes
|
|
18.3 RMF’s role in identifying , measuring, assessing, managing, mitigating, monitoring and reporting on risks
|
18.3 RMF’s role in identifying , measuring, assessing, managing, mitigating, monitoring and reporting on risks
|
|
18.4 RMF’s role in limits
|
18.4 RMF’s role in limits
|
|
18.5 Head of the risk management function
|
18.5 Head of the risk management function
|
|
19 Compliance function
|
19 Compliance function
|
|
20 Internal audit function
|
20 Internal audit function
|
|
Title VI – business continuity management
|
Title VI – business continuity management
|
|
Title VII – transparency
|
Title VII – transparency
|
,
1.1 References
1.2 Identified Requirements
1.3 Related Standards
2. Identified Requirements
Requirements
| Source |
Requirement |
3. Related Standards
Standards
| Source |
Requirement |
- EBA - Published by the European Banking Authority at https://www.eba.europa.eu/
|