+4. Guidelines
---+Title I – proportionality
------+17. Where applying these guidelines, competent authorities and investment firms should have regard …
------+18. For the purposes of the previous paragraph, account should be taken of the variety of different …
------+19. Where applying the principle of proportionality as set out in Article 26 (3) of Directive (EU) …
------+20. For the purpose of the application of the principle of proportionality and in order to ensure …
------+21. Investment firms that are legal persons managed by a single natural person should have …
---+Title II – role and composition of the management body and committees
---+1 Role and responsibilities of the management body
------+22. The management body must have ultimate and overall responsibility for the investment firm and …
------+23. The duties of the management body should be clearly defined, distinguishing between the duties …
------+24. The management body in its supervisory function and its management function should interact …
------+25. Without prejudice to the tasks and responsibilities assigned to the management body under …
------+26. When setting up, approving and overseeing the implementation of the aspects listed in paragraph …
------+27. The management body should oversee the process of disclosure and communications with external …
------+28. All members of the management body should be informed about the overall activity, financial and …
------+29. A member of the management body may be responsible for an internal control function as referred …
------+30. The management body should monitor, periodically review and address any weaknesses identified …
------+31. Where investment firms are legal persons managed by a single natural person in accordance with …
---+2 Management function of the management body
------+32. In its management function, the management body should actively engage in the business of an …
------+33. In its management function, the management body should be responsible for the implementation of …
------+34. In its management function, the management body should constructively challenge and critically …
------+35. Without prejudice to the national transposition of Directive (EU) 2015/849 Anti-Money …
---+3 Supervisory function of the management body
------+36. The role of the members of the management body in its supervisory function should include …
------+37. Without prejudice to national law, in its supervisory function the management body should …
------+38. Without prejudice to the responsibilities assigned under the applicable national company law …
---+4 Role of the chair of the management body
------+39. The chair of the management body should lead the management body, contribute to an efficient …
------+40. The chair should encourage and promote open and critical discussion and ensure that dissenting …
------+41. Where the chair is permitted to assume executive duties, the investment firm should have …
------+42. The chair should set meeting agendas and ensure that strategic issues are discussed as a …
------+43. The chair of the management body should contribute to a clear allocation of duties between …
---+5 Committees of the management body in its supervisory function
---+5.1 Setting up committees
------+44. In accordance with Article 28 of the IFD and unless otherwise specified by national law …
------+45. Where no risk committee is established, the references in these guidelines to this committee …
------+46. Investment firms may, taking into account the criteria set out in Title I of these guidelines …
------+47. Investment firms should ensure a clear allocation and distribution of duties and tasks between …
------+48. Committees should support the supervisory function in specific areas and facilitate the …
---+5.2 Composition of committees
------+49. All committees should be chaired by a non-executive member of the management body who is able …
------+50. Independent members of the management body in its supervisory function should be actively …
------+51. Where committees have to be set up in accordance with Directive (EU) 2019/2034 or national law …
------+52. The risk committee should be composed of non-executive members of the management body in its …
------+53. The risk committee should be chaired, where possible, by an independent member. Members of the …
---+5.3 Committees’ p rocesses
------+54. Committees should regularly report to the management body in its supervisory function.
------+55. Committees should interact with each other as appropriate. Without prejudice to paragraph 51 …
------+56. Members of committees should engage in open and critical discussions, during which dissenting …
------+57. Committees should document the agendas of committee meetings and their main results and …
------+58. The risk committee should at least: a. have access to all the relevant information and data …
---+5.4 Role of the risk committee
------+59. Where established, the risk committee should at least: a. advise and support the management …
------+60. The risk committee should collaborate with other committees whose activities may have an impact …
---+Title III – governance framework
---+6 Organisational framework and structure
---+6.1 Organisational framework
------+61. The management body of an investment firm should ensure a suitable and transparent …
------+62. The management body should ensure that the internal control functions have the appropriate …
------+63. The structure of the investment firm should not impede the ability of the management body to …
------+64. The management body should assess whether and how material changes to the group ’ s structure …
---+6.2 Know your structure
------+65. The management body should fully know and understand the legal, organisational and operational …
------+66. The management body should be responsible for the approval of sound strategies and policies for …
------+67. The management body should guide the investment firm ’s structure, its evolution and its …
------+68. The management body of a Union parent undertaking should understand not only the legal …
------+69. The management body of a Union parent undertaking should ensure that the different group …
---+6.3 Complex structures and non-standard or non-transparent activities
------+70. Investment firms should avoid setting up complex and potentially non-transparent structures. …
------+71. In any case, investment firms should not set up opaque or unnecessarily complex structures that …
------+72. When setting up such structures, the management body should understand them and their purpose …
------+73. Investment firms should document their decisions and be able to justify their decisions to …
------+74. The management body should ensure that appropriate actions are taken to avoid or mitigate the …
------+75. These structures and activities, including their compliance with legislation and professional …
------+76. Investment firms should take effective risk management measures when they perform non-standard …
---+7 Organisational framework in a group context
------+77. In accordance with Article 25 of Directive (EU) 2019/2034 and Article 7 of Regulation (EU) …
------+78. The management body of a subsidiary that is subject to Directive (EU) 2019/2034 should adopt …
------+79. At the consolidated level, the Union parent undertaking should ensure adherence to the …
------+80. A Union parent undertaking should consider the interests of all its subsidiaries, and how …
------+81. A Union parent undertaking and its subsidiaries should ensure that the investment firms and …
------+82. The Union parent undertaking should ensure that subsidiaries established in third countries …
------+83. The governance requirements of Directive 2019/2034/EU and the provisions in these guidelines …
------+84. When establishing policies and documenting governance arrangements, investment firms should …
---+Title IV – risk culture and business conduct
---+8 Risk culture
------+85. A sound, diligent and consistent risk culture should be a key element of investment firms ’ …
------+86. Investment firms should develop an integrated and investment firm-wide risk culture, based on a …
------+87. Investment firms should develop a risk culture through policies, communication and staff …
------+88. Staff should be fully aware of their responsibilities relating to risk management. Risk …
------+89. A strong risk culture should include but is not necessarily limited to: a. Tone from the top …
---+9 Corporate values and code of conduct
------+90. The management body should develop, adopt, adhere to and promote high ethical and professional …
------+91. Investment firms should ensure that there is no discrimination towards staff based on gender …
------+92. Investment firms ’ policies should be gender-neutral. This includes, but is not limited to …
------+93. The standards implemented should aim to enhance the institution’s robust governance …
------+94. The management body should have clear and documented policies for how these standards should be …
------+95. Investment firms should monitor compliance with such standards and ensure staff awareness, e.g. …
---+10 Conflict of interest policy at firm level
------+96. The management body should be responsible for establishing, approving and overseeing the …
------+97. Investment firms ’ measures to manage or where appropriate mitigate conflicts of interest …
---+11 Conflict of interest policy for staff
------+98. Without prejudice to Article 23 of Directive 2014/65/EU and Section 3 of the Chapter 2 of the …
------+99. The policy should aim to identify conflicts of interest of staff, including the interests of …
------+100. Regarding conflicts of interest that may result from past relationships, investment firms …
------+101. The policy should cover at least the following situations or relationships where conflicts of …
------+102. Notwithstanding the above, investment firms should take into consideration that being a …
------+103. The policy should set out the processes for reporting and communication to the function …
------+104. The policy should differentiate between conflicts of interest that persist and need to be …
------+105. The policy should set out procedures, measures, documentation requirements and …
------+106. The policy should specifically cover the risk of conflicts of interest at the level of the …
------+107. When mitigating identified conflicts of interest of members of the management body, investment …
------+108. Actual or potential conflicts of interest that have been disclosed to the responsible function …
------+109. All actual and potential conflicts of interest at the management body level, individually and …
---+11.1 Conflicts of interest policy in the context of loans and other transactions with members of the management body and their related parties
------+110. As part of their conflicts of interest policies for staff (Section 11) and the management of …
------+111. Investment firms should consider additional categories of related parties to whom they apply …
------+112. The conflicts of interest framework should ensure that decisions regarding loans and entering …
------+113. The management body should set out the applicable decision-making processes for granting loans …
------+114. As part of the conflicts of interest framework, the management body should set appropriate …
------+115. The member of the management body benefiting from such a material loan or other material …
------+116. When deciding on a loan or other transaction with a member of the management body or their …
------+117. To ensure compliance with their conflicts of interest policies, investment firms should ensure …
---+11.2 Documentation of loans to members of the management body and their related parties and additional information
------+118. For the purposes of Article 26 of Directive (EU) 2019/2034, investment firms should document …
------+119. Investment firms should ensure that the documentation of all loans to members of the …
---+12 Internal alert procedures
------+120. Investment firms should put in place and maintain appropriate internal alert policies and …
------+121. To avoid conflicts of interest, it should be possible for staff to report breaches outside …
------+122. The alert procedures should be made available to all staff within an investment firm.
------+123. Information provided by staff through the alert procedures should, if appropriate, be made …
------+124. Investment firms should ensure that the person reporting the breach is appropriately protected …
------+125. Investment firms should also protect persons who have been reported from any negative effects …
------+126. In particular, internal alert procedures should: a. be documented (e.g. staff handbooks); b. …
---+13 Reporting of breaches to competent authorities
------+127. In accordance with article 22 of Directive (EU) 2019/2034, competent authorities should …
------+128. Without prejudice to the possibility of reporting breaches through the competent authorities’ …
---+Title V – internal control framework and mechanisms
---+14 Internal control framework
------+129. Investment firms should develop and maintain a culture that encourages a positive attitude …
------+130. The internal control framework of the investment firm concerned should be adapted on an …
------+131. Investment firms should implement appropriate processes and procedures to ensure that they …
------+132. The internal control framework should cover the whole organisation, including the management …
------+133. The internal control framework of an investment firm should ensure: a. effective and efficient …
---+15 Implementing an internal control framework
------+134. The management body should be responsible for establishing and monitoring the adequacy and …
------+135. An investment firm should have a clear, transparent and documented decision-making process and …
------+136. Investment firms should communicate these policies, mechanisms and procedures to all staff and …
------+137. The internal control functions should verify that the policies, mechanisms and procedures set …
------+138. Internal control functions should regularly submit to the management body written reports on …
---+16 Risk management framework
------+139. As part of the overall internal control framework, investment firms should have a holistic …
------+140. An investment firm ’s risk management framework should include policies, procedures, risk …
------+141. An investment firm ’ s risk management framework should provide specific guidance on the …
------+142. The risk management framework should be subject to independent internal review, e.g. performed …
------+143. When identifying and measuring or assessing risks, an investment firm should develop …
------+144. Investment firms should take into consideration that the results of quantitative assessment …
------+145. The ultimate responsibility for risk assessment lies solely with the investment firm, which …
------+146. Investment firms should be fully aware of the limitations of models and metrics and use not …
------+147. In addition to the investment firms ’ own assessments, investment firms may use external risk …
------+148. Regular and transparent reporting mechanisms should be established so that the management …
------+149. Effective communication and awareness regarding risks and the risk strategy is crucial for the …
---+17 Internal control functions
------+150. The internal control functions should include an effective and permanent internal compliance …
------+151. Where the investment firm does not establish an internal risk management function (RMF) or …
------+152. Without prejudice to national law implementing Directive (EU) 2015/849, institutions should …
---+17.1 Heads of the internal control functions
------+153. Heads of internal control functions should be established at an adequate hierarchical level …
------+154. Where necessary, the heads of internal control functions should be able to have access and …
------+155. Investment firms should have documented processes in place to assign the position of the head …
---+17.2 Independence of internal control functions
------+156. In order for the internal control functions to be regarded as operating independently, the …
---+17.3 Resources of internal control functions
------+157. Internal control functions should have sufficient resources. Taking into account the …
------+158. Internal control functions should have appropriate IT systems and support at their disposal …
---+18 Risk management function
------+159. The risk management function (RMF) should cover the whole investment firm. The RMF should have …
------+160. The RMF should have, where necessary, direct access to the management body in its supervisory …
------+161. The RMF should have access to all business lines and other internal units that have the …
------+162. Staff within the RMF should possess sufficient knowledge, skills and experience in relation to …
------+163. The RMF should be a central organisational feature of the investment firm, structured so that …
------+164. In a group, the RMF in the Union parent undertaking should be able to deliver a group-wide …
------+165. The RMF should provide relevant independent information, analyses and expert judgement on risk …
---+18.1 RMF’s role in risk strategy and decisions
------+166. The RMF should be actively involved at an early stage in developing the investment firm ’s …
------+167. The RMF’s involvement in decision -making processes should ensure that risk considerations are …
---+18.2 RMF’s role in material changes
------+168. Before decisions on material changes to processes or systems or exceptional transactions are …
------+169. The RMF should evaluate how the risks identified could affect the investment firm ’s or …
---+18.3 RMF’s role in identifying , measuring, assessing, managing, mitigating, monitoring and reporting on risks
------+170. The RMF should ensure that that there is an appropriate risk management framework and that all …
------+171. The RMF should ensure that identification and assessment are not based only on quantitative …
------+172. The RMF should ensure that transactions with related parties are reviewed and that the risks …
------+173. The RMF should ensure that all identified risks are effectively monitored by the business …
------+174. The RMF should regularly monitor the actual risk profile of the investment firm and scrutinise …
------+175. The RMF should analyse trends and recognise new or emerging risks and increases in risk …
------+176. The RMF should evaluate possible ways to mitigate risks. Reporting to the management body …
---+18.4 RMF’s role in limits
------+177. The RMF should independently assess breaches of risk appetite or limits (including …
------+178. The RMF should play a key role in ensuring that a decision on its recommendation is made at …
---+18.5 Head of the risk management function
------+179. Where established, the head of the RMF should be responsible for providing comprehensive and …
------+180. The head of the RMF should have sufficient expertise, independence and seniority to challenge …
------+181. The head of the RMF should be able to challenge decisions taken by the investment firm ’ s …
------+182. Investment firms should establish strengthened processes for the approval of decisions on …
---+19 Compliance function
------+183. Investment firms should establish a permanent and effective compliance function to manage …
------+184. The role of compliance officer, taking into account the principle of proportionality as set …
------+185. Staff within the compliance function should possess sufficient knowledge, skills and …
------+186. The management body in its supervisory function should oversee the implementation of a …
------+187. The compliance function should advise the management body on measures to be taken to ensure …
------+188. The compliance function should ensure that compliance monitoring is carried out through a …
------+189. Investment firms should take appropriate action against internal or external behaviour that …
------+190. Investment firms should ensure that their subsidiaries and branches take steps to ensure that …
---+20 Internal audit function
------+191. Where established, the IAF should be independent and have sufficient authority, stature and …
------+192. The IAF should be independent of the audited activities. Therefore, the IAF should not be …
------+193. The IAF should, following a risk-based approach, independently review and provide objective …
------+194. The IAF should not be involved in designing, selecting, establishing or implementing specific …
------+195. The IAF should assess whether the investment firm ’s internal control framework as set out in …
------+196. The IAF should verify, in particular, the integrity of the processes ensuring the reliability …
------+197. The IAF should have unfettered investment firm-wide access to all the records, documents …
------+198. The IAF should adhere to national and international professional standards. An example of the …
------+199. Internal audit work should be performed in accordance with an audit plan and a detailed audit …
------+200. An internal audit plan should be drawn up at least once a year on the basis of the annual …
------+201. All audit recommendations should be subject to a formal follow-up procedure by the appropriate …
---+Title VI – business continuity management
------+202. Investment firms should establish a sound business continuity management and recovery plan to …
------+203. Investment firms may establish a specific independent business continuity function.
------+204. An investment firm ’s business relies on several critical resources (e.g. IT systems …
------+205. In order to establish a sound business continuity management plan, an investment firm should …
------+206. On the basis of the abovementioned analysis, an investment firm should put in place: a. …
------+207. Contingency, business continuity and recovery plans should be documented and carefully …
---+Title VII – transparency
------+208. Strategies, policies and procedures should be communicated to all relevant staff throughout an …
------+209. Accordingly, the management body should inform and update the relevant staff about the …
------+210. Where parent undertakings are required by competent authorities under Article 44 of Directive …
------+211. The publication should include at least: a. an overview of the internal organisation of the …

4. Guidelines

4. Guidelines

1. Overview

,
Summary Regulation
Title I – proportionality

Title I – proportionality

Title II – role and composition of the management body and committees

Title II – role and composition of the management body and committees

1 Role and responsibilities of the management body

1 Role and responsibilities of the management body

2 Management function of the management body

2 Management function of the management body

3 Supervisory function of the management body

3 Supervisory function of the management body

4 Role of the chair of the management body

4 Role of the chair of the management body

5 Committees of the management body in its supervisory function

5 Committees of the management body in its supervisory function

5.1 Setting up committees

5.1 Setting up committees

5.2 Composition of committees

5.2 Composition of committees

5.3 Committees’ p rocesses

5.3 Committees’ p rocesses

5.4 Role of the risk committee

5.4 Role of the risk committee

Title III – governance framework

Title III – governance framework

6 Organisational framework and structure

6 Organisational framework and structure

6.1 Organisational framework

6.1 Organisational framework

6.2 Know your structure

6.2 Know your structure

6.3 Complex structures and non-standard or non-transparent activities

6.3 Complex structures and non-standard or non-transparent activities

7 Organisational framework in a group context

7 Organisational framework in a group context

Title IV – risk culture and business conduct

Title IV – risk culture and business conduct

8 Risk culture

8 Risk culture

9 Corporate values and code of conduct

9 Corporate values and code of conduct

10 Conflict of interest policy at firm level

10 Conflict of interest policy at firm level

11 Conflict of interest policy for staff

11 Conflict of interest policy for staff

11.1 Conflicts of interest policy in the context of loans and other transactions with members of the management body and their related parties

11.1 Conflicts of interest policy in the context of loans and other transactions with members of the management body and their related parties

11.2 Documentation of loans to members of the management body and their related parties and additional information

11.2 Documentation of loans to members of the management body and their related parties and additional information

12 Internal alert procedures

12 Internal alert procedures

13 Reporting of breaches to competent authorities

13 Reporting of breaches to competent authorities

Title V – internal control framework and mechanisms

Title V – internal control framework and mechanisms

14 Internal control framework

14 Internal control framework

15 Implementing an internal control framework

15 Implementing an internal control framework

16 Risk management framework

16 Risk management framework

17 Internal control functions

17 Internal control functions

17.1 Heads of the internal control functions

17.1 Heads of the internal control functions

17.2 Independence of internal control functions

17.2 Independence of internal control functions

17.3 Resources of internal control functions

17.3 Resources of internal control functions

18 Risk management function

18 Risk management function

18.1 RMF’s role in risk strategy and decisions

18.1 RMF’s role in risk strategy and decisions

18.2 RMF’s role in material changes

18.2 RMF’s role in material changes

18.3 RMF’s role in identifying , measuring, assessing, managing, mitigating, monitoring and reporting on risks

18.3 RMF’s role in identifying , measuring, assessing, managing, mitigating, monitoring and reporting on risks

18.4 RMF’s role in limits

18.4 RMF’s role in limits

18.5 Head of the risk management function

18.5 Head of the risk management function

19 Compliance function

19 Compliance function

20 Internal audit function

20 Internal audit function

Title VI – business continuity management

Title VI – business continuity management

Title VII – transparency

Title VII – transparency

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

Requirements
Source Requirement

3. Related Standards

Standards
Source Requirement
  • EBA - Published by the European Banking Authority at https://www.eba.europa.eu/