58. The risk committee should at least: a. have access to all the relevant information and data …

The risk committee should at least:

• a. have access to all the relevant information and data necessary to perform its role, including information and data from relevant corporate and control functions (e.g. legal, finance, human resources, IT, internal audit, risk and compliance, including information on AML/CTF compliance and aggregated information on suspicious transaction reports, and ML/TF risk factors);
• b. receive regular reports, ad hoc information, communications and opinions from heads of internal control functions concerning the current risk profile of the investment firm, its risk culture and its risk limits, as well as on any material breaches²² that may have occurred, with detailed information on and recommendations for corrective measures taken, to be taken or suggested to address them; periodically review and decide on the content, format and frequency of the information regarding risk to be reported to it; and
• c. where necessary, ensure the proper involvement of the internal control functions and other relevant functions (human resources, legal and finance) within their respective areas of expertise and/or seek external expert advice.

²² With regard to serious breaches in the area of AML/TF, please refer also to the guidelines to be issued under Article 117 (6) of Directive 2013/36/EU, specifying the manner of cooperation and information exchange between the authorities referred to in paragraph 5 of this Article, particularly in relation to cross-border groups and in the context of identifying serious breaches of anti-money laundering rules.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/