14 Internal control framework

Investment firms should develop and maintain a culture that encourages a positive attitude towards risk control and compliance within the investment firms and a robust and comprehensive internal control framework. Under this framework, investment firm s’ business lines should be responsible for managing the risks they incur in conducting their activities and should have controls in place that aim to ensure compliance with internal and external requirements. As part of this framework, investment firms should have a permanent and effective internal compliance function³³ with appropriate and sufficient authority, stature and access to the management body to fulfil its mission, and a risk management framework. Where proportionate taking into account the criteria listed in Title I, investment firms should also have an internal risk management and audit function.

³³ Without prejudice to Article 22 of the EU Commission Delegated Regulation 565/2017

The internal control framework of the investment firm concerned should be adapted on an individual basis to the specificity of its business, its complexity and the associated risks, taking into account the group context. The investment firm concerned should organise the exchange of the necessary information in a manner that ensures that each management body, business line and internal unit, including each internal control function, is able to carry out its duties. This means, for example, a necessary exchange of adequate information between the business lines and the compliance function, and the AML/CFT compliance function where it is a separate control function, at the group level and between the heads of the internal control functions at the group level and the management body of the investment firms.

Investment firms should implement appropriate processes and procedures to ensure that they comply with their obligations in the context of combating money laundering and terrorist financing. Investment firms should assess their exposure to the risk that they may be used for the purpose of ML/TF and, where necessary, take mitigating measures to reduce those risks as well as the operational and reputational risks linked to them. Investment firms should take measures to ensure that their staff are aware of such ML/TF risks and the impact that ML/TF has on the investment firm and the integrity of the financial system.

The internal control framework should cover the whole organisation, including the management body ’s responsibilities and tasks, and the activities of all business lines and internal units, including internal control functions, outsourced activities and distribution channels.

The internal control framework of an investment firm should ensure:

• a. effective and efficient operations;
• b. adequate identification, measurement and mitigation of risks;
• c. the reliability of financial and non-financial information reported both internally and externally;
• d. sound administrative and accounting procedures; and
• e. compliance with laws, regulations, supervisory requirements and the investment firm ’ s internal policies, processes, rules and decisions.