4.9 Identification of key vulnerabilities

Having conducted the BMA, competent authorities should assess the key vulnerabilities to which the investment firm’s business model and strategy expose it or may expose it, considering any of the following:

• a. poor expected financial performance;
• b. reliance on an unrealistic strategy;
• c. excessive concentrations or volatility (including earnings, revenues and customers subject to enhanced customer due diligence set out in Chapter II, Section 3 of Directive (EU) 2015/849, high risk third countries in accordance with Article 9 of that Directive);
• d. excessive risk-taking;
• e. cash-flow and financing structure concerns;
• f. significant external issues (including regulatory threats, such as mandating of ‘ring-fencing’ of business units); and
• g. ESG risks and their impact on the viability and sustainability of the business model and long-term resilience of the investment firm.

Following the above assessment, competent authorities should form a view on the viability of the investment firm’s business model and the sustainability of its strategy, and any necessary measures to address problems and concerns.