5.1 General considerations

Competent authorities should assess whether or not an investment firm’s internal governance arrangements are adequate for and commensurate with the investment firm’s risk profile, business model, nature, size and complexity. They should identify the extent to which the investment firm complies with the applicable EU and national requirements regarding sound internal governance arrangements and identify any shortcomings. Competent authorities should evaluate in particular whether or not the internal governance arrangements ensure the sound management of risks and include appropriate internal controls and oversight. Competent authorities should establish if there are material risks posed by poor internal governance arrangements and their potential effect on the risk profile sustainability of the investment firm.

For SREP, the assessment of the investment firm’s internal governance and controls should include, having regard to the application of the principle of proportionality, an assessment of the following areas:

• a. the overall internal governance framework, which should include a clear organisational structure and appropriate corporate risk culture;
• b. the composition, organisation and functioning of the management body and its committees, where established;
• c. remuneration policies and practices;
• d. the internal control framework, which should include an independent compliance, and, where applicable, internal risk management and internal audit functions;
• e. risk management framework, including ICARAP;
• f. Information and communication technology; and
• g. business continuity planning.

The assessment of internal governance should inform the specific assessment of risk management and controls as specified in Titles 6 and 8 as well as the SREP capital assessment in Title 7 and the SREP liquidity assessment in Title 9. Likewise, a risk-by-risk analysis of internal capital adequacy and internal-risk assessment process reviewed under Title 7, and any deficiencies identified thereby, should inform the assessment of the overall risk management framework assessed under this title.

In line with the EBA Guidelines on internal governance¹⁵ , the assessment of the internal governance framework should include the verification of the existence of governance arrangements and mechanisms to ensure that the investment firm complies with applicable AML/CFT requirements and takes into account any supplementary information received from the AML/CFT supervisors on the assessment of these arrangements and mechanisms.

¹⁵ EBA Guidelines on Internal Governance under Directive (EU) 2019/2034 (EBA/GL/2021/14).

To ensure a consistent investor protection across the financial services, competent authorities should coordinate with market authorities, and consider relevant information received from such authorities for the assessment of governance arrangements and firm-wide controls.

Principle of proportionality

Competent authorities should have regard to the principle of proportionality with a view to ensure that the internal governance arrangements established by investment firms including within the context of investment firm groups, are consistent with the individual risk profile of the firm and the group, commensurate to their size and internal organization, relevant to their business model, suitable for the nature, scale and complexity of their activities and sufficient to effectively achieve the objectives of the relevant regulatory requirements.

For the purpose of the above paragraph and having regard to the variety of different business models under which investment firms and investment firm groups operate, it should be assessed whether investment firms with a more complex organisation or with a larger scale should have more sophisticated governance arrangements, while investment firms with a simpler organisation or with a smaller scale or less complex activities may implement simpler governance arrangements.

Criteria to be taken into account for the application of the principle of proportionality such as the following should be considered for assessing the internal governance, in accordance with the EBA Guidelines on internal governance:

• a. the size in terms of the balance-sheet of the investment firm and its subsidiaries within the scope of prudential consolidation;
• b. the assets under management;
• c. whether the investment firm is authorized to hold client money or assets;
• d. the assets safeguarded and administered;
• e. the volume of client orders handled;
• f. the volume of daily trading flow;
• g. the geographical presence of the investment firms and the size of its operations in each jurisdiction, including in third countries jurisdictions;
• h. the legal form of the investment firm, including whether the investment firm is part of a group and, if so, the proportionality assessment for the group;
• i. whether the investment firm is authorised to use internal models for the measurement of capital requirements, as referred to in Article 22 of Regulation (EU) 2019/2033;
• j. the type of authorised activities, the services performed by the investment firm as defined in Sections A and B of Annex I to Directive 2014/65/EU and other services performed by the investment firm;
• k. the underlying business model and strategy; the nature and complexity of the business activities, and the investment firm’s organisational structure
• l. the risk strategy, risk appetite and actual risk profile of the investment firm, taking into account also the result of the SREP capital and SREP liquidity assessments;
• m. the ownership and funding structure of the investment firm;
• n. the type of clients;
• o. the complexity of the financial instruments or contracts;
• p. the outsourced functions and distribution channels;
• q. the existing information and communication systems and technology (ICT), including continuity systems and outsourcing functions in this area;

For the appropriate application of the SREP in the case of investment firms classified, in accordance with Title 2, to category 3, adjusted minimum requirements are provided in the respective sections of this title.

For investment firms which meet the conditions for qualifying as small and non-interconnected investment firms set out in Article 12(1) of Regulation (EU) 2019/2033 (Class 3 firms), competent authorities should review their organisational arrangements as they deem appropriate, having regard to the applicable regulatory requirements.