107. Competent authorities should assess whether the investment firm establishes robust internal …

Competent authorities should assess whether the investment firm establishes robust internal governance framework and arrangements, in accordance with the provisions of Article 26 of Directive (EU) 2019/2034, the EBA Guidelines on internal governance, the EBA Guidelines on sound remuneration policies¹⁶ , Commission Delegated Regulation (EU) 2017/565¹⁷ , the ESMA Guidelines on MiFID II product governance requirements¹⁸ , and the Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders¹⁹ . Competent authorities should assess whether the investment firm demonstrates at least that:

• a. the management body has set, approved and oversees an adequate and effective internal governance and internal control framework that includes a suitable and transparent organisational and operational structure and well-functioning internal control framework, including sound administration and accounting procedures and a permanent and effective compliance function and, where appropriate and proportionate, internal risk management and internal audit functions that have sufficient authority, stature and resources to perform their functions independently. Where investment firms do not establish and maintain a risk management function and an internal audit function, competent authorities should assess whether the policies and procedures adopted and implemented for an internal control framework achieve the same outcome with the ultimate responsibility remaining with the management body;
• b. the management body ensures and periodically assesses the effectiveness of the investment firm’s internal governance arrangements and takes appropriate steps to address any identified deficiencies;
• c. the management body has set, approved and oversees the overall business and risk strategy, including the setting of investment firm’s risk appetite and its risk management framework, including adequate policies and procedures;
• d. the management body knows and understands the legal, organisational and operational structure of the investment firm (‘know your structure’), in particular where the investment firm involves complex structures, and ensures that it is consistent with its approved business and risk strategies and risk appetite;
• e. the investment firm has an appropriate and transparent corporate structure that is ‘fit for purpose’ and that does not raise concerns that the investment firm might be used for purposes connected with financial crime and a sound corporate and risk culture that is comprehensive and proportionate to the nature, scale and complexity of the risks inherent within the business model and the investment firm's activities and consistent with the investment firm’s risk appetite;
• f. the investment firm promotes and ensures a risk culture and high ethical professional standards, through a code of conduct, and implemented appropriate internal alert policies and procedures;
• g. there is clear, strong and effective communication of strategies, corporate values, the code of conduct, risk and other policies to all relevant staff;
• h. the management body established, approved and oversees the implementation and maintenance of effective policies and processes to identify, assess, manage and mitigate or prevent actual and potential conflicts of interest at firm level as well as between the investment firm and the private interests of staff, including members of the management body, which could adversely influence the performance of their duties and responsibilities;
• i. the management body has set out and ensures the implementation of a framework for entering into loans and other transactions, with members of the management body and their related parties;
• j. investment firms have put in place and maintain appropriate internal alert policies and procedures for staff to report potential or actual breaches of Regulation (EU) 2019/2033 and national provisions transposing Directive (EU) 2019/2034 through a specific, independent and autonomous channel;
• k. a selection and suitability assessment process for the members of the management body and key function holders has been implemented;
• l. arrangements aimed at ensuring the integrity of the accounting and financial reporting systems, including financial and operational controls and compliance with the law and relevant standards have been implemented;
• m. the internal governance framework is set, overseen and regularly assessed by the management body; and
• n. strategies, policies and procedures are communicated to all relevant staff throughout an investment firm and the structures of an investment firm and are clear, efficient and transparent to the investment firm’s staff, shareholders and other stakeholders and to the competent authority.

¹⁶ EBA Guidelines on sound remuneration policies under Directive (EU) 2019/2034 (EBA/GL/2021/13).

¹⁷ COMMISSION DELEGATED REGULATION (EU) 2017/565 of 25 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive (OJ L 087 31.3.2017, p. 1).

¹⁸ ESMA Guidelines on MiFID II product governance requirements (ESMA35-43-620).

¹⁹ Joint ESMA and EBA Guidelines on the assessment of suitability of members of the management body and key function holders (EBA/GL/2017/12).

1. Overview

1.1 References

• Article 26 Internal governance

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/