9. Internal control framework

Issuers of ARTs should develop and maintain a culture that encourages a positive attitude towards risk control and compliance within the issuer and a robust and comprehensive internal control framework. Under this framework, issuers of ARTs business lines or internal unit should be responsible for managing the risks they incur in conducting their activities and should have controls in place that aim to ensure compliance with internal and external requirements. As part of this framework, issuers of ARTs should have a permanent and effective internal compliance function with appropriate and sufficient authority, stature and access to the management body to fulfil its mission, and a risk management framework. Where proportionate, taking into account the criteria listed in Title I, issuers of ART should also have an internal risk management and audit function. In any case, the issuer of ARTs should have appropriate risk management and audit policies and procedures in place.

The internal control framework of the issuers of ARTs concerned should be adapted on an individual basis to the specificity of its business, its complexity and the associated risks, taking into account, where applicable, the group context. Within a group context, the issuer of ARTs concerned should organise the exchange of the necessary information in a manner that ensures that each management body, business line and internal unit, including each internal control function, is able to carry out its duties.

The internal control framework should cover the whole organisation, including the management body’s responsibilities and tasks, and the activities of all business lines and internal units, including internal control functions, the use of third-party providers and distribution channels.

The internal control framework of an issuer of ARTs should ensure:

• a. effective and efficient operations including with regard to issuance of ARTs;
• b. adequate identification, measurement and mitigation of risks including operational risk and risk related to ICT in accordance with Regulation (EU) 2022/2554;
• c. the reliability of financial and non-financial information reported both internally and externally;
• d. sound administrative and accounting procedures; and
• e. compliance with laws, regulations, supervisory requirements and the issuer of ARTs internal policies, processes, rules and decisions.