4.1 Governance framework and the role of the management body

Financial institutions should put in place a governance framework to ensure that policies, pro-cedures and controls for the implementation of restrictive measures are adequate and imple-mented effectively.

The financial institution’s managem ent body should be responsible for approving the financial institution’s strategy for compliance with restrictive measures and for overseeing its implemen-tation through the policies, procedures and controls necessary to ensure the implementation of restrictive measures. All the members of the management body should be aware of the expo-sure of the financial institution to restrictive measures and its vulnerability to circumvention of restrictive measures.

Where the business of the financial institution is directed by a single person, this person may assign a senior manager to perform the function of the management body pursuant to para-graph 4.

Where the financial institution is the parent undertaking of a group as defined in Article 2, point (9) and point(11) of Directive 2013/34/EU⁸ , the management body of the parent undertaking should ensure that each management body, business line and internal unit, including each in-ternal control function of subsidiaries of the group has the relevant information to be able to comply with restrictive measures. The ultimate responsibility for compliance with restrictive measures lies with each entity of the group.

⁸ Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial state-ments, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC.

Where a financial institution is the parent undertaking of a group, the management body of the parent undertaking should ensure that the subsidiaries of the group perform their own restric-tive measures exposure assessment, as set out Section in 4.2, in a coordinated way and based on a common m ethodology, reflecting the group’s specificities.

4.1.1 The role of the management body in its supervisory function

The management body in its supervisory function should be responsible for overseeing and monitoring the internal controls and governance framework the financial institution has put in place to comply with restrictive measures to ensure that it is effective, pursuant to Section 4.3.

In addition to the provisions set out in the Guidelines EBA/GL/2021/05⁹ , the management body of a financial institution in its supervisory function should:

• a. be informed of the results of the latest restrictive measures exposure assessment, pur-suant to Section 4.2;
• b. oversee and monitor, through the internal controls function, the extent to which the restrictive measures policies and procedures are adequate and effective, pursuant to Section 4.3, in light of the restrictive measures exposure and risks of circumvention of restrictive measures to which the financial institution is exposed and take appropriate steps to ensure remedial measures are taken where necessary;
• c. at least once a year, assess the effective functioning of the restrictive measures com-pliance function, including internal policies, procedures and controls, including the ap-propriateness of the human and technical resources allocated to compliance with re-strictive measures.

⁹ Guidelines EBA/GL/2021/05 on internal governance under Directive 2013/36/EU.

Where a financial institution is the parent undertaking of a group, the management body of that parent undertaking should also perform all the tasks referred to in paragraph 9 at group level. The ultimate responsibility for compliance with restrictive measures lies with each entity of the group.

4.1.2 The role of the management body in its management function

In addition to the provisions set out in the Guidelines EBA/GL/2021/05, the financial institution’s management body in its management function should:

• a. ensure that it is informed of the results of the latest restrictive measures exposure assessment, pursuant to Section 4.2;
• b. adopt an appropriate risk management framework and internal control system that is sufficiently independent from the business it controls;
• c. approve policies, procedures and controls that are proportionate to the financial insti-tution’s restrictive measures exposure and adequate to ensure the financial institu-tion’s compliance with restrictive measures;
• d. ensure the effective implementation of the financial institution’s processes to comply with restrictive measures;
• e. implement the organisational and operational structure necessary to comply effec-tively with the restrictive measures strategy adopted by the management body;
• f. ensure that the human and technical resources allocated to the compliance with re-strictive measures are appropriate and commensurate with the institutions’ exposure to restrictive measures;
• g. where operational functions of the compliance with restrictive measures are out-sourced, ensure that these arrangements comply with Guidelines EBA/GL/2019/02¹⁰ , and receive regular reports on the effectiveness of the system from the service provider to inform the management body.

¹⁰ Guidelines EBA/GL/2019/02 on outsourcing arrangements, to be replaced by Guidelines EBA/GL/XXXX/XX on sound management of third party risks.

Where the financial institution is the parent undertaking of a group, the management body of that parent undertaking should ensure that all the tasks referred to in paragraph 11 are also performed at the level of subsidiaries and that policies and procedures put in place are aligned with the group’s p rocedures and policies, to the extent permitted under applicable national law.

4.1.3 The role of the senior staff member in charge of compliance with restric-tive measures

4.1.3.1 Appointing the senior staff member

Financial institutions should appoint a senior staff member in charge of performing the functions and tasks set out in paragraphs 19 to 21. The management body should ensure that the senior staff member has the knowledge and understanding of restrictive measures necessary to fulfil their functions effectively.

The management body may assign this role to a senior staff member who already has other duties or functions within the financial institution (such as the AML/CFT compliance officer or the chief compliance officer) provided that:

• a. this is justified by the size and complexity of the financial institution and the outcome of the restrictive measures exposure assessment;
• b. this does not affect the ability of this senior staff member to carry out their duties or functions effectively; and
• c. this combination of tasks does not raise any conflicts of interest, such as conflicts be-tween operational and control tasks assigned to this staff member.

The management body should allow the senior staff member to assign and delegate the tasks stipulated in paragraphs 19 to 21 to other staff acting under the direction and supervision of the senior staff member, provided that the ultimate responsibility for the effective fulfilment of those tasks remains with the senior staff member.

Irrespective of the institutional arrangements, financial institutions should ensure that:

• a. the senior staff member can coordinate and cooperate effectively with internal con-trol functions; and
• b. the senior staff member is able to report and has direct access to the management body in the management and supervisory function.

Where the financial institution is part of a group, the management body of the parent financial institution should appoint a group-level senior staff member.

4.1.3.2 The role of the senior staff member

The senior staff member should develop, put in place and maintain policies, procedures and controls that are adequate to ensure the financial institution’s compli ance with restrictive measures and proportionate to the financial institution’s restrictive measures exposure.

The senior staff member should:

• a. take the measures necessary to ensure compliance with Section 4.2 on the restrictive measures exposure assessment;
• b. take the measures necessary to ensure compliance with Section 4.3 on effective re-strictive measures policies and procedures;
• c. provide regular and adequate information to the management body to enable it to carry out its functions as defined in Section 4.1.1 and Section 4.1.2 Management in-formation should at least include:
• i) changes to the financial institution’s restrictive measures exposure and the outcome of the financial institution’s restrictive measures exposure assessment;
• ii) changes to restrictive measures regimes and their impact on the financial institution;
• iii) statistics and information relating to:
• ▪ the number of alerts generated;
• ▪ the number of alerts awaiting analysis;
• ▪ the number of reports submitted to the relevant national authority competent for the im-plementation of restrictive measures¹¹ and/or to the competent supervisory authority as required by the applicable laws;
• ▪ the average time between the true positive match and the report submitted to the rele-vant national authority competent for the implementation of restrictive measures and/or to the competent supervisory authority as required by the applicable laws;
• ▪ the value of frozen funds, frozen economic resources¹² and the nature of those assets, held at the financial institution;
• iv) information on human and technical resources and the adequacy of those resources in light of the financial institution’s restrictive measure s exposure;
• v) deficiencies or shortcomings identified in relation to the financial institution’s re-strictive measures policies, procedures and controls, including observations pro-vided by competent authorities for the supervision of policies, procedures and con-trols for the implementation of restrictive measures;
• vi) cases of violation and of circumvention of restrictive measures and the reasons for those violation and circumvention;
• vii) proposals on how to address any changes in regulatory requirements or in restric-tive measures exposure, or any deficiencies or shortcomings in the financial institu-tion’s restrictive measures policies, procedures or controls that have been identified and cases of violation and circumvention of restrictive measures that have been identified.
• d. report all violations of restrictive measures to the relevant national authorities compe-tent for the implementation of restrictive measures and/or to the competent supervi-sory authority as required by the applicable laws;
• e. cooperate effectively and constructively with relevant national authorities competent for the implementation of restrictive measures and competent supervisory authority as required by the applicable laws.

¹¹ https://finance.ec.europa.eu/eu-and-world/sanctions-restrictive-measures/overview-sanctions-and-related-re-sources_en#contact.

¹² See Article 2, point (5) and (6) of Directive (EU) 2024/1226.

Where the financial institution is part of a group, the group-level senior staff member should assess the effectiveness of policies, procedures and controls for compliance with relevant re-strictive measures across branches, subsidiaries, intermediaries, distributors and agents where applicable. The ultimate responsibility for compliance with restrictive measures lies with each entity of the group.

The senior staff member should oversee the preparation and implementation of the training programme as specified in Section 4.4.