58. As part of the activities of the second line of defence: a) the risk management function should …

As part of the activities of the second line of defence:

• a) the risk management function should be responsible for undertaking ESG risk assess-ment and monitoring independently from the first line of defence, including by en-suring adherence to the risk limits, questioning and where necessary challenging the initial assessment conducted by the business relationship officers;
• b) the compliance function should oversee how the first line of defence ensures adher-ence to applicable ESG risk legal requirements and internal policies, and should advise the management body and other relevant staff on measures to be taken to ensure such compliance. In addition, in relation to the sustainability claims and/or commit-ments made by the institution, it should provide advice on the reputational and con-duct risks associated with the implementation or failure to implement such claims and/or commitments;

12 Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU (EBA/GL/2021/06) 13 Title IV – Risk culture and business conduct 14 Title V – Internal control framework and mechanisms 30

• c) the compliance function and the risk management function should be consulted for the approval of new products with ESG features or for significant changes to existing products to embed ESG aspects.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/