18 Internal control functions

In accordance with Article 76(5) of Directive 2013/36/EU, the internal control functions should include a risk management function (see Section 19), a compliance function (see Section 20) and an internal audit function (see Section 21). The risk management and compliance functions should also be subject to review by the internal audit function. The responsibilities of internal control functions also include ensuring compliance with AML/CFT requirements.

The operational tasks of the internal control functions may be performed by a third-party service provider, taking into account the proportionality criteria listed in Title I, which may be the consolidating institution or another entity within or outside of the group with the consent of the management bodies of the institutions concerned. Even when internal control operational tasks are partially or fully provided by a third-party service provider, the head of the internal control function concerned and the management body are still responsible for these activities and for maintaining an internal control function within the institution.

As part of the internal control functions, in accordance with Article 11(1) of Regulation (EU) 2024/1624⁵² , institutions should assign the responsibility for ensuring the institution’s compliance with the requirements of that Regulation and the institution ’ s policies and procedures to a member of the management body in its management function⁵³ . The person responsible for the policies, procedures and controls in the day-to-day operation of the obliged entity’s AML/CFT requirements in accordance with Article 11(2) and 11(5) of Regulation (EU) 2024/1624 should be able to directly report to the management body in its supervisory function and raise concerns where specific risk developments affect or may affect the institution.

⁵² Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing. Applies from 10 July 2027.

⁵³ Please refer also to the EBA Guidelines on the role, tasks and responsibilities of the AML/CFT compliance officer.