2.1 Responsibilities, design, approval and oversight of the remuneration policy

The management body¹⁵ in its supervisory function (hereafter ‘ supervisory function ’ ) should be responsible for adopting and maintaining the remuneration policy of the institution, and overseeing its implementation to ensure it is fully operating as intended. The supervisory function should also approve any subsequent material exemptions made for individual staff members and changes to the remuneration policy and carefully consider and monitor their effects. Any exemptions should not be based on gender considerations or other aspects that would be discriminatory, should be well reasoned and should be in line with the remuneration requirements under national law.

30.The supervisory function should collectively have adequate knowledge, skills and experience with regard to remuneration policies and practices as well as of incentives and risks that can arise therefrom. This should include knowledge, skills and experience with regard to the mechanisms for aligning the remuneration structure to institutions ’ risk profiles and capital structure.

31.The supervisory function should ensure that the institution ’ s remuneration policies and practices are appropriately implemented and aligned with the institution ’ s overall corporate governance framework, corporate and risk culture, risk appetite and the related governance processes.

32.Conflicts of interests with regard to the remuneration policy and remuneration awarded should be identified and appropriately mitigated, including by establishing objective award criteria based on the internal reporting system, appropriate controls and the four eyes principle. The remuneration policy should ensure that no material conflicts of interest arise for staff, including for staff in control functions.

33.The remuneration policy and practices and the procedures to determine them should be clear, well documented and transparent. Proper documentation on the decision-making process (e.g. minutes of relevant meetings, relevant reports, and other relevant documents) and the reasoning behind the remuneration policy should be maintained.

34.The supervisory and management functions and, where established, the remuneration and the risk committees should work closely together and ensure that the remuneration policy is consistent with and promotes sound and effective risk management. 35.The remuneration policy should provide for an effective framework for performance measurement, risk adjustment and the linkages of performance to reward.

36.Risk and compliance functions should provide effective input in accordance with their roles into the setting of bonus pools, performance criteria and remuneration awards where those functions have concerns regarding the impact on staff behaviour and the riskiness of the business undertaken.

37.The supervisory function should determine and oversee the remuneration of the members of the management function and, if the remuneration committee referred to in section 2.4 has not been established, directly oversee the remuneration of the senior officers in the independent control functions, including the risk management and compliance functions.

38.The supervisory function should take into account the input provided by all competent corporate functions and bodies (e.g. committees, control functions¹⁶ , human resources, legal, strategic planning, budget function, etc.) and business units about the design, implementation and oversight of the institution ’ s remuneration policies.

39.The human resources function should participate in and inform on the drawing up and the evaluation of the remuneration policy for the institution, including the remuneration structure, the aspect of gender neutrality, remuneration levels and incentive schemes, in a way that would not only attract and retain the staff the institution needs but also ensure that the remuneration policy is aligned with the institution ’ s risk profile.

40.The risk management function should assist with and inform on the definition of suitable risk-adjusted performance measures (including ex post adjustments), as well as with assessing how the variable remuneration structure affects the risk profile and culture of the institution. The risk management function should validate and assess risk adjustment data as well as be invited to attend the meetings of the remuneration committee on this matter.

41.The compliance function should analyse how the remuneration policy affects the institution ’ s compliance with legislation, regulations, internal policies and risk culture and should report all identified compliance risks and issues of non-compliance to the management body, both in its management and supervisory functions. The findings of the compliance function should be taken into account by the supervisory function during the approval, review procedures and oversight of the remuneration policy.

42.The internal audit function should carry out an independent review of the design, implementation and effects of the institution ’ s remuneration policies on its risk profile and the way these effects are managed in line with the guidelines provided in section 2.5. 43.Within a group context, the competent functions within the consolidating institution and subsidiaries should interact and exchange information as appropriate.

¹⁵ Different management body structures can be observed in European countries. In some countries, a unitary structure is common, i.e. supervisory and management functions of the board are exercised by only one body. In other countries, a dual structure is common, with two independent bodies being established, one for the management function and the other for the supervision of the management function.

¹⁶ Independent control function comprises organisational units, independent of the business and corporate functions that are responsible for controlling and monitoring the operations and risks arising from those operations, ensuring compliance with all applicable laws, rules and regulations and advising the management functions on the matters within their area of expertise. Independent control functions typically comprise risk management, compliance and internal audit functions. Further details on control functions can be found in the EBA Guidelines on Internal Governance (GL44), points 26 to 29.