+4. Guidelines
---+Title I – Proportionality
------+16. The proportionality principle encoded in Article 74(2) of Directive 2013/36/EU aims to ensure …
------+17. Institutions should take into account their size and internal organisation, and the nature …
------+18. For the purpose of the application of the principle of proportionality and in order to ensure …
---+Title II – Role and composition of the management body and committees
---+1 Role and responsibilities of the management body
------+19. In accordance with Article 88(1) of Directive 2013/36/EU, the management body must have …
------+20. The duties of the management body should be clearly defined, distinguishing between the duties …
------+21. The management body in its supervisory function and in its management function should interact …
------+22. The management body ’s responsibilities should include setting, approving and overseeing the …
------+23. When setting, approving and overseeing the implementation of the aspects listed in Paragraph 22 …
------+24. The management body must oversee the process of disclosure and communications with external …
------+25. All members of the management body should be informed about the overall activity, financial and …
------+26. A member of the management body may be responsible for an internal control function as referred …
------+27. The management body should monitor, periodically review and address any weaknesses identified …
---+2 Management function of the management body
------+28. The management body in its management function should engage actively in the business of an …
------+29. The management body in its management function should be responsible for the implementation of …
------+30. The management body in its management function should constructively challenge and critically …
------+31. Without prejudice to the national transposition of Directive 2015/849/EU, the management body …
---+3 Supervisory function of the management body
------+32. The role of the members of the management body in its supervisory function should include …
------+33. Without prejudice to national law the management body in its supervisory function should …
------+34. Without prejudice to the responsibilities assigned under the applicable national company law …
---+4 Role of the chair of the management body
------+35. The chair of the management body should lead the management body, contribute to an efficient …
------+36. The chair should encourage and promote open and critical discussion and ensure that dissenting …
------+37. As a general principle, the chair of the management body should be a non-executive member. …
------+38. The chair should set meeting agendas and ensure that strategic issues are discussed with …
------+39. The chair of the management body should contribute to a clear allocation of duties between …
---+5 Committees of the management body in its supervisory function
---+5.1 Setting up committees
------+40. In accordance with Article 109(1) of Directive 2013/36/EU in conjunction with Articles 76(3) …
------+41. Where no risk or nomination committee is established, the references in these guidelines to …
------+42. Institutions may, taking into account the criteria set out in Title I of these guidelines …
------+43. Institutions should ensure a clear allocation and distribution of duties and tasks between …
------+44. Each committee should have a documented mandate, including the scope of its responsibilities …
------+45. Committees should support the supervisory function in specific areas and facilitate the …
---+5.2 Composition of committees
------+46. All committees should be chaired by a non-executive member of the management body who is able …
------+47. Independent members of the management body in its supervisory function should be actively …
------+48. Where committees have to be set up in accordance with Directive 2013/36/EU or national law …
------+49. Institutions should ensure, taking into account the size of the management body and the number …
------+50. Institutions should consider the occasional rotation of chairs and members of committees …
------+51. The risk and nomination committees should be composed of non-executive members of the …
------+52. In G-SIIs and O-SIIs, the nomination committee should include a majority of members who are …
------+53. Members of the nomination committee should have, individually and collectively, appropriate …
------+54. In G-SIIs and O-SIIs, the risk committee should include a majority of members who are …
------+55. Members of the risk committee should have, individually and collectively, appropriate …
---+5.3 Committees’ p rocesses
------+56. Committees should regularly report to the management body in its supervisory function.
------+57. Committees should interact with each other as appropriate. Without prejudice to Paragraph 49 …
------+58. Members of committees should engage in open and critical discussions, during which dissenting …
------+59. Committees should document the agendas of committee meetings and their main results and …
------+60. The risk and nomination committees should at least: a. have access to all relevant information …
---+5.4 Role of the risk committee
------+61. Where established, the risk committee should at least: a. advise and support the management …
------+62. The risk committee should collaborate with other committees whose activities may have an impact …
------+63. When established, the risk committee must, without prejudice to the tasks of the remuneration …
---+5.5 Role of the audit committee
------+64. In accordance with Directive 2006/43/EC , where established, the audit committee should, inter …
---+5.6 Combined committees
------+65. In accordance with Article 76(3) of Directive 2013/36/EU, competent authorities may allow …
------+66. Where risk and nomination committees are established in non-significant institutions, they may …
------+67. Institutions should at all times ensure that the members of a combined committee possess …
---+Title III – Governance framework
---+6 Organisational framework and structure
---+6.1 Organisational framework
------+68. The management body of an institution should ensure a suitable and transparent organisational …
------+69. The structure of the institution should not impede the ability of the management body to …
------+70. The management body should assess whether and how material changes to the group ’ s structure …
---+6.2 Know your structure
------+71. The management body should fully know and understand the legal, organisational and operational …
------+72. The management body should be responsible for the approval of sound strategies and policies for …
------+73. The management body should guide the institution ’s structure, its evolution and its …
------+74. The management body of a consolidating institution should understand not only the legal …
------+75. The management body of a consolidating institution should ensure that the different group …
---+6.3 Complex structures and non-standard or non-transparent activities
------+76. Institutions should avoid setting up complex and potentially non-transparent structures. …
------+77. In any case, institutions should not set up opaque or unnecessarily complex structures which …
------+78. When setting up such structures, the management body should understand them and their purpose …
------+79. Institutions should document their decisions and be able to justify their decisions to …
------+80. The management body should ensure that appropriate actions are taken to avoid or mitigate the …
------+81. These structures and activities, including their compliance with legislation and professional …
------+82. Institutions should take the same risk management measures as for the institution ’s own …
---+7 Organisational framework in a group context
------+83. In accordance with Article 109(2) of Directive 2013/36/EU, parent undertakings and subsidiaries …
------+84. The management body of a subsidiary that is subject to Directive 2013/36/EU should adopt and …
------+85. At the consolidated and sub-consolidated levels, the consolidating institution should ensure …
------+86. A consolidating institution should consider the interests of all its subsidiaries, and how …
------+87. Parent undertakings and their subsidiaries should ensure that the institutions and entities …
------+88. The consolidating institution should ensure that subsidiaries established in third countries …
------+89. The governance requirements of Directive 2013/36/EU and provisions in these guidelines apply to …
------+90. When establishing policies and documenting governance arrangements, institutions should take …
---+8 Outsourcing policy
------+91. The management body should approve and regularly review and update the outsourcing policy of an …
------+92. The outsourcing policy should consider the impact of outsourcing on an institution’s business …
------+93. The policy should state that outsourcing arrangements should not hinder effective on-site or …
---+Title IV – Risk culture and business conduct
---+9 Risk culture
------+94. A sound, diligent and consistent risk culture should be a key element of institution s’ …
------+95. Institutions should develop an integrated and institution-wide risk culture, based on a full …
------+96. Institutions should develop a risk culture through policies, communication and staff training …
------+97. Staff should be fully aware of their responsibilities relating to risk management. Risk …
------+98. A strong risk culture should include but is not necessarily limited to: a. Tone from the top …
---+10 Corporate values and code of conduct
------+99. The management body should develop, adopt, adhere to and promote high ethical and professional …
------+100. Institutions should ensure that there is no discrimination of staff based on gender, race …
------+101. Institution ’ s policies should be gender neutral. This includes, but is not limited to …
------+102. The implemented standards should aim at enhancing the institution ’ s robust governance …
------+103. The management body should have clear and documented policies for how these standards should …
------+104. Institutions should monitor compliance with such standards and ensure staff awareness, e.g. by …
---+11 Conflict of interest policy at institutional level
------+105. The management body should be responsible for establishing, approving and overseeing the …
------+106. Institutions should take, within their organisational and administrative arrangements …
------+107. Institutions ’ measures to manage or, where appropriate, mitigate conflicts of interest should …
---+12 Conflict of interest policy for staff
------+108. The management body should be responsible for establishing, approving and overseeing the …
------+109. The policy should aim at identifying conflicts of interest of staff, including the interests …
------+110. Regarding conflicts of interest that may result from past relationships, institutions should …
------+111. The policy should cover at least the following situations or relationships where conflicts of …
------+112. Notwithstanding the above, institutions should take into consideration that being a …
------+113. The policy should set out the processes for reporting and communication to the function …
------+114. The policy should differentiate between conflicts of interest that persist and need to be …
------+115. The policy should set out procedures, measures, documentation elements and responsibilities …
------+116. The policy should specifically cover the risk of conflicts of interest at the level of the …
------+117. When mitigating identified conflicts of interests of members of the management body …
------+118. Actual or potential conflicts of interest that have been disclosed to the responsible function …
------+119. All actual and potential conflicts of interest at management body level, individually and …
---+12.1 Conflict of interest policy in the context of loans and other transactions with members of the management body and their related parties
------+120. As part of their conflicts of interest policies for staff (Section 12) and the management of …
------+121. Without prejudice to the national transposition of Directive 2013/36/EU , institutions may …
------+122. The conflicts of interest framework should ensure that decisions regarding the granting of …
------+123. The management body should set out the applicable decision-making processes for granting loans …
------+124. As part of the conflicts of interest framework, the management body should set appropriate …
------+125. The member of the management body benefitting from such a material loan or other material …
------+126. When deciding on a loan or other transaction with a member of the management body or their …
------+127. Where loans are arranged as a line of credit (e.g. overdrafts), the initial decision and …
------+128. To ensure compliance with their conflict of interest policies, institutions should ensure that …
---+12.2 Documentation of loans to members of the management body and their related parties and additional information
------+129. For the purpose of Article 88(1) of Directive 2013/36/EU, institutions should document data on …
------+130. Institutions should ensure that the documentation of all loans to members of the management …
------+131. For a loan to a member of the management body or their related parties above an amount of EUR …
---+13 Internal alert procedures
------+132. Institutions should put in place and maintain appropriate internal alert policies and …
------+133. To avoid conflicts of interest, it should be possible for staff to report breaches outside …
------+134. The alert procedures should be made available to all staff within an institution.
------+135. Information provided by staff through the alert procedures should, if appropriate, be made …
------+136. Institutions should ensure that the person reporting the breach is appropriately protected …
------+137. Institutions should also protect persons who have been reported from any negative effects in …
------+138. In particular, internal alert procedures should: a. be documented (e.g. staff handbooks); b. …
---+14 Reporting of breaches to competent authorities
------+139. Competent authorities should establish effective and reliable mechanisms to enable institution …
------+140. Without prejudice to the possibility of reporting breaches through the competent authorities’ …
---+Title V – Internal control framework and mechanisms
---+15 Internal control framework
------+141. Institutions should develop and maintain a culture that encourages a positive attitude towards …
------+142. The internal control framework of institutions should be adapted on an individual basis to the …
------+143. Institutions should implement appropriate processes and procedures that ensure that they …
------+144. The internal control framework should cover the whole organisation, including the management …
------+145. The internal control framework of an institution should ensure: a. effective and efficient …
---+16 Implementing an internal control framework
------+146. The management body should be responsible for establishing and monitoring the adequacy and …
------+147. An institution should have a clear, transparent and documented decision-making process and a …
------+148. Institutions should communicate those policies, mechanisms and procedures to all staff and …
------+149. When implementing the internal control framework, institutions should establish adequate …
------+150. The internal control functions should verify that the policies, mechanisms and procedures set …
------+151. Internal control functions should regularly submit to the management body written reports on …
---+17 Risk management framework
------+152. As part of the overall internal control framework, institutions should have a holistic …
------+153. An institution ’s risk management framework should include policies, procedures, risk limits …
------+154. An institution ’ s risk management framework should provide specific guidance on the …
------+155. The risk management framework should be subject to independent internal review, e.g. performed …
------+156. When identifying and measuring or assessing risks, an institution should develop appropriate …
------+157. Institutions should take into consideration that the results of quantitative assessment …
------+158. The ultimate responsibility for risk assessment lies solely with the institution, which …
------+159. Institutions should be fully aware of the limitations of models and metrics and use not only …
------+160. In addition to the institutions ’ own assessments, institutions may use external risk …
------+161. Regular and transparent reporting mechanisms should be established so that the management …
------+162. Effective communication and awareness regarding risks and the risk strategy is crucial for the …
---+18 New products and significant changes
------+163. An institution should have in place a well-documented new product approval policy (NPAP) …
------+164. Material changes or exceptional transactions may include mergers and acquisitions, including …
------+165. An institution should have specific procedures for assessing compliance with these policies …
------+166. An institution ’s NPAP should cover every consideration to be ta ken into account before …
------+167. The NPAP should set out the main issues to be addressed before a decision is made. These …
------+168. The risk management function and the compliance function should be involved in approving new …
---+19 Internal control functions
------+169. The internal control functions should include a risk management function (see Section 20), a …
------+170. The operational tasks of the internal control functions may be outsourced, taking into account …
------+171. Without prejudice to national law implementing Directive 2015/849/EU, institutions should …
---+19.1 Heads of the internal control functions
------+172. Heads of internal control functions should be established at an adequate hierarchical level …
------+173. Where necessary, the heads of internal control functions should be able to have access and …
------+174. Institutions should have documented processes in place to assign the position of the head of …
---+19.2 Independence of internal control functions
------+175. In order for the internal control functions to be regarded as independent, the following …
---+19.3 Combination of internal control functions
------+176. Taking into account the proportionality criteria set out in Title I, the risk management …
---+19.4 Resources of internal control functions
------+177. Internal control functions should have sufficient resources. They should have an adequate …
------+178. Internal control functions should have appropriate IT systems and support at their disposal …
---+20 Risk management function
------+179. Institutions should establish a risk management function (RMF) covering the whole institution. …
------+180. The RMF should have, where necessary, direct access to the management body in its supervisory …
------+181. The RMF should have access to all business lines and other internal units that have the …
------+182. Staff within the RMF should possess sufficient knowledge, skills and experience in relation to …
------+183. The RMF should be independent of the business lines and units whose risks it controls but …
------+184. The RMF should be a central organisational feature of the institution, structured so that it …
------+185. Significant institutions may consider establishing dedicated RMFs for each material business …
------+186. The RMF should provide relevant independent information, analyses and expert judgement on risk …
---+20.1 RMF’s role in risk strategy and decisions
------+187. The RMF should be actively involved at an early stage in elaborating the institution ’s risk …
------+188. The RMF’s involvement in decision -making processes should ensure that risk considerations are …
---+20.2 RMF’s role in material changes
------+189. In line with Section 18, before decisions on material changes or exceptional transactions are …
------+190. The RMF should evaluate how risks identified could affect the institution ’s or group’s …
---+20.3 RMF’s role in identifying , measuring, assessing, managing, mitigating, monitoring and reporting risks
------+191. The RMF should ensure that there is an appropriate risk management framework and that all …
------+192. The RMF should ensure that identification and assessment are not based only on quantitative …
------+193. The RMF should ensure that transactions with related parties are reviewed and that the risks …
------+194. The RMF should ensure that all identified risks are effectively monitored by the business …
------+195. The RMF should regularly monitor the actual risk profile of the institution and scrutinise it …
------+196. The RMF should analyse trends and recognise new or emerging risks and risk increases arising …
------+197. The RMF should evaluate possible ways to mitigate risks. Reporting to the management body …
---+20.4 RMF’s role in unapproved exposures
------+198. The RMF should independently assess breaches of risk appetite or limits (including …
------+199. The RMF should play a key role in ensuring a decision on its recommendation is made at the …
---+20.5 Head of the risk management function
------+200. The head of the RMF should be responsible for providing comprehensive and understandable …
------+201. The head of the RMF should have sufficient expertise, independence and seniority to challenge …
------+202. The head of the RMF should be able to challenge decisions taken by the institution ’ s …
------+203. Institutions should establish strengthened processes for the approval of decisions on which …
---+21 Compliance function
------+204. Institutions should establish a permanent and effective compliance function to manage …
------+205. Where it is not proportionate to appoint a person who is dedicated only to the role of head of …
------+206. The compliance function, including the head of compliance, should be independent of the …
------+207. Staff within the compliance function should possess sufficient knowledge, skills and …
------+208. The management body in its supervisory function should oversee the implementation of a …
------+209. The compliance function should advise the management body on measures to be taken to ensure …
------+210. The compliance function should ensure that compliance monitoring is carried out through a …
------+211. In line with Section 18 of these guidelines, the compliance function should also verify, in …
------+212. Institutions should take appropriate action against internal or external behaviour that could …
------+213. Institutions should ensure that their subsidiaries and branches take steps to ensure that …
---+22 Internal audit function
------+214. Institutions should set up an independent and effective internal audit function (IAF), taking …
------+215. The IAF should be independent of the audited activities. Therefore, the IAF should not be …
------+216. The IAF should, following a risk-based approach, independently review and provide objective …
------+217. The IAF should not be involved in designing, selecting, establishing and implementing specific …
------+218. The IAF should assess whether the institution ’s internal control framework as set out in …
------+219. The IAF should verify, in particular, the integrity of the processes ensuring the reliability …
------+220. The IAF should have unfettered institution-wide access to all the records, documents …
------+221. The IAF should adhere to national and international professional standards. An example of the …
------+222. Internal audit work should be performed in accordance with an audit plan and a detailed audit …
------+223. An internal audit plan should be drawn up at least once a year on the basis of the annual …
------+224. All audit recommendations should be subject to a formal follow-up procedure by the appropriate …
---+Title VI – Business continuity management
------+225. Institutions should establish a sound business continuity management and recovery plan to …
------+226. Institutions may establish a specific independent business continuity function, e.g. as part …
------+227. An institution ’s business relies on several critical reso urces (e.g. IT systems, including …
------+228. In order to establish a sound business continuity management plan, an institution should …
------+229. On the basis of the abovementioned analysis, an institution should put in place: a. …
------+230. Contingency, business continuity and recovery plans should be documented and carefully …
---+Title VII – Transparency
------+231. Strategies, policies and procedures should be communicated to all relevant staff throughout an …
------+232. Accordingly, the management body should inform and update the relevant staff about the …
------+233. Where parent undertakings are required by competent authorities under Article 106(2) of …
------+234. The publication should include at least: a. an overview of the internal organisation of the …

4. Guidelines

4. Guidelines

1. Forbhreathnú

,
Title I – Proportionality

Title I – Proportionality
Title II – Role and composition of the management body and committees

Title II – Role and composition of the management body and committees
1 Role and responsibilities of the management body

1 Role and responsibilities of the management body
2 Management function of the management body

2 Management function of the management body
3 Supervisory function of the management body

3 Supervisory function of the management body
4 Role of the chair of the management body

4 Role of the chair of the management body
5 Committees of the management body in its supervisory function

5 Committees of the management body in its supervisory function
5.1 Setting up committees

5.1 Setting up committees
5.2 Composition of committees

5.2 Composition of committees
5.3 Committees’ p rocesses

5.3 Committees’ p rocesses
5.4 Role of the risk committee

5.4 Role of the risk committee
5.5 Role of the audit committee

5.5 Role of the audit committee
5.6 Combined committees

5.6 Combined committees
Title III – Governance framework

Title III – Governance framework
6 Organisational framework and structure

6 Organisational framework and structure
6.1 Organisational framework

6.1 Organisational framework
6.2 Know your structure

6.2 Know your structure
6.3 Complex structures and non-standard or non-transparent activities

6.3 Complex structures and non-standard or non-transparent activities
7 Organisational framework in a group context

7 Organisational framework in a group context
8 Outsourcing policy

8 Outsourcing policy
Title IV – Risk culture and business conduct

Title IV – Risk culture and business conduct
9 Risk culture

9 Risk culture
10 Corporate values and code of conduct

10 Corporate values and code of conduct
11 Conflict of interest policy at institutional level

11 Conflict of interest policy at institutional level
12 Conflict of interest policy for staff

12 Conflict of interest policy for staff
12.1 Conflict of interest policy in the context of loans and other transactions with members of the management body and their related parties

12.1 Conflict of interest policy in the context of loans and other transactions with members of the management body and their related parties
12.2 Documentation of loans to members of the management body and their related parties and additional information

12.2 Documentation of loans to members of the management body and their related parties and additional information
13 Internal alert procedures

13 Internal alert procedures
14 Reporting of breaches to competent authorities

14 Reporting of breaches to competent authorities
Title V – Internal control framework and mechanisms

Title V – Internal control framework and mechanisms
15 Internal control framework

15 Internal control framework
16 Implementing an internal control framework

16 Implementing an internal control framework
17 Risk management framework

17 Risk management framework
18 New products and significant changes

18 New products and significant changes
19 Internal control functions

19 Internal control functions
19.1 Heads of the internal control functions

19.1 Heads of the internal control functions
19.2 Independence of internal control functions

19.2 Independence of internal control functions
19.3 Combination of internal control functions

19.3 Combination of internal control functions
19.4 Resources of internal control functions

19.4 Resources of internal control functions
20 Risk management function

20 Risk management function
20.1 RMF’s role in risk strategy and decisions

20.1 RMF’s role in risk strategy and decisions
20.2 RMF’s role in material changes

20.2 RMF’s role in material changes
20.3 RMF’s role in identifying , measuring, assessing, managing, mitigating, monitoring and reporting risks

20.3 RMF’s role in identifying , measuring, assessing, managing, mitigating, monitoring and reporting risks
20.4 RMF’s role in unapproved exposures

20.4 RMF’s role in unapproved exposures
20.5 Head of the risk management function

20.5 Head of the risk management function
21 Compliance function

21 Compliance function
22 Internal audit function

22 Internal audit function
Title VI – Business continuity management

Title VI – Business continuity management
Title VII – Transparency

Title VII – Transparency

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Caighdeáin ghaolmhara

Caighdeáin
  • EBA - Published by the European Banking Authority at https://www.eba.europa.eu/