15 Internal control framework

Institutions should develop and maintain a culture that encourages a positive attitude towards risk control and compliance within the institution and a robust and comprehensive internal control framework. Under this framework, institution s’ business lines should be responsible for managing the risks they incur in conducting their activities and should have controls in place that aim to ensure compliance with internal and external requirements. As part of this framework, institutions should have internal control functions with appropriate and sufficient authority, stature and access to the management body to fulfil their mission, and a risk management framework.

The internal control framework of institutions should be adapted on an individual basis to the specificity of its business, its complexity and the associated risks, taking into account the group context. Institutions should organise the exchange of the necessary information in a manner that ensures that each management body, business line and internal unit, including each internal control function, is able to carry out its duties. This means, for example, a necessary exchange of adequate information between the business lines and the compliance function and the AML/CFT compliance function where it is a separate control function, at the group level and between the heads of the internal control functions at the group level and the management body of the institution.

Institutions should implement appropriate processes and procedures that ensure that they comply with their obligations in the context of combating money laundering and terrorist financing. Institutions should assess their exposure to the risk that they may be used for the purpose of ML/TF and, where necessary, take mitigating measures to reduce those risks as well as their operational and reputational risks linked to them. Institutions should take measures to ensure that their staff is aware of such ML/TF risks and the impact that ML/TF has on the institution and the integrity of the financial system.

The internal control framework should cover the whole organisation, including the management body ’s responsibilities and tasks, and the activities of all business lines and internal units, including internal control functions, outsourced activities and distribution channels.

The internal control framework of an institution should ensure:

• a. effective and efficient operations;
• b. prudent conduct of business;
• c. adequate identification, measurement and mitigation of risks;
• d. the reliability of financial and non-financial information reported both internally and externally;
• e. sound administrative and accounting procedures; and
• f. compliance with laws, regulations, supervisory requirements and the institution ’ s internal policies, processes, rules and decisions.