2. The institutions ’ assessment of the collective suitability of the management body

Institutions should ensure, in fulfilling the obligation set out in Article 91(7) of Directive 2013/36/EU, that at all times the management body collectively possesses adequate knowledge, skills and experience to be able to understand the institution ’ s activities, including the main risks. Notwithstanding the experience, knowledge and skills requirement for each member of the management body, institutions should ensure that the overall composition of the management body reflects an adequately broad range of knowledge, skills and experience to understand the institution’s activities , including main risks.

Institutions should assess or re-assess the collective suitability of the management body, in particular:

• a. when applying for authorisation to take up the business, including situations where additional activities are authorised;
• b. when material changes to the composition of the management body occur, including:
• i. when appointing new members of the management body, including as a result of a direct or indirect acquisition or increase of a qualifying holding in an institution¹⁹ ;
• ii. when re-appointing members of the management body, if the requirements of the position have changed or if the members are appointed to a different position within the management body;
• iii. when appointed or reappointed members cease to be members of the management body;
• c. on an ongoing basis, in accordance with paragraph 31.

¹⁹ See footnote 17.

Institutions should re-assess the collective suitability of the members of the management body, in particular, in the following cases:

• a. when there is a material change to the institution’s business model , risk appetite or strategy or structure at individual or group level;
• b. as part of the review of the internal governance arrangements by the management body;
• c. where there are reasonable grounds to suspect that money laundering or terrorist financing has been or is being committed or attempted or there is an increased risk thereof in connection with that institution and in particular in situations where information available suggests that the institution
• i. has not implemented appropriate internal controls or oversight mechanisms to monitor and mitigate ML/TF risks (e.g. identified by supervisory findings from on-site inspections or off-site inspections, supervisory dialogue or in the context of sanctions);
• ii. has been found to be in breach of its AML/CFT obligations in the home or host Member State or in a third country; or
• iii. has materially changed its business activity or business model in a manner that suggests that its exposure to ML/TF risk has significantly increased;
• d. in any event that can otherwise materially affect the collective suitability of the management body.

Where re-assessments of the collective suitability are performed, institutions should focus their assessment on the relevant changes in the institution ’ s business activities, strategies and risk profile and in the distribution of duties within the management body and their effect on the required collective knowledge, skills and experience of the management body.

Institutions should base their suitability assessments on the notions defined in Title III and should implement a suitability policy and processes as set out in Titles VI and VII.

The assessment of the initial and ongoing collective suitability of the management body is the responsibility of institutions. Where the assessment is also carried out by competent authorities for supervisory purposes, the responsibility to assess and ensure the collective suitability of the management body continues to remain with the institutions.