23. Competent authorities’ assessment procedures

Competent authorities should specify the supervisory procedures applicable to the suitability assessment of members of the management body of institutions, as well as the heads of internal control functions and the CFO, where they are not part of the management body, in the case of significant CRD institutions. When specifying the supervisory procedures, competent authorities should consider that a suitability assessment performed after the member has taken up his or her position could lead to the need to remove a non-suitable member from the management body or to a situation where the management body collectively has ceased to be suitable. Competent authorities should ensure that a description of those assessment procedures is publicly available.

The suitability assessments of heads of internal control functions and the CFO, where they are not part of the management body, for significant CRD institutions, should be performed by competent authorities for:

• a. significant consolidating CRD institutions;
• b. significant CRD institutions that are part of a group, where the consolidating CRD institution is not a significant institution;
• c. significant CRD institutions that are not part of a group.

The supervisory procedures should ensure that newly appointed members of the management body, the management body as a collective body and, for significant CRD institutions referred to in paragraph 172, newly appointed heads of internal control functions and the CFO, where they are not part of the management body, are assessed by the competent authorities. The supervisory procedures should also ensure that re-appointed members of the management body are re-assessed by the competent authority in accordance with paragraphs 22 b) ii) and 30 b) ii) where a re-assessment is necessary.

Competent authorities should ensure that their supervisory procedures allow them to address cases of non-compliance in a timely manner.

As part of the above supervisory procedures, institutions should be required to inform competent authorities without delay of any vacant positions within the management body. Institutions should also be required to notify competent authorities of the intended appointment, in cases where the competent authority assesses the suitability before the appointment, or the appointment, in cases where the competent authorities assess the suitability after the appointment, of a member of the management body. Such notifications should, in cases where the competent authority assesses the suitability before the appointment, be made not later than two weeks after the institution decided to propose the member for appointment or, in cases where the competent authorities assess the suitability after the appointment, two weeks after the appointment and include the complete documentation and information in Annex III.

In the duly justified cases referred to in paragraph 136, institutions should be required to provide the complete documentation and information in Annex III, together with the notification to the competent authority within one month of the member being appointed.

Significant CRD institutions, for which an assessment of heads of internal control functions and the CFO, where they are not part of the management body, is required in line with paragraphs 172 and 173, should notify competent authorities of the appointment of these functions without delay and at the latest within two weeks of their appointment. Significant CRD institutions should be required to provide the complete documentation and information listed in Annex III, as applicable, together with the notification.

Competent authorities may set out the supervisory procedures applicable to the assessment of suitability of heads of internal control functions and the CFO, where they are not part of the management body, in other institutions not referred to in paragraph 172 and, where identified on a risk-based approach, other key function holders in institutions. As part of those procedures, competent authorities may also request those institutions to inform them about the results of the assessment carried out and to submit the relevant documentation to them.

Competent authorities should set out a maximum period for their assessment of suitability which should not exceed four months from the date when the notifications referred to in paragraphs 175 to 177 are provided by the institution. Where a competent authority establishes that additional documentation and information are needed to complete the assessment, that period may be suspended from the time when the competent authority requests additional documentation and information necessary to complete the assessment, until the receipt of that documentation and information. Necessary documentation and information should include documents or hearings that have to be requested or conducted in the course of the administrative procedures in cases where a negative decision is intended.

In accordance with Article 15 of Directive 2013/36/EU, where the assessment of suitability is performed in the context of an authorisation to take up the business, the maximum period must not exceed six months after receipt of the application or, where the application is incomplete, six months after receipt of the complete information required for the decision³⁵ .

³⁵ See footnote 28.

Competent authorities should perform their assessment on the basis of the documentation and information provided by the institution and assessed members, and assess them against the notions defined in Title III, as applicable.

The assessment of the individual and collective suitability of the members of the management body and, in case of significant CRD institutions, the assessment of the individual suitability of the heads of internal control functions and the CFO, where they are not part of the management body, should be performed on an ongoing basis by competent authorities, as part of their ongoing supervisory activity. Competent authorities should ensure that necessary re-assessments under sections 1, 2 and 3 of Title II are conducted by institutions. If a re-assessment of suitability by a competent authority is prompted by a re-assessment by an institution, that competent authority should in particular take into account the circumstances that prompted the re-assessment by the institution. In particular, competent authorities should re-assess the individual or collective suitability of the members of the management body and the individual suitability of heads of internal control functions and the CFO, where they are not part of the management body, within significant CRD institutions referred in paragraph 172 whenever significant new facts or evidence are unveiled during the course of ongoing supervision. This should include situations that cast factual material doubt on the past or ongoing compliance with AML/TF requirements by the institution, individual members of the management body and, within significant institutions referred to in paragraph 173, heads of internal control functions and the CFO, where they are not part of the management body.

For significant CRD institutions, competent authorities should use interviews where appropriate for the purpose of suitability assessments. Interviews may also be performed for other institutions on a risk-based approach, taking into account the criteria set out in Title I as well as the individual circumstances of the institution, the assessed individual, and the position for which an assessment is made.

Where appropriate, the interview process may also serve to re-assess the suitability of a member of the management body or key function holder when there are any new facts or circumstances that may raise concerns about the suitability of the individual.

Competent authorities may attend or conduct meetings with the institution, including with some or all members of its management body or key function holders, or participate as an observer in meetings of the management body in order to assess the effective functioning of the management body. The frequency of such meetings should be set using a risk-based approach.

A breach of a prudential or other regulatory requirement by an institution can, in some circumstances, support a finding by the competent authority that an individual is no longer suitable – for instance, in the event that the competent authority establishes, following due process, that an individual failed to take such steps as a person in his or her position could reasonably be expected to take in order to prevent, remedy or stop the breach.