4.4 Measures to be taken to ensure the timely return to compliance of the institution with the limits of Article 395(1) of Regulation (EU) No 575/2013

When a competent authority has granted an institution a period longer than 3 months to return to compliance with the limits of Article 395(1) of Regulation (EU) No 575/2013, the institution shall present a compliance plan for a timely return to compliance.

The compliance plan should at least encompass the following:

• a. arrangements to reduce the concerned exposure(s);
• b. measures to increase the in stitution’s own funds , where necessary;
• c. arrangements to reinforce internal risk management and control processes;
• d. any necessary amendments to the institution’s compliance policy ;
• e. appropriate procedures to ensure the timely implementation of the measures; and
• f. a detailed timetable to implement the measures, including the intended date of returning to compliance.

The measures proposed by an institution should include a description of any foreseeable risks or obstacles to the effective and timely execution of the compliance plan.

The competent authority should assess the appropriateness, sufficiency and feasibility of the measures to ensure a timely return to compliance on a stable and continuous basis, and that the detailed timeframe is appropriate and achievable.

If the competent authority has any material concerns with regard to the measures, it should promptly inform the institution.

The institution should inform the competent authority immediately in case some of the measures foreseen cannot be achieved as planned. The competent authority should closely monitor the implementation of the measures to ascertain the effective and timely return to compliance. In particular, it should monitor whether the different milestones are fully accomplished. If the institution fails to achieve any of those milestones, the competent authority should require the institution to address such failings appropriately.

The frequency and intensity of the competent authority’s monitoring should be adequate and proportional to the cause and size of the breach, its potential impact on the institution and the specificities of the compliance plan and the measures undertaken during periods of less than 3 months. It should also consider the evolution of the concerned exposure(s), based on regular information provided by the institution. Whenever it is necessary, the competent authority should request additional information.

The competent authority should decide and communicate whether the institution should perform an internal or an external audit regarding internal control and risk management processes, the results of which should be communicated to both the institution’s management body and the competent authority.

The competent authority should have in place a standard and documented procedure with clear instructions that describe the necessary steps to monitor that institutions having notified a breach return to compliance in a timely manner.

Institutions should ensure, in accordance with the EBA Guidelines on Internal Governance that its management body oversees and monitors the implementation of the measures taken that ensures a duly and timely return to compliance with the limits of Article 395(1) of Regulation (EU) No 575/2013.