4. Assessment of internal governance and risk management framework of the TCB

Competent authorities should assess the applicant’s internal governance arrangements, based on the information provided by the applicant, in accordance with the requirements of chapter on TCBs of the requirements as per Article 48g of Directive 2013/36/EU as specified in the revised EBA Guidelines on internal governance in accordance with Articles 74(3) and 48g(9) of Directive 2013/36/EU²⁸ .

Competent authorities should assess the suitability of the at least two persons effectively directing the business of the TCB or, where applicable, the members of the local management committee, in accordance with the requirements set out for the assessment of the members of the management body under Article 91 of CRD as specified in the Joint EBA and ESMA Guidelines on the assessment of suitability of the members of the management body in accordance with Article 91(11) and 91a(8)) of Directive 2013/36/EU (CRD) and Article 9 of Directive 2014/65/EU (MiFID II)²⁹ , that apply mutatis mutandis and in line with Article 48g(1) CRD . Where applicable, competent authorities should also assess the suitability of the key function holder(s) in accordance with the same Joint EBA and ESMA Guidelines.

As part of the review of the internal governance arrangements, having regard in particular to the risk management framework, competent authorities should satisfy themselves that all relevant risks are covered, including potential risks related to the instruments constituting the capital endowment and those fulfilling the liquidity requirement. Competent authorities should also review the ICT security and risk management information in accordance with DORA requirements as applicable.

Competent authorities should pay attention that back-to-back booking practices or intragroup operations – where envisaged – are not planned to an extent to deprive the TCB of the purpose and rationale of its presence in the relevant Member State, turning them into ‘empty shells’ that circumvent legal and regulatory requirements. This assessment should also focus on the consistency of such practices with risk management requirements, and the extent of revenue dependence.

Competent authorities should assess, where relevant, the applicant’s third -party arrangements, including intragroup arrangements, regarding important or critical functions provided by third party service providers, in accordance with Article 74 CRD and the related EBA Guidelineson the sound management of third-party risk³⁰ .