3. Programme of operations: internal governance and risk management of the TCB

In relation to the internal governance and internal controls of the TCB, the application should include the following information:

• a) a chart of the planned TCB organisational structure accompanied by relevant explanations;
• b) the identity of each of the at least two persons who will effectively direct the TCB or, where applicable, of each member of the local management committee and the information for the related suitability assessment in accordance with Article 91 of CRD, as specified in the EBA RTS on information and documentation to carry out the suitability assessment of the members of the management body under article 91 of CRD²⁵ , that will apply mutatis mutandis and in line with Article 48g(1) CRD; The application should contain the results of the applicant’s head undertaking most recent internal suitability assessment of the at least two persons effectively directing the TCB or, where applicable, of the members of the local management committee;
• c) where available, the internal suitability assessment of the key function holders of the envisaged TCB and, where applicable in accordance with national law, the supporting information for the competent authority’s suitability assessment;
• d) description of the allocation of duties between the at least two persons effectively directing the TCB and, where applicable, among the members of the local management committee;
• e) policies and procedures governing the internal control functions, i.e. risk management, compliance and internal audit;
• f) description of the reporting lines between the internal control functions and the persons effectively directing the TCB’s business and, where applicable, the local management committee as well as to the management body of the head undertaking.
• g) where applicable, copy of the rules of procedure for the local management committee;
• h) outline of the TCB’s credit risk policy and, where applicable rules of procedure of the credit risk committee;
• i) outline of the TCB’s remuneration policy;
• j) description of the ICT strategy, including ICT risk management framework compliant with Regulation (EU) 2022/2554 (“DORA”)²⁶ ;
• k) description of the third-party arrangements supporting of critical or important functions;
• l) details of internal arrangements under which critical or important functions of the TCB are performed by the head undertaking;
• m) outline of the business continuity plan, and information on the coverage of the TCB by the recovery plan of the applicant head undertaking(s).