Circular Letter No. CC/2024/00000027: Supervisory Expectations on the Suitability of Board and Supervisory Board Members and ICT, Security, and Risk Management Unit Heads

The Banco de Portugal establishes supervisory expectations for credit institutions regarding the suitability of board members and key ICT, security, and risk management personnel. It mandates that executive members responsible for ICT and risk management possess at least three years of relevant professional experience and appropriate academic qualifications. Institutions must ensure collective board competence in ICT risks, maintain independent second-line defense functions, and implement continuous training programs, with performance indicators potentially linked to variable remuneration. These requirements apply to credit institutions, excluding specific agricultural credit entities, and are enforced through ongoing supervisory assessments.

BDP published 5 documents in the last 30 days — get each new one by email the day it lands.

Circular Letter No. CC/2024/00000027
Sent to:
Credit Institutions.
Mod. 99999975/T – 01/14
Subject: Supervisory expectations regarding the suitability of members of the administrative and supervisory bodies and those responsible for information and communication technology (ICT), security, and associated risk management structural units

Framework
In accordance with Articles 115-A and 115-K of the General Regime of Credit Institutions and Financial Companies (RGICSF), institutions must have robust governance systems that allow them to adequately manage the risks to which they are or may become exposed.

Read the rest free, and get an email when BDP publishes again

Email me when BDP publishes something newOne email per publication, same day. Sign in below to keep reading.

Lineage: In force

amendssupersedesissued underrefers toproposed or not in RegAlertarrows run from the older text to the one that changes it

Source: Banco de Portugal — original document · Summary generated with machine assistance and reviewed before publication; the authoritative text is the regulator's original document. How RegAlert works