Final Report on Guidelines on internal governance under CRD

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE EBA/GL/2021/05 2 July 2021 Final Report on Guidelines on internal governance under Directive 2013/36/EU

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Contents Executive Summary 3 Background and rationale 4

1. Compliance and reporting obligations 13
   Status of these guidelines 13
   Reporting requirements 13
2. Subject matter, scope and definitions 14
   Subject matter 14
   Addressees 14
   Scope of application 14
   Definitions 15
3. Implementation 17
   Date of application 17
   Repeal 17
4. Guidelines 18
   Title I – Proportionality 18
   Title II – Role and composition of the management body and committees 19 1 Role and responsibilities of the management body 19 2 Management function of the management body 22 3 Supervisory function of the management body 22 4 Role of the chair of the management body 24 5 Committees of the management body in its supervisory function 24
   5.1 Setting up committees 24
   5.2 Composition of committees 25
   5.3 Committees’ processes 26
   5.4 Role of the risk committee 27
   5.5 Role of the audit committee 28
   5.6 Combined committees 29
   Title III – Governance framework 30
   6 Organisational framework and structure 30
   6.1 Organisational framework 30
   6.2 Know your structure 30
   6.3 Complex structures and non-standard or non-transparent activities 32
   7 Organisational framework in a group context 33 8 Outsourcing policy 35

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Title IV – Risk culture and business conduct 35 9 Risk culture 35 10 Corporate values and code of conduct 36 11 Conflict of interest policy at institutional level 38 12 Conflict of interest policy for staff 39
12.1 Conflict of interest policy in the context of loans and other transactions with members of
the management body and their related parties 41
12.2 Documentation of loans to members of the management body and their related parties and
additional information 42
13 Internal alert procedures 43
14 Reporting of breaches to competent authorities 45 Title V – Internal control framework and mechanisms 46 15 Internal control framework 46 16 Implementing an internal control framework 47 17 Risk management framework 48 18 New products and significant changes 50 19 Internal control functions 51
19.1 Heads of the internal control functions 51
19.2 Independence of internal control functions 52
19.3 Combination of internal control functions 52
19.4 Resources of internal control functions 52
20 Risk management function 53
20.1 RMF’s role in risk strategy and decisions 54
20.2 RMF’s role in material changes 54
20.3 RMF’s role in identifying, measuring, assessing, managing, mitigating, monitoring and
reporting risks 54
20.4 RMF’s role in unapproved exposures 55
20.5 Head of the risk management function 55
21 Compliance function 56
22 Internal audit function 57
Title VI – Business continuity management 59
Title VII – Transparency 60
Annex I – Aspects to take into account when developing an internal governance policy 62
5. Accompanying documents 64
5.1. Draft cost-benefit analysis/impact assessment 64
5.2. Summary of responses to the consultation and the EBA’s analysis 66

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Executive summary In recent years, internal governance issues have received increased attention from various international bodies. Their main aim has been to correct institutions’ weak or superficial internal governance practices, as identified during the financial crisis. Recently, there has been a greater focus on conduct-related shortcomings, including compliance with the framework to prevent money laundering and terrorist financing and activities in offshore financial centres. Sound internal governance arrangements are fundamental if institutions, individually and the banking system they form, are to operate well. Directive 2013/36/EU, as amended by Directive 2019/878/EU, reinforces the governance requirements for institutions and in particular, stresses the responsibility of the management body for sound governance arrangements; the importance of a strong supervisory function that challenges management decision-making; and the need to establish and implement a sound risk strategy, risk appetite and risk management framework. To further harmonise institutions’ internal governance arrangements, processes and mechanisms within the EU in line with the requirements introduced by Directive 2013/36/EU, the European Banking Authority (EBA) is mandated by Article 74(3) of Directive 2013/36/EU,to develop guidelines in this area. The guidelines apply to all institutionsregardless of their governance structures (unitary board, dual board or other structure), without advocating or preferring any specific structure. The terms ‘management body in its management function’ and ‘management body in its supervisory function’ should be interpreted throughout the guidelines in accordance with the applicable law within each Member State. The guidelines complete the various governance provisions in Directive 2013/36/EU, taking into account the principle of proportionality, by specifying the tasks, responsibilities and organisation of the management body, and the organisation of institutions, including the need to create transparent structures that allow for supervision of all their activities; the guidelines also specify further the requirementsunder Directive 2013/36/EU aimed at ensuring the sound management of risks across all three lines of defence and, in particular,set out detailed elementsfor the second line of defence (the independent risk management and compliance function) and the third line of defence (the internalaudit function). The guidelines are based on an earlier set of guidelines on internal governance and in particular add additional elementsthat aim to foster a sound risk culture implemented by the management body, to strengthen the management body’s oversight of the institution’s activities and to strengthen the risk management frameworks of institutions, e.g. by including the aspect of AML/TF risk factors.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Background and rationale

1. Trust in the reliability of the financial system is crucial for its proper functioning and a
   prerequisite if it is to contribute to the economy as a whole. Consequently, effective internal governance arrangements are fundamental if institutions, individually and the banking system they form, are to operate well.
2. In recent years, internal governance issues have received increased attention from various
   international bodies. Their main aim has been to correct institutions’ weak or superficial internal governance practices, as identified during the financial crisis. These faulty practices, while not a direct trigger for the financial crisis, were closely associated with it and were questionable. In addition, recently, there has been a greater focus on conduct-related shortcomings and activities in offshore financial centres.
3. In some cases, at the time of the financial crisis the absence of effective checks and balances
   within institutions resulted in a lack of effective oversight of management decision-making, which led to short-term oriented and excessively risky management strategies. Weak oversight by the management body in its supervisory function has been identified as a contributing factor. The management body, both in its management function and, in particular, in its supervisory function, might not have understood the complexity of the business and the risks involved, consequently failing to identify and constrain excessive risk￾taking in an effective manner.
4. Internal governance frameworks, including internal control mechanisms and risk
   management, were often not sufficiently integrated within institutions or groups. There was a lack of a uniform methodology and terminology, so that a holistic view of all risks did not exist. Internal control functions often lacked appropriate resources, status and/or expertise.
5. Conversely, sound internal governance practices helped some institutions to manage the
   financial crisis significantly better than others. These practices included the setting of an appropriate risk strategy and appropriate risk appetite levels, a holistic risk management framework and effective reporting lines to the management body.
6. Against this background, there is a clear need to address the potentially detrimental effects
   of poorly designed internal governance arrangements on the sound management of risk, to ensure effective oversight by the management body, in particular in its supervisory function, to promote a sound risk culture at all levels of institutions and to enable competent authorities to supervise andmonitor the adequacy of internal governance arrangements.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Legal basis
7. The guidelines apply in the same way to institutions as to investment firms that are subject to
Title VII of Directive 2013/36/EU 1 as amended by Directive 2019/878/EU 2 in application of
Article 1(2) and (5) of Regulation 2019/2033/EU.
8. To further harmonise institutions’ internal governance arrangements, processes and
mechanisms within the EU, the EBA is mandated by Article 74(3) of Directive 2013/36/EU to develop guidelines in this area.
9. Article 74(1) of Directive 2013/36/EU, requires institutions to have robust governance
arrangements, including a clear organisational structure with well-defined, transparent and consistent lines of responsibility.
10. Article 76 of Directive 2013/36/EU sets out requirements for the involvement of the
management body in risk management, the setting up of a risk committee for significant institutions, and the tasks and organisation of the risk management function. In addition,this
article establishes ‘that the head of the risk management function shall be an independent
senior managerwith distinct responsibility for the risk management function’. To reflect the wording of the directive,the revised guidelines refer,regarding the second line of defence,to the ‘(independent) risk management function’, while the previous guidelines used the term ‘(independent) risk control function’. However, it should be remembered that business lines or units, as the first line of defence, have a material role in ensuring robustrisk management and compliance within an institution.
11. Article 88 of Directive 2013/36/EU sets out the responsibilities of the management body
regarding governance arrangements, including the segregation of duties in the organisation and the prevention of conflicts of interest. Moreover, the directive sets out that Member States shall ensure that data on loans to members of the management body and their related parties are properly documented and made available to competent authorities upon request. Significant institutions are obliged under Paragraph 2 of this article to set up a nomination committee, unless under national law, the management body does not have any competence in the process of selection and appointment of any of its members.
12. Under Article 109(1) of Directive 2013/36/EU, competent authorities must require
institutions to meet the obligations set out in Articles 74 to 96 of that directive on an individual basis, unless competent authorities make use of the derogations as defined in
Article 7 of Regulation (EU) No 575/2013 as amended by Regulation (EU) No 2019/876 and/or
1 Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC 2Directive (EU) 2019/878 of the European Parliament and of the Council of 20 May 2019 amending Directive 2013/36/EU as regards exempted entities, financial holding companies, mixed financial holding companies, remuneration, supervisory measures and powers and capital conservation measures

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE waivers for institutions permanently affiliated to a central body in compliance with Article 21 of Directive 2013/36/EU.
13. Under Article 109 (2) of Directive 2013/36/EU these guidelines apply on a sub-consolidated
or consolidated basis. For this purpose, parent undertakings and subsidiaries subject to Directive 2013/36/EU must ensure that internal governance arrangements, processes and mechanisms in their subsidiaries are consistent, well integrated and that the governance arrangements on a consolidated basis are robust. In particular, it should be ensured that parent undertakings and subsidiaries subject to this directive implement such arrangements, processes and mechanisms in their subsidiaries not subject to this directive, including those established in third countries, including offshore financial centres. These arrangements, processes and mechanisms must also be consistent and well integrated and those subsidiaries not subject to this directive must also be able to produce any data and information relevant to the purpose of supervision. As set out in Article 109(2) CRD, subsidiary undertakings that are not themselves subject to this directive shall comply with their sector-specific requirements on an individual basis.
14. In accordance with Article 109(3) of Directive 2013/36/EU, the requirement under
Article 109(2) of this directive to ensure the application of Articles 74 to 96 of the directive
also in subsidiaries not themselves subject to this directive does not apply only, if the EU parent institution can demonstrate that the application is unlawful under the law of the third country where the subsidiary is established. With regard to the application of the remuneration requirements laid down in Articles 92, 94 and 95 of Directive 2013/36/EU,
Article 109(4) of that directive foresees that those provisions should not apply on a
consolidated basis to subsidiaries that are not themselves subject to this directive under certain specific conditions 3 .
15. Under Article 123(2) of Directive 2013/36/EU, competent authorities must require
institutions to have in place adequate risk management processes and internal control mechanisms, including sound reporting and accounting procedures in order to identify, measure, monitor and control transactions with their parent mixed-activity holding company and its subsidiaries appropriately.
16. In line with Article 47 of Directive 2013/36/EU, branches in a Member State of credit
institutions authorised in a third country should be subject to equivalent requirements to those applicable to institutions within the Member State where the branch is located,taking into account, regarding internal governance arrangements, that the branch does not have a management body, but persons who are responsible for effectively directing the business.
17. These guidelines should be read in conjunction with other relevant EBA guidelines, including
the EBA guidelines on outsourcing arrangements, the joint EBA and European Securities and Markets Authority (ESMA) guidelines on the assessment of the suitability of members of the See EBA guidelines on sound remuneration policies

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE management body and key function holders, the EBA guidelines on sound remuneration and the EBA guidelines on the supervisory review and evaluation process (SREP). Rationale and objective of the guidelines
18. Internal governance includes all standards and principles concerned with setting an
institution’s objectives, strategies and risk management framework; how its business is organised; how responsibilities and authority are defined and clearly allocated; how reporting lines are set up and what information they convey; and how the internal control framework is organised and implemented, including accounting procedures and remuneration policies. Internal governance also encompasses sound information technology systems, outsourcing arrangements and business continuity management.
19. Combating money laundering and terrorist financing is essential for maintaining stability and
integrity in the financial system. Uncovering involvement of an institution in money laundering and terrorist financing might have an impact on its viability and the trust in the financial system. Together with the authorities and bodies (e.g. AML supervisors and financial intelligence units) responsible for ensuring compliance with anti-money laundering rules under Directive (EU) 2015/849, competent authorities have an important role to play in identifying and tackling weaknesses. In this context, the guidelines clarify in line with Directive 2013/36/EU that identifying, managing and mitigating money laundering and financing of terrorism risk is part of sound internal governance arrangements and credit institutions’risk management framework.
20. In the same way institutions should take into account environmental, social and governance
(ESG) risk factors within their risk management framework.
21. Directive 2013/36/EU sets out requirements aimed at remedying weaknesses that were
identified during the financial crisis regarding internal governance arrangements and in particular the sound management and oversight of risks. Identified weaknesses included in particular a lack of effective oversight by the management body, in particular in its supervisory function, limited accessibility of the supervisory function and shortcomings regarding the authority, stature and resources of the risk management function.
22. In addition, it is also necessary to take into account developments in this area since the
publication of the revised EBA guidelines on internal governance in 2017, such as the updated OECD principles of corporate governance 4 and the revised corporate governance principles for banks published by the Basel Committee on Banking Supervision (BCBS) 5 . The guidelines align the terminology used regarding risk appetite and risk tolerance with the EBA guidelines on common procedures and methodologies for the SREP and also with the revised BCBS principles;they use the term ‘risk appetite’to refer to the aggregate level of risk and the types The OECD principles can be found at http://www.oecd.org/corporate/principles-corporate-governance.htm. The BCBS guidelines can be found at http://www.bis.org/bcbs/publ/d328.htm.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE of risk an institution is willing to assume, while ‘risk capacity’ is the maximum amount of risk an institution is able to assume.
23. The guidelines are intended to apply to all existing board structures without interfering with
the general allocation of competences in accordance with national company law or advocating any particular structure. Accordingly, they should be applied irrespective of the board structure used (a unitary and/or a dual board structure and/or another structure) across Member States. The management body, as defined in Points (7) and (8) of Article 3(1) of Directive 2013/36/EU, should be understood as having management (executive) and supervisory (non-executive) functions.
24. The terms ‘management body in its management function’ and ‘management body in its
supervisory function’ are used throughout these guidelines without referring to any specific governance structure, and references to the management (executive) or supervisory (non￾executive) function should be understood as applying to the bodies or members of the management body responsible for that function in accordance with national law.
25. In Member States where the management body delegates, partially or fully, the executive
function to a person or an internal executive body (e.g. a chief executive officer (CEO), management team or executive committee), the persons who perform those executive functions and direct the business of the institution on the basis of that delegation should be understood as constituting the management function of the management body. For the purposes of these guidelines, any reference to the management body in its management function should be understood as including also the members of the executive body or the CEO, as defined in these guidelines, even if they have not been proposed or appointed as formal members of the institution’s governing body or bodies under national law.
26. The management body is empowered to set the institution’s strategy, objectives and overall
direction, and oversees and monitors management decision-making. The management body in its management function directsthe institution. Senior management is accountable to the management body for the day-to-day running of the institution. The management body in its supervisory function oversees and challenges the management function and provides appropriate advice. The oversight roles include reviewing the performance of the management function and the achievement of objectives, challenging the strategy, and monitoring and scrutinising the systems that ensure the integrity of financial information as well as the soundness and effectiveness of risk management and internal controls.
27. Taking into consideration all existing governance structures provided for by national laws,
competent authorities should ensure the effective and consistent application of the guidelines in their jurisdictions in accordance with the rationale and objectives of the guidelines themselves. For this purpose, competent authorities may clarify the governing bodies and functions to which the tasks and responsibilities set forth in the guidelines pertain, when this is appropriate to ensure the proper application of the guidelines in accordance with the governance structures provided for under national company law.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
28. Independent directors within the supervisory function of the management body helps to
ensure that the interests of all internal and external stakeholders are considered and that independent judgement is exercised where there is an actual or potential conflict of interest 6 .
29. With regard to the composition of committees and, in particular, with regard to independent
members,the guidelines are in line with the BCBS principles on corporate governance, which set out guidance for the largest institutions. To take into account the principle of proportionality,simpler elements have been introduced for smaller institutions.
30. The guidelines are consistent with the ‘three lines of defence’ model in identifying the
functions within institutions responsible for addressing and managing risks.
31. The business lines, as part of the first line of defence, take risks and are responsible for their
operational management directly and on a permanent basis. For that purpose, business lines should have appropriate processes and controls in place that aim to ensure that risks are identified, analysed, measured, monitored, managed, reported and kept within the limits of the institution’s risk appetite and that the business activities are in compliance with external and internal requirements.
32. Not only business lines, but also other functions or units, e.g. HR, legal or information
technology, are responsible for managing their risks and having appropriate controls in place. Other functions or units are mainly exposed to operational and reputational risks that must be considered by the compliance function and risk management function when forming an enterprise-wide holistic view on all risks. All other functions or units should also be subject to the monitoring and oversight by the independent risk management and compliance function on a risk-based approach.
33. The risk management function and compliance function form the second line of defence.
Institutions may set up additional specific control functions (e.g. IT security control or AML compliance function). The risk management function (referred to in the previous guidelines as the ‘risk control function’) facilitates the implementation of a sound risk management framework throughout the institution and has responsibility for further identifying, monitoring, analysing, measuring, managing and reporting risks and forming a holistic view on all risks on an individual and consolidated basis. It challenges and assists in the implementation of risk management measures by the business lines in order to ensure that the process and controls in place at the first line of defence are properly designed and effective. The compliance function monitors compliance with legal requirements and internal policies, provides advice on compliance to the management body and other relevant staff, and establishes policies and processes to manage compliance risks and to ensure compliance. Both functions may intervene to ensure the modification of internal control and risk management systems within the first line of defence where necessary. In this regard, the guidelines are based on the Commission Recommendation of 15 February 2005 on the role of non￾executive or supervisory directors of listed companies and on the committees of the (supervisory) board.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
34. The independent internal audit function, as the third line of defence, conducts risk-based and
general audits and reviews the internal governance arrangements, processes and mechanisms to ascertain that they are sound and effective, implemented and consistently applied. The internal audit function is also in charge of the independent review of the first two lines of defence, including other internal functions, units and business lines. The internal audit function performs its tasks fully independently ofthe other lines of defence.
35. To ensure their proper functioning, all internal control functions need to be independent of
the business they control, have the appropriate financial and human resources to perform their tasks, and report directly to the management body. Within all three lines of defence, appropriate internal control procedures, mechanisms and processes should be designed, developed, maintained and evaluated under the ultimate responsibility of the management body.
36. All elements within the guidelines are subject to the principle of proportionality, meaning that
they are to be applied in a manner that is appropriate, taking into account in particular the institution’s size, internal organisation and nature, and the complexity of its activities.
37. The guidelines specify further the requirements underDirective 2013/36/EU that need to be
considered when setting up new structures, e.g. in third countries, including also offshore financial centres, and which aim to increase the transparency of and reduce the risks connected with such activities. Guidelines are also provided regarding the reporting of institutions on governance arrangements, including in relation to such structures.
38. The guidelines aim to establish a sound risk culture in institutions. Risks should be taken within
a well-defined framework in line with the institution’s risk strategy and risk appetite. This includes the establishment of and ensuring compliance with a system of limits and controls. Risks within new products and business areas, but also risks that may result from changes to institutions’ products, processes and systems, are to be duly identified, assessed, appropriately managed and monitored. The risk management function and compliance function should be involved in the establishment of the framework and the approval of such changes to ensure that all material risks are taken into account and that the institution complies with all internal and external requirements.
39. To ensure objective decision-making, oversight and compliance with external and internal
requirements, including institutions’ strategies and risk limits, institutions should implement a conflict-of-interest policy and internal whistleblowing procedures.
40. In order to prevent conflicts of interest, the management body should ensure that a
framework for the identification and, where necessary, mitigation of conflicts of interests exist. The institution, its organisational substructures, staff and shareholders hold different intereststhat should be considered in such a framework in order to ensure that decisions are taken objectively. Examples of typical sources of conflicts of interests are diverging economic

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE interests of different partiesinvolved or close links between decision-makers and contractual parties.
41. The management body has the highest decision-making powers, consequently the
identification and management of conflicts of interest of members of the management body and parties closely related to the members of the management body is a cornerstone of sound internal governance practices. Therefore, the guidelines specify measures that should be implemented by institutions to prudently manage conflicts of interests that may arise from granting loans to and entering into other transactions with members of the management body and their related parties.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE EBA/GL/2021/05 2 July 2021 Guidelines on internal governance

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE

1. Compliance and reporting
   obligations
   Status of these guidelines
2. These guidelines are issued pursuant to Article 16 of Regulation (EU) No 1093/2010 7
   . In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions, including institutions, must make every effort to comply with the guidelines.
3. Guidelines set the EBA view of appropriate supervisory practices within the European System
   of Financial Supervision or of how Union law should be applied in a particular area. Competent authority as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions. Reporting requirements
4. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authority must notify
   the EBA as to whether they comply or intend to comply with these guidelines, or otherwise with reasons for non-compliance, by ([dd.mm.yyyy]). In the absence of any notification by this deadline, competent authority will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website to compliance@eba.europa.eu with the reference ‘EBA/GL/2021/05’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authority. Any change in the status of compliance must also be reported to EBA.
5. Notifications will be published on the EBA website, in line with Article 16(3) of Regulation (EU)
   No 1093/2010.
   Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
2. Subject matter, scope and definitions
Subject matter
5. These guidelines specify further the internal governance arrangements, processes and
mechanisms that institutions,that are subject to Directive 2013/36/EU 8 and investment firms that are subject to Title VII of Directive 2013/36/EU in application of Article 1(2) and (5) of Regulation 2019/2033/EU, should implement in accordance with Article 74(1) of Directive 2013/36/EU to ensure their effective and prudent management. Addressees These guidelines are addressed to competent authorities as defined in point (i) of Article 4 2) of Regulation (EU) 1093/2010, and to financial institutions as defined in Article 4(1) of Regulation (EU) 1093/2010 that are either institutions for the purposes of the application of Directive 2013/36/EU as defined in point 3 of Article 3(1) of Directive 2013/36/EU also having regard to Article 3 (3) of that Directive or investment firms subject to Title VII of Directive 2013/36/EU in application of Article 1(2) and (5) of Regulation 2019/2033/EU (‘institutions’). Scope of application
6. These guidelines apply in relation to institutions’ governance arrangements, including their
organisational structure and the corresponding lines of responsibility, processes to identify, manage, monitor and report all risks 9 they are or might be exposed to, and internal control framework.
7. The guidelines intend to embrace all existing board structures and do not advocate any
particular structure. The guidelines do not interfere with the general allocation of competences in accordance with national company law. Accordingly, they should be applied irrespective of the board structure used (unitary and/or a dual board structure and/or another structure) across Member States. The management body, as defined in Points(7) and (8) of Article 3(1) of Directive 2013/36/EU, should be understood as having management (executive) and supervisory (non-executive) functions 10 .
8. The terms ‘management body in its management function’ and ‘management body in its
supervisory function’ are used throughout these guidelines without referring to any specific 8 Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338). 9 Any reference to risks in these guidelines should include money laundering and terrorist financing risks. 10 See also recital 56 of Directive 2013/36/EU.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE governance structure, and references to the management (executive) or supervisory (non￾executive) function should be understood as applying to the bodies or members of the management body responsible for that function in accordance with national law. When implementing these guidelines, competent authorities should take into account their national company law and specify, where necessary, to which body or members of the management body those functions should apply.
9. In Member States where the management body delegates, partially or fully, the executive
functions to a person or an internal executive body (e.g. a chief executive officer (CEO), management team or executive committee), the persons who perform those executive functions on the basis of that delegation should be understood as constituting the management function of the management body. For the purposes of these guidelines, any reference to the management body in its management function should be understood as including also the members of the executive body or the CEO, as defined in these guidelines, even if they have not been proposed or appointed as formal members of the institution’s governing body or bodies under national law.
10. In Member States where some responsibilities are directly exercised by shareholders, members
or owners of the institution instead of the management body, institutions should ensure that such responsibilities and related decisions are in line, as far as possible, with the guidelines applicable to the management body.
11. The definitions of CEO, chief financial officer (CFO) and key function holder used in these
guidelines are purely functional and are not intended to impose the appointment of those officers or the creation of such positions unless prescribed by relevant EU or national law.
12. Institutions should comply and competent authorities should ensure that institutions comply
with these guidelines on an individual, sub-consolidated and consolidated basis, in accordance with the level of application set out in Article 109 of Directive 2013/36/EU. Definitions
13. Unless otherwise specified, terms used and defined in Directive 2013/36/EU and Regulation
(EU) No 575/2013 have the same meaning in the guidelines. In addition, for the purposes of these guidelines, the following definitions apply:
Risk appetite means the aggregate level and types of risk an institution is willing to assume within its risk capacity, in line with its business model, to achieve its strategic objectives. Risk capacity means the maximum level of risk an institution is able to assume given its capital base, its risk management and control capabilities, and its regulatory constraints.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Risk culture means an institution’s norms, attitudes and behaviours related to risk awareness, risk-taking and risk management, and the controls that shape decisions on risks. Risk culture influences the decisions of management and employees during the day-to-day activities and has an impact on the risks they assume. Staff means all employees of an institution and its subsidiaries within its scope of consolidation, including subsidiaries not subject to Directive 2013/36/EU, and all members of the management body in its management function and in its supervisory function. Chief executive officer(CEO) means the person who is responsible for managing and steering the overall business activities of an institution. Chief financial officer (CFO) means the person who is overall responsible for managing all of the following activities: financial resources management, financial planning and financial reporting. Heads of internal control functions means the persons at the highest hierarchical level in charge of effectively managing the day-to-day operation of the independent risk management, compliance and internal audit functions. Key function holders means persons who have significant influence over the direction of the institution but who are neither members of the management body, nor the CEO. They include the heads of internal control functions and the CFO, where they are not members of the management body, and, where identified on a risk-based approach by institutions, other key function holders. Other key function holders might include heads of significant business lines, European Economic Area/European Free Trade Association branches, third country subsidiaries and other internal functions. Prudential consolidation means the application of the prudential rules set out in Directive 2013/36/EU and Regulation (EU) No 575/2013 on a consolidated or sub-consolidated basis, in accordance with Part 1, Title 2,
Chapter 2 of Regulation (EU) No 575/2013. 11
Gender pay gap means the difference between the average gross hourly earnings of men and women expressed as a percentage of the average gross hourly earnings of men. Consolidating institution means an institution that is required to abide by the prudential requirements on the basis of the consolidated situation in accordance with Part 1, Title 2, Chapter2 of Regulation (EU) No 575/2013. 11 See also RTS on prudential consolidation under:
https://www.eba.europa.eu/sites/default/documents/files/document_library/Publications/Draft%20Technical%20Stan dards/2021/973355/Final%20Report%20Draft%20RTS%20methods%20of%20consolidation.pdf

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Significant institutions means institutions referred to in Article 131 of Directive 2013/36/EU (global systemically important institutions (G-SIIs) and other systemically important institutions (O-SIIs)), and, as appropriate, other institutions determined by the competent authority or national law, based on an assessment of the institutions’ size and internal organisation, and the nature, scope and complexity of their activities. Listed institution means institutions whose financial instruments are admitted to trading on a regulated market or on a multilateral trading facility as defined under Article 4(21) and Article 4(22) of Directive 2014/65/EU, in one or more Member States 12 . Shareholder means a person who owns shares in an institution or, depending on the legal form of an institution, other owners or members of the institution. Directorship means a position as a member of the management body of an institution or another legal entity.
3. Implementation
Date of application
14. These updated guidelines apply from 31 December2021.
Repeal
15. The EBA Guidelines on internal governance (EBA/GL/2017/11) of 26 September 2017 are
repealed with effect from 31 December 2021.
12 Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
4. Guidelines
Title I – Proportionality
16. The proportionality principle encoded in Article 74(2) of Directive 2013/36/EU aims to ensure
that internal governance arrangements are consistent with the individual risk profile and business model of the institution, so that the objectives of the regulatory requirements and provisions are effectively achieved.
17. Institutions should take into account their size and internal organisation, and the nature, scale
and complexity of their activities, when developing and implementing internal governance arrangements. Significant institutions should have more sophisticated governance arrangements, while small and less complex institutions may implement simpler governance arrangements. Institutions should however note that the size or systemic importance of an institution may not, by itself, be indicative of the extent to which an institution is exposed to risks.
18. For the purpose of the application of the principle of proportionality and in order to ensure an
appropriate implementation of the regulatory requirements and these guidelines, all the following aspects should be taken into account by institutions and competent authorities:
a. the size in terms of the balance-sheet total of the institution and its subsidiaries within the scope of prudential consolidation; b. the geographical presence of the institution and the size of its operations in each jurisdiction;
c. the legal form of the institution, including whether the institution is part of a group
and, if so, the proportionality assessment for the group; d. whether it is a listed institution; e. whether the institution is authorised to use internal models for the measurement of capital requirements (e.g. the internal ratings-based approach); f. the type of authorised activities and services performed by the institution (e.g. see also
Annex 1 to Directive 2013/36/EU and Annex 1 to Directive 2014/65/EU);
g. the underlying business model and strategy; the nature and complexity of the business activities, and the institution’s organisational structure;

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE h. the risk strategy, risk appetite and actual risk profile of the institution, taking into account also the result of the SREP capital and SREP liquidity assessments;
i. the ownership and funding structure of the institution;
j. the type of clients (e.g. retail, corporate, institutional, small businesses, public entities) and the complexity of the products or contracts; k. the outsourced functions and distribution channels;
l. the existing information technology (IT) systems, including continuity systems and
outsourcing functions in this area; and m. whether the institution falls under the definition in Points 145 and 146 of Article 4(1) of Regulation (EU) No 575/2013 of a small and non-complex institution or a large institution. Title II – Role and composition of the management body and committees 1 Role and responsibilities of the management body
19. In accordance with Article 88(1) of Directive 2013/36/EU, the management body must have
ultimate and overall responsibility for the institution and defines, oversees and is accountable for the implementation of the governance arrangements within the institution that ensure effective and prudent management of the institution.
20. The duties of the management body should be clearly defined, distinguishing between the
duties of the management (executive) function and the supervisory (non-executive) function. The responsibilities and duties of the management body should be described in a written document and duly approved by the management body. All members of the management body should be fully aware of the structure and responsibilities of the management body, and of the division of tasks between different functions of the management body and its committees.
21. The management body in its supervisory function and in its management function should
interact effectively. Both functions should provide each other with sufficient information to allow them to perform their respective roles. In order to have appropriate checks and balances in place, the decision-making within the management body should not be dominated by a single member or a small subset of its members.
22. The management body’sresponsibilities should include setting, approving and overseeing the
implementation of:

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE a. the overall business strategy and the key policies of the institution within the applicable legal and regulatory framework, taking into account the institution’s long￾term financial interests and solvency; b. the overall risk strategy, the institution’s risk appetite and its risk management framework and measures to ensure that the management body devotessufficient time to risk and risk management issues;
c. an adequate and effective internal governance and internal control framework, as
defined in Title V,that:
i. includes a clear organisational structure and well-functioning independent
internal risk management, compliance and audit functions that have sufficient authority, stature and resources to perform their functions;
ii. ensures compliance with applicable regulatory requirements in the context
of the prevention of money laundering and terrorism financing; d. the amounts, types and distribution of both internal capital and regulatory capital to adequately cover the risks of the institution; e. targets for the liquidity management of the institution; f. a remuneration policy that is in line with the remuneration principles set out in Articles 92 to 95 of Directive 2013/36/EU and the EBA guidelines on sound remuneration policies under Articles 74(3) and 75(2) of Directive 2013/36/EU 13; g. arrangements aimed at ensuring that the individual and collective suitability assessments of the management body are carried out effectively, that the composition and succession planning of the management body are appropriate, and that the management body performs its functions effectively 14; h. a selection and suitability assessment process for key function holders 15;
i. arrangements aimed at ensuring the internal functioning of each committee of the
management body, when established, detailing the:
i. role, composition and tasks of each of them;
13 EBA guidelines on sound remuneration policies 14 See also the joint ESMA and EBA guidelines on the assessment of the suitability of members of the management body and key function holders. 15 See also joint ESMA and EBA guidelines on the assessment of the suitability of members of the management body and key function holders.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
ii. appropriate information flow, including the documentation of
recommendations and conclusions, and reporting lines between each committee and the management body, competent authorities and other parties; j. a risk culture in line with Section 9 of these guidelines, which addresses the institution’s risk awareness and risk-taking behaviour; k. a corporate culture and values in line with Section 10, which foster responsible and ethical behaviour, including a code of conduct or similar instrument;
l. a conflict-of-interest policy at institutional level in line with Section 11 and for staff in
line with Section 12; and m. arrangements aimed at ensuring the integrity of the accounting and financial reporting systems, including financial and operational controls and compliance with the law and relevant standards.
23. When setting, approving and overseeing the implementation of the aspects listed in
Paragraph 22 the management body should aim at ensuring a business model, governance arrangements, including a risk management framework that take into account all risks. When taking into account all risks, institutions are exposed to, institutions should take into account all relevant risk factors, including environmental, social and governance risk factors. Institutions should consider that the latter may drive their prudential risks, including credit risks, e.g. via risk factors related to the transition to a sustainable economy or external physical climate￾related events that may affect debtors, market, liquidity, operational risks and also reputational risks, e.g. via social and governance risk factors, e.g. in the context of outsourcing arrangements 16. Such risks include, e.g. legal risks in the area of contractual or labour law, risks related to potential human rights violations or other ESG risk factorsthat may affect the country where a service provider is located and its ability to provide the agreed service levels.
24. The management body must oversee the process of disclosure and communications with
external stakeholders and competent authorities.
25. All members of the management body should be informed about the overall activity, financial
and risk situation of the institution, taking into account the economic environment, and about decisions taken that have a major impact on the institution’s business.
26. A member of the management body may be responsible for an internal control function as
referred to in Title V, Section 19.1, provided that the member does not have other mandates 16 See EBA report on ESG risk management and supervision published under the CRD Art. 98(8) for a description of EBA’s understanding of ESG risks, transmission channels, and recommendations for arrangements, processes, mechanisms and strategies to be implemented by institutions to identify, assess and manage ESG risks.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE that would compromise the member’s internal control activities and the independence of the internal control function.
27. The management body should monitor, periodically review and address any weaknesses
identified regarding the implementation of processes, strategies and policies related to the responsibilities listed in Paragraphs 22 and 23. The internal governance framework and its implementation should be reviewed and updated on a periodic basis taking into account the proportionality principle, as further explained in Title I. A deeper review should be carried out where material changes affectthe institution. 2 Management function of the management body
28. The management body in its management function should engage actively in the business of
an institution and should take decisions on a sound and well-informed basis.
29. The management body in its management function should be responsible for the
implementation of the strategies set by the management body and discuss regularly the implementation and appropriateness of those strategies with the management body in its supervisory function. The operational implementation may be performed by the institution’s management.
30. The management body in its management function should constructively challenge and
critically review propositions, explanations and information received when exercising its judgement and taking decisions. The management body in its management function should comprehensively report, and inform regularly and where necessary without undue delay the management body in its supervisory function of the relevant elements for the assessment of a situation, the risks and developments affecting or that may affect the institution, e.g. material decisions on business activities and risks taken, the evaluation of the institution’s economic and business environment, liquidity and sound capital base, and assessment of its material risk exposures.
31. Without prejudice to the national transposition of Directive 2015/849/EU, the management
body should identify one of its members in line with the requirements under Article 46(4) of Directive 2015/849/EU Anti-Money Laundering Directive (AMLD) who is responsible for the implementation of the laws, regulations and administrative provisions necessary to comply with this directive, including the corresponding AML/CFT policies and procedures in the institution and at the level of the management body 17 . 3 Supervisory function of the management body
32. The role of the members of the management body in its supervisory function should include
monitoring and constructively challenging the strategy of the institution. 17The management body as a collegial body remains responsible as a whole.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
33. Without prejudice to national law the management body in its supervisory function should
include independent members as provided for in Section 9.3 of the joint ESMA and EBA guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU.
34. Without prejudice to the responsibilities assigned under the applicable national company law,
the management body in its supervisory function should:
a. oversee and monitor management decision-making and actions and provide effective oversight of the management body in its management function, including monitoring and scrutinising its individual and collective performance and the implementation of the institution’s strategy and objectives; b. constructively challenge and critically review proposals and information provided by members of the management body in its management function, as well as its decisions;
c. taking into account the proportionality principle as set out in Title I, appropriately fulfil
the duties and role of the risk committee, the remuneration committee and the nomination committee, where no such committees have been set up; d. ensure and periodically assess the effectiveness of the institution’s internal governance framework and take appropriate steps to address any identified deficiencies; e. oversee and monitorthat the institution’s strategic objectives, organisational structure and risk strategy, its risk appetite and risk management framework, as well as other policies (e.g. remuneration policy) and the disclosure framework are implemented consistently; f. monitor that the risk culture of the institution is implemented consistently; g. oversee the implementation and maintenance of a code of conduct or similar code and effective policies to identify, manage and mitigate actual and potential conflicts of interest; h. oversee the integrity of financial information and reporting, and the internal control framework, including an effective and sound risk management framework;
i. ensure that the heads of internal control functions are able to act independently and,
regardlessthe responsibility to report to other internal bodies, business lines or units, can raise concerns and warn the management body in its supervisory function directly, where necessary, when adverse risk developments affect or may affect the institution; and

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE j. monitor the implementation of the internal audit plan, after the prior involvement of the risk and audit committees, where such committees are established. 4 Role of the chair of the management body
35. The chair of the management body should lead the management body, contribute to an
efficient flow of information within the management body and between the management body and the committees thereof, where established, and should be responsible for its effective overall functioning.
36. The chair should encourage and promote open and critical discussion and ensure that
dissenting views can be expressed and discussed within the decision-making process.
37. As a general principle, the chair of the management body should be a non-executive member.
Where the chair is permitted to assume executive duties, the institution should have measures in place to mitigate any adverse impact on the institution’s checks and balances (e.g. by designating a lead board member ora senior independent board member, or by having a larger number of non-executive members within the management body in its supervisory function). In particular, in accordance with Article 88(1)(e) of Directive 2013/36/EU, the chair of the management body in its supervisory function of an institutionmust not exercise simultaneously the functions of a CEO within the same institution, unless justified by the institution and authorised by competent authorities.
38. The chair should set meeting agendas and ensure that strategic issues are discussed with
priority. He or she should ensure that decisions of the management body are taken on a sound and well-informed basis and that documents and information are received in enough time before the meeting.
39. The chair of the management body should contribute to a clear allocation of duties between
members of the management body and the existence of an efficient flow of information between them, in order to allow the members of the management body in its supervisory function to constructively contribute to discussions and to cast their votes on a sound and well￾informed basis. 5 Committees of the management body in its supervisory function
5.1 Setting up committees
40. In accordance with Article 109(1) of Directive 2013/36/EU in conjunction with Articles 76(3),
88(2), and 95(1) of Directive 2013/36/EU, all institutions that are themselves significant, considering the individual, sub-consolidated and consolidated levels, must establish risk,

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE nomination 18 and remuneration 19 committees to advise the management body in its supervisory function and to prepare the decisions to be taken by this body. Non-significant institutions, including when they are within the scope of prudential consolidation of an institution that is significant in a sub-consolidated or consolidated situation, are not obliged to establish those committees.
41. Where no risk or nomination committee is established, the references in these guidelines to
those committees should be construed as applying to the management body in its supervisory function,taking into account the principle of proportionality as set out in Title I.
42. Institutions may, taking into account the criteria set out in Title I of these guidelines, establish
other committees (e.g. anti-money laundering/counter terrorist financing (AML/CTF), ethics, conduct and compliance committees).
43. Institutions should ensure a clear allocation and distribution of duties and tasks between
specialised committees of the management body.
44. Each committee should have a documented mandate, including the scopeof its responsibilities,
from the management body in its supervisory function and establish appropriate working procedures.
45. Committees should support the supervisory function in specific areas and facilitate the
development and implementation of a sound internal governance framework. Delegating to committees does not in any way release the management body in its supervisory function from collectively fulfilling its duties and responsibilities.
5.2 Composition of committees
46. All committees should be chaired by a non-executive member of the management body who is
able to exercise objective judgement.
47. Independent members 21 of the management body in its supervisory function should be actively
involved in committees.
48. Where committees have to be set up in accordance with Directive 2013/36/EU or national law,
they should be composed of at least three members.
18 See also the joint ESMA and EBA guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU. 19 With regard to the remuneration committee, please refer to the EBA guidelines on sound remuneration practices. 20 This section should be read in conjunction with the joint ESMA and EBA guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU. 21 As defined in Section 9.3 of the joint ESMA and EBA guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
49. Institutions should ensure, taking into account the size of the management body and the
number of independent members of the management body in its supervisory function, that committees are not composed of the same group of members that forms another committee.
50. Institutions should consider the occasional rotation of chairs and members of committees,
taking into account the specific experience, knowledge and skills that are individually or collectively required for those committees.
51. The risk and nomination committees should be composed of non-executive members of the
management body in itssupervisory function ofthe institution concerned. The audit committee should be composed in accordance with Article 41 of Directive 2006/43/EC 22 . The remuneration committee should be composed in accordance with Section 2.4.1 of the EBA guidelines on sound remuneration policies 23 .
52. In G-SIIs and O-SIIs,the nomination committee should include a majority of members who are
independent and be chaired by an independent member. In other significant institutions, determined by competent authorities or national law, the nomination committee should include a sufficient number of members who are independent; such institutions may also consider as a good practice having a chair of the nomination committee who is independent.
53. Members of the nomination committee should have, individually and collectively, appropriate
knowledge, skills and expertise concerning the selection process and suitability requirements as set out under Directive 2013/36/EU.
54. In G-SIIs and O-SIIs, the risk committee should include a majority of members who are
independent. In G-SIIs and O-SIIs the chair of the risk committee should be an independent member. In other significant institutions, determined by competent authorities or national law, the risk committee should include a sufficient number of members who are independent and the risk committee should be chaired, where possible, by an independent member. In all institutions, the chair of the risk committee should be neither the chair of the management body nor the chair of any other committee.
55. Members of the risk committee should have, individually and collectively, appropriate
knowledge, skills and expertise concerning risk management and control practices.
5.3 Committees’ processes
56. Committees should regularly report to the management body in its supervisory function.
22 Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC (OJ L 157, 9.6.2006, p. 87) as last amended by Directive 2014/56/EU of the European Parliament and of the Council of 16 April 2014. 23 EBA guidelines on sound remuneration policies under Articles 74(3) and 75(2) of Directive 2013/36/EU and disclosures under Article 450 of Regulation (EU) No 575/2013 (EBA/GL/2015/22).

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
57. Committees should interact with each other as appropriate. Without prejudice to
Paragraph 49, such interaction could take the form of cross-participation so that the chair or a member of a committee may also be a member of another committee.
58. Members of committees should engage in open and critical discussions, during which
dissenting views are discussed in a constructive manner.
59. Committees should document the agendas of committee meetings and their main results and
conclusions.
60. The risk and nomination committees should at least:
a. have access to all relevant information and data necessary to perform their role, including information and data from relevant corporate and control functions (e.g. legal, finance, human resources, IT, internal audit, risk, compliance, including information on AML/CTF compliance and aggregated information on suspicious transaction reports, and ML/TF risk factors); b. receive regular reports, ad hoc information, communications and opinions from heads of internal control functions concerning the current risk profile of the institution, its risk culture and its risk limits, as well as on any material breaches 24 , that may have occurred, with detailed information on and recommendationsfor corrective measures taken, to be taken or suggested to address them; periodically review and decide on the content,format and frequency of the information on risk to be reported to them; and
c. where necessary, ensure the properinvolvement of the internal controlfunctions and
other relevant functions (human resources, legal, finance) within their respective areas of expertise and/or seek external expert advice.
5.4 Role of the risk committee
61. Where established, the risk committee should at least:
a. advise and support the management body in its supervisory function regarding the monitoring of the institution’s overallactual and future risk strategy and risk appetite, taking into account all types of risks, to ensure that they are in line with the business strategy, objectives, corporate culture and values of the institution; b. assist the management body in its supervisory function in overseeing the implementation of the institution’s risk strategy and the corresponding limits set; 24 With regard to serious breaches in the area of AML/TF. Please refer also to the Guidelines to be issued under
Article 117(6) of Directive 2013/36/EU, specifying the manner of cooperation and information exchange between the
authorities referred to in Paragraph 5 of this article, particularly in relation to cross-border groups and in the context of identifying serious breaches of anti-money laundering rules.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
c. oversee the implementation of the strategies for capital and liquidity management as
well as for all other relevant risks of an institution, such as market, credit, operational (including legal and IT risks), and reputationalrisks, in order to assess their adequacy against the approved risk strategy and risk appetite; d. provide the management body in its supervisory function with recommendations on necessary adjustments to the risk strategy resulting from, inter alia, changes in the business model of the institution, market developments or recommendations made by the risk management function; e. provide advice on the appointment of external consultants that the supervisory function may decide to engage for advice or support; f. review a number of possible scenarios, including stressed scenarios, to assess how the institution’srisk profile would react to external and internal events; g. oversee the alignment between allmaterial financial products and services offered to clients and the business model and risk strategy of the institution 25 . The risk committee should assess the risks associated with the offered financial products and services and take into account the alignment between the prices assigned to and the profits gained from those products and services; and h. assess the recommendations of internal or external auditors and follow up on the appropriate implementation of measures taken.
62. The risk committee should collaborate with other committees whose activities may have an
impact on the risk strategy (e.g. audit and remuneration committees) and regularly communicate with the institution’s internal control functions, in particular the risk management function.
63. When established, the risk committeemust, without prejudice to the tasks of the remuneration
committee, examine whether incentives provided by the remuneration policies and practices take into consideration the institution’s risk, capital and liquidity and the likelihood and timing of earnings.
5.5 Role of the audit committee
64. In accordance with Directive 2006/43/EC 26, where established, the audit committee should,
inter alia:
25 See also the EBA guidelines on product oversight and governance arrangements for retail banking products, available at http://www.eba.europa.eu/regulation-and-policy/consumer-protection-and-financial-innovation/guidelines-on￾product-oversight-and-governance-arrangements-for-retail-banking-products. 26 Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC (OJ L 157, 9.6.2006, p. 87), as last amended by Directive 2014/56/EU of the European Parliament and of the Council of 16 April 2014.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE a. monitor the effectiveness of the institution’s internal quality control and risk management systems and, where applicable, its internal audit function, with regard to the financial reporting of the audited institution, without breaching its independence; b. oversee the establishment of accounting policies by the institution;
c. monitor the financial reporting process and submit recommendations aimed at
ensuring its integrity; d. review and monitor the independence of the statutory auditors or the audit firms in accordance with Articles 22, 22a, 22b, 24a and 24b of Directive 2006/43/EU and
Article 6 of Regulation (EU) No 537/2014 27, and in particular the appropriateness of
the provision of non-audit services to the audited institution in accordance with
Article 5 of that regulation;
e. monitor the statutory audit of the annual and consolidated financial statements, in particular its performance, taking into account any findings and conclusions by the competent authority pursuant to Article 26(6) of Regulation (EU) No 537/2014; f. be responsible for the procedure for the selection of external statutory auditor(s) or audit firm(s) and recommend for approval by the institution’s competent body their appointment (in accordance with Article 16 of Regulation (EU) No 537/2014 except when Article 16(8) of Regulation (EU) No 537/2014 is applied), compensation and dismissal; g. review the audit scope and frequency of the statutory audit of annual or consolidated accounts; h. in accordance with Article 39(6)(a) of Directive 2006/43/EU, inform the administrative or supervisory body of the audited entity of the outcome of the statutory audit and explain how the statutory audit contributed to the integrity of financial reporting and what the role of the audit committee was in that process; and
i. receive and take into account audit reports.
5.6 Combined committees
65. In accordance with Article 76(3) of Directive 2013/36/EU, competent authorities may allow
institutions that are not considered significant to combine the risk committee with, where established, the audit committee as referred to in Article 39 of Directive 2006/43/EC. 27 Regulation (EU) No 537/2014 of the European Parliament and of the Council of 16 April 2014 on specific requirements regarding statutory audit of public-interest entities and repealing Commission Decision 2005/909/EC (OJ L 158, 27.5.2014, p. 77).

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
66. Where risk and nomination committees are established in non-significant institutions, they may
combine the committees. If they do so, those institutions should document the reasons why they have chosen to combine the committees and how the approach achieves the objectives of the committees.
67. Institutions should at all times ensure that the members of a combined committee possess,
individually and collectively, the necessary knowledge, skills and expertise to fully understand the duties to be performed by the combined committee 28 . Title III – Governance framework 6 Organisational framework and structure
6.1 Organisational framework
68. The management body of an institution should ensure a suitable and transparent
organisational and operational structure for that institution and should have a written description of it. The structure should promote and demonstrate the effective and prudent management of an institution at individual, sub-consolidated and consolidated levels. The management body should ensure that the internal control functions are independent of the business lines they control, including that there is an adequate segregation of duties, and that they have the appropriate financial and human resources as well as powers to effectively perform their role. The reporting lines and the allocation of responsibilities, in particular among key function holders, within an institution should be clear, well-defined, coherent, enforceable and duly documented. The documentation should be updated as appropriate.
69. The structure of the institution should not impede the ability of the management body to
oversee and manage effectively the risks the institution or the group faces or the ability of the competent authority to effectively supervise the institution.
70. The management body should assess whether and how material changes to the group’s
structure (e.g. setting up of new subsidiaries, mergers and acquisitions, selling or winding-up parts of the group, or external developments) impact the soundness of the institution’s organisational framework. Where weaknesses are identified, the management body should make any necessary adjustments swiftly.
6.2 Know your structure
71. The management body should fully know and understand the legal, organisational and
operational structure of the institution (‘know your structure’) and ensure that it is in line with its approved business and risk strategy and risk appetite and covered by its risk management framework. 28 See also the joint ESMA and EBA guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
72. The management body should be responsible for the approval of sound strategies and policies
for the establishment of new structures. Where an institution creates many legal entities within its group, their number and, in particular, the interconnections and transactions between them should not pose challenges for the design of its internal governance, and for the effective management and oversight of the risks of the group as a whole. The management body should ensure that the structure of an institution and, where applicable, the structures within a group, taking into account the criteria specified in Section 7, are clear, efficient and transparent to the institution’s staff, shareholders and otherstakeholders and to the competent authority.
73. The management body should guide the institution’s structure, its evolution and its limitations
and should ensure that the structure is justified and efficient and does not involve undue or inappropriate complexity.
74. The management body of a consolidating institution should understand not only the legal,
organisational and operational structure of the group but also the purpose and activities of its different entities and the links and relationships among them. This includes understanding group-specific operational risks and intra-group exposures as well as how the group's funding, capital, liquidity and risk profiles could be affected under normal and adverse circumstances. The management body should ensure that the institution is able to produce information on the group in a timely manner, regarding the type, the characteristics, the organisational chart, the ownership structure and the businesses of each legal entity, and thatthe institutions within the group comply with all supervisory reporting requirements on an individual, sub-consolidated and consolidated basis.
75. The management body of a consolidating institution should ensure that the different group
entities (including the consolidating institution itself) receive enough information to get a clear perception of the general objectives, strategies and risk profile of the group and how the group entity concerned is embedded in the group’s structure and operational functioning. Such information and revisions thereof should be documented and made available to the relevant functions concerned, including the management body, business lines and internal control functions. The members of the management body of a consolidating institution should keep themselves informed about the risks the group’s structure causes, taking into account the criteria specified in Section 7 of the guidelines. This includes receiving:
a. information on major risk drivers; b. regular reports assessing the institution’s overall structure and evaluating the compliance of individual entities’ activities with the approved group-wide strategy; and
c. regular reports on topics where the regulatory framework requires compliance at
individual, sub-consolidated and consolidated levels.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
6.3 Complex structures and non-standard or non-transparent
activities
76. Institutions should avoid setting up complex and potentially non-transparent structures.
Institutions should take into account in their decision-making the results of a risk assessment performed to identify whether such structures could be used for a purpose connected with money laundering, terrorist financing or other financial crimes and the respective controls and legal framework in place 29. To this end, institutions should take into account at least:
a. the extent to which the jurisdiction in which the structure will be set up complies effectively with EU and international standards on tax transparency, anti-money laundering and countering the financing of terrorism 30; b. the extent to which the structure serves an obvious economic and lawful purpose;
c. the extent to which the structure could be used to hide the identity of the ultimate
beneficial owner; d. the extent to which the customer’s request that leads to the possible setting up of a structure gives rise to concern; e. whether the structure might impede appropriate oversight by the institution’s management body orthe institution’s ability to manage the related risk; and f. whether the structure poses obstacles to effective supervision by competent authorities.
77. In any case, institutions should not set up opaque or unnecessarily complex structures which
have no clear economic rationale or legal purpose or structures that could raise concernsthat these might be created for a purpose connected with financial crime.
78. When setting up such structures, the management body should understand them and their
purpose and the particular risks associated with them and ensure that the internal control functions are appropriately involved. Such structures should be approved and maintained only when their purpose has been clearly defined and understood, and when the management body is satisfied that all material risks, including reputational risks, have been identified, that all risks can be managed effectively and appropriately reported, and that effective oversight has been ensured. The more complex and opaque the organisational and operational structure, and the greater the risks, the more intensive the oversight of the structure should be. 29 For further details on the assessment of country risk and the risk associated with individual products and customers, institutions should refer also to the joint guidelines on ML/TF risk factors (EBA GL JC/2017/37) currently under review. 30 See also:https://eba.europa.eu/regulation-and-policy/anti-money-laundering-and-e-money/rts-on-the￾implementation-of-group-wide-aml/cft-policies-in-third-countries

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
79. Institutions should document their decisions and be able to justify their decisionsto competent
authorities.
80. The management body should ensure that appropriate actions are taken to avoid or mitigate
the risks of activities within such structures. This includes ensuring that:
a. the institution has in place adequate policies and procedures and documented processes (e.g. applicable limits, information flows) for the consideration, compliance, approval and risk management of such activities, taking into account the consequences for the group’s organisational and operational structure, its risk profile and its reputational risk; b. information concerning these activities and the risks thereof is accessible to the consolidating institution and internal and external auditors and is reported to the management body in its supervisory function and to the competent authority that granted authorisation; and
c. the institution periodically assesses the continuing need to maintain such structures.
81. These structures and activities, including their compliance with legislation and professional
standards, should be subject to regular review by the internal audit function following a risk￾based approach.
82. Institutions should take the same risk management measures as for the institution’s own
business activities when they perform non-standard or non-transparent activities for clients (e.g. helping clients to set up vehicles in offshore jurisdictions, developing complex structures, financing transactions for them or providing trustee services) that pose similar internal governance challenges and create significant operational and reputational risks. In particular, institutions should analyse the reason why a client wants to set up a particular structure. 7 Organisational framework in a group context
83. In accordance with Article 109(2) of Directive 2013/36/EU, parent undertakings and
subsidiaries subject to that directive should ensure that governance arrangements, processes and mechanisms are consistent and well integrated on a consolidated or sub-consolidated basis. To this end, parent undertakings and subsidiaries within the scope of prudential consolidation should implement such arrangements, processes and mechanisms in their subsidiaries not subject to Directive 2013/36/EU, including those established in third countries, including in offshore financial centres, to ensure robust governance arrangements on a consolidated and sub-consolidated basis. With regard to remuneration requirements some exceptions in line with Article 109 (4) and (5) apply 31 . Competent functions within the consolidating institution and its subsidiaries should interact and exchange data and information as appropriate. The governance arrangements, processes and mechanisms should ensure that 31 Please refer also to the EBA guidelines on sound remuneration policies

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE the consolidating institution has sufficient data and information and is able to assess the group￾wide risk profile, as detailed in Section 6.2.
84. The management body of a subsidiary that is subject to Directive 2013/36/EU should adopt and
implement on the individual level the group-wide governance policies established at the consolidated or sub-consolidated level, in a manner that complies with all specific requirements under EU and national law.
85. At the consolidated and sub-consolidated levels, the consolidating institution should ensure
adherence to the group-wide governance policies and internal control framework as referred to in Title V by all institutions and other entities within the scope of prudential consolidation, including their subsidiaries not themselves subject to Directive 2013/36/EU. When implementing governance policies, the consolidating institution should ensure that robust governance arrangements are in place for each subsidiary and consider specific arrangements, processes and mechanisms where business activities are organised not in separate legal entities but within a matrix of business lines that encompasses multiple legal entities.
86. A consolidating institution should consider the interests of all its subsidiaries, and how
strategies and policies contribute to the interest of each subsidiary and the interest of the group as a whole over the long term.
87. Parent undertakings and their subsidiaries should ensure that the institutions and entities
within the group comply with all specific regulatory requirements in any relevant jurisdiction.
88. The consolidating institution should ensure that subsidiaries established in third countries, and
which are included in the scope of prudential consolidation, have governance arrangements, processes and mechanisms in place that are consistent with group-wide governance policies and comply with the requirements of Articles 74 to 96 of Directive 2013/36/EU and these guidelines, as long as this is not unlawful under the laws of the third country.
89. The governance requirements of Directive 2013/36/EU and provisions in these guidelines apply
to institutions independent of the fact that they may be subsidiaries of a parent undertaking in a third country. Where an EU subsidiary of a parent undertaking in a third country is a consolidating institution, the scope of prudential consolidation does not include the level of the parent undertaking located in a third country and other direct subsidiaries of that parent undertaking. The consolidating institution should ensure that the group-wide governance policy of the parent institution in a third country is taken into consideration within its own governance policy insofar as this is not contrary to the requirements set out under relevant EU law, including Directive 2013/36/EU and the further specifications in these guidelines.
90. When establishing policies and documenting governance arrangements, institutions should
take into account the aspects listed in Annex I to the guidelines. While policies and documentation may be included in separate documents, institutions should consider combining them or referring to them in a single governance framework document.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE 8 Outsourcing policy 32
91. The management body should approve and regularly review and update the outsourcing policy
of an institution, ensuring that appropriate changes are implemented in a timely manner.
92. The outsourcing policy should consider the impact of outsourcing on an institution’s business
and the risks it faces (such as operational risks, including legal and IT risks; reputational risks; and concentration risks). The policy should include the reporting and monitoring arrangements to be implemented from inception to the end of an outsourcing agreement (including drawing up the business case for outsourcing, entering into an outsourcing contract, the implementation of the contract to its expiry, contingency plans and exit strategies). An institution remains fully responsible for all outsourced services and activities and management decisions arising from them. Accordingly, the outsourcing policy should make it clear that outsourcing does not relieve the institution of its regulatory obligations and its responsibilities to its customers.
93. The policy should state that outsourcing arrangements should not hinder effective on-site or
off-site supervision of the institution and should not contravene any supervisory restrictions on services and activities. The policy should also cover intragroup outsourcing (i.e. services provided by a separate legal entity within an institution’s group) and take into account any specific group circumstances. Title IV – Risk culture and business conduct 9 Risk culture
94. A sound, diligent and consistent risk culture should be a key element of institutions’ effective
risk management and should enable institutions to make sound and informed decisions.
95. Institutions should develop an integrated and institution-wide risk culture, based on a full
understanding and holistic view of the risks they face and how they are managed, taking into account the institution’s risk appetite.
96. Institutions should develop a risk culture through policies, communication and staff training
regarding the institutions’ activities, strategy and risk profile, and should adapt communication and staff training to take into account staff’s responsibilities regarding risk-taking and risk management.
97. Staff should be fully aware of their responsibilities relating to risk management. Risk
management should not be confined to risk specialists or internal control functions. Business units, under the oversight of the management body, should be primarily responsible for 32 See also: EBA Guidelines on outsourcing arrangements available at: https://www.eba.europa.eu/regulation-and￾policy/internal-governance/guidelines-on-outsourcing-arrangements

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE managing risks on a day-to-day basis in line with the institution’s policies, procedures and controls, taking into account the institution’s risk appetite and risk capacity.
98. A strong risk culture should include but is not necessarily limited to:
a. Tone from the top: the management body should be responsible for setting and communicating the institution’s core values and expectations. The behaviour of its members should reflect the values. Institutions’ management, including key function holders, should contribute to the internal communication of core values and expectations to staff. Staff should act in accordance with all applicable laws and regulations and promptly escalate observed non-compliance within or outside the institution (e.g. to the competent authority through a whistleblowing process). The management body should on an ongoing basis promote, monitor and assess the risk culture of the institution; consider the impact of the risk culture on the financial stability, risk profile and robust governance of the institution; and make changes where necessary. b. Accountability: relevant staff at all levels should know and understand the core values of the institution and, to the extent necessary for their role, its risk appetite and risk capacity. They should be capable of performing their roles and be aware that they will be held accountable for their actions in relation to the institution’s risk-taking behaviour.
c. Effective communication and challenge: a sound risk culture should promote an
environment of open communication and effective challenge in which decision￾making processes encourage a broad range of views, allow for testing of current practices, stimulate a constructive critical attitude among staff, and promote an environment of open and constructive engagement throughout the entire organisation. d. Incentives: appropriate incentives should play a key role in aligning risk-taking behaviour with the institution’s risk profile and its long-term interest 33 . 10 Corporate values and code of conduct
99. The management body should develop, adopt, adhere to and promote high ethical and
professional standards, taking into account the specific needs and characteristics of the institution, and should ensure the implementation of such standards (through a code of conduct or similar instrument). It should also oversee adherence to these standards by staff. Where applicable, the management body may adopt and implement the institution’s group￾wide standards or common standardsreleased by associations or other relevant organisations. 33 Please refer also to the EBA guidelines on sound remuneration policies under Articles 74(3) and 75(2) of Directive 2013/36/EU and disclosures under Article 450 of Regulation (EU) No 575/2013 (EBA/GL/2015/22), available at https://www.eba.europa.eu/regulation-and-policy/remuneration.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
100. Institutions should ensure that there is no discrimination of staff based on gender, race,
colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation.
101. Institution’s policies should be gender neutral. This includes, but is not limited to
remuneration, recruitment policies, career development and succession plans, access to training and ability to apply for internal vacancies. Institutions should ensure equal opportunities 34 for all staff independent of their genders, including with regard to career perspectives and aim to improve the representation of the underrepresented gender in positions within the management body as well as in the group of staff that have managerial responsibilities as defined in the Commission’s Delegated Regulation (regulatory technical standards (RTS) on identified staff). 35 Institutions should monitor the development of the gender pay gap separately for identified staff (excluding members of the management body), members of the management body in its management function, members of the management body in the supervisory function and other staff. Institutions should havepolicies that facilitate the reintegration of staff after maternity, paternity or parental leave.
102. The implemented standards should aim at enhancing the institution’s robust governance
arrangements and reducing the risks to which the institution is exposed, in particular operational and reputational risks, which can have a considerable adverse impact on an institution’s profitability and sustainability through fines, litigation costs, restrictions imposed by competent authorities, other financial and criminal penalties, and the loss of brand value and consumer confidence.
103. The management body should have clear and documentedpolicies for how these standards
should be met. These policies should:
a. remind staffthat all the institution’s activities should be conducted in compliance with the applicable law and with the institution’s corporate values; b. promote risk awareness through a strong risk culture in line with Section 9 of the guidelines, conveying the management body’s expectation that activities will not go beyond the defined risk appetite and limits defined by the institution and the respective responsibilities of staff;
c. set out principles on and provide examples of acceptable and unacceptable behaviours
linked in particular to financial misreporting and misconduct, economic and financial crime including but not limited to fraud, money laundering and terrorist financing (ML/TF), anti-trust practices, financial sanctions, bribery and corruption, market manipulation, mis-selling and other violations of consumer protection laws, tax 34 See also Directive 2006/54/EC of the European Parliament and of the Council of 5 July 2006 on the implementation of the principle of equal opportunities and equal treatment of men and women in matters of employment and occupation 35 See also EBA Guidelines on gender neutral remuneration policies

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE offences, whether committed directly or indirectly, including through unlawful or banned dividend arbitrage schemes; d. clarify that in addition to complying with legal and regulatory requirements and internal policies, staff are expected to conduct themselves with honesty and integrity and perform their duties with due skill, care and diligence; and e. ensure that staff are aware of the potential internal and external disciplinary actions, legal actions and sanctions that may follow misconduct and unacceptable behaviours.
104. Institutions should monitor compliance with such standards and ensure staff awareness,
e.g. by providing training. Institutions should define the function responsible for monitoring compliance with and evaluating breaches of the code of conduct or similar instrument and a process for dealing with issues of non-compliance. The results should periodically be reported to the management body. 11 Conflict of interest policy at institutional level
105. The management body should be responsible for establishing, approving and overseeing
the implementation and maintenance of effective policies to identify, assess, manage and mitigate or prevent actual and potential conflicts of interest at institutional level, e.g. as a result of the various activities and roles of the institution, of different institutions within the scope of prudential consolidation or of different business lines or units within an institution, or with regard to external stakeholders.
106. Institutions should take, within their organisational and administrative arrangements,
adequate measures to prevent conflicts of interest from adversely affecting the interests of its clients.
107. Institutions’ measures to manage or, where appropriate, mitigate conflicts of interest
should be documented and include, inter alia:
a. an appropriate segregation of duties, e.g. entrusting conflicting activities within the processing of transactions or when providing services to different persons, or entrusting supervisory and reporting responsibilities for conflicting activities to different persons; b. establishing information barriers, e.g. through the physical separation of certain businesslines or units.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE 12 Conflict of interest policy for staff 36
108. The management body should be responsible for establishing, approving and overseeing
the implementation and maintenance of effective policies to identify, assess, manage and mitigate or prevent actual and potential conflicts between the interests of the institution and the private interests of staff, including members of the management body, which could adversely influence the performance of their duties and responsibilities. A consolidating institution should consider interests within a group-wide conflict of interest policy on a consolidated or sub-consolidated basis.
109. The policy should aim at identifying conflicts of interest of staff, including the interests of
their closest family members. Institutions should take into consideration that conflicts of interest may arise not only from present but also from past personal or professional relationships. Where conflicts of interest arise, institutions should assess their materiality and decide on and implementmitigating measures, as appropriate.
110. Regarding conflicts of interest that may result from past relationships, institutions should
set an appropriate timeframe for which they want staff to report such conflicts of interest, on the basis that these may still have an impact on staff’s behaviour and participation in decision￾making.
111. The policy should cover at least the following situations or relationships where conflicts of
interestmay arise:
a. economic interests (e.g. shares, other ownership rights and memberships, financial holdings and other economic interests in commercial customers, intellectual property rights, loans granted by the institution to a company owned by staff, membership in a body or ownership of a body or entity with conflicting interests); b. personal or professional relationships with the owners of qualifying holdings in the institution;
c. personalor professional relationships with staff of the institution or entities included
within the scope of prudential consolidation (e.g. family relationships); d. other employment and previous employment within the recent past (e.g. five years); e. personal or professional relationships with relevant external stakeholders (e.g. being associated with material suppliers, consultancies or other service providers); and f. political influence or political relationships. 36 This section should be read in conjunction with the joint ESMA and EBA guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
112. Notwithstanding the above, institutions should take into consideration that being a
shareholder of an institution or having private accounts or loans with or using other services of an institution should not lead to a situation where staff are considered to have a conflict of interest if they stay within an appropriate de minimis threshold.
113. The policy should set out the processes for reporting and communication to the function
responsible under the policy. Staff should have the duty to promptly disclose internally any matter that may result, or has already resulted, in a conflict of interest.
114. The policy should differentiate between conflicts of interest that persist and need to be
managed permanently and conflicts of interest that occur unexpectedly with regard to a single event (e.g. a transaction, the selection of service provider, etc.) and can usually be managed with a one-off measure. In all circumstances,the interest of the institution should be central to the decisions taken.
115. The policy should set out procedures, measures, documentation elements and
responsibilities for the identification and prevention of conflicts of interest, for the assessment of their materiality and for taking mitigating measures. Such procedures, elements , responsibilities and measures should include:
a. entrusting conflicting activities or transactions to different persons; b. preventing staff who are also active outside the institution from having inappropriate influence within the institution regarding those other activities;
c. establishing the responsibility of the members of the management body to abstain
from voting on any matter where a member has or may have a conflict of interest or where the member’s objectivity or ability to properly fulfil duties to the institutionmay be otherwise compromised; d. preventing members of the management body from holding directorships in competing institutions, unless they are within institutions that belong to the same institutional protection scheme, as referred to in Article 113(7) of Regulation (EU) No 575/2013, credit institutions permanently affiliated to a central body, as referred to in Article 10 of Regulation (EU) No 575/2013, or institutions within the scope of prudential consolidation.
116. The policy should specifically cover the risk of conflicts of interest at the level of the
management body and provide sufficient guidance on the identification and management of conflicts of interest that may impede the ability of members of the management body to take objective and impartial decisions that aim to fulfil the best interests of the institution.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Institutions should take into consideration that conflicts of interest can have an impact on the independence of mind of members of the management body 37 .
117. When mitigating identified conflicts of interests of members of the management body,
institutions should document the measures taken, including the reasoning on how those are effective to ensure objective decision-making.
118. Actual or potential conflicts of interest that have been disclosed to the responsible function
within the institution should be appropriately assessed and managed. If a conflict of interest of staff is identified, the institution should document the decision taken, in particularif the conflict of interest and the related risks have been accepted, and if it has been accepted, how this conflict of interest has been satisfactorily mitigated or remedied.
119. All actual and potential conflicts of interest at management body level, individually and
collectively, should be adequately documented, communicated to the management body, and discussed, decided on and duly managed by the management body.
12.1 Conflict of interest policy in the context of loans and other
transactions with members of the management body and their related parties
120. As part of their conflicts of interest policies for staff (Section 12) and the management of
conflicts of interest of members of the management body as set out in Paragraph 117, the management body should set out a framework for identifying and managing conflicts of interest in the context of granting loans and entering into other transactions (e.g. factoring, leasing, property transactions, etc.) with members of the management body and their related parties.
121. Without prejudice to the nationaltransposition of Directive 2013/36/EU 38, institutions may
consider additional categories of related parties to whom they apply, in whole or in part, the ir conflicts of interest framework regarding loans and other transactions.
122. The conflicts of interestframework should ensure that decisions regarding the granting of
loans and entering into other transactions with members of the management body and their related parties are taken objectively, without undue influence by conflicts of interests and are as a general principle conducted at arm’s length.
123. The management body should set out the applicable decision-making processes for
granting loans to and entering into other transactions with members of the management body and their related parties. This framework may provide for a differentiation between standard 37See also the joint ESMA and EBA guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU. 38 Please also refer to Basel Core Principle 20

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE business transactions 39 entered into in the ordinary course of business and concluded on normal market terms and staff loans and transactions, which are concluded on conditions available to all staff. Furthermore, the conflicts of interest framework and decision-making process may differentiate between material and non-material loans and other transactions, different types of loans and other transactions and the level of actual or potential conflicts of interest they may create.
124. As part of the conflicts of interest framework, the management body should set
appropriate thresholds (e.g. per product type, or depending on the conditions) above which the loan or other transaction with a member of the management body or its related parties always requires the approval by the management body. Decisions on material loans or other material transactions with members of the management body that are not being concluded under normal market terms, but on conditions available to all staff, should always be made by the management body.
125. The member of the management body benefitting from such a material loan or other
material transaction or the member who is related to the counterparty, should not be involved in the decision-making.
126. When deciding on a loan or other transaction with a member of the management body or
their related parties, before taking a decision, institutions should assess the risk to which the institution might be exposed due to the transaction.
127. Where loans are arranged as a line of credit (e.g. overdrafts), the initial decision and
amendments thereof should be documented. Any use of such agreed credit facilities within the agreed limits should not be considered as a new decision on a loan to a member of the management body or their related party. Where an amendment of a line of credit is material in line with the institution’s policy, a new assessment and decision should be made.
128. To ensure compliance with their conflict of interest policies, institutions should ensure that
all relevant internal control procedures fully apply to loans and to other transactions with members of the management body or their related parties and that an appropriate oversight framework is in place at the level of the management body in its supervisory function.
12.2 Documentation of loans to members of the management
body and their related parties and additional information
129. For the purpose of Article 88(1) of Directive 2013/36/EU, institutions should document
data on loans 40 to members of the management body and their related parties properly, including at least:
39 Business transactions include loans and other transactions (e.g. leasing, factoring, services in the context of initial public offerings (IPOs), mergers and acquisitions, selling and buying property). 40 See also EBA Guidelines on loan origination, available under: https://eba.europa.eu/regulation-and-policy/credit￾risk/guidelines-on-loan-origination-and-monitoring

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE a. the name of the debtor and theirstatus (i.e. member of the management body or related party) and regarding loans to a related party, the member of the management body to whom the party is related and the nature of the relationship to the related party; b. the type/nature of loan and the amount;
c. the terms and conditions applicable to the loan;
d. the date of approval of the loan; e. the name of the individual or body and its composition taking the decision to approve the loan and the applicable conditions; f. the fact (yes/no) as to whether or not the loan has been granted at market conditions; and g. the fact (yes/no) as to whether or not the loan has been granted at conditions available to all staff.
130. Institutions should ensure that the documentation of all loans to members of the
management body and their related parties is complete and updated and that the institution is able to make available to competent authorities the complete documentation in an appropriate format upon request without undue delay.
131. For a loan to a member of the management body or their related parties above an amount
of EUR 200 000, institutions should be able to provide to the competent authority upon request the following additional information:
a. the percentage of the loan and the percentage of the sum of all outstanding amounts of loans towards the same debtor compared to:
i. the sum of its Tier 1 capital and Tier 2 capital and
ii. common equity Tier-1 capital of the institution;
b. whether the loan is part of a large exposure 41; and
c. the relative weight of the aggregated sum of all outstanding amounts of loans
towards the same debtor, calculated as a percentage by dividing the total outstanding amount by the total amount of all outstanding loans to members of the management body and their related parties. 13 Internal alert procedures
132. Institutions should put in place and maintain appropriate internal alert policies and
procedures for staff to report potential or actual breaches of regulatory or internal requirements, including, but not limited to, those of Regulation (EU) No 575/2013 and national 41 See also Part IV of Regulation (EU) No 575/2013 and in particular Article 392.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE provisions transposing Directive 2013/36/EU, or of internal governance arrangements, through a specific, independent and autonomous channel. It should not be necessary for reporting staff to have evidence of a breach; however, they should have a sufficient level of certainty that provides sufficient reason to launch an investigation. Institutions should also implement appropriate processes and procedures that ensure that they comply with their obligations under the national implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.
133. To avoid conflicts of interest, it should be possible for staff to report breaches outside
regular reporting lines (e.g. through the compliance function,the internal audit function or an independent internal whistleblowing procedure). The alert procedures should ensure the protection of the personal data of both the person who reports the breach and the natural person who is allegedly responsible for the breach, in accordance with Regulation (EU) 2016/679 42 (GDPR).
134. The alert procedures should be made available to all staff within an institution.
135. Information provided by staff through the alert proceduresshould, if appropriate, be made
available to the management body and other responsible functions defined within the internal alert policy. Where required by the staff member reporting a breach, the information should be provided to the management body and other responsible functions in an anonymised way. Institutions may also provide for a whistleblowing process that allows information to be submitted in an anonymised way.
136. Institutionsshould ensure that the person reporting the breach is appropriately protected
from any negative impact, e.g. retaliation, discrimination or other types of unfair treatment. The institution should ensure that no person under the institution’s control engages in victimisation of a person who has reported a breach and should take appropriate measures against those responsible for any such victimisation.
137. Institutionsshould also protect persons who have been reported from any negative effects
in case the investigation finds no evidence that justifies taking measures against that person. If measures are taken, the institution should take themin a way that aims to protect the person concerned from unintended negative effects that go beyond the objective of the measure taken.
138. In particular, internal alert procedures should:
a. be documented (e.g. staff handbooks); b. provide clear rules that ensure that information on the reporting and the reported persons and the breach are treated confidentially, in accordance with Regulation (EU) 42 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE 2016/679, unless disclosure is required under national law in the context of further investigations or subsequent judicial proceedings;
c. protect staff who raise concerns from being victimised because they have disclosed
reportable breaches; d. ensure that the potential or actual breaches raised are assessed and escalated, including as appropriate to the relevant competent authority or law enforcement agency; e. ensure, where possible, that confirmation of receipt of information is provided to staff who have raised potential or actual breaches; f. ensure the tracking ofthe outcome of an investigation into a reported breach; and g. ensure appropriate record keeping. 14 Reporting of breaches to competent authorities
139. Competent authorities should establish effective and reliable mechanisms to enable
institutions’ staff to report to competent authorities relevant potential or actual breaches of regulatory requirements, including, but not limited to, those of Regulation (EU) No 575/2013 and national provisions transposing Directive 2013/36/EU. These mechanisms should include at least:
a. specific procedures for the receipt of reports on breaches and follow-up, for instance a dedicated whistleblowing department, unit or function; b. appropriate protection as referred to in Section 13;
c. protection of the personal data of both the natural person who reports the breach and
the natural person who is allegedly responsible for the breach, in accordance with Regulation (EU) 2016/679 (GDPR); and d. clear procedures as set out in Section 13.
140. Without prejudice to the possibility of reporting breaches through the competent
authorities’ mechanisms, competent authorities may encourage staff to first try and seek to use their institutions’ internal alert procedures.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Title V – Internal control framework and mechanisms 15 Internal control framework
141. Institutions should develop and maintain a culture that encourages a positive attitude
towards risk control and compliance within the institution and a robust and comprehensive internal control framework. Under this framework, institutions’ business lines should be responsible for managing the risks they incur in conducting their activities and should have controls in place that aim to ensure compliance with internal and external requirements. As
part of this framework, institutions should have internal control functions with appropriate and
sufficient authority, stature and access to the management body to fulfil their mission, and a risk management framework.
142. The internal control framework of institutions should be adapted on an individual basis to
the specificity of its business, its complexity and the associated risks, taking into account the group context. Institutions should organise the exchange of the necessary information in a manner that ensures that each management body, business line and internal unit, including each internal control function, is able to carry out its duties. This means, for example, a necessary exchange of adequate information between the business lines and the compliance function and the AML/CFT compliance function where it is a separate control function, at the group leveland between the heads of the internal control functions at the group level and the management body of the institution.
143. Institutions should implement appropriate processes and procedures that ensure that they
comply with their obligations in the context of combating money laundering and terrorist financing. Institutions should assess their exposure to the risk that they may be used for the purpose of ML/TF and, where necessary,take mitigating measures to reduce those risks as well as their operational and reputational risks linked to them. Institutions should take measures to ensure that their staff is aware of such ML/TF risks and the impact that ML/TF has on the institution and the integrity of the financial system.
144. The internal control framework should cover the whole organisation, including the
management body’s responsibilities and tasks, and the activities of all business lines and internal units, including internal control functions, outsourced activities and distribution channels.
145. The internal control framework of an institution should ensure:
a. effective and efficient operations; b. prudent conduct of business;
c. adequate identification, measurement and mitigation of risks;

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE d. the reliability of financial and non-financial information reported both internally and externally; e. sound administrative and accounting procedures; and f. compliance with laws, regulations, supervisory requirements and the institution’s internal policies, processes,rules and decisions. 16 Implementing an internal control framework
146. The management bodyshould be responsible for establishing and monitoring the adequacy
and effectiveness of the internal control framework, processes and mechanisms, and for overseeing all businesslines and internalunits, including internal control functions(such as risk management, compliance, AML/CFT compliance, where separate from the compliance function, and internal audit functions). Institutions should establish, maintain and regularly update adequate written internal control policies, mechanisms and procedures, which should be approved by the management body.
147. An institution should have a clear, transparent and documented decision-making process
and a clear allocation of responsibilities and authority within its internal control framework, including its business lines, internal units and internal control functions.
148. Institutions should communicate those policies, mechanisms and procedures to all staff
and every time material changes have been made.
149. When implementing the internal control framework, institutions should establish adequate
segregation of duties – e.g. entrusting conflicting activities within the processing of transactions or when providing services to different persons, or entrusting supervisory and reporting responsibilities for conflicting activities to different persons – and establish information barriers, e.g. through the physical separation of certain departments.
150. The internal control functions should verify that the policies, mechanisms and procedures
set out in the internal control framework are correctly implemented in their respective areas of competence.
151. Internal control functions should regularly submit to the management body written reports
on major identified deficiencies. These reports should include, for each new identified major deficiency, the relevant risks involved, an impact assessment, recommendations and corrective measures to be taken. The management body should follow up on the findings of the internal control functions in a timely and effective manner and require adequate remedial actions. A formal follow-up procedure on findings and corrective measures taken should be put in place.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE 17 Risk management framework
152. As part of the overall internal control framework, institutions should have a holistic
institution-wide risk management framework extending across all its business lines and internal units, including internal control functions, recognising fully the economic substance of all its risk exposures. The risk management framework should enable the institution to make fully informed decisions on risk-taking. The risk management framework should encompass on- and off-balance-sheet risks as well as actual risks and future risks that the institution may be exposed to. Risks should be evaluated from the bottom up and from the top down, within and across business lines, using consistent terminology and compatible methodologies throughout the institution and at consolidated or sub-consolidated level. All relevant risks should be encompassed in the risk management framework with appropriate consideration of both financial and non-financial risks, including credit, market, liquidity, concentration, operational, IT, reputational, legal, conduct, compliance with AML/CTF and other financial crime, ESG, and strategic risks.
153. An institution’s risk management framework should include policies, procedures, risk limits
and risk controls ensuring adequate, timely and continuous identification, measurement or assessment, monitoring, management, mitigation and reporting of the risks at the business line, institution and consolidated or sub-consolidated levels.
154. An institution’s risk management framework should provide specific guidance on the
implementation of its strategies. This guidance should, where appropriate, establish and maintain internal limits consistent with the institution’s risk appetite and commensurate with its sound operation, financial strength, capital base and strategic goals. An institution’s risk profile should be kept within these established limits. The risk management framework should ensure that, whenever breaches of risk limits occur, there is a defined process to escalate and address them with an appropriate follow-up procedure.
155. The risk management framework should be subject to independent internal review, e.g.
performed by the internal audit function, and reassessed regularly against the institution’s risk appetite, taking into account information from the risk management function and, where established, the risk committee. Factors that should be considered include internal and external developments, including balance-sheet and revenue changes; any increase in the complexity of the institution's business, risk profile or operating structure; geographic expansion; mergers and acquisitions; and the introduction of new products or business lines.
156. When identifying and measuring or assessing risks, an institution should develop
appropriate methodologies including both forward-looking and backward-looking tools. The methodologies should allow for the aggregation of risk exposures across business lines and support the identification of risk concentrations. The tools should include the assessment of the actual risk profile against the institution’s risk appetite, as well as the identification and assessment of potential and stressed risk exposures under a range of assumed adverse circumstances against the institution’s risk capacity. The tools should provide information on

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE any adjustment to the risk profile that may be required. Institutions should make appropriately conservative assumptions when building stressed scenarios.
157. Institutions should take into consideration that the results of quantitative assessment
methodologies, including stress testing, are highly dependent on the limitations and assumptions of the models (including the severity and duration of the shock and the underlying risks). For example, models showing very high returns on economic capital may result from a weakness in the models (e.g. the exclusion of some relevant risks) rather than a superior strategy or excellent execution of a strategy on the part of the institution. The determination of the level of risk taken should not therefore be based only on quantitative information or model outputs;itshould also comprise a qualitative approach (including expert judgement and critical analysis). Relevant macroeconomic environmentaltrends and data should be explicitly addressed to identify their potential impact on exposures and portfolios.
158. The ultimate responsibility for risk assessment lies solely with the institution, which,
accordingly, should evaluate its risks critically and should not rely exclusively on external assessments. For example, an institution should validate a purchased risk model and calibrate it to its own individual circumstances to ensure that the model accurately and comprehensively captures and analyses the risk.
159. Institutions should be fully aware of the limitations of models and metrics and use not only
quantitative but also qualitative risk assessment tools (including expert judgement and critical analysis).
160. In addition to the institutions’ own assessments, institutions may use external risk
assessments (including external credit ratings or externally purchased risk models). Institutions should be fully aware of the exact scope of such assessments and their limitations.
161. Regular and transparent reporting mechanisms should be established so that the
management body, its risk committee, where established,and all relevant units in an institution are provided with reports in a timely, accurate, concise, understandable and meaningful manner and can share relevant information about the identification, measurement or assessment, monitoring and management of risks. The reporting framework should be well defined and documented.
162. Effective communication and awareness regarding risks and the risk strategy is crucial for
the whole risk management process, including the review and decision-making processes, and helps prevent decisions that may unknowingly increase risk. Effective risk reporting involves sound internal consideration and communication of risk strategy and relevant risk data (e.g. exposures and key risk indicators), both horizontally across the institution and up and down the management chain.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE 18 New products and significant changes 43
163. An institution should have in place a well-documented new product approval policy (NPAP),
approved by the management body, that addresses the development of new markets, products and services, and significant changes to existing ones, as well as exceptional transactions. The policy should in addition encompass material changes to related processes (e.g. new outsourcing arrangements) and systems (e.g. IT change processes). The NPAP should ensure that approved products and changes are consistent with the risk strategy and risk appetite of the institution and the corresponding limits of the institution, or that necessary revisions are made.
164. Material changes or exceptional transactions may include mergers and acquisitions,
including the potential consequences of conducting insufficient due diligence that fails to identify post-merger risks and liabilities; setting up structures (e.g. new subsidiaries or single￾purpose vehicles; new products; changes to systems or the risk management framework or procedures; and changes to the institution’s organisation.
165. An institution should have specific procedures for assessing compliance with thesepolicies,
taking into account the input ofthe risk management function. This should include a systematic prior assessment and documented opinion by the compliance function for new products or significant changes to existing products.
166. An institution’s NPAP should cover every consideration to be taken into account before
deciding to enter new markets, deal in new products, launch a new service, or make significant changes to existing products or services. The NPAP should also include the definitions of ‘new product/market/business’ and ‘significant changes’ to be used in the organisation and the internal functions to be involved in the decision-making process.
167. The NPAP should set out the main issues to be addressed before a decision is made. These
should include regulatory compliance; accounting; pricing models; the impact on risk profile, capital adequacy and profitability; the availability of adequate front, back and middle office resources; and the availability of adequate internal tools and expertise to understand and monitor the associated risks. Furthermore, to comply with obligations under Directive (EU) 2015/849, institutions should identify and assess the ML/TF risk associated with the new product or business practice, and set out the measures to take to mitigate those risks. The decision to launch a new activity should clearly state the business unit and individuals responsible for it. A new activity should not be undertaken until adequate resources to understand and manage the associated risks are available.
168. The risk management function and the compliance function should be involved in
approving new products or significant changes to existing products, processes and systems. 43 See also the EBA guidelines on product oversight and governance requirements for manufacturers and distributors of retail banking products, available at https://www.eba.europa.eu/-/eba-publishes-final-product-oversight-and￾governance-requirements-for-manufactures-and-distributors-of-retail-banking-products.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Their input should include a full and objective assessment of risks arising from new activities under a variety of scenarios, of any potential shortcomings in the institution’s risk management and internal control frameworks, and of the institution’s ability to manage any new risks effectively. The risk management function should also have a clear overview of the roll-out of new products (or significant changes to existing products, processes and systems) across different business lines and portfolios, and the power to require that changes to existing products go through the formal NPAP process. 19 Internal control functions
169. The internal control functions should include a risk management function (see Section 20),
a compliance function (see Section 21) and an internal audit function (see Section 22). The risk management and compliance functions should be subject to review by the internal audit function. The responsibilities of control functions also include to ensure compliance with AML/CTF requirements.
170. The operational tasks of the internal control functions may be outsourced, taking into
account the proportionality criteria listed in Title I, to the consolidating institution or another entity within or outside of the group with the consent of the management bodies of the institutions concerned. Even when internal control operational tasks are partially or fully outsourced, the head of the internal control function concerned and the management body are still responsible for these activities and for maintaining an internal control function within the institution.
171. Without prejudice to national law implementing Directive 2015/849/EU, institutions
should assign the responsibility for ensuring the institution’s compliance with the requirements of that directive and the institution’s policies and procedures to a staff member (e.g. head of compliance). Institutions may establish a separate AML/TF compliance function as an independent control function. 44 The person responsible for AML/CTF should, where necessary, be able to directly report to the management body in its management and its supervisory function.
19.1 Heads of the internal control functions
172. Heads of internal control functionsshould be established at an adequate hierarchical level
that provides the head of the control function with the appropriate authority and stature needed to fulfil his or her responsibilities. Notwithstanding the overall responsibility of the management body, heads of internal control functions should be independent of the business lines or units they control. To this end, the heads of the risk management, compliance and internal audit functions should report and be directly accountable to the management body, and theirperformance should be reviewed by the management body. 44 Please refer also to the EBA Guidelines on the AML/CTF compliance function (currently under development)

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
173. Where necessary, the heads of internal control functions should be able to have access and
report directly to the management body in its supervisory function to raise concerns and warn the supervisory function, where appropriate, when specific developments affect or may affect the institution. This should not prevent the heads of internal control functionsfrom reporting within the regular reporting lines as well.
174. Institutions should have documented processes in place to assign the position of the head
of an internal control function and for withdrawing his or her responsibilities. In any case, the heads of internal control functions should – and under Article 76(5) of Directive 2013/36/EU the head of the risk management function must – not be removed withoutthe prior approval of the management body in its supervisory function. In significant institutions, competent authorities should be promptly informed about the approval and the main reasons for the removal of a head of an internal control function.
19.2 Independence of internal control functions
175. In order for the internal control functions to be regarded as independent, the following
conditions should be met:
a. their staff do not perform any operational tasks that fall within the scope of the activities the internal control functions are intended to monitor and control; b. they are organisationally separate from the activities they are assigned to monitor and control;
c. notwithstanding the overall responsibility of members of the management body for
the institution, the head of an internal control function should not be subordinate to a person who has responsibility for managing the activities the internal control function monitors and controls; and d. the remuneration of the internal control functions staff should not be linked to the performance of the activities the internal control function monitors and controls, and not otherwise likely to compromise their objectivity 45 .
19.3 Combination of internal control functions
176. Taking into account the proportionality criteria set out in Title I, the risk management
function and compliance function may be combined. The internal audit function should not be combined with another internal control function.
19.4 Resources of internal control functions
45 See also the EBA guidelines on sound remuneration policies, available at https://www.eba.europa.eu/regulation-and￾policy/remuneration/guidelines-on-sound-remuneration-policies.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
177. Internal control functions should have sufficient resources. They should have an adequate
number of qualified staff (both at parent level and at subsidiary level). Staff should remain qualified on an ongoing basis and should receive training as necessary.
178. Internal control functions should have appropriate IT systems and support at their disposal,
with access to the internal and external information necessary to meet their responsibilities. They should have access to all necessary information regarding all business lines and relevant risk-bearing subsidiaries, in particular those that can potentially generate material risks for the institutions. 20 Risk management function
179. Institutions should establish a risk management function (RMF) covering the whole
institution. The RMF should have sufficient authority, stature and resources, taking into account the proportionality criteria listed in Title I, to implement risk policies and the risk management framework as set out in Section 17.
180. The RMF should have, where necessary, direct access to the management body in its
supervisory function and its committees, where established, including in particular the risk committee.
181. The RMF should have access to all business lines and other internal units that have the
potential to generate risk, as well as to relevant subsidiaries and affiliates.
182. Staff within the RMF should possess sufficient knowledge, skills and experience in relation
to risk management techniques and procedures, and markets and products, and should have access to regular training.
183. The RMF should be independent of the business lines and units whose risks it controls but
should not be prevented from interacting with them. Interaction between the operational functions and the RMF should help to achieve the objective of all the institution’s staff bearing responsibility for managing risk.
184. The RMF should be a central organisational feature of the institution, structured so that it
can implement risk policies and control the risk management framework. The RMF should play a key role in ensuring that the institution has effective risk management processes in place. The RMF should be actively involved in all material risk management decisions.
185. Significant institutions may consider establishing dedicated RMFs for each material
business line. However, there should be a central RMF, including a group RMF in the consolidating institution,to deliver an institution- and group-wide holistic view on all risks and to ensure that the risk strategy is complied with.
186. The RMF should provide relevant independent information, analyses and expert judgement
on risk exposures, and advice on proposals and risk decisions made by businesslines or internal

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE units, and should inform the management body as to whether they are consistent with the institution’s risk strategy and risk appetite. The RMF may recommend improvements to the risk management framework and corrective measures to remedy breaches of risk policies, procedures and limits.
20.1 RMF’s role in risk strategy and decisions
187. The RMF should be actively involved at an early stage in elaborating the institution’s risk
strategy and in ensuring that the institution has effective risk management processes in place. The RMF should provide the management body with all relevant risk-related information to enable it to set the institution’s risk appetite level. The RMF should assess the robustness and sustainability of the risk strategy and appetite. It should ensure that the risk appetite is appropriately translated into specific risk limits. The RMF should also assess the risk strategies and risk appetite of business units, including targets proposed by the business units, and should be involved before a decision is made by the management body concerning the risk strategies and risk appetite. Targets should be plausible and consistent with the institution’s risk strategy.
188. The RMF’s involvement in decision-making processes should ensure that risk
considerations are taken into account appropriately. However, accountability for the decisions taken should remain with the business and internal units, and ultimately the management body.
20.2 RMF’s role in material changes
189. In line with Section 18, before decisions on material changes or exceptional transactions
are taken, the RMF should be involved in the evaluation of the impact of such changes and exceptional transactions on the institution’s and group’s overall risk, and should report its findings directly to the management body before a decision is taken.
190. The RMF should evaluate how risks identified could affect the institution’s or group’s ability
to manage its risk profile, its liquidity and its sound capital base under normal and adverse circumstances.
20.3 RMF’s role in identifying, measuring, assessing,
managing, mitigating, monitoring and reporting risks
191. The RMF should ensure that there is an appropriate risk management framework and that
all risks are identified, assessed, measured, monitored, managed and properly reported on by the relevant units in the institution.
192. The RMF should ensure that identification and assessment are not based only on
quantitative information or model outputs, but also take into account qualitative approaches. The RMF should keep the management body informed of the assumptions used in and potential shortcomings of the risk models and analysis.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
193. The RMF should ensure that transactions with related parties are reviewed and that the
risks they pose for the institution are identified and adequately assessed.
194. The RMF should ensure that all identified risks are effectively monitored by the business
units.
195. The RMF should regularly monitor the actual risk profile of the institution and scrutinise it
against the institution’s strategic goals and risk appetite to enable decision-making by the management body in its management function and challenge by the management body in its supervisory function.
196. The RMF should analyse trends and recognise new or emerging risks and risk increases
arising from changing circumstances and conditions. It should also regularly review actual risk outcomes against previous estimates (i.e. back testing) to assess and improve the accuracy and effectiveness of the risk management process.
197. The RMF should evaluate possible ways to mitigate risks. Reporting to the management
body should include proposed appropriate risk-mitigating actions.
20.4 RMF’s role in unapproved exposures
198. The RMF should independently assess breaches of risk appetite or limits (including
ascertaining the cause and undertaking a legal and economic analysis of the actual cost of closing, reducing or hedging the exposure against the potential cost of keeping it). The RMF should inform the business units concerned and the management body, and recommend possible remedies. The RMF should report directly to the management body in its supervisory function when the breach is material, without prejudice for the RMF to report to otherinternal functions and committees.
199. The RMF should play a key role in ensuring a decision on its recommendation is made at
the relevant level, complied with by the relevant business units and appropriately reported to the management body and, where established, the risk committee.
20.5 Head of the risk management function
200. The head of the RMF should be responsible for providing comprehensive and
understandable information on risks and advising the management body, enabling this body to understand the institution’s overall risk profile. The same applies to the head of the RMF of a parent institution regarding the consolidated situation.
201. The head of the RMF should have sufficient expertise, independence and seniority to
challenge decisions that affect an institution’s exposure to risks. When the head of the RMF is not a member of the management body, significant institutionsshould appoint an independent head of the RMF who has no responsibilities for other functions and reports directly to the management body. Where it is not proportionate to appoint a person who is dedicated only to

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE the role of head of the RMF, taking into account the principle of proportionality as set out in Title I, this function can be combined with the head of the compliance function or can be performed by another senior person, provided there is no conflict of interest between the functions combined. In any case, this person should have sufficient authority, stature and independence (e.g. head of legal).
202. The head of the RMF should be able to challenge decisions taken by the institution’s
management and its management body, and the grounds for objections should be formally documented. If an institution wishes to grant the head of the RMF the right to veto decisions (e.g. a credit or investment decision or the setting of a limit) made at levels below the management body, it should specify the scope of such a veto right, the escalation or appeal procedures, and how the management body will be involved.
203. Institutionsshould establish strengthened processesfor the approval of decisions on which
the head of the RMF has expressed a negative view. The management body in its supervisory function should be able to communicate directly with the head of the RMF on key risk issues, including developments that may be inconsistent with the institution’s risk strategy and risk appetite. 21 Compliance function
204. Institutions should establish a permanent and effective compliance function to manage
compliance risk, and should appoint a person to be responsible for this function across the entire institution (the compliance officer or head of compliance).
205. Where it is not proportionate to appoint a person who is dedicated only to the role of head
of compliance, taking into account the principle of proportionality as set out in Title I, this function can be combined with the head of the RMF or can be performed by another senior person (e.g. head of legal), provided there is no conflict of interest between the functions combined.
206. The compliance function, including the head of compliance,should be independent of the
business lines and internal units it controls and have sufficient authority, stature and resources. Taking into account the proportionality criteria set out in Title I, this function may be assisted by the RMF or combined with the RMF or other appropriate functions, e.g. the legal division or human resources.
207. Staff within the compliance function should possess sufficient knowledge, skills and
experience in relation to compliance and relevant procedures, and should have access to regular training.
208. The management body in its supervisory function should oversee the implementation of a
well-documented compliance policy, which should be communicated to all staff. Institutions should set up a process to regularly assess changes in the law and regulations applicable to its activities.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
209. The compliance function should advise the management body on measures to be taken to
ensure compliance with applicable laws, rules, regulations and standards, and should assess the possible impact of any changes in the legal or regulatory environment on the institution’s activities and compliance framework.
210. The compliance function should ensure that compliance monitoring is carried out through
a structured and well-defined compliance monitoring programme and that the compliance policy is observed. The compliance function should report to the management body and communicate as appropriate with the RMF on the institution’s compliance risk and its management. The compliance function and the RMF should cooperate and exchange information as appropriate to perform their respective tasks. The findings of the compliance function should be taken into account by the management body and the RMF in decision￾making processes.
211. In line with Section 18 of these guidelines, the compliance function should also verify, in
close cooperation with the RMF and the legal unit, that new products and new procedures comply with the current legal framework and, where appropriate, with any known forthcoming changes to legislation, regulations and supervisory requirements.
212. Institutions should take appropriate action against internal or external behaviour that could
facilitate or enable fraud, ML/TF or other financial crime and breaches of discipline (e.g. breaches of internal procedures, breaches of limits).
213. Institutions should ensure that their subsidiaries and branches take steps to ensure that
their operations are compliant with local laws and regulations. If local laws and regulations hamper the application of stricter procedures and compliance systems implemented by the group, especially if they prevent the disclosure and exchange of necessary informationbetween entities within the group, subsidiaries and branches should inform the compliance officer or the head of compliance of the consolidating institution. 22 Internal audit function
214. Institutionsshould set up an independent and effective internal audit function (IAF),taking
into account the proportionality criteria set out in Title I, and should appoint a person to be responsible for this function across the entire institution. The IAF should be independent and have sufficient authority, stature and resources. In particular, the institution should ensure that the qualification of the IAF’s staff members and the IAF’s resources, in particular its auditing tools and risk analysis methods, are adequate for the institution’s size and locations, and the nature, scale and complexity of the risks associated with the institution’s business model, activities, risk culture and risk appetite.
215. The IAF should be independent of the audited activities. Therefore, the IAF should not be
combined with other functions.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
216. The IAF should, following a risk-based approach, independently review and provide
objective assurance of the compliance of all activities and units of an institution, including outsourced activities, with the institution’s policies and procedures and with regulatory requirements. Each entity within the group should fall within the scope of the IAF.
217. The IAF should not be involved in designing, selecting, establishing and implementing
specific internal control policies, mechanisms and procedures, and risk limits. However, this should not prevent the management body in its management function from requesting input from internal audit on matters related to risk, internal controls and compliance with applicable rules.
218. The IAF should assess whether the institution’s internal control framework as set out in
Section 15 is both effective and efficient. In particular, the IAF should assess:
a. the appropriateness of the institution’s governance framework; b. whether existing policies and procedures remain adequate and comply with legal and regulatory requirements and with the risk strategy and risk appetite of the institution;
c. the compliance of the procedures with the applicable laws and regulations and with
decisions of the management body; d. whether the procedures are correctly and effectively implemented (e.g. compliance of transactions, the level of risk effectively incurred, etc.); and e. the adequacy, quality and effectiveness of the controls performed and the reporting done by the defence business units and the risk management and compliance functions.
219. The IAF should verify, in particular, the integrity of the processes ensuring the reliability of
the institution’s methods and techniques, and the assumptions and sources of information used in its internal models (e.g. risk modelling and accounting measurements). It should also evaluate the quality and use of qualitative risk identification and assessment tools and the risk mitigation measures taken.
220. The IAF should have unfettered institution-wide access to all the records, documents,
information and buildings of the institution. This should include access to management information systems and minutes of all committees and decision-making bodies.
221. The IAF should adhere to national and international professional standards. An example of
the professional standards referred to here is the standards established by the Institute of Internal Auditors.
222. Internal audit work should be performed in accordance with an audit plan and a detailed
audit programme following a risk-based approach.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
223. An internal audit plan should be drawn up at least once a year on the basis of the annual
internal audit control objectives. The internal audit plan should be approved by the management body.
224. All audit recommendations should be subject to a formal follow-up procedure by the
appropriate levels of management to ensure and report on their effective and timely resolution. Title VI – Business continuity management 46
225. Institutions should establish a sound business continuity management and recovery plan
to ensure their ability to operate on an ongoing basis and to limit losses in the event of severe business disruption.
226. Institutions may establish a specific independent business continuity function, e.g. as part
of the RMF 47
.
227. An institution’s business relies on several critical resources (e.g. IT systems, including cloud
services, communication systems, core staff and buildings). The purpose of business continuity management is to reduce the operational, financial, legal, reputational and other material consequences arising from a disaster or extended interruption to these resources and consequent disruption to the institution’s ordinary business procedures. Other risk management measures might be intended to reduce the probability of such incidents or to transfer their financial impact to third parties (e.g. through insurance).
228. In order to establish a sound business continuity management plan, an institution should
carefully analyse risk factors for and its exposure to severe business disruptions and assess (quantitatively and qualitatively) their potential impact, using internal and/or external data and scenario analysis. This analysis should cover all business lines and internal units, including the RMF, and should take into account their interdependency. The results of the analysis should contribute to defining the institution’s recovery priorities and objectives.
229. On the basis of the abovementioned analysis, an institution should put in place:
a. contingency and business continuity plans to ensure that the institution reacts appropriately to emergencies and is able to maintain its most important business activities if there is disruption to its ordinary business procedures; and 46 Institutions should also refer to the EBA Guidelines on ICT risk:, available under: https://eba.europa.eu/regulation-and￾policy/internal-governance/guidelines-on-ict-and-security-risk-management 47 Please refer also to Article 312 of Regulation (EU) No 575/2013.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE b. recovery plans for critical resources to enable the institution to return to ordinary business procedures in an appropriate timeframe. Any residual risk from potential business disruptions should be consistent with the institution’s risk appetite.
230. Contingency, business continuity and recovery plans should be documented and carefully
implemented. The documentation should be available within the business lines, internal units and RMF, and should be stored on systems that are physically separated and readily accessible in case of contingency. Appropriate training should be provided. Plans should be regularly tested and updated. Any challenges or failures occurring in the tests should be documented and analysed, with the plans reviewed accordingly. Title VII – Transparency
231. Strategies, policies and procedures should be communicated to all relevant staff
throughout an institution. An institution’s staff should understand and adhere to policies and procedures pertaining to their duties and responsibilities.
232. Accordingly, the management body should inform and update the relevant staff about the
institution’s strategies and policies in a clear and consistent way, at least to the level needed to carry out their particular duties. This may be done through written guidelines, manuals or other means.
233. Where parent undertakings are required by competent authorities under Article 106(2) of
Directive 2013/36/EU to publish annually a description of their legal structure and governance and the organisational structure of the group of institutions, the information should include all entities within the group structure as defined in Directive 2013/34/EU 48 , by country.
234. The publication should include at least:
a. an overview of the internal organisation of the institutions and the group structure as defined in Directive 2013/34/EU and changes thereto, including the main reporting lines and responsibilities; b. any material changes since the previous publication and the date of the material change;
c. new legal, governance or organisational structures;
d. information on the structure, organisation and members of the management body, including the number of its members and the number of those qualified as 48 Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC (OJ L 182, 29.6.2013, p. 19).

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE independent, and specifying the gender and duration of the mandate of each member of the management body; e. the key responsibilities of the management body; f. a list of the committees of the management body in its supervisory function and their composition; g. an overview of the conflict of interest policy applicable to the institution and to the management body; h. an overview of the internal control framework; and
i. an overview of the business continuity management framework.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
Annex I – Aspects to take into account
when developing an internal governance policy
In line with Title III, institutions should consider the following aspects when documenting internal governance policies and arrangements:

1. Shareholder structure
2. Group structure, if applicable (legal and functional structure)
3. Composition and functioning of the management body
   a) selection criteria, including how diversity is taken into account b) number, length of mandate, rotation, age c) independentmembers of the management body d) executive members of the management body e) non-executive members of the management body f) internal division of tasks, if applicable
4. Governance structure and organisation chart (with impact on the group, if applicable)
   a) specialised committees
   i. composition
   ii. functioning
   b) executive committee, if any
   i. composition
   ii. functioning
5. Key function holders
   a) head of the risk management function b) head of the compliance function c) head of the internal audit function d) chief financial officer e) other key function holders
6. Internal control framework
   a) description of each function, including its organisation,resources, stature and authority
7. Description of the risk strategy and risk management framework

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
8. Organisational structure (with impact on the group, if applicable)
a) operational structure, business lines, and allocation of competences and responsibilities b) outsourcing c) range of products and services d) geographical scope of business e) provision of services under the regime of freedom of provision of services f) branches g) subsidiaries, joint ventures, etc. h) use of offshore centres
9. Code of conduct and behaviour(with impact on the group, if applicable)
a) strategic objectives and company values b) internal codes and regulations, prevention policy c) conflict of interest policy d) whistleblowing
10. Status of the internal governance policy, with date
a) development b) last amendment c) last assessment d) approval by the management body.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
5. Accompanying documents
5.1. Draft cost-benefit analysis/impact assessment

1. Article 16(2) of Regulation (EU) No 1093/2010 of the European Parliament and of the Council
   of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority) (EBA Regulation) provides that the EBA should carry out an analysis of ‘the potential related costs and benefits’ of any guidelines it develops. This analysis should provide an overview of the findings regarding the problem to be dealt with, the solutions proposed and the potential impact of these options. A. Problem identification and policy objectives
2. Directive 2013/36/EU has been amended. The EBA Guidelines on internal governance needed
   to be amended to reflect those changes and to align their wording with other EBA work.
3. The amendments to the guidelines should ensure that institutions have specific governance
   arrangements regarding the management of money laundering and terrorist financing risks and to avoid that they contribute to dividend arbitrage schemes. Institutions should also have a strong framework to manage conflicts of interests and ensure prudent decision-making in the context of loans to related parties. B. Baseline scenario
4. The current EU legislative framework for institutions’ internal governance consists mainly of
   Directive 2013/36/EU, the EBA guidelines on internal governance, the EBA Guidelines on the assessment of the suitability of members of the management body and key function holders and the EBA Guidelines on outsourcing.
5. The impact assessment covers guidelines developed to ensure the harmonised application of
   additional governance requirementsintroduced by Directive 2013/36/EU and areas where the policy has changed. Areas that have not changed in substance and the underlying changes introduced by the Directive 2013/36/EU and Regulation (EU) No 575/2013 have not been assessed.
   C. Options considered
6. Guidelines have been provided on the code of conduct that link the guidelines to the
   requirements on non-discrimination and equal opportunities within the European Charter of Fundamental Rights and the Treaty on the Functioning of the European Union. Those additions have no impact as the underlying provisions are fundamental principles that are already

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE implemented by Member States based on the aforementioned frameworks. The EBA has to take those frameworksinto account when setting out guidelines.
7. The guidelines provide additional clarity about the institutions internal governance in the
context of AML/CTF provisions. Institutions should already have sufficient governance arrangements in place to ensure that they comply with Anti-Money Laundering, Anti-Terrorist Financing and tax laws. The related risks are already covered by the CRD requirement on institutions to manage all their risks. Hence,the clarifications provided in the guidelines should not trigger any implementation costs if the institution concerned already had the required arrangementsin place and had implemented the requirements under Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015.
8. In addition the guidelines have been clarified regarding the management of conflicts of
interest in relation to loans and other transactions to members of the management body and their related parties. Given that specific provisions have been added to Directive 2013/36/EU it was considered necessary to clarify the regulatory expectations and the requirements with regard to the documentation of such loans and the management of related conflicts of interest. It is necessary that institutions document all loans and transactions. The specific documentation elements on such loans in the guidelines are limited and do not create a material burden. The need to identify such loans, to document them and to comply with the GDPR in this context is created by the requirement within the Capital Requirements Directive (CRD). Hence, the costs for those aspects are not assessed as part of this impact assessment.
9. The objective of the changes are that there is sufficient scrutiny on decisions regarding such
loans and that conflicts of interest in that context are appropriately managed. Restricting the guidelines to loans to members of the management body and their related parties would not be effective as other transactions might also create material conflicts of interests. Limited additional documentation elements regarding the conditions of such loans as compared to market conditions and their volumes are necessary to assess the appropriateness of the management of conflicts of interests. Given the need to document contractual conditions and to comply e.g. with the large loan regime it is assessed that the additional costs for providing the additional information, when requested, is low.
10. In line with the principle of proportionality,the guidelines differentiate between material and
non-material loans and transactions. The guidelines further specify the already existing CRD requirements for all institutions. D. Cost-benefit analysis
11. Given the limited amendments to the guidelines and given that they are based on
amendments of Directive 2013/36/EU and other existing legal requirements, it is assumed that changes to the guidelines create no or very low implementation costs for updates to internal policies and additional documentation.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
5.2. Summary of responses to the consultation and the EBA’s
analysis
The EBA published its consultation paper on 31 July 2020 and received overall 18 responses; 16 of them were published, while the other 2 have been submitted on a confidential basis. The consultation was limited to the changes made to the guidelines previously in place. Therefore, comments received on guidelines that have not been amended are in general not included in the feedback table. The Banking Stakeholder Group did not submit an opinion. The main comments received challenged the chapter on related party transactions and the manner in which the topic of anti-money laundering has been integrated into the guidelines. Many respondents challenged the legal basis to ask institutions for specific actions regarding third party transactions, while the CRD includes only specific documentation requirements on loans to members of the management body and their related parties. The submission of information on loans to members of the management body and their related parties is set out in Article 88 of the CRD, and the management of conflicts of interests is also explicitly required under Article 88 of the CRD. Decisions on related party loans and transactions should be made objectively and related conflicts of interests must be identified and managed. The guidelines have been aligned with the CRD requirements and specify them further. The guidelines further specify how conflicts of interest in this context should be managed and which information on such loans should be made available to competent authorities upon request. Many institutions had objections to the provision that a member of the management body should be identified as being responsible for implementation of the requirements in Directive 2018/843 (AMLDV) on anti-money laundering and terrorist financing. Moreover, some respondents would prefer to remove the guidance provided in light of other upcoming EBA work on this topic. The guidelines have been aligned with the requirements under AMLDV, which is in the scope of the EBA’s action. Institutions’ governance arrangements must take into account the risks that can emerge from being involved or being exploited in the context of money laundering and terrorist financing. The management body bears the overall responsibility for implementing the related policies and processes. However, many national laws, in line with the AMLDV, indeed foresee that companies that are subject to the AMLDV must identify one member of the management body, where such a body exists, as being responsible. The EBA is working on additional guidelines on AML compliance, while the guidelines on internal governance set out high level principles on AML compliance and principles on the management of risks triggered by ML/TF risk factors. The AML/CTF framework is part of institutions governance arrangements and therefore the topic has been retained within the guidelines. Other comments received concern the principles included regarding non-discrimination and equal opportunities
and respondents found that those guidelines would exceed the EBA’s mandate.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE All institutions are not only subject to the CRD and CRR requirements, but also to other laws and regulations. The code of conduct and working conditions are part of institutions’ governance arrangements. When setting out guidelines under the mandates received under the CRD, the EBA also has to take into account the values of the European Union and other directives and regulations in place, including the Treaty on the Functioning of the European Union, the European Charter of Fundamental Rights and the Directive of the European Parliament and of the Council of 5 July 2006 on the implementation of the principle of equal opportunities and equal treatment of men and women in matters of employment and occupation. A detailed analysis of the comments received is included in the feedback table below.

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Summary of responses to the consultation and the EBA’s analysis General comments Date of application Several respondents suggest postponing the date of application to duly take into account the time needed for the CRD and Investment Firm Directive (IFD) national transposition processes, translations of the guidelines (GL) into the EU languages and the ‘comply and explain’ procedures. The EBA appreciates that the implementation of the revised guidelines will require some time and has postponed the date of application. However, the guidelines (GL) do not change the timelines for the implementation of national laws that will have entered into force. GL amended Definitions Some respondents recommend ensuring alignment to the definitions provided in the EBA GL on fitness and propriety. More specifically, reference is made to the definitions of ‘prudential consolidation’ and ‘relevant institution’. The EBA has reviewed the mentioned guidelines and ensured that definitions are consistent. However, smaller differentiations were necessary, given their different scope of application, e.g. the term ‘relevant institution’ also includes Class 2 investment firms, while the present GL do not apply to such investment firms. The definition of ‘prudential consolidation’ has been added for the sake of completeness, while it is, in principle, not necessary as the method to be used and its scope is set out in Regulation (EU) 575/2013. GL amended Scope of application Some respondents ask for further clarifications regarding the scope of application, especially related to the prudential consolidation, materiality of risks and other transactions. All institutions that are subject to Directive 2013/36/EU (CRD) are within the scope of application of the guidelines. The requirements on governance under the CRD apply on an individual and consolidated basis, unless the waivers in Article 21 of the CRD are applied. All institutions are subject to the provisions on related party loans in the CRD and the requirement to manage conflicts of interests (COI). The GL set out further details on how institutions should manage such COI also in the context of other transactions. No change

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE The scope of application is not affected by the materiality of risks. The materiality of risks and the needed risk management measures depend on the business model of the institution, its risk appetite, risk bearing capacity and all relevant risk factors. Application of national and sector-specific law On several occasions respondents asked to add references to relevant national or sector-specific requirements that apply to subsidiaries. The GL aim to achieve harmonisation on an EU level. All institutions and all their subsidiaries have to comply with all applicable Union and national legal requirements without this fact being stated in guidelines. A sentence has been added to the background section. Background amended Definitions A few respondents suggest adding a definition on ´Management Body´ and ´Senior Management´ (to the guidelines. The named definitions are provided within the CRR and the CRD. No change Anti-discrimination policies Some respondents complain about the lack of legal basis for the introduction of the requirement to adopt these policies, both in the Charter of Fundamental Rights and in banking supervision law (CRD V). Anti-discrimination rules are a part of robust governance arrangements, The guidelines determine how compliance should be achieved. The legal mandate is provided in Article 74 CRD and Art. 16 of the EBA founding regulation. When providing guidelines, the EBA also has to take into account the Treaty, European Charter of Fundamental Rights and other EU Directives and Regulations. No change Anti-discrimination policies Considering that some national legal frameworks already provide requirements on the adoption of non￾discrimination policies, some respondents suggest adopting a more proportional approach to ensure non￾discrimination and consider the policies that are already in place to suffice for complying with the GL. Where policies are in place that ensure compliance with the GL, it is not necessary to create new policies. It is important that institutions take appropriate measures to ensure that there is no discrimination. Such measures need to be documented. GL amended Anti-discrimination policies With specific regard to gender-neutral policies, some respondents seek guidance on their application in smaller banks and/or in dual board structures. In small banks adopting a dual board governance structure, the While institutions need to take into account the gender balance when recruiting new members of the management body, there is no guideline included that requires a certain minimum representation. Having a gender-neutral remuneration policy does No change

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE management body often consists of only two members, who usually hold this position for a longer period of time. For them, a gender-balanced composition would mean that one board member should always be a woman. not require having male and female members of the management body in its management function. The composition of the management body should be subject to a diversity policy. With small management boards, a more diverse approach could also be achieved by having a more gender-balanced supervisory function. ML/FT risks in the internal control and general risk management framework Several respondents suggest clarifying if the GL aim to integrate the AML/CTF check in the general risk management. If so, clarifications are also needed on the effects on the responsibilities within the credit institutions. For some respondents, AML should not be arbitrarily dropped into the ‘overarching internal controls’ section. It should instead be included within its own sub-heading as a sub-topic. A few respondents commented that the results of the AML/CTF check should not have any impact on regulatory requirements, especially not on capital requirements; a negative result of the AML/CTF check can only result in the rejection or increased monitoring of the business relationship. Many respondents recommend more proportionality on the requirement to adopt specific risk mitigation measures: they evidence that, with regard to operational and reputational risks arising from ML/TF risks, such measures are not necessary for all institutions, depending largely on the nature and complexity of individual business activities. The GL have been clarified. Institutions need to take into account money laundering and terrorist financing (ML/TF) risk factors in their general risk management. However, they also need to ensure compliance with the provisions under Directive (EU) 2015/849 (AMLD), including that they implement appropriate AML/CTF controls. While both issues are related, their context (prudential/compliance) differs. While the AMLD requires specific measures, the present guidelines deal with the internal governance of institutions and its risk management in more general. Hence, singling out AML provisions, rather than integrating such requirements in the control framework, has not been seen as appropriate. Moreover, the EBA is going to issue additional guidelines in the area of AML/CTF compliance. In any case, institutions need to be aware that AML/CTF breaches can also lead to operational and reputational risks and, if systematic, doubts regarding the suitability of members of the management body. The present guidelines do not contain provisions that are related to potential capital add-ons. It is self-evident that the needed controls and risk mitigation measures should take into account the existing risk factors and risk levels. GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE ESG factors in the risk management framework Generally, respondents do not find the proposal clear and recommend either providing further clarification or deleting. The GL cannot replace the major work that is on its way in the area of ESG risk factors. It is important that institutions take into account ESG risk factors and adjust their business model and risk appetite where necessary. The GL were clarified to ensure that the responsibility of the management body to ensure an appropriate management of all risks, including risks driven by ESG risk factors, are managed. GL amended Responses to questions in Consultation Paper EBA/CP/2020/20 Commentsto the background section Para. 14 Background and rationale Some respondents comment that the reference to ‘offshore financial centres’ is not clearly defined. Therefore, the GL should use a consistent and more legally clear term such as ‘third country’, unless a distinction is established between third countries and offshore financial centres. The GL reflect the wording within the CRD. Indeed, the application of the CRD requirements outside the EU on a consolidated basis is not different between ‘third countries’ and ‘offshore financial centres’. While international bodies, e.g. the IMF provide for a definition of ‘offshore financial centres’, the CRD does not. It has been clarified that there is no differentiation of the CRD requirements between third countries and offshore financial centres. GL amended Para. 14-15 Background and rationale One respondent comment that the principle of proportionality should also apply when applying the guidelines on the consolidated basis. Therefore, Paragraph 14 should specify as follows: ‘Under
Article 109(2) of Directive 2013/13/EU, these guidelines
apply on a sub-consolidated and consolidated basis by taking into account the proportionality principle.’ Some respondents comment that ‘adequate’, added in Paragraph 14 of the Legal Basis, is not in line with The principle of proportionality is a general principle of law that also applies to the EBA Guidelines. It entails, that all provisions are applied in a proportionate way. It does not mean that certain provisions may not be applied. The wording of Paragraph 14 has been aligned with the CRD text. GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE
Article 109 CRD V. One respondent suggests that ‘sound’,
‘solid’ or ‘similar’ may be better suited in the relevant context.
Para. 19
Background and rationale
One respondent suggests limiting the reference to the EBA publication by type, as otherwise it would be too broad. The comment has been accommodated. Background amended Para. 21 Background and rationale A few respondents ask for clarification to which ‘bodies’ the guidelines refer. The background section has been clarified. GL amended Para. 31 Background and rationale One respondent asks whether the renaming to ‘three lines model’ by the Institute of Internal Auditors has a bearing on these guidelines and the name of the ‘three lines of defence’model. The IIA’s model allows the 1st and 2nd line to be blended. This is quite a substantial difference compared to these guidelines which clearly require the independence of the control functions in credit institutions. The respondent requests how the EBA will take the IIA’s three lines model into consideration. Within institutions, the internal control functions must be independent of the business they control in line with the CRD and also international standards (e.g. BCBS). There is no intention to deviate from this approach. No change Para. 33 Background and rationale One respondent asks for revision of the background
section as regards the compliance function’s scope of
responsibility is defined too broad and prescriptive. Even though the compliance function is considered to be a crucial function for ensuring compliance with laws and regulations, it should not be responsible for compliance with all applicable laws and regulations but rather with those related to the Compliance function as such. The background section is clear and provides an overview on the internal organisation of the institution. The guidelines further specify the CRD requirements. It is deemed sufficiently clear, that the compliance function does not carry all those responsibilities all on its own, but together with the first line of defence and other functions (e.g. legal unit) within the institution. No change

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Para. 40 Background and rationale Some respondents suggest that this section should only refer to loans and not to other transactions (CRD V considers loans only). See comments above under general comments. No change Comments to the guidelines Para. 14 Definitions One respondent recommends to review the definitions and operate with one set of definitions for the guidelines on internal governance and the guidelines on fitness and propriety (e.g. definition of staff, prudential consolidation). The term ‘relevant institutions’ has been introduced in the guidelines on fitness and propriety and makes it difficult to further differentiate between the categories of institutions that are now in scope (there are overall 6 categories:
‘institutions’, ‘CRD-institutions’, ‘relevant institutions’, ‘significant CRD-institutions’, ‘listed relevant institutions and listed institutions’, ‘consolidating credit institutions’); on the other side, the Internal Governance GL operates with the terms ‘significant credit institutions’ and ‘listed CRD credit institutions’. The definitions within the guidelines have been reviewed and aligned to the extent possible. As the scope of application of the guidelines differs, it is necessary to include additional definitions within the guidelines on fitness and propriety. E.g. the term ‘relevant institution’ comprises institutions subject to the CRD and investment firms, unless they are small and not interconnected. GL amended Para. 7 Scope of application One respondent suggests that the EBA considers how to extend the scope to all financial services firms (e.g. payment providers). The EBA’s mandate is to provide guidance on the application of requirements set out in directives and regulations within its scope of action. The EBA does not have the power to extent the scope of application of the CRD to other financial institutions. No change Para. 7 Scope of application A few respondents asks for confirmation that the deletion of the definition ‘institution’ and the use of the word ‘credit institution’ is linked to the new IFR/IFD regulation and to the new definition of credit institutions. This was indeed the intention. Some investment firms will have to apply for an authorisation under the CRD. The CRD continues to use the term ‘institutions’ for all entities that are subject to the CRD. The EBA will amend the guidelines accordingly. However, some GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE investment firms are required via the IFD to apply the provisions of Title VII of the CRD, this has been clarified in the guidelines. Para. 15 Date of application Several respondents suggest postponing the date of application, taking into consideration the Covid-19 pandemic and the implementation date of the whistleblower directive (17 December 2021) and that IT system changes are needed to comply with the requirements on related party loans and transactions. One respondent ´points out that for investment firms that are subject to the guidelines, it might be difficult to comply with the new guidelines in a short period of time especially in Member States where the local regulations on corporate governance did not apply to them. The effective coming into force of the amendments within the guidelines has been set to 31.12.2021, take into account the time needed for their implementation. Investment firms that will have to apply for authorisation as credit institution were subject to the previous EBA guidelines on internal governance, that are now being updated. Investment firms, unless small and not interconnected, are subject to the IFD and apply the governance requirements as further specified within the corresponding EBA guidelines under IFD. Small and non-interconnected investment firms continue to apply the governance requirements under Directive 2014/65/EU (MiFID) and the Commissions Delegated Regulation (EU) 2017/584 on organisational requirements. GL amended No change Para. 17 Proportionality One respondent raises that the section on the proportionality principles differ between the two guidelines. The scope of application and subject matter of the guidelines on internal governance and the guidelines on fitness and propriety differ. Different factors to determine the proportionate application of the provisions have therefore a different relevance, while the general principle is indeed the same. Some criteria have, however, been aligned. GL amended Para. 19 and 84 Proportionality and organisational framework in a group context One respondent suggested a specific proportionality regime for subsidiaries that are set up to develop and accelerate technology and innovation businesses (e.g. proprietary software and technology infrastructure, payment services) to serve the Group’s banks at arms￾length and suggest that those subsidiaries should not be The CRD applies also on a consolidated basis. The scope of prudential consolidation is specified within the CRR. The principle of proportionality determines how requirements and provisions within these guidelines are applied in a proportionate way. Creating additional waivers within guidelines for certain firms in the scope of No change

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE subject to the banks’ governance requirements on a consolidated basis. prudential consolidation is not possible under the existing legal framework. Para. 19(m) Proportionality Regarding the introduction of small and non-complex institutions, some respondents recommended adding a reference to the relevant CRR 2 provisions. The comment has been accommodated. GL amended Para. 19(m) Proportionality Some respondents asked to clarify that the proportionality criteria could be considered even though the entity is classified as a large institution. All criteria are applied in parallel and do not limit the consideration of other criteria. The guidelines do not contain any limits to the proportionality principle, but the CRD contains specific provisions with which large institutions must comply. In some cases, the CRD also established minimum requirements for all institutions. The principle of proportionality also requires the largest and most complex institutions to comply with the requirements in a more sophisticated manner than is expected from average or small institutions. No change Para. 21 and 22 Role and responsibility of the management body Some respondents proposed to (re)move the last sentence of Paragraph 22 to Paragraph 21 since it would not only refer to the management board in its supervisory function. The wording has been clarified. GL amended Question 2 Setting up of an AML/TF control framework Para. 23 and 32 Some respondents asked for clarification regarding the upcoming EBA products in this area and suggested to wait concerning the inclusion of AML in the guidelines until other work on this topic has been completed and recommend adding cross references. Several respondents proposed the removal of all references to the identification of a member of the management board as responsible for ensuring compliance with the national implementation of AMLD on the grounds of contradiction with certain national The guidelines clarify that ML/TF risk factors are one of the factors that are relevant for the institution’s risk. Moreover, the guidelines determine that a control function should be responsible for monitoring AML/CTF compliance as part of the robust governance arrangements. The EBA’s work on AML/CTF is part of the overall working program, available at: https://www.eba.europa.eu/about-us/work￾programme/current-work-programme GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE corporate laws that, for instance, apply the principles of collegiality and joint and several responsibility to the management body (e.g., in one-tier board systems). They also highlight that Article 46(4) AMLD, when setting ‘where applicable’, leaves room for Member States to stipulate otherwise, the topic still not being sufficiently harmonised. In one-tier systems it could entail assigning that responsibility to an executive director (e.g., the CEO, who is in many instances the sole executive member within the board ‘effectively directing the institution’), and that would put into question the independence and accountability framework from internal control functions envisaged in the guidelines on internal governance. It would also be impossible in a hybrid system where there is a CEO who can be (but is not systemically) part of the board of directors. Respondents find it is hard to see the rationale behind a new accountability regime, applicable only to AML/CTF issues, where responsibility would lie with a member of the management body instead of with the corresponding internal control head (accountable directly to the management body as a whole). A few respondents suggest merging Para. 23(c) and (d) to avoid creating two parallel control frameworks. Given the upcoming additional work, the guidelines have been revised to only include high-level principles re the AML/CTF compliance officer and compliance function and related responsibilities at the level of the management body. Where the head of a control function is a member of the management body, institutions should be mindful of any possible conflicts of interests. The same applies when assigning responsibilities regarding the AML/CTF function. The allocation of such responsibilities to a member of the management body does not reduce the overall responsibility of the management body for this topic as prescribed in Art. 88 CRD. Para. 23 and 32 Proportionality and role and responsibility of the management body Reporting lines Some respondents also find that assigning the responsibility to a member of the management body contradicts Para. 155-156, which determine that the heads of internal control functions should be directly accountable to the management body and ‘be able to have access and report directly to the management body in its supervisory Also internal control functions could be headed by a member of the management body. The approach regarding AML compliance is consistent with the approach for other control functions. All institutions have to have a management function and a supervisory function within the management body. The governance arrangements must be in line with this approach, hence, reporting No change

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE function to raise concerns and warn the supervisory function, where appropriate, when specific developments affect or may affect the credit institution’. Respondents point to difficulties to implement such requirements in unitary board structures and find it impossible in hybrid system, where there is a CEO who can be (but is not systemically) part of the board of directors. lines to the supervisory function can always be established, even if a control function is led by a member of the management body in its management function. According to the CRD all persons who direct the business (including the CEO) are per definition part of the management body and the respective CRD requirements. Para. 23 Cross references One respondent points to the changed references (due to the new structure of the draft guidelines) in points k (Section 8 instead of 9), l (Section 9 instead of 10) and m (Section 10 instead of 11) of Paragraph 23. All cross references in the document have been reviewed and where necessary corrected. GL amended Question 3 Para. 24 role and responsibility of the management body Some respondents find that the guidelines are not sufficiently clear and should either be expended or the paragraphs should be removed as the responsibilities are already covered in Para. 23. A few responses add that ESG risks are not a separate risk category. It is suggested to delete the last part of Para. 24 ‘that takes into account all risks, including environmental, social and governance risks’. One respondent asked for a further explanation on the definition of a sustainable business model. One respondent asks for clarification why the guidelines add a section on ESG and at the same time mention that the EBA is developing a separate work on ESG. It is important to introduce a reference to ESG risk factors and for other risk management purposes and to the responsibility on institutions to take into account such factors and their impact on relevant risk exposures created by the transition of the economy and the risk of external events that could lead to losses, e.g. due to climate change or natural disasters. Such risks need to be taken into account in the institutions business model. Some additional clarity has been provided in a principled manner to not pre-empt upcoming work at European level and at the EBA. GL amended Question 4 ESG risks Another respondent evidences that there is currently no uniform definition of ESG risks and therefore suggests replacing ‘environmental, social and governance risks’ by ‘environmental, social and governance factors’. The wording has been reviewed and reference is made to ESG risk factors. GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Para. 34 Formal independence One respondent again questions the requirement of formal independence. It would have no Level 1 basis, and would be very difficult to comply with due to the governance structure of cooperative banks, as management board members are, by nature and statutory, or imposed by law, clients and shareholders. It would also be incompatible with the fit and proper requirements such as experience, especially to chair a committee. This paragraph has not been consulted on, please refer to the feedback provided to the previous version of these guidelines. No change Para. 43: setting up committees – AML committee One respondent asks for more guidance on the suggestion to establish a committee, e.g. AML/CTF. Indications would be useful as to the size at which it would make sense to establish such a committee. The establishment of such a committee is a possibility for institutions to ensure robust governance arrangements, but not a general regulatory requirement. While some institutions may deal with this topic in the risk committee, others may prefer to establish a separate committee. No change Para. 61 Committee’s process One respondent asks to clarify that the factors listed (including the new reference to AML/CFT compliance) should be read as each applicable to one or both (but not necessarily both) committees (risk and nomination committee). Since AML/CTF information can be strictly confidential (especially suspicious activity reports (SARs)) one respondent recommends deleting the wording ‘including AML/CTF compliance’ in order to avoid conflicting regulatory requirements. At least, if the proposal is not accepted, it is suggested to add the exclusion of SARs from the information access of the committees. The guidelines apply to both committees when they are established. The committees need to receive information that is relevant for their work. As part of this they also need to receive some aggregated information on the frequency of SARs (risk committee). The guidelines have been clarified that no individual SARs should be submitted. GL amended Question 4 Para. 84 A few respondents request adding a definition of ‘offshore financial centres’ and to clarify if this notion leads to The wording ‘offshore financial centres’ repeats the wording used in Article 109 of the CRD. The use of this term in the guidelines does not lead to a differentiation of the CRD requirements between such No change

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Organisational framework in a group context different requirements regarding the expected governance arrangements. centres and other third countries and therefore no definition is necessary. Question 4 Para. 84 One respondent asks why ‘on a consolidated and sub￾consolidated basis’ is mentioned whereas Article 109(2) CRD IV mentions ‘on a consolidated or sub-consolidated basis’. The comment has been accommodated. GL amended (former) Section 8:
Outsourcing Policy
Some respondents noted that the removal of the (former)
Section 8 would require additional cross-checking since the
guidelines on outsourcing arrangements make several references to these guidelines. A section on outsourcing policies has been added to the guidelines. GL amended Para. 92: risk culture Some respondents state that the ‘righteous culture’ is not sufficiently clearly defined. One respondent added that it would include judgmental elements that might not fit to a culture, but rather to preventive and corrective structures and processes. The guidelines have been clarified, the intention is to ensure that the risk culture is not only lawful and consistent with the institutions’ risk appetite, but also in line with the values that are expected to be met by a diligent bank, e.g. in the context of implementing and applying the AML/CTF framework. GL amended Question 5 Para. 98 and 99: general comment Some respondents recommend these paragraphs be deleted for lack of a legal basis and argue that these paragraphs are outside the scope of the CRD, which only requires a gender-neutral remuneration policy and does not include additional requirements for other areas within the institution in the field of anti-discrimination or equal opportunities. Moreover, several dispositions of regional, national and EU law (e.g., European Charter) already provide for obligations to establish no-discrimination policies and in particular anti-gender discrimination policies.
Article 74 CRD requires that institutions have robust governance
arrangements. It is part of the EBA’s role to take into account such principles when setting out guidelines. Robust governance arrangements should ensure that the principles set regarding non￾discrimination and equal opportunities in the TFEU, European convention on human rights and the European Charter of fundamental rights (e.g. Article 21 and 23) are met. Member State s should have implemented such requirements in line with Directive 2006/54/EC on equal opportunities. Institutions should ensure compliance with such principles. Where institutions already have policies in place under national law, that GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE A few other respondents support the approach or even ask that further details be provided and ask to fully align the principle with the text of the European Charter of Fundamental Rights (e.g. re the terms birth and origin). are in line with the EBA’s Guidelines, no further implementation burden would exist. It is not necessary to have one single document containing all the measures taken, but institutions must be able to demonstrate that they have ensured that there is no discrimination in the meaning of the guidelines. Institutions should actively aim at increasing the pool of suitable candidates for positions within the management body. By improving the gender balance in positions directly below the management body, institutions will be able to better take into account gender diversity when recruiting members of the management body (see also Art. 91 CRD). The guidelines have been revised and fully aligned with the European Charter of Fundamental Rights. Question 6 Corporate values and code of conduct – tax offences – illicit dividend arbitrage schemes Para. 101(c) Several respondents suggest deleting the provision on tax offences, but in particular on dividend arbitrage schemes, deeming it unnecessary, too vague and not appropriate to specifically point out to one particular kind of tax evasion scheme. The word ‘illicit’ is not sufficiently clear. Alternatively, it was suggested by some respondents to limit this provision to cases where a court decision or a decision from the AML/CFT supervisor has been issued or where the competent authority have found a particular practice to be illicit. One respondent asks for clarification of the obligation on banks to prevent tax crimes. The amendment of the guidelines is necessary to stress that tax offences are a relevant factor that should be considered within the code of conduct. The term ‘illicit’ covers schemes that are unlawful or are banned; the wording has been clarified. Institutions have no active role in prosecuting clients for committing tax crimes, but, as part of money laundering controls, institutions must have appropriate controls to prevent them being used by customers for money laundering, including the use of funds derived from tax offences, purposes. GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Para. 106 and Para. 126:
documentation of conflicts of interest
Some respondents urge the need for more proportionality, deeming that a detailed documentation and measures should not be required for every minor or merely theoretical conflict of interest. Suggestion to clarify as follows: ‘If a notable conflict of interest is identified’. The guidelines in Para. 106 have been clarified, in some cases minor conflicts of interest may be accepted without specific measures taken. COI should still be documented. The awareness of such conflicts should already be a sufficient control measure in some cases and the controls in place can in such cases be considered as sufficient. GL amended Question 7. Section 11 has been added to provide guidelines on loans and transactions with members of the management body and their related parties, reflecting changes to the CRD. Is the section appropriate and sufficiently clear? Loans and other transactions with members of the management body and their related parties Legal basis Most respondents raised that there is a lack of legal basis to extend the provisions to other transactions, observing that the CRD V does not provide for the setting up of a monitoring framework or approval process or limits to transactions with members of the management body and their related parties. Moreover, the scope of other transactions is very wide and would lead to excessive burden. The guidelines have been revised to provide guidance on the documentation on related party loans and the management of conflicts of interest in relation to loans and transactions with members of the management body and related parties. For both,
Article 88 CRD and Article 16 EBA founding regulation provide for a
clear legal basis.
While there is an obligation on institutions to be able to submit certain information under Art. 88 CRD to their competent authority and there is a definition of related parties, the guidelines do not foresee a limitation of loans or transactions, but the consultation paper (CP) foreseesthat institutions should set limits in their policy, which could be overruled by the management body. The guidelines have been reworded to make clear that there should be thresholds that trigger decision-making at the level of the management body. GL amended Loans and other transactions with members of the The requirement to make available annually to shareholders appropriate aggregated information is criticised for lacking a legal basis in the CRD. Institutions are subject to the provisions within the CRD, MiFID and when listed the SRD. All of the requirements need to be complied with at the same time. The EBA is aware that national laws exist that transpose those EU GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE management body and their related parties Relation to shareholder rights directive (SRD) and national law Some respondents find the proposed provisions disproportionate, as they are even stricter than the rules provided for in SRD. Moreover, listed credit institution s would be subject to two different and complex regimes for related party transactions, leading to unreasonable administrative burden and costs. Overlaps are also highlighted with IAS24 disclosure requirements. According to SRD only material related party transactions are subject to approval and disclosure requirements and the SRD provides for several exemptions (e.g. for subsidiaries). Additionally, several respondents highlight possible overlapping with national requirements that already provide for related parties transactions. Directives. The EBA guidelines aim to achieve a harmonised application of the provisions in the EU that are within the EBA’s scope of action. The guidelines have been revised and aligned with the CRD requirements, without providing guidelines on requirements under the SRD with which some institutions have to comply. Loans and other transactions with members of the management body and their related parties Overlap with existing control framework and compliance costs A few respondents point to overlaps with the existing control frameworks that aim to control similar risks and propose to take a more flexible approach. Some respondents also observe that this section would impose new compliance costs on credit institutions (e.g., review of procedures and IT systems) at a very inopportune moment (i.e., COVID-19 crisis). Confidentiality/Data protection issues have also been raised. The provisions in the guidelines on related party loans and transactions are a specific form of measures to manage conflicts of interests. The obligation to manage such conflicts is part of the CRD and while the EBA has identified some additional costs for the implementation of the CRD provisions, the guidelines specify those provisions and those additional elements add only very limited to the costs created by the CRD provisions. Institutions document all loans and transactions; while this contains personal data, this is a normal and necessary business practice. The GL have been revised to reduce the documentation burden. GL amended Loans and other transactions with members of the With regard to banking groups, a few respondents suggest clarifying that this section is not applicable to loans granted to board members of other group entities, being only The relevant provisions within the CRD apply on an individual and consolidated basis. The guidelines have been clarified. E.g. loans by the consolidated institution to a member of the management body of a subsidiary, that does not fall under the GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE management body and their related parties Application on a consolidated level addressed to loans made by the parent bank to its own board members and their related parties. On the issue of intra-group transactions, a few respondents suggest, in line with Para. 116, to clarify that situations in which there is no conflict of interest, although loans or transactions are performed with a ‘related party’ as per the definition of Article 88(1) CRD, such loans or transactions can be excluded from additional requirements. The proposed exclusion would apply, for instance, to transactions with (i) the sole shareholder; (ii) subsidiaries or (iii) commercial entities (corporate banking) including, for example, companies where a close family member holds a senior management position or has a share of 10%; or entities where the board member has no influence (for example where the board member holds a non-executive directorship and where decisions are taken collectively); (iv) shareholders and companies on which the credit institution exerts control or significant influence; (v) the shareholder of the credit institution who is represented in the supervisory function of the management body by its managing director or a person with a senior management position; (vi) the management board member who holds a supervisory board function in a subsidiary. definition of a related party at the consolidated level, are not considered to be related party loans. However, loans by the subsidiary to the members of its management body are related party loans, even if they were subsidiaries within a group and additional controls are applied on a group level. The proposed exclusions have not been included in the guidelines with regard to the documentation to related party loans, as otherwise there would not be a record of the assessment of conflicts of interest and no possibility for further follow ups if the situation changes, nor the possibility to provide aggregated data. Loans and other transactions with members of the management body and their related parties With regard to the application in cooperative credit institutions, some respondents find the requirements inappropriate, because in these banks directors are by definition clients. Therefore, it would become very difficult to find clients who accept to become involved in the management body The requirements regarding related party loans are encoded within the CRD. They apply also to cooperative banks.
Article 88 CRD requires all institutions to manage conflicts of
interest. All those requirements apply also to cooperative banks.
No change

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Application in cooperative banks if their (and those of their related parties) requests for loans would have to be limited. Loans and other transactions with members of the management body and their related parties Materiality threshold Some respondents suggest further specifying that only loans that are material and have been concluded under better conditions than standard conditions be subject to increased documentation or approval requirements. Some other respondents observe that the GL do not clearly set a materiality threshold and, therefore, since a materiality threshold could already be in place in the national legal frameworks, they suggest that the GL refer to national laws. The provisions within the CRD apply to all related party loans. The guidelines follow this approach and already foresee a differentiation between material and non-material loans. The GL aim to harmonise the application in all Member States. This cannot be achieved by references to national law. It should be noted that the GL already indicated a threshold that aimed at reducing the burden for supervisors and institutions regarding the review of such loans. For the management of conflict of interest, additional guidelines have been provided that take into account the materiality of such loans and transactions. The materiality threshold has to be set by institutions. The guidelines have been reviewed and clarified to reduce the burden for institutions with regard to non-material loans and transactions. GL amended Loans and other transactions with members of the management body and their related parties Supervisory reporting With regard to the requirement to make available, without undue delay, the documentation to competent authorities, several respondents suggest deleting it because it is excessively burdensome and difficult to implement for complex loans. Institutions must comply with all requirements under the CRD and the CRR and it must be possible to exercise effective supervision. The term ‘undue delay’ already allows for the needed flexibility and reflects the provision within Article 88 CRD with regard to related party loans. Given other revisions to this section, the additional burden created appears to be acceptable and is mainly caused by the provision within the CRD. No change

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Loans and other transactions with members of the management body and their related parties Disclosure and reporting to shareholders Some respondents raise confidentiality/data protection issues; others evidence possible conflicts with some national legal frameworks. Moreover, it would be problematic to require cooperative banks to disclose aggregated information as the management body members might be well known at the regional level. Disclosure requirements already exist under the CRR and under IAS24. The guidelines have been revised to ensure that they are fully in line with the legal requirements under the CRD and CRR; in particular, some disclosure and reporting requirements to shareholders have been removed or revised. The publication of aggregated information as required under the CRR should not raise concerns under data protection requirements. GL amended Loans and other transactions with members of the management body and their related parties Additional related parties With regard to the possibility to allow credit institutions to identify additional categories of related parties, some respondents complain that the GL adopt an inconsistent approach since, on the one side, they remove flexibility in the procedure to be adopted as well as the possibility to utilise the existing frameworks and, on the other side, they leave flexibility on the scope of related parties, which is defined in great detail in the CRD V. The guidelines follow the approach taken in the CRD, but leaves it to institutions to apply, if they deem it necessary, to extend the scope of related parties. This could e.g. be necessary where required under national law. The text has been clarified. GL amended
Section 11, related party
loans and transactions
Some respondents raise confidentiality/data protection issues and the right to informational self-determination of the relatives concerned. They note that a mandatory notification from a circle of related parties enlarged by parents and grown-up children presumes that there is in fact legal authority for the legally￾binding collection of data by a member of the management body, otherwise the management body member/institution bears the objective risk that relevant data, e.g., from his/her majority aged children or parents, cannot be obtained in their entirety. From a purely factual standpoint, this then raises the question whether a nearly complete establishment and ongoing updating of the The declaration of members of the management body of their conflicts of interests with regard to loans to related parties and other transactions is a part of the measures necessary to manage conflicts of interest and to ensure objective decision-making regarding such loans and transactions. Institutions in any case keep data on loans and transactions. Marking loans, as related party loan is an additional element that is necessary to comply with the requirement under the CRD. The provisions have been revised and specified to reduce the regulatory burden. However, the identification of related parties is necessary to comply with the requirements under Art. 88 CRD. GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE shareholding/ownership structure of each institution is even possible. Related party loans and transactions Single respondents suggest enriching the section by including (i) additional guidelines or limits for secured vs. unsecured credit exposure extended to insiders; (ii) annual submission of the related interest attestation from the members containing a list of all organisations in which they have regulatory significant interest in or are in a position to make or influence significant business decisions or impacting financial profitability of the related company. Several respondents suggest further specifying that only loans that are classified as material and have been concluded under better conditions than standard conditions are subject to increased documentation or approval requirements. All loans to related parties must be documented and submitted to the competent authority (CA) upon request, regardless whether they are secured or not. Also decisions on secured loans should not be taken by staff that has material conflicts of interest. Institutions have to manage conflicts of interests; as part of this they may require annual declarations, however, as a general obligation this would be too burdensome. No change Para. 107 to 109 One respondent suggests carefully reviewing the wording for consistency, for instance, the terms ‘framework’, ‘decision’, and ‘procedure’ are used frequently in different contexts (mainly Para. 107, 108 and 109) and to provide further guidance on the elements expected that should be specified in the related party framework, e.g., a decision￾making process (including approvals), internal procedures, policies. The guidelines are considered sufficiently clear and have not been changed compared to the guidelines in force. No change Para. 107 – arm’s length conditions Some respondents claim that there is no legal basis to prescribe arm’s length conditions for private-law agreements in general. The wording should be clarified as follows: ‘Such a framework should include limits for loans and transactions (e.g. per product type) and ensure that The arm's length principle is the condition that the parties of a transaction are independent and on an equal footing, which leads usually to conditions that are fair for all concerned parties, including the institution’s shareholders. Where transactions are not conducted under market conditions, the inappropriate GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE they are either conducted at arm’s length or deviations are documented.’ Another respondent felt that the restriction to ‘conditions available to staff’ is not necessary. management of conflicts of interest might be the reason for such decisions. However, it is accepted that special conditions are provided to staff. There are however some limits in national law that must be considered. The guidelines have been clarified. Para. 107: content of the framework – loans fair from the perspective of the shareholders or owners As for the distinction between the transactions carried out on normal market terms and the transactions which are considered fair and reasonable from the perspective of the institution and of the shareholders, it is suggested to limit the assessment to the perspective of the institution, taking into account its safe and sound management. Therefore, the assessment should not be extended to the interests of the shareholders or owners of the bank. The institution is owned by shareholders or equity holders and therefore they need to be considered when assessing conflicts of interest. No change Para. 108: decision on material loans – approval by the management body Some respondents seek further clarification deeming unclear when a person is considered ‘personally concerned by a loan to or transaction with a member of the management body or their related parties’. They suggest clarifying that a loan granted to a commercial entity, which is a related party to a management body member, does not automatically result in the qualification of that management body member as ‘personally concerned’ (in its personal interests). The guidelines have been clarified, the person concerned is the person who, because of the relation to a party, actually or potentially has a conflict of interest and should therefore not influence the specific decision made. GL amended Para. 112: data on loans to be documented Some respondents suggest that the identification of the details on the loans to be provided should be left to entities in accordance with local regulations and internal procedures: the day-to-day IT management of credits and the associated risks is the core business of banks and the EBA should not interfere in this field. In particular, this Institutions document each and every contract they have. For all related party loans, institutions must ensure that they can provide competent authorities with the information requested regarding related party loans. The guidelines specify this provision. Moreover, competent authorities must also be able to effectively supervise institutions, including, e.g. the management of conflicts GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE paragraph 112 does not make any difference between the type of loans and as such is much too broad. Others view that the requirements are too extensive. of interest that is required under Article 88(1) CRD. The guidelines have been revised and clarified. Para. 112 (d) and (g) Loans and other transactions with members of the management body and their related parties The GL do not define how to calculate the EUR 200 000 threshold; one respondent requests indications on how to calculate the threshold of loans (e.g., should all respective transactions related to a member of the management body and their related parties be taken jointly into consideration or should each transaction be examined separately?). Some respondents ask to clarify how data should be aggregated. The guidelines have been clarified. GL amended Question 8. Paragraph 126 has been added, is it sufficiently clear? Para. 126 Documentation of conflicts of interest – see Para. 106. Please refer to comments (Para. 106) above. Para. 129: Internal alert procedures - protection of persons who report breaches of Union law One respondent suggests deleting the added last sentence deeming questionable whether there is any added value to insert a requirement to ensure that credit institutions are compliant with national law in one certain aspect. While institutions have to comply with national law, this additional aspect, that has been introduced only recently, has been retained in the guidelines for the sake of completeness. No change Question 9 Para. 140 and 149: ML/FT risks in the internal control framework – general comment Several respondents deem that more proportionality is needed regarding the measures to mitigate operational and reputational risks arising from ML/TF risk factors. The risks caused depend on the nature and complexity of individual business activities. This should be clarified as follows: ‘and take mitigating measures to reduce those risks as well as, where relevant, their operational and reputational risks linked to them.’ All banks are exposed to such risks, but to a different level. They need to be identified and should form part of the holistic view on all risks. However, not every risk needs to be mitigated. Measures should be taken on a risk-based approach. Paragraph 140 has been clarified. GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE AML training One respondent suggests, in the phrasing of the last paragraph concerning staff, to expand to continuous efforts by companies, i.e., ´Credit institutions should take continuous measures to ensure that their staff is made aware (…)´. The guidelines already contain that staff should receive the necessary training on a regular basis. No change AML/TF risk factors One respondent asks if the credit institution should take into account any criteria other than those published by the Commission for the assessment of ML/TF risks. Does the EBA have any additional expectations from the credit institutions apart from the compulsory training of their staff? The EBA has issued guidelines on ML/TF risk factors that should be taken into account. The EBA is going to publish guidelines on the AML/CTF compliance function. All institutions need to comply with the framework set under AMLD, including any delegated regulations, etc. No change AML committee One respondent observes that compliance with AML/CFT regulations should be ensured through adequate and effective internal management structures and appropriate control mechanisms. For this, banks could also form an AML/CFT committee. Institutions can set up an AML committee. However, one person has to be responsible for AML/CTF compliance. No change Para. 143: Implementing an internal control framework (and Para. 166 internal control functions) Some respondents suggest clarifying which ‘other’ compliance functions are referred to. Some of them ask for clarification that the reference to compliance may be covered by a separate Anti-Financial Crime (AFC) function, if this exists within an organisation. Consequently it is suggested including either AFC in the definition of ‘compliance’ or in a second sentence before internal audit in Para. 166. One of the respondents asks if AML/TF shall be a separate control function. The guidelines do not aim at requiring additional control functions, but allow for them to be installed by the institution. It is not uncommon that larger institutions have separate control functions that are, as a second line of defence,responsible for overseeing and managing AML risks. Institutions e.g. may also have a separate function for information security risks. However, the guidelines leave it to institutions to set up additional control functions, determine their scope of action and label them. No change

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Para. 164: New products and significant changes – ML/CF associated risks One respondent observes that the requirement to take ML/TF risks into account in new-product processes is superfluous since it is already the subject of European supervisory regulations/circulars. The inclusion in the guidelines aims at raising the awareness on this important risk factor, its assessment and documentation, including in the new product approval process. No change Para. 166: AML/CFT in internal control functions – general comment Some respondents ask for clarification on whether the control functions are supposed to cover new/additional tasks or if AML/CTF aspects shall be integrated into the respective department. On this, one respondent suggests stating that the AML/CFT compliance should be ensured by the compliance department or another department. See also comments under Para. 143. The same as with all risks, ML/TF risks are managed by the first line of defence and the second line of defence, which ensures the compliance with AML/CTF related provision and oversees and supports the first line of defence. Institutions may set up an AML/CTF compliance function or integrate it into the compliance function. The guidelines have been clarified. GL amended Para. 208: Compliance function - fraud, ML/TF or other financial crime One respondent suggests deleting the part of sentence ‘ML/TF or other financial crime’, as this is the responsibility of the AML Department and any overlaps in responsibilities or tasks with the Compliance Department, which belongs to the same line of defence, must be avoided. While institutions may have an independent AML department, other institutions may have this function performed by the compliance function. The AML/CTF compliance function should be independent from the business it controls. Also the business has to implement appropriate AML/CTF controls. No change Para. 210 – 220: Internal audit function One respondent highlights that internal audit is more and more assessing outsourced activities as banks outsource more and more operations; therefore, it suggests to explicitly mention that ‘Every activity (including outsourced activities) and every entity of the bank should fall within the overall scope of the internal audit function.’ All activities and functions of the institution are within the audit universe. This does not change when activities or functions are outsourced. This principle is encoded within the EBA Guidelines on outsourcing. No change Para. 223: Business continuity management - HR Some respondents suggest that ‘core human resources’ should refer to ‘core staff/employees’ so it is clear that it does not refer to HR department. The comment has been accommodated. GL amended

FINAL REPORT ON GUIDELINES ON INTERNAL GOVERNANCE Para. 224: Business continuity management plan One respondent deems unclear how the inclusion of the word ‘drivers’ changes the intended meaning of this requirement. The additional wording clarifies that institutions should also look into the risk factors (drivers) that can lead to severe business disruptions. GL amended

FINAL REPORT EBA GUIDELINES ON INTERNAL GOVERNANCE