Final Report on Guidelines on Internal Governance (European Banking Authority)

Summary

• Article 74(1) of Directive 2013/36/EU mandates institutions to maintain processes for managing risks, including environmental, social, and governance (ESG) risks over a short, medium, and long-term horizon of at least 10 years.p.7
• For loans granted to a member of the management body or their related parties exceeding EUR 200 000, institutions must provide detailed exposure and capital ratio data to competent authorities upon request.p.51
• Committees established by institutions under Directive 2013/36/EU or national law are required to be composed of at least 3 members.p.28
• When assessing potential staff conflicts of interest, institutions must evaluate employment and professional relationships from the recent past, such as 5 years.p.47
• Where a former CEO transitions into the role of chairperson within the same entity within 2 years, institutions must implement specific safeguards to address conflicts of interest.p.46
• Under Article 48g(3) of Directive 2013/36/EU, Class 2 third-country branches are subject to specific internal control requirements under Article 76(5) and Article 76(6).p.9

Key insights

1. Effective internal governance arrangements are a fundamental prerequisite for the prudent management of institutions and overall financial stability across the Union.p.5
2. The updated guidelines align governance expectations with Directive (EU) 2024/1619 (CRD VI), Directive (EU) 2019/878, and Regulation (EU) 2022/2554 (DORA).p.5
3. Institutions must comply with internal governance requirements on an individual, sub-consolidated, and consolidated basis in accordance with Article 109 of Directive 2013/36/EU.p.18
4. The chair of the management body in its supervisory function is prohibited from simultaneously exercising the function of CEO within the same institution.p.27
5. Significant institutions must establish dedicated risk, nomination, and remuneration committees to prepare decisions for the supervisory function of the management body.p.28
6. Institutions must draw up and maintain a mapping of duties and individual statements setting out the roles of all members of the management body, senior management, and key function holders.p.34
7. Third-country branches and EU subsidiaries must maintain sufficient operational substance and cannot operate as empty shells or letter-box entities.p.9
8. Risk management and compliance functions form the second line of defence, whereas the internal audit function acts as an independent third line of defence.p.13