European UnionCapital Requirements Directive, Robust Governance Arrangements of Institutions (Article 74(1))
Directive 2013/36/EU, Article 74(1)
In force since .
An AI sector rules rule binding private bodies.
- Obligation class
- Governance
- Audit expectation
- none
As of .
What it requires
- This Directive is addressed to the Member States (Article 165), which had to adopt and publish the measures necessary to comply with it by and apply them from (Article 162(1)), so an institution meets these rules through each Member State's national law; Article 74(1) in the wording that Directive (EU) 2024/1619 gave it applies from (Article 2(1) of that Directive).
- It reaches you if you are an institution, as defined in point (3) of Article 4(1) of Regulation (EU) No 575/2013 (Article 2(1) and Article 3(1), point (3)).
- Have robust governance arrangements, which include a clear organizational structure with well-defined, transparent and consistent lines of responsibility (Article 74(1), point (a)).
- Have effective processes to identify, manage, monitor and report the risks you are or might be exposed to, including ESG risks in the short, medium and long term (Article 74(1), point (b)).
- Have adequate internal control mechanisms, including sound administration and accounting procedures (Article 74(1), point (c)).
- Set up and manage your network and information systems in accordance with Regulation (EU) 2022/2554 (Article 74(1), point (d)).
- Have remuneration policies and practices that are consistent with and promote sound and effective risk management, including by taking into account your risk appetite in terms of ESG risks, and make them gender neutral (Article 74(1), point (e) and second subparagraph).
- Make the arrangements, processes and mechanisms comprehensive and proportionate to the nature, scale and complexity of the risks inherent in your business model and activities, taking the technical criteria established in Articles 76 to 95 into account (Article 74(2)).
Who enforces it
Enforcement body
The competent authorities that each Member State designates under Article 4(1), which monitor the activities of institutions to assess compliance with the requirements of the Directive and of Regulation (EU) No 575/2013 (Article 4(2)).
What it makes you log
Logging duty
Article 74(1) requires governance arrangements, risk processes, internal control mechanisms and sound administration and accounting procedures; it names no log or record of events.
- Kind
- None
- As of
What this law does
Article 74(1), as replaced by Directive (EU) 2024/1619, requires institutions to have robust governance arrangements, which include a clear organizational structure with well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks they are or might be exposed to, including ESG risks in the short, medium and long term, adequate internal control mechanisms, including sound administration and accounting procedures, network and information systems that are set up and managed in accordance with Regulation (EU) 2022/2554, and remuneration policies and practices that are consistent with and promote sound and effective risk management, including by taking into account the institutions' risk appetite in terms of ESG risks.
The remuneration policies and practices referred to in Article 74(1), point (e), shall be gender neutral.
Before that replacement, Article 74(1) provided that institutions shall have robust governance arrangements, which include a clear organizational structure with well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks they are or might be exposed to, adequate internal control mechanisms, including sound administration and accounting procedures, and remuneration policies and practices that are consistent with and promote sound and effective risk management.
Article 74(2) provides that the arrangements, processes and mechanisms referred to in paragraph 1 shall be comprehensive and proportionate to the nature, scale and complexity of the risks inherent in the business model and the institution's activities. Article 74(2) also provides that the technical criteria established in Articles 76 to 95 shall be taken into account.
Article 74(3) provides that EBA shall issue guidelines on the arrangements, processes and mechanisms referred to in paragraph 1, in accordance with paragraph 2.
Article 2(1) provides that the Directive applies to institutions. Article 3(1), point (3), defines an institution as an institution as defined in point (3) of Article 4(1) of Regulation (EU) No 575/2013. Article 4(2) requires Member States to ensure that the competent authorities monitor the activities of institutions so as to assess compliance with the requirements of the Directive and Regulation (EU) No 575/2013.
Article 67(1), point (d), as replaced by Directive (EU) 2024/1619, applies the Article's penalty provisions to an institution that fails to have in place governance arrangements and gender neutral remuneration policies required by the competent authorities in accordance with Article 74.
Article 67(2), as replaced by Directive (EU) 2024/1619, requires Member States to ensure that in those cases the measures that can be applied include at least administrative pecuniary penalties of up to 10 percent of the total annual net turnover of the undertaking in the case of a legal person, and of up to EUR 5 million in the case of a natural person.
Article 162(1) required Member States to adopt and publish by the laws, regulations and administrative provisions necessary to comply with the Directive, and to apply those provisions from . Article 2(1) of Directive (EU) 2024/1619 requires Member States to apply the measures necessary to comply with that Directive from , and to apply the amendments in Article 1, points (9) and (13), from .
Guidance on this law
How the bodies that enforce this law read it. Guidance binds nobody by itself, so LexLint never raises a finding from it; the duty is this law's.
- EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, the European Banking Authority
- EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02), outsourcing a function to a service provider, the European Banking Authority
When LexLint raises it
When your app profile says your app provides financial services.