paul@paulfoleylaw.ie
22 Northumberland Road, Dublin D04 ED73, Ireland, EU
INTRO
INSIGHTS

MiFID II: aspects of Internal Governance (August 2024)

By
Paul Foley
Internal governance requirements under MiFID II are complex. Satisfying the competent authority on an applicant’s internal governance controls is central to a successful MiFID II application. This article takes readers through some of the main requirements.
Copyright (c) Paul Foley Law 2024: all rights reserved. See also the Notice at the end of this article for the purposes of Directive EU 2019/790 (on Copyright and Related Rights), Article 4 (Exception or limitation for text and data mining).
About Paul Foley Law

Paul Foley Law provides and has provided for many years applicants for investment services authorisation under MiFID II with regulatory law advice and drafting including with specific policies required for the purposes of an authorisation application.

Paul Foley Law also advises authorised MiFID II investment firms on compliance and reporting requirements with/under MiFID II, CA 2014, IFD and IFR, the EU Market Abuse Laws, the EU AI Act, GDPR and all other laws and regulations applying to investment firms.

For legal advice and drafting, contact: paul@paulfoleylaw.ie

MiFID II internal governance

Directive (EU) 2014/65 (MiFID II) (Articles 9, 16, 23 and 24 thereof), Commission Delegated Regulation (EU) 2017/565 and Commission Delegated Directive (EU) No 2017/593 together with certain EBA and joint ESMA and EBA guidelines, form the foundation for the MiFID II internal governance requirements.

IFD and IFR

However, the recently in force Directive (EU) 2019/2034 (IFD) and Regulation (EU) 2019/2033 (IFR) regime, which the EBA argue is consistent with MiFID II, established a dedicated prudential framework for investment firms. The EBA stated that the CRR/CRDIV regime, did not effectively capture the actual risks faced by the majority of EU investment firms. Hence the need for this new regime.

The IFD contains provisions on governance and remuneration set out at Arts 25 to 34 of the IFD. These Arts do not apply to small and non-interconnected firms (Art 25(1), IFD).

Internal governance 

Investment firms must have robust governance arrangements, including all of the following:

  1. a clear organisational structure with well‐defined, transparent and consistent lines of responsibility;

  2. effective processes to identify, manage, monitor and report the risks that investment firms are or might be exposed to, or the risks that they pose or might pose to others;

  3. adequate internal control mechanisms, including sound administration and accounting procedures;

  4. remuneration policies and practices that are consistent with and promote sound and effective risk management (Art 26(1) of the IFD).

When establishing these arrangements, the criteria set out in Art 28 to Art 33 of the IFD (not reproduced here) must be taken into account (Art 26(2)).

The arrangements in Art 26(1) must be appropriate and proportionate to the nature, scale and complexity of the risks inherent in the business model and the activities of the investment firm (Art 26(3)).  Par 20 of the EBA Governance Guidelines (pages 17 to 19) further specifies how to take into account criteria for the application of the proportionality principle.

In addition, Art 9(1) of MiFID II specifies that investment firms and their management bodies must comply with Art 88 (Governance arrangements) and Art 91 (Management Body) of CRDIV.

In November 2021, the EBA published guidelines on internal governance, under Art 26(4) of the IFD (EBA: final report on guidelines on internal governance under Directive (EU)2019/2034 (EBA/GL/2021/14)) which guidelines, provide guidance on the governance arrangements referred to in Art 26(1) (EBA Governance Guidelines).

In accordance with the IFD, the EBA Governance Guidelines apply to all investment firms that do not qualify as small and non-interconnected investment firms (class 3 firms) as referred to under Art 12(1) of the IFR.

Three Lines of Defence

The EBA Governance Guidelines specify in more detail the requirements under the IFD.

The business lines, as part of the first line of defence, take risks and are directly and permanently responsible for their operational management.

The independent risk management function, where established, and the compliance function form the second line of defence.

A member of the management body may be responsible for the risk management function provided that the member does not have other mandates that would compromise the member’s internal control activities and the independence of the risk management function.

The internal audit function, where established as an independent third line of defence, conducts risk-based and general audits and reviews the internal governance arrangements, processes and mechanisms to ascertain that they are sound and effective, implemented and consistently applied.

Investment firms that do not establish an independent audit function must establish other appropriate audit policies and procedures. In any case, the ultimate responsibility for audits remains with the management body (see below).

While the business needs to manage its risks, the EBA Governance Guidelines stress the responsibilities of the second line of defence (the independent risk management and compliance function) and also the third line of defence (the internal audit function).

Management body

The EBA Governance Guidelines specify that the terms ‘management body in its management function’ and ‘management body in its supervisory function’ should be understood as applying to the bodies or members of the management body responsible for that function in accordance with national law.

The EBA Governance Guidelines state that the management body should identify one of its members in line with the requirements under Article 46(4) of Directive (EU) 2015/849 (AMLD IV) to be responsible for the implementation of the laws, regulations and administrative provisions necessary to comply with AMLD IV.

Under the updated joint EBA and ESMA guidelines on suitability of the management function (ESMA35-36-2319 EBA/GL/2021/06), investment firms that do not meet all of the conditions for qualifying as small and non-interconnected investment firms under Art 12(1) of the IFR and that are neither significant nor listed should, as a general principle, have at least one independent member on the management body in its supervisory function. However, competent authorities may not require any independent directors under specific conditions foreseen in the guidelines.

Compliance function

The EBA Governance Guidelines provide that investment firms should establish a permanent and effective compliance function to manage compliance risk, and should appoint a person to be responsible for this function across the entire investment firm (the compliance officer).

The compliance function, policies and procedures should also be compliant with Art 22 of Commission Delegated Regulation (EU) 2017/565 and with also the ESMA guidelines on certain aspects of the MiFID II compliance function.

The EBA Governance Guidelines specify that where it is not proportionate to appoint a person who is dedicated only to the role of head of the risk management function (RMF), taking into account the principle of proportionality, this function can be combined with the head of the compliance function or can be performed by another senior person, provided there is no conflict of interest between the tasks performed. In any case, this person should have sufficient authority, stature and independence (e.g. head of legal).

The compliance function and, where established, the risk management function intervene as necessary to ensure the modification of internal control and risk management systems within the first line of defence.  The ESMA Guidelines On certain aspects of the MiFID II compliance function requirements provide detail and guidance on the outsourcing of the compliance function (at page 21).

Committees of the Management Body

Member States must ensure that investment firms which do not meet the criteria set out in Art 32(4)(a) of the IFD, establish a risk committee composed of members of the management body who do not perform any executive function in the investment firm concerned (Art 28(4) IFD).

Member States must ensure that investment firms which do not meet the criteria set out in Art 32(4)(a) of the IFD, establish a remuneration committee. That remuneration committee must be gender balanced and must exercise competent and independent judgment on remuneration policies and practices and the incentives created for managing risk, capital and liquidity. The remuneration committee may be established at group level (Art 33(1) IFD).

With regard to the remuneration committee, please also refer to the EBA Guidelines on sound remuneration practices under Directive (EU) 2019/2034 (EBA/GL/2021/13 of 22 November 2021).

Investment firms that are legal persons managed by a single natural person

Investment firms that are legal persons managed by a single natural person should have alternative arrangements in place which ensure the sound and prudent management of such investment firms and the adequate consideration of internal governance arrangements (par 21 of the EBA Governance Guidelines on page 19).

Where investment firms are legal persons managed by a single natural person in accordance with their constitutive rules and national laws, the references in these guidelines to a management body should be construed as applying to the single person that is responsible for implementing alternative arrangements to ensure the sound and prudent management of such an investment firm and the adequate consideration of internal governance arrangements (par 31 of the EBA Governance Guidelines on pages 21 & 22).


Copyright Notice: No text or data mining, or Web scraping

Our website: www.paulfoleylaw.ie

You shall not conduct, facilitate, authorise or permit any text or data mining or web scraping in relation to any articles on our website or any services provided via, or in relation to, our website. This includes using (or permitting, authorising or attempting the use of):

- Any "robot", "bot", "spider", "scraper" or other automated device, program, tool, algorithm, code, process or methodology to access, obtain, copy, monitor or republish any portion of the website or any data, content, information or services accessed via the same;

- Any automated analytical technique aimed at analysing text and data in digital form to generate information which includes but is not limited to patterns, trends and correlations.

The provisions in this clause should be treated as an express reservation of our rights in this regard, including for the purposes of Article 4(3) of The Digital Copyright Directive ((EU) 2019/790).

This clause shall not apply insofar as (but only to the extent that) we are unable to exclude or limit text or data mining or web scraping activity by contract under the laws which are applicable to us.
Full copyright policy HERE >
map-markerenvelopetagarrow-left linkedin facebook pinterest youtube rss twitter instagram facebook-blank rss-blank linkedin-blank pinterest youtube twitter instagram