S.L. 330.6 Art. 9Internal control mechanisms and risk management processes.

(1) A regulated entity authorised in Malta identified as forming part of a financial conglomerate in terms of these regulations shall have in place, at the level of the financial conglomerate, adequate risk management processes and internal control mechanisms, including sound administrative and accounting procedures.

(2) The risk management processes referred to in sub-regulation (1) shall include:

(a) sound governance and management with the approval and periodic review of the strategies and policies by the appropriate governing bodies at the level of the financial conglomerate with respect to all the risks they assume;

(b) adequate capital adequacy policies in order to anticipate the impact of their business strategy on risk profile and capital requirements as determined in accordance with regulation 6 and the First Schedule; and

(c) adequate procedures to ensure that their risk monitoring systems are well integrated into their organisation and that all measures are taken to ensure that the systems implemented in all the undertakings included in the scope of supplementary supervision are consistent so that the risks can be measured, monitored and controlled at the level of the financial conglomerate; and

(d) arrangements in place to contribute to and develop, if required, adequate recovery and resolution arrangements and plans. Such arrangements shall be updated regularly.

(3) The internal control mechanisms referred to in sub-regulation (1) shall include:

(a) adequate mechanisms as regards capital adequacy to identify and measure all material risks incurred and to appropriately relate own funds to risks; and

(b) sound reporting and accounting procedures to identify, measure, monitor and control the intra-group transactions and the risk concentration.

(4) The Authority shall ensure that in all undertakings included in the scope of supplementary supervision pursuant to regulation 5, there are adequate internal control mechanisms for the production of any data and information which would be relevant for the purposes of supplementary supervision.

(5) The Authority shall require the regulated entities at the level of the financial conglomerate to regularly provide details on their legal structure, governance and organisational structure including all regulated entities, non-regulated subsidiaries and significant branches.

(6) The Authority shall require the regulated entities to disclose publicly, at the level of the financial conglomerate, on an annual basis, either in full or by way of references to equivalent information, a description of their legal structure and governance and organisational structure.

(7) The processes and mechanisms referred to in sub-regulations (1) to (6) shall be subject to supervisory overview by the Authority when acting as coordinator or by another coordinator.

(8) The Authority shall align the application of supplementary supervision of internal control mechanisms and risk management processes as provided for in this regulation with the supervisory review processes as provided for by Article 97 of Directive 2013/ 36/EU and Article 248 of Directive 2009/138/EC.