S.L. 370.47 Art. 9Supervisoryreview and evaluation. 

(1) The competent authority shall review, to the extent relevant and necessary, taking into account the investment firm’s size, risk profile and business model, the arrangements, strategies, processes and mechanisms implemented by the investment firm to comply with the IFD and IFR and evaluate the following as appropriate and relevant, so as to ensure a sound management and coverage of its risks:

(a) the risks referred to in Article 29 of the IFD;

(b) the geographical location of an investment firm’s exposures;

(c) the business model of the investment firm;

(d) the assessment of systemic risk, taking into account the identification and measurement of systemic risk under Article 23 of Regulation 1093/2010 or recommendations of the ESRB;

(e) the risks posed to the security of investment firms’ network and information systems to ensure confidentiality, integrity and availability of their processes, data and assets;

(f) the exposure of investment firms to the interest rate risk arising from non‐trading book activities;

(g) governance arrangements of investment firms and the ability of members of the management body to perform their duties:

Provided that for the purposes of this sub-regulation, the competent authority shall duly take into account whether the investment firm holds a professional indemnity insurance.

(2) The competent authority shall establish the frequency and intensity of the review and evaluation referred to in sub-regulation

(1) having regard to the size, systemic importance, nature, scale and complexity of the activities of the investment firm concerned and taking into account the principle of proportionality. The provisions of the Investment Services Act (Control of Assets) Regulations must be taken into consideration.

(3) The competent authority shall decide on a case‐by‐case basis whether and in which form the review and evaluation is to be carried out with regard to investment firms that meet the conditions for qualifying as small and non‐interconnected investment firms set out in Article 12(1) of the IFR, only where it deems it to be necessary due to the size, nature, scale and complexity of the activities of those investment firms. INVESTMENT FIRMS DIRECTIVE)

(4) When conducting the review and evaluation referred to in paragraph (g) of sub-regulation (1), the competent authority shall have access to agendas, minutes and supporting documents for meetings of the management body and its committees, and the results of the internal or external evaluation of the performance of the management body.