Article 9

Internal control mechanisms and risk management processes

1. The Member States shall require regulated entities to have, in place at the level of the financial conglomerate, adequate risk management processes and internal control mechanisms, including sound administrative and accounting procedures.

2. The risk management processes shall include:

(a) sound governance and management with the approval and periodical review of the strategies and policies by the appropriate governing bodies at the level of the financial conglomerate with respect to all the risks they assume;

(b) adequate capital adequacy policies in order to anticipate the impact of their business strategy on risk profile and capital requirements as determined in accordance with Article 6 and Annex I;

(c) adequate procedures to ensure that their risk monitoring systems are well integrated into their organisation and that all measures are taken to ensure that the systems implemented in all the undertakings included in the scope of supplementary supervision are consistent so that the risks can be measured, monitored and controlled at the level of the financial conglomerate.

3. The internal control mechanisms shall include:

(a) adequate mechanisms as regards capital adequacy to identify and measure all material risks incurred and to appropriately relate own funds to risks;

(b) sound reporting and accounting procedures to identify, measure, monitor and control the intra-group transactions and the risk concentration.

4. The Member States shall ensure that, in all undertakings included in the scope of supplementary supervision pursuant to Article 5, there are adequate internal control mechanisms for the production of any data and information which would be relevant for the purposes of the supplementary supervision.

5. The processes and mechanisms referred to in paragraphs 1 to 4 shall be subject to supervisory overview by the coordinator.

SECTION 3

MEASURES TO FACILITATE SUPPLEMENTARY SUPERVISION