Legal references and instructions

Row number

Explanation

(a)

The concise risk statement approved by the management body in the application of point (f) of Article 435(1) CRR shall describe how the business model determines and interacts with the overall risk profile: for instance, the key risks related to the business model and how each of these risks is reflected and described in the risk disclosures, or how the risk profile of the institution interacts with the risk tolerance approved by the management body.

Within the risk statement in the application of point (f) of Article 435(1) CRR, institutions shall also disclose the nature, extent, purpose and economic substance of material transactions within the group, affiliates and related parties. The disclosure shall be limited to transactions that have a material impact on the risk profile of the institution (including reputational risk) or the distribution of risks within the group. Institutions shall also include key ratios and figures that show how the risk profile of the institution interacts with the risk tolerance set by the management body.

(b)

Information to be disclosed in the application of point (b) of Article 435(1) CRR includes the risk governance structure for each type of risk: responsibilities attributed throughout the institution (including, where relevant, oversight and delegation of authority and breakdown of responsibilities between the management body, the business lines and the risk management function by type of risk, business unit, and other relevant information); relationships between the bodies and functions involved in risk management processes (including, as appropriate, the management body, risk committee, risk management function, compliance function, internal audit function); and the organisational and internal control procedures.

When disclosing the structure and organisation of the relevant risk management function, institutions shall complement the disclosure with the following information:

(c)

The declaration that institutions shall disclose in compliance with point (e) of Article 435(1) CRR, on the adequacy of the risk management arrangements, has to be approved by the management body and provide assurance that the risk management systems put in place are adequate taking into account the institution’s risk profile and its strategy.

(d)

As part of the disclosures required in point (c) of Article 435(1) CRR, institutions shall disclose the scope and nature of risk disclosure and/or measurement systems and the description of the flow on risk to the management body and senior management.

(e)

When providing information on the main features of risk disclosure and measurement systems in the application of point (c) of Article 435(1) CRR, institutions shall disclose their policies regarding systematic and regular reviews of risk management strategies, and the periodical assessment of their effectiveness.

(f)

Disclosure on the strategies and processes to manage risk in the application of point (a) of Article 435(1) CRR shall include qualitative information on stress testing, such as the portfolios subject to stress testing, scenarios adopted and methodologies used, and the use of stress testing in risk management.

(g)

Institutions shall provide information on the strategies and processes to manage, hedge and mitigate risks, as well as on the monitoring of the effectiveness of hedges and mitigants in accordance with points (a) and (d) of Article 435(1) CRR for risks that arise from the institutions’ business model.

Legal references and instructions

Row number

Explanation

(a)

Institutions shall disclose the number of directorships held by members of the management body in accordance with point (a) of Article 435(2) CRR. When disclosing this information, the following specifications apply:

(b)

When disclosing information regarding the recruitment policy for the selection of members of the management body in accordance with point (b) of Article 435(2) CRR, institutions shall include information on the actual knowledge, skills and expertise of the members. Institutions shall include information on the policy possibly resulting from succession planning and on any foreseeable changes within the overall composition of the management body.

(c)

When disclosing their diversity policy in accordance with point (c) of Article 435(2) CRR, institutions shall disclose information on the objectives and any relevant targets set out in that policy, and the extent to which those objectives and targets have been achieved.

In particular institutions shall disclose the policy on gender diversity, including:

(d)

Institution shall disclose if they have set up a separate risk committee, and the number of times the risk committee has met in accordance with point (d) of Article 435(2) CRR.

(e)

As part of data on the information flow on risk to the management body in the application of point (e) of Article 435(2) CRR, institutions shall describe the process of the risk disclosure provided to the management body, particularly the frequency, scope and main content of risk exposure and how the management body was involved in defining the content to be disclosed.