> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/eu-level/guidelines/esma35-36-2319-joint-suitability-mgmt-body.md). # ESMA35-36-2319 — Joint EBA and ESMA Guidelines on the assessment of the ... | | | | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | **Authority** | Joint (ESMA, EBA) | | **Reference** | ESMA35-36-2319 / EBA/GL/2021/06 | | **Legal basis** | Article 91(12) CRD IV; Article 9(1) MiFID II | | **Status** | In force | | **Published** | 2 July 2021 | | **Source** | [ESMA landing page](https://www.esma.europa.eu/document/joint-eba-and-esma-guidelines-assessment-suitability-members-management-body-and-key) | | **Documents** | [Guideline PDF](https://www.esma.europa.eu/sites/default/files/library/joint_eba_and_esma_gl_on_the_assessment_of_suitability.pdf) | | EBA/GL/2021/06 | | -------------- | | ESMA35-36-2319 | | 2 July 2021 | ## Guidelines on the assessment of the suitability of members of the management body and key function holders ## 1. Compliance and reporting obligations ### Status of these Guidelines 1. These Guidelines are issued pursuant to Article 16 of the ESA Regulations. In accordance with Article 16(3), competent authorities and financial institutions shall make every effort to comply with the Guidelines. 2. These Guidelines set out appropriate supervisory practices within the European System of Financial Supervision and regarding how Union law should be applied. Competent authorities to which these Guidelines apply should comply by incorporating them into their supervisory practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where Guidelines are directed primarily at institutions. ### Reporting requirements 3. According to Article 16(3) of Regulation (EU) No 1093/2010 and Article 16(3) of Regulation (EU) No 1095/2010, competent authorities must notify the EBA and ESMA as to whether they comply or intend to comply with these Guidelines, or otherwise with reasons for noncompliance, by \[28.12.2021]. In the absence of any notification by this deadline, the competent authority will be considered to be non-compliant by the EBA and ESMA. Notifications should be sent by submitting the form available on the EBA website to with the reference ' EBA/GL/2021/06 ' and the form available on the ESMA website to with the reference ' ESMA35-36-2319 ' . Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authority. Any change in the status of compliance must also be reported to the EBA and ESMA. 4. Notifications will be published on the EBA website, in line with Article 16(3) of Regulation (EU) No 1093/2010, and on the ESMA website, in line with Article 16(3) of Regulation (EU) No 1095/2010. ## 2. Subject matter, scope and definitions ### Subject matter 5. These Guidelines specify further, in accordance with Article 91(12) of Directive 2013/36/EU 2 and Article 9(1) second subparagraph of Directive 2014/65/EU 3 , the requirements regarding the suitability of members of the management body in particular, the notions of sufficient time commitment; honesty, integrity and independence of mind of a member of the management body; adequate collective knowledge, skills and experience of the management body; and adequate human and financial resources devoted to the induction and training of such members. The notion of diversity to be taken into account for the selection of members of the management body is also specified in accordance with the above-mentioned articles. 6. The Guidelines also specify elements regarding the suitability of the heads of internal control functions and the chief financial officer (CFO), where they are not part of the management body, and, where identified on a risk-based approach by those institutions, of other key function holders, as part of the governance arrangements referred to in Articles 74 and 88 of Directive 2013/36/EU and Articles 9(3), 9(6) and 16(2) of Directive 2014/65/EU, and on the related assessment processes, governance policies and practices, including the principle of independence applicable to certain members of the management body in its supervisory function. ### Addressees 7. These Guidelines are addressed to competent authorities as defined in Article 4 (2) (i) of Regulation 1093/2010 and in Article 4(3) (i) of Regulation 1095/2010, to financial institutions as defined in Article 4(1) of that Regulation that are institutions for the purposes of the application of Directive 2013/36/EU as defined in point 3 of Article 3(1) of Directive 2013/36/EU also having regard to Article[^1] (3) of that Directive, and to financial market participants as defined in Article 4(1) of Regulation 1095/2010 that are investment firms as defined in Article 4(1)(1) of Directive 2014/65/EU ( ' institutions ' ). ### Scope of application 8. Unless otherwise specified as directly referring to either CRD institutions, or relevant institutions, these Guidelines apply to all institutions, as defined therein. 9. CRD institutions subject to Directive 2013/36/EU should comply with these Guidelines on an individual, sub-consolidated and consolidated basis, including their subsidiaries not subject to Directive 2013/36/EU, even if they are established in a third country, including offshore financial centres, in accordance with Article 109 of that Directive. 10. The Guidelines intend to embrace all existing board structures and do not advocate any particular structure. The Guidelines do not interfere with the general allocation of competences in accordance with national company law. Accordingly, they should be applied irrespective of the board structures used (unitary and/or a dual board structure and/or other structures) across Member States. The management body, as defined in points (7) and (8) of Article 3(1) of Directive 2013/36/EU, should be understood as having management (executive) and supervisory functions (non-executive). 11. The terms 'management body in its management function' and 'management body in its supervisory function' are used throughout these Guidelines without referring to any specific governance structure and references to the management (executive) or supervisory (nonexecutive) function should be understood as applying to the bodies or members of the management body responsible for that function in accordance with national law. 12. In Member States where the management body delegates, partially or fully, the executive functions to a person or an internal executive body (e.g. chief executive officer (CEO), management team or executive committee), the persons who perform those executive functions on the basis of that delegation should be understood as constituting the management function of the management body. For the purposes of these Guidelines, any reference to the management body in its management function should be understood as including also the members of such an executive body or the CEO, as defined in these Guidelines, even if they have not been proposed or appointed as formal members of the institution ' s governing body or bodies under national law. 13. In Member States where some responsibilities assigned in these Guidelines to the management body are directly exercised by shareholders, members or owners of the institution rather than the management body, institutions should ensure that such responsibilities and related decisions are exercised, as far as possible, in line with the Guidelines applicable to the management body. 14. The definitions of CEO, CFO and key function holder used in these Guidelines are purely functional and are not intended to impose the appointment of those officers or the creation of such positions unless prescribed by relevant EU or national law. 15. Any references to ' risks ' in these Guidelines should include also money laundering and terrorist financing risks and environmental, social and governance risk factors. ### Definitions 16. Unless otherwise specified, terms used and defined in Directive 2013/36/EU, Regulation (EU) 575/2013 and Directive 2014/65/EU have the same meaning in the Guidelines. In addition, for the purposes of these Guidelines, the following definitions apply: ### Table | Institutions | means institutions as defined in point 3 of Article 3(1) of Directive 2013/36/EU having also regard to Article 3(3) of that Directive, and investment firms as defined in Article 4(1)(1) of Directive 2014/65/EU. | | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | Full table: see [document](https://www.esma.europa.eu/sites/default/files/library/joint_eba_and_esma_gl_on_the_assessment_of_suitability.pdf). published by ESMA in accordance with Article 56 of Directive 2014/65/EU, in one or more Member States . 5 ### Table | Staff | means all employees of an institution and its subsidiaries within its scope of consolidation, including subsidiaries not subject to Directive 2013/36/EU, and all members of the management body in its management function and in its supervisory function. | | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | Full table: see [document](https://www.esma.europa.eu/sites/default/files/library/joint_eba_and_esma_gl_on_the_assessment_of_suitability.pdf). ### Table | Prudential consolidation | means the application of the prudential rules set out in Directive 2013/36/EU and Regulation (EU) No 575/2013 on a consolidated or sub-consolidated basis, in accordance with Part 1, Title 2, Chapter 2 of Regulation (EU) No 575/2013. | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | Full table: see [document](https://www.esma.europa.eu/sites/default/files/library/joint_eba_and_esma_gl_on_the_assessment_of_suitability.pdf). | Executive directorship | meansadirectorship in which a person is responsible for effectively directing the business of an entity. | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | AML/CFT supervisor | means a competent authority responsible for the supervision of institutions' compliance with provisions of Directive (EU) 2015/849. | ## 3. Implementation ### Date of application 17. These Guidelines apply from 31 December 2021. ## Repeal The EBA Guidelines on the assessment of the suitability of members of the management body and key function holders (EBA/GL/2017/12) of 26 September 2017 are repealed with effect from 31 December 2021. ## 4. Guidelines ## Title I - Application of the proportionality principle 18. The proportionality principle aims to match governance arrangements consistently with the individual risk profile and business model of the institution and takes into account the individual position for which an assessment is made so that the objectives of the regulatory requirements are effectively achieved. 19. Institutions should take into account their size, their internal organisation and the nature, scale and complexity of their activities when developing and implementing policies and processes set out in these Guidelines. Significant institutions should have more sophisticated policies and processes, while in particular small and less complex institutions may implement simpler policies and processes. Institutions should note that the size or systemic importance of an institution may not, by itself, be indicative of the extent to which an institution is exposed to risks. Those policies and processes should, however, ensure compliance with the criteria specified in these Guidelines to assess the suitability of members of the management body and key function holders and the elements to take diversity into account when recruiting members to the management body and to provide sufficient resources for their induction and training. 20. All members of the management body and key function holders should, in any event, be of sufficiently good repute and have honesty and integrity, and all members of the management body should have independence of mind regardless of the institution's size, internal organisation and the nature, scope and complexity of its activities, and the duties and responsibilities of the specific position, including memberships held in committees of the management body. 21. For the purpose of applying the principle of proportionality and in order to ensure the appropriate implementation of the governance requirements of Directive 2013/36/EU and Directive 2014/65/EU which the Guidelines further specify, the following criteria should be taken into account by institutions and competent authorities: 1. the size of the institution in terms of the balance sheet total, the client assets held or managed, and/or the volume of transactions processed by the institution or its subsidiaries within the scope of prudential consolidation; 2. the legal form of the institution, including whether or not the institution is part of a group and, if so, the proportionality assessment for the group; 3. whether the institution is listed or not; 4. the type of authorised activities and services performed by the institution (see also Annex 1 of Directive 2013/36/EU and Annex 1 of Directive 2014/65/EU); 5. the geographical presence of the institution and the size of the operations in each jurisdiction; 6. the underlying business model and strategy, the nature and complexity of the business activities, and the institution's organisational structure; 7. the risk strategy, risk appetite and actual risk profile of the institution, also taking into account the result of the annual capital adequacy assessment; 8. the authorisation for institutions to use internal models for the measurement of capital requirements, where relevant; 9. the type of clients[^2]; and 10. the nature and complexity of the products, contracts or instruments offered by the institution. ## Title II -Scope of suitability assessments by institutions ## 1. The institutions ' assessment of the individual suitability of members of the management body 22. Institutions should have the primary responsibility for ensuring, in accordance with Article 91(1) of Directive 2013/36/EU, that the members of the management body are individually suitable at all times and should assess or re-assess the suitability, in particular: 1. when applying for authorisation to take up the business; 2. when material changes to the composition of the management body occur, including: 1. when appointing new members of the management body, including as a result of a direct or indirect acquisition or increase of a qualifying holding in an institution. This assessment should be limited to newly appointed members; 2. when re-appointing members of the management body, if the requirements of the position have changed or if the member is appointed to a different position within the management body. This assessment should be limited to the members whose position has changed and to the analysis of the relevant aspects, taking into account any additional requirements for the position; 3. on an ongoing basis in accordance with paragraphs 26 and 27. 23. The initial and ongoing assessment of the individual suitability of the members of the management body is the responsibility of institutions, without prejudice to the assessment carried out by competent authorities for supervisory purposes. 24. Institutions should assess, in particular, whether or not the members: 1. are of sufficiently good repute; 2. possess sufficient knowledge, skills and experience to perform their duties; 3. are able to act with honesty, integrity and independence of mind to effectively assess and challenge the decisions of the management body in its management function and other relevant management decisions where necessary and to effectively oversee and monitor management decision-making; 4. are able to commit sufficient time to performing their functions in the institution and, where the institution is significant, whether or not the limitation of directorships under Article 91(3) of Directive 2013/36/EU is being complied with. 25. Where an assessment is made for a specific position, the assessment of sufficient knowledge, skills, experience and time commitment should take into account the role of the specific position concerned. The level and nature of the sufficient knowledge, skills and experience required from a member of the management body in its management function may differ from that required from a member of the management body in its supervisory function, in particular if these functions are assigned to different bodies. 26. Institutions should monitor on an ongoing basis the suitability of the members of the management body to identify, in the light of any relevant new fact, situations where a reassessment of their suitability should be performed. In particular, a re-assessment should be performed in the following cases: 1. when there are concerns regarding the individual or collective suitability of the members of the management body; 2. in the event of a material impact on the reputation of a member of the management body, or the institution, including cases where members do not comply with the institution's conflict of interest policy; 3. where there are reasonable grounds to suspect that money laundering or terrorist financing has been or is being committed or attempted or there is an increased risk thereof in connection with that institution and in particular in situations where information available suggests that the institution: 1. has not implemented appropriate internal controls or oversight mechanisms to monitor and mitigate ML/TF risks (e.g. identified by supervisory findings from onsite inspections or off-site inspections, supervisory dialogue or in the context of sanctions); 2. has been found to be in breach of its AML/CFT obligations in the home or host Member State or in a third country; 3. has materially changed its business activity or business model in a manner that suggests that its exposure to ML/TF risk has significantly increased; or 4. in any event that can otherwise materially affect the suitability of the member of the management body. 27. Institutions should also re-assess the sufficient time commitment of a member of the management body if that member takes on an additional directorship or starts to perform new relevant activities, including political ones. 28. Institutions should base their suitability assessments on the notions defined in Title III, taking into account the diversity of the management body as specified in Title V, and should implement a suitability policy and processes as set out, respectively, in Titles VI and VII. ## 2. The institutions ' assessment of the collective suitability of the management body 29. Institutions should ensure, in fulfilling the obligation set out in Article 91(7) of Directive 2013/36/EU, that at all times the management body collectively possesses adequate knowledge, skills and experience to be able to understand the institution ' s activities, including the main risks. Notwithstanding the experience, knowledge and skills requirement for each member of the management body, institutions should ensure that the overall composition of the management body reflects an adequately broad range of knowledge, skills and experience to understand the institution's activities , including main risks. 30. Institutions should assess or re-assess the collective suitability of the management body, in particular: 1. when applying for authorisation to take up the business, including situations where additional activities are authorised; 2. when material changes to the composition of the management body occur, including: 1. when appointing new members of the management body, including as a result of a direct or indirect acquisition or increase of a qualifying holding in an institution[^3]; 2. when re-appointing members of the management body, if the requirements of the position have changed or if the members are appointed to a different position within the management body; 3. when appointed or reappointed members cease to be members of the management body; 3. on an ongoing basis, in accordance with paragraph 31. 31. Institutions should re-assess the collective suitability of the members of the management body, in particular, in the following cases: 1. when there is a material change to the institution's business model , risk appetite or strategy or structure at individual or group level; 2. as part of the review of the internal governance arrangements by the management body; 3. where there are reasonable grounds to suspect that money laundering or terrorist financing has been or is being committed or attempted or there is an increased risk thereof in connection with that institution and in particular in situations where information available suggests that the institution 1. has not implemented appropriate internal controls or oversight mechanisms to monitor and mitigate ML/TF risks (e.g. identified by supervisory findings from on-site inspections or off-site inspections, supervisory dialogue or in the context of sanctions); 2. has been found to be in breach of its AML/CFT obligations in the home or host Member State or in a third country; or 3. has materially changed its business activity or business model in a manner that suggests that its exposure to ML/TF risk has significantly increased; 4. in any event that can otherwise materially affect the collective suitability of the management body. 32. Where re-assessments of the collective suitability are performed, institutions should focus their assessment on the relevant changes in the institution ' s business activities, strategies and risk profile and in the distribution of duties within the management body and their effect on the required collective knowledge, skills and experience of the management body. 33. Institutions should base their suitability assessments on the notions defined in Title III and should implement a suitability policy and processes as set out in Titles VI and VII. 34. The assessment of the initial and ongoing collective suitability of the management body is the responsibility of institutions. Where the assessment is also carried out by competent authorities for supervisory purposes, the responsibility to assess and ensure the collective suitability of the management body continues to remain with the institutions. ## 3. The relevant institutions' assessment of the suitability of key function holders 35. While all institutions should ensure that their staff are able to perform their functions adequately, relevant institutions should specifically ensure that key function holders are of sufficient good repute, have honesty and integrity, and possess sufficient knowledge, skills and experience for their positions at all times and assess the aforementioned elements, in particular: 1. when applying for an authorisation; 2. when appointing new key function holders, including as a result of a direct or indirect acquisition or increase of a qualifying holding in an institution; 3. where necessary, in accordance with paragraph 36. 36. Relevant institutions should monitor on an ongoing basis the reputation, honesty, integrity, knowledge, skills and experience of key function holders to identify, in the light of any relevant new fact, situations where a re-assessment should be performed. In particular a reassessment should be made in the following cases: 1. where there are concerns regarding their suitability; 2. in the event of a material impact on the reputation of the individual; 3. where there are reasonable grounds to suspect that money laundering or terrorist financing has been or is being committed or attempted or there is an increased risk thereof in connection with that institution and in particular in situations where the institution: 1. has not implemented appropriate internal controls or oversight mechanisms to monitor and mitigate ML/TF risks (e.g. identified by supervisory findings from on-site inspections or off-site inspections, supervisory dialogue or in the context of sanctions); 2. has been found to be in breach of its AML/CFT obligations at home or abroad; or 3. has materially changed its business activity or business model in a manner that suggests that its exposure to ML/TF risk has significantly increased; 4. as part of the review of the internal governance arrangements by the management body; 5. in any event that can otherwise materially affect the suitability of the individual. 37. The assessment of the individual reputation, honesty, integrity, knowledge, skills and experience of key function holders should be based on the same criteria as those applied to the assessment of such suitability requirements of the members of the management body. When assessing knowledge, skills and experience, the role and duties of the specific position should be considered. 38. Assessing the initial and ongoing suitability of key function holders is the responsibility of the institutions. Where the assessment for some key function holders is also carried out by competent authorities for supervisory purposes, the responsibility to assess and ensure the suitability of those key function holders continues to remain with the institutions. ## Title III -Notions of suitability listed in Article 91(12) of Directive 2013/36/EU ## 4. Sufficient time commitment of a member of the management body 39. Institutions should assess whether or not a member of the management body is able to commit sufficient time to performing his or her functions and responsibilities including understanding the business of the institution, its main risks and the implications of the business and the risk strategy. Where the person holds a mandate in a significant CRD institution, this should include an assessment to ensure that the limitation of the maximum number of directorships under Article 91(3) of Directive 2013/36/EU or Article 9(2) of Directive 2014/65/EU, as applicable, is being complied with. 40. Members should also be able to fulfil their duties in periods of particularly increased activity, such as a restructuring, a relocation of the institution, an acquisition, a merger, a takeover or a crisis situation, or as a result of some major difficulty with one or more of its operations, taking into account that in such periods a higher level of time commitment than in normal periods may be required. 41. In the assessment of sufficient time commitment of a member, institutions should take at least the following into account: 1. the number of directorships in financial and non-financial companies held by that member at the same time, taking into account possible synergies when they are held within the same group, including when acting on behalf of a legal person or as an alternate of a member of the management body; 2. the size, nature, scope and complexity of the activities of the entity where the member holds a directorship and, in particular, whether or not the entity is a non-EU entity; 3. the member's geographical presence and the travel time required for the role; 4. the number of meetings scheduled for the management body; 5. the directorships in organisations which do not pursue predominantly commercial objectives held by that member at the same time; 6. any necessary meetings to be held, in particular, with competent authorities or other internal or external stakeholders outside the management body's formal meeting schedule; 7. the nature of the specific position and the responsibilities of the member, including specific roles such as CEO, chairperson, or chair or member of a committee, whether the member holds an executive or non-executive position, and the need of that member to attend meetings in the companies listed in point (a) and in the institution; 8. other external professional or political activities, and any other functions and relevant activities, both within and outside the financial sector and both within and outside the EU; 9. the necessary induction and training; 10. any other relevant duties of the member that institutions consider to be necessary to take into account when carrying out the assessment of sufficient time commitment of a member; and 11. available relevant benchmarking on time commitment, including the benchmarking provided by the EBA. 42. Institutions should record in writing the roles, duties and required capabilities of the various positions within the management body and the expected time commitment required for each position, also taking into account the need to devote sufficient time for induction and training. For this purpose, smaller and less complex institutions may differentiate the expected time commitment only between executive and non-executive directorships. 43. A member of the management body should be made aware of the expected time commitment required to spend on his or her duties. Institutions may require the member to confirm that he or she can devote that amount of time to the role. 44. Institutions should monitor whether the members of the management body commit sufficient time to performing their functions. Preparation for meetings, attendance and the active involvement of members in management body meetings are all indicators of time commitment. 45. An institution should also consider the impact of any long-term absences of members of the management body in its assessment of the sufficient time commitment of other individual members of the management body. 46. Institutions should keep records of all external professional and political positions held by the members of the management body. Such records should be updated whenever a member notifies the institution of a change and when such changes come otherwise to the attention of the institution. Where changes to such positions occur that may reduce the ability of a member of the management body to commit sufficient time to performing his or her function, the institution should reassess the member's ability to respect the required time commitment for his or her position. ## 5. Calculation of the number of directorships 47. In addition to the requirement to commit sufficient time to performing their functions, members of the management body that hold a directorship within a significant CRD institution must comply with the limitation of directorships set out in Article 91(3) of Directive 2013/36/EU. 48. For the purposes of Article 91(3) of Directive 2013/36/EU, where a directorship involves at the same time executive and non-executive responsibilities, the directorship should count as an executive directorship. 49. Where multiple directorships count as a single directorship, as described in Article 91(4) of Directive 2013/36/EU and as set out in paragraphs 50 to 55, that single directorship should count as a single executive directorship when it includes at least one executive directorship; otherwise it should count as a single non-executive directorship. 50. In accordance with Article 91(4)(a) of Directive 2013/36/EU, all directorships held within the same group count as a single directorship. 51. In accordance with Article 91(4)(b)(ii) of Directive 2013/36/EU, all directorships held within undertakings in which the institution holds a qualifying holding, but which are not subsidiaries included within the same group, count as a single directorship. That single directorship in qualifying holdings counts as a separate single directorship, i.e. the directorship held within the same institution and the single directorship in its qualifying holdings together count as two directorships. 52. When multiple institutions within the same group hold qualifying holdings, the directorships in all qualifying holdings should be counted, taking into account the consolidated situation (based on the accounting scope of consolidation) of the institution, as one separate single directorship. That single directorship in qualifying holdings counts as a separate single directorship, i.e. the single directorship counted for the directorships held within entities that belong to the group and the single directorship counted for the directorships held in all qualifying holdings of the same group count together as two directorships. 53. Where a member of the management body holds directorships in different groups or undertakings, all directorships held within the same institutional protection scheme, as referred to in Article 91(4)(b)(i) of Directive 2013/36/EU, count as a single directorship. Where the application of the rule set out in Article 91(4)(b)(i) of Directive 2013/36/EU, regarding the counting of directorships within the same institutional protection scheme, leads to a higher count of single directorships than the application of the rule set out in Article 91(4)(a) regarding the counting of single directorships within groups, the resulting lower number of single directorships should apply (e.g. where directorships are held within two groups, in both cases within undertakings that are members and at the same time within undertakings that are not members of the same institutional protection scheme, only two single directorships should be counted). 54. Directorships held in entities which do not pursue predominantly commercial objectives must not be counted when calculating the number of directorships under Article 91(3) of that Directive. However, such activities should be taken into account when assessing the time commitment of the concerned member. 55. Entities which do not pursue predominantly commercial objectives include among others: 1. charities; 2. other not-for-profit organisations; and 3. companies that are set up for the sole purpose of managing the private economic interests of members of the management body or their family members, provided that they do not require day-to-day management by the member of the management body. ## 6. Adequate knowledge, skills and experience 56. Members of the management body should have an up-to-date understanding of the business of the institution and its risks, at a level commensurate with their responsibilities. This includes an appropriate understanding of those areas for which an individual member is not directly responsible but is collectively accountable together with the other members of the management body. 57. Members of the management body should have a clear understanding of the institution's governance arrangements, their respective role and responsibilities and, where applicable, the group structure and any possible conflicts of interest that may arise therefrom. Members of the management body should be able to contribute to the implementation of an appropriate culture, corporate values and behaviour within the management body and the institution. 58. Without prejudice to the national transposition of Directive 2015/849/EU, the member of the management body identified as responsible for the implementation of the laws, regulations and administrative provisions necessary to comply with Directive (EU) 2015/849 12 should have good knowledge, skills and relevant experience regarding ML/TF risk identification and assessment, and AML/CFT policies, controls and procedures. This person should have a good understanding of the extent to which the institution ' s business model exposes it to ML/TF risks. 59. In this respect, the assessment of adequate knowledge, skills and experience should consider: 1. the role and duties of the position and the required capabilities; 2. the knowledge and skills attained through education, training and practice; 3. the practical and professional experience gained in previous positions; and 12 The identification of a member of the management body as responsible for AML is for the purpose of allocation of duties and is without prejudice to the final responsibility of the management body in its management function for the day-to-day management of the institution and its responsibility for all activities of the institution. * d. the knowledge and skills acquired and demonstrated by the professional conduct of the member of the management body. 60. To properly assess the skills of the members of the management body, institutions should consider using the non-exhaustive list of relevant skills set out in Annex II to these Guidelines, taking into account the role and duties of the position occupied by the member of the management body. 61. The level and profile of the education of the member and whether or not it relates to banking and financial services or other relevant areas should be considered. In particular, education in the areas of banking and finance, economics, law, accounting, auditing, administration, financial regulation, information technology and quantitative methods can in general be considered to be relevant for the financial services sector. 62. The assessment should not be limited to the educational degree of the member or proof of a certain period of service in an institution. A more thorough analysis of the member's practical experience should be conducted, as the knowledge and skills gained from previous occupations depend on the nature, scale and complexity of the business as well as the function that the member performed within it. 63. When assessing the knowledge, skills and experience of a member of the management body, consideration should be given to theoretical and practical experience relating to: 1. banking and financial markets; 2. legal requirements and regulatory framework; 3. strategic planning, the understanding of an institution's business strategy or business plan and accomplishment thereof; 4. risk management (identifying, assessing, monitoring, controlling and mitigating the main types of risk of an institution including environmental, governance and social risks and risk factors); 5. accounting and auditing; 6. the assessment of the effectiveness of an institution's arrangements, ensuring effective governance, oversight and controls; 7. the interpretation of an institution's financial information, the identification of key issues based on this information, and appropriate controls and measures. 64. Members of the management body in its management function should have gained sufficient practical and professional experience from a managerial position over a sufficiently long period. Short-term positions may be considered as part of the assessment, but such positions alone should not be sufficient to assume that a member has sufficient experience. When assessing the practical and professional experience gained from previous positions, particular consideration should be given to: * a. the nature of the management position held and its hierarchical level; * b. the length of service; * c. the nature and complexity of the business where the position was held, including its organisational structure; * d. the scope of competencies, decision-making powers and responsibilities of the member; * e. the technical knowledge gained through the position; * f. the number of subordinates. 65. Members of the management body in its supervisory function should be able to provide constructive challenge to the decisions and effective oversight of the management body in its management function. Adequate knowledge, skills and experience for fulfilling the supervisory function effectively may have been gained from relevant academic or administrative positions or through the management, supervision or control of financial institutions or other firms. ## 7. Collective suitability criteria 66. The management body should collectively be able to understand the institution's activities, including the main risks. Unless otherwise indicated in this section, these criteria should be applied separately to the management body in its management function and the management body in its supervisory function. 67. The members of the management body should collectively be able to take appropriate decisions considering the business model, risk appetite, strategy and markets in which the institution operates. 68. Members of the management body in its supervisory function should collectively be able to effectively challenge and monitor decisions made by the management body in its management function. 69. All areas of knowledge required for the institution's business activities should be covered by the management body collectively with sufficient expertise among members of the management body. There should be a sufficient number of members with knowledge in each area to allow a discussion of decisions to be made. The members of the management body should collectively have the skills to present their views and to influence the decision-making process within the management body. 70. The composition of the management body should reflect the knowledge, skills and experience necessary to fulfil its responsibilities. This includes that the management body collectively has an appropriate understanding of those areas for which the members are collectively accountable, and the skills to effectively manage and oversee the institution, including the following aspects: 1. the business of the institution and main risks related to it; 2. each of the material activities of the institution; 3. relevant areas of sectoral/financial competence, including financial and capital markets, solvency and models, environmental, governance and social risks and risk factors; 4. financial accounting and reporting; 5. risk management, compliance and internal audit; 6. information technology and security; 7. local, regional and global markets, where applicable; 8. the legal and regulatory environment; 9. managerial skills and experience; 10. the ability to plan strategically; 11. the management of (inter)national groups and risks related to group structures, where applicable. 71. While the management body in its management function should collectively have a high level of managerial skills, the management body in its supervisory function should collectively have sufficient management skills to organise its tasks effectively and to be able to understand and challenge the management practices applied and decisions taken by the management body in its management function. ## 8. Reputation, honesty and integrity 72. A member of the management body should be deemed to be of good repute and of honesty and integrity if there are no objective and demonstrable grounds to suggest otherwise, in particular taking into account the relevant available information on the factors or situations listed in paragraphs 73 to 77. The assessment of reputation, honesty and integrity should also consider the impact of the cumulative effects of minor incidents on a member's reputation. 73. Without prejudice to any fundamental rights, any relevant criminal or administrative records should be taken into account for the assessment of good repute, honesty and integrity, considering the type of conviction or indictment, the role of the individual involved, the penalty received, the phase of the judicial process reached and any rehabilitation measures that have taken effect. The surrounding circumstances, including mitigating factors, the seriousness of any relevant offence or administrative or supervisory action, the time elapsed since the offence, the member's conduct since the offence or action, and the relevance of the offence or action to the member's role should be considered. Any relevant criminal or administrative records should be taken into account considering periods of limitation in force in the national law. 74. Without prejudice to the presumption of innocence applicable to criminal proceedings, and other fundamental rights, the following factors should at least be considered in the assessment of reputation, honesty and integrity: 1. convictions or ongoing prosecutions for a criminal offence, in particular: 1. offences under the laws governing banking, financial, securities, insurance activities, or concerning securities markets or financial or payment instruments, including laws on money laundering and terrorism financing or any of the predicate offences to ML set out in Directive (EU) 2015/849, corruption, market manipulation, or insider dealing and usury; 2. offences of dishonesty, fraud or other financial crime; 3. tax offences, whether committed directly or indirectly, including through unlawful or banned dividend arbitrage schemes; 4. other offences under legislation relating to companies, bankruptcy, insolvency, or consumer protection; 2. other relevant current or past findings and measures taken by any regulatory or professional body for non-compliance with any relevant provisions governing banking, financial, securities or insurance activities or any of the matters in paragraph (a) above. 75. Ongoing investigations should be taken into account when resulting from judicial or administrative procedures or other analogous regulatory investigations without prejudice to fundamental individual rights. Other adverse reports with relevant, credible and reliable information (e.g. as part of whistleblowing procedures) should also be considered by institutions and competent authorities. 76. The following situations relating to the past and present business performance and financial soundness of a member of the management body should be considered, with regard to their potential impact on the member's reputation, integrity and honesty: 1. being a defaulting debtor (e.g. having negative records at a reliable credit bureau if available); 2. financial and business performance of entities owned or directed by the member or in which the member had or has significant share or influence with special consideration given to any bankruptcy and winding-up proceedings and whether or not and how the member has contributed to the situation that led to the proceedings; 3. declaration of personal bankruptcy; and 4. without prejudice to the presumption of innocence, civil lawsuits, administrative or criminal proceedings, large investments or exposures and loans taken out, insofar as they can have a significant impact on the financial soundness of the member or entities owned or directed by him or her, or in which the member has a significant share. 77. A member of the management body should uphold high standards of integrity and honesty. At least the following factors should also be considered in the assessment of reputation, honesty and integrity: 1. any evidence that the person has not been transparent, open and cooperative in his or her dealings with competent authorities; 2. refusal, revocation, withdrawal or expulsion of any registration, authorisation, membership, or licence to carry out a trade, business, or profession; 3. the reasons for any dismissal from employment or from any position of trust, fiduciary relationship, or similar situation, or for having been asked to resign from employment in such a position; 4. disqualification by any relevant competent authority from acting as a member of the management body, including persons who effectively direct the business of an entity; and 5. any other evidence or serious allegation based on relevant, credible and reliable information that suggests that the person acts in a manner that is not in line with high standards of conduct. ## 9. Independence of mind and independent members ### 9.1 Interaction between independence of mind and the principle of being independent 78. When assessing the independence of members, institutions should differentiate between the notion of 'independence of mind' , applicable to all members of an institution's management body, and the principle of 'being independent' , required for certain members of a relevant institution's management body in its supervisory function. The criteria for the assessment of 'independence of mind' are provided in section 9. 2 and for the assessment of 'being independent' in section 9.3. 79. Acting with ' independence of mind ' is a pattern of behaviour, shown in particular during discussions and decision-making within the management body, and is required for each member of the management body regardless of whether or not the member is considered as 'being independent ' in accordance with section 9.3. All members of the management body should engage actively in their duties and should be able to make their own sound, objective and independent decisions and judgments when performing their functions and responsibilities. 80. ' B eing independent' mean s that a member of the management body in its supervisory function does not have any present or recent past relationships or links of any nature with the relevant institution or its management that could influence the member ' s objective and balanced judgement and reduce the member's ability to take decisions independently. The fact that a member is considered as ' being independent ' does not mean that the member of the management body should automatically be deemed to be ' independent of mind ' as the member might lack the required behavioural skills. ### 9.2 Independence of mind 81. When assessing the independence of mind as referred to in paragraph 79, institutions should assess whether or not all members of the management body have: 1. the necessary behavioural skills, including: 1. courage, conviction and strength to effectively assess and challenge the proposed decisions of other members of the management body; 2. being able to ask questions of the members of the management body in its management function; and 3. being able to resist groupthink; 2. conflicts of interest to an extent that would impede their ability to perform their duties independently and objectively. 82. When assessing the required behavioural skills of a member referred to in paragraph 82 (a), his or her past and ongoing behaviour, in particular within the institution, should be taken into account. 83. When assessing the existence of conflicts of interest referred to in paragraph 82 (b), institutions should identify actual or potential conflicts of interest in accordance with the institution's conflict of interest policy[^4] and assess their materiality. At least the following situations that could create actual or potential conflicts of interests should be considered: 1. economic interests (e.g. shares, other ownership rights and memberships, holdings and other economic interests in commercial customers, intellectual property rights, loans granted by the institution to a company owned by members of the management body); 2. personal or professional relationships with the owners of qualifying holdings in the institution; 3. personal or professional relationships with staff of the institution or entities included within the scope of prudential consolidation (e.g. close family relationships); 4. other employments and previous employments within the recent past (e.g. five years); 5. personal or professional relationships with relevant external stakeholders (e.g. being associated with material suppliers, consultancies or other service providers); 6. membership in a body or ownership of a body or entity with conflicting interests; 7. political influence or political relationships. 84. All actual and potential conflicts of interest at management body level should be adequately communicated, discussed, documented, decided on and duly managed by the management body (i.e. the necessary mitigating measures should be taken). A member of the management body should abstain from voting on any matter where that member has a conflict of interest. 85. Institutions should inform competent authorities if an institution has identified a conflict of interest that may impact the independence of mind of a member of the management body, including the mitigating measures taken. 86. Being a shareholder, owner or member of an institution, a member of affiliated companies or affiliated entities, having private accounts, loans or using other services of the institution or any entity within the scope of consolidation should not be considered by itself to affect the independence of mind of a member of the management body. 16 ### 9.3 Independent members of a relevant institution's management body in its supervisory function 87. Having independent members, as referred to in paragraph 80, and non-independent members in the management body in its supervisory function is considered good practice for all relevant institutions. 88. When determining the sufficient number of independent members, the principle of proportionality should be taken into account. Members representing employees in the management body should not be taken into account when determining the sufficient number of independent members in the management body in its supervisory function. Without prejudice to any additional requirements imposed by national law the following should apply: 1. the following relevant institutions should have a management body in its supervisory function that includes a sufficient number of independent members: 1. significant CRD institutions; 2. listed relevant institutions; 2. relevant institutions that are neither significant nor listed should, as a general principle, have at least one independent member within the management body in its supervisory function. However, competent authorities may not require any independent directors within: 1. relevant institutions that are wholly owned by a relevant institution, in particular when the subsidiary is located in the same Member State as the parent relevant institution; 2. investment firms that meet the criteria set out in point (a) of Article 32(4) of Directive 2019/2034/EU or the other criteria established by a relevant Member State in accordance with paragraphs (5) and (6) of Article 32 of Directive No 2019/2034/EU. 3. Within the overall responsibility of the management body, the independent members should play a key role in enhancing the effectiveness of checks and balances within 16 Please refer to the EBA's Guidelines on Internal Governance para 114. the relevant institutions by improving oversight of management decision-making and ensuring that: * d. the interests of all stakeholders, including minority shareholders, are appropriately taken into account in the discussions and decision-making of the management body. Independent members could also help to mitigate or offset undue dominance by individual members of the management body representing a particular group or category of stakeholders; * e. no individual or small group of members dominates decision-making; and * f. conflicts of interest between the institution, its business units, other entities within the accounting scope of consolidation and external stakeholders, including clients, are appropriately managed. 89. Without prejudice to paragraph 91, in the following situations it is presumed that a member of a relevant institution 's management body in its supervisory function is regarded as not ' being independent ' : 1. the member has or has had a mandate as a member of the management body in its management function within an institution within the scope of prudential consolidation, unless he or she has not occupied such a position for the previous five years; 2. the member is a controlling shareholder of the relevant institution, being determined by reference to the cases mentioned in Article 22(1) of Directive 2013/34/EU, or represents the interest of a controlling shareholder, including where the owner is a Member State or other public body; 3. the member has a material financial or business relationship with the relevant institution; 4. the member is an employee of or is otherwise associated with a controlling shareholder of the relevant institution; 5. the member is employed by any entity within the scope of consolidation, except when both of the following conditions are met: 1. the member does not belong to the institution ' s highest hierarchical level, which is directly accountable to the management body; 2. the member has been elected to the supervisory function in the context of a system of employees ' representation and national law provides for adequate protection against abusive dismissal and other forms of unfair treatment; 6. the member has previously been employed in a position at the highest hierarchical level in the relevant institution or another entity within its scope of prudential consolidation, being directly accountable only to the management body, and there has not been a period of at least three years between ceasing such employment and serving on the management body; 7. the member has been, within a period of three years, a principal of a material professional adviser, an external auditor or a material consultant to the relevant institution or another entity within the scope of prudential consolidation, or otherwise an employee materially associated with the service provided; 8. the member is or has been, within the last year, a material supplier or material customer of the relevant institution or another entity within the scope of prudential consolidation or had another material business relationship, or is a senior officer of or is otherwise associated directly or indirectly with a material supplier, customer or commercial entity that has a material business relationship; 9. the member receives, in addition to remuneration for his or her role and remuneration for employment in line with point (c), significant fees or other benefits from the relevant institution or another entity within its scope of prudential consolidation; 10. the member served as a member of the management body within the entity for 12 consecutive years or longer; 11. the member is a close family member of a member of the management body in the management function of the relevant institution or another entity in the scope of prudential consolidation or a person in a situation referred to under points (a) to (h). 90. The mere fact of meeting one or more situations under paragraph 89 does not automatically qualify a member as not being independent. Where a member falls under one or more of the situations set out in paragraph 89, the relevant institution may demonstrate to the competent authority that the member should nevertheless be considered as 'being independent' . To this end relevant institutions should be able to justify to the competent authority the reasoning why the member ' s ability to exercise objective and balanced judgement and to take decisions independently is not affected by the situation. 91. For the purpose of paragraph 90 relevant institutions should consider that being a shareholder of a relevant institution, having private accounts or loans or using other services, other than in the cases explicitly listed within this section, should not lead to a situation where the member is considered to be non-independent if they stay within an appropriate de minimis threshold. Such relationships should be taken into account within the management of conflicts of interest in accordance with the relevant EBA Guidelines on Internal Governance. ## Title IV -Human and financial resources for training of members of the management body ## 10. Setting objectives of induction and training 92. Institutions should provide for the induction of members of the management body to facilitate their clear understanding of the relevant laws, regulations and administrative provisions, the institution's structure, business model, risk profile and governance arrangements, and the role of the member(s) within them, and to provide for relevant general and as appropriate individually tailored training programmes. Training should also promote their awareness regarding the benefits of diversity in the management body and institution. Institutions should allocate sufficient resources for induction and training for members of the management body individually and collectively. 93. All newly appointed members of the management body should receive key information one month after taking up their position at the latest, and the induction should be completed within six months. 94. Where appointed members of the management body are subject to fulfilling a particular aspect of the knowledge and skill elements, the training and induction for that member should aim to fill the identified gap within an appropriate timeframe, where possible before the position is effectively taken up or otherwise as soon as possible after the position is effectively taken up. In any case, a member should fulfil all knowledge and skill elements as set out in section 6 not later than one year after taking up the position. Where appropriate, the institution should set a timeframe within which the necessary measures should be completed and inform the competent authority accordingly. Members of the management body should maintain and deepen the knowledge and skills needed to fulfil their responsibilities. ## 11. Induction and training policy 95. Institutions should have in place policies and procedures for the induction and training of members of the management body. The policy should be adopted by the management body. 96. The human and financial resources provided for induction and training should be sufficient to achieve the objectives of induction and training and to ensure that the member is suitable and meets the requirements for his or her role. When establishing the human and financial resources required to deliver effective policies and procedures for the induction and training of the members of the management body, the institution should take into account available * relevant industry benchmarks, for example relating to available training budget and training days provided, including benchmarking results provided by the EBA. 17 97. The policies and procedures for induction and training may be part of an overall suitability policy, and should at least set out: 1. the induction and training objectives for the management body, separately for the management function and the supervisory function where applicable. This should also include where appropriate the induction and training objectives for specific positions according to their specific responsibilities and involvement in committees; 2. the responsibilities for the development of a detailed training programme; 3. the financial resources and human resources made available by the institution for induction and training, taking into account the number of induction and training sessions, their cost and any related administrative tasks, in order to ensure that induction and training can be provided in line with the policy; 4. a clear process under which any member of the management body can request induction or training. 98. In the development of the policy, the management body or the nomination committee, when established, should consider input from the human resources function and the function responsible for the budgeting and organisation of training, as well as relevant internal control functions, where appropriate. 99. Institutions should have in place a process to identify the areas in which training is required, both for the management body collectively and for individual members of the management body. Relevant business areas and internal functions, including internal control functions, should be involved as appropriate in the development of the content of induction and training programmes. 100. The policies and procedures as well as training plans should be kept up to date, taking into account governance changes, strategic changes, new products and other relevant changes, as well as changes in applicable legislation and market developments. 101. Institutions should have an evaluation process in place to review the execution and the quality of induction and training provided and to ensure compliance with the induction and training policies and procedures. 17 The Annex to the impact assessment of these Guidelines includes EBA benchmarking results (2015 data) for training resources and training days provided by institutions. ## Title V -Diversity within the management body ## 12. Diversity policy objectives 102. In accordance with Article 91(10) of Directive 2013/36/EU, all institutions should have and implement a policy promoting diversity on the management body, in order to promote a diverse pool of members. It should aim to engage a broad set of qualities and competences when recruiting members of the management body, to achieve a variety of views and experiences and to facilitate independent opinions and sound decision-making within the management body. Institutions should aim at an appropriate representation of all genders within the management body and ensure that the principle of equal opportunities is respected when selecting members of the management body. Having employee representatives, where required under national law, of the under-represented gender alone is not sufficient to ensure that the management body has an appropriate gender balance. 103. The diversity policy should at least refer to the following diversity aspects: educational and professional background, gender, age and, in particular for institutions that are active internationally, geographical provenance, unless the inclusion of the aspect of geographical provenance is unlawful under the laws of the Member State. The diversity policy for significant CRD institutions should include a quantitative target for the representation of the under-represented gender in the management body. Significant CRD institutions should quantify the targeted participation of the under-represented gender and specify an appropriate timeframe within which the target should be met and how it will be met. The target should be defined for the management body collectively, but may be broken down into the management and supervisory functions where a sufficiently large management body exists. In all other institutions, in particular with a management body of fewer than five members, the target may be expressed in a qualitative way. 104. When setting diversity objectives, institutions should consider diversity benchmarking results published by competent authorities, the EBA or other relevant international bodies or organisations 18 . 105. The diversity policy may include employee representation within the management body in order to add day-to-day practical knowledge and experience of the internal workings of the institution. 106. Significant CRD institutions should also document, as part of the annual review of the composition of the management body, their compliance with the objectives and targets set. 18 See also the EBA's report on diversity benchmarking: and In the event that any diversity objectives or targets have not been met, the significant CRD institution should document the reasons why, the measures to be taken and the timeframe for measures to be taken, in order to ensure that the diversity objectives and targets will be met. 107. In order to facilitate an appropriately diverse pool of candidates for management body positions, institutions should implement a diversity policy for staff, including career planning aspects and measures to ensure equal treatment and opportunities for staff of different genders. Such measures should include that the aspect of appropriate gender representation is also taken into account when selecting staff for management positions or when providing management training. 108. In order to support a diverse composition of the management body institutions should have policies that ensure that there is no discrimination based on gender, race, colour, ethnic or social origin, genetic features, religion or belief, membership of a national minority, property, birth, disability, age, or sexual orientation. 19 ## Title VI -Suitability policy and governance arrangements ## 13. Suitability policy 109. According to Article 88(1) of Directive 2013/36/EU, an institution's management body defines, oversees and is accountable for the implementation of the governance arrangements that ensure effective and prudent management of the institution. In addition, according to Article 9(3) of Directive 2014/65/EU, the management body of an investment firm as defined in Directive 2014/65/EU (MiFID firm) defines, oversees and is accountable for the implementation of governance arrangements in a manner that promotes the integrity of the market and the interest of clients. This includes th at the institution's suitability policy should be aligned with the institution's overall corporate governance framework, corporate culture and risk appetite and that the processes under the policy are fully operating as intended. This also includes that the institution's management body should adopt -without prejudice to any required shareholders' approval -and maintain a policy for the assessment of the suitability of members of the management body. 110. The suitability policy should include or refer to the diversity policy to ensure that diversity is taken into account when recruiting new members. 111. Any changes to the suitability policy should also be approved by the management body, without prejudice to any required shareholders' approval . Documentation regarding the 19 See also the section on diversity in the EBA Guidelines on Internal Governance. adoption of the policy and any amendments thereof should be maintained (e.g. in the minutes of relevant meetings). 112. The policy should be clear, well documented and transparent to all staff within the institution. When developing the policy, the management body may request and take into account input from other internal committees, in particular the nomination committee where established and other internal functions, such as the legal, human resources or control functions. 113. Internal control functions[^5] should provide effective input to the development of the suitability policy in accordance with their roles. Notably, the compliance function should analyse how the suitability policy affects the inst itution's compliance with legislation, regulations, internal policies and procedures, and should report all identified compliance risks and issues of non-compliance to the management body. 114. The policy should include principles on the selection, monitoring and succession planning of its members and for re-appointing existing members, and should set out at least the following: 1. the process for the selection, appointment, re-appointment and succession planning of members of the management body and the applicable internal procedure for the assessment of the suitability of a member including the internal function responsible for providing support for the assessment (e.g. human resources); 2. the criteria to be used in the assessment, which should include the suitability criteria set out in these Guidelines; 3. how, as part of the selection process, the diversity policy for members of the management body of significant CRD institutions and the target for the underrepresented gender in the management body are to be taken into account; 4. the communication channel with the competent authorities; and 5. how the assessment should be documented. 115. Relevant institutions should also include within their suitability policy the processes for the selection and appointment of key function holders. The suitability policy might set out in a risk-based approach those positions that could be considered by relevant institutions as key function holders in addition to the heads of internal control functions and the CFO, where they are not part of the management body. 116. The management body in its supervisory function and the nomination committee where established should monitor the effectiveness of the institution's suitability policy and review its design and implementation. The management body should amend the policy, where appropriate, taking into account the recommendations made by the nomination committee where established and the internal audit function. ## 14. Suitability policy in a group context 117. In accordance with Article 109(2) and (3) of Directive 2013/36/EU, the consolidating CRD institution should ensure that a group-wide policy for the assessment of suitability of all members of the management body and key function holders is implemented consistently and well integrated in all subsidiaries within the scope of prudential consolidation, including those not subject to Directive 2013/36/EU, even when they are established in third countries, including in offshore financial centres. 118. The policy should be adjusted to the specific situation of the credit institutions that are part of the group and subsidiaries within the scope of prudential consolidation that are not themselves subject to Directive 2013/36/EU. Competent bodies or functions within the consolidating CRD institution and its subsidiaries should interact and exchange information for the assessment of suitability as appropriate. 119. The consolidating CRD institution should ensure that the suitability assessment complies with all specific requirements in any relevant jurisdiction. Regarding institutions and entities within a group located in more than one Member State, the consolidating CRD institution should ensure that the group-wide policy takes into account differences between national company laws and other regulatory requirements. 120. The consolidating CRD institution should ensure that subsidiaries established in third countries that are included in the scope of prudential consolidation have consistently implemented the group policy in a way that complies with the requirements of Articles 74, 88 and 91 of Directive 2013/36/EU, as long as this is not unlawful under the laws of the third country. For this purpose, the EU parent undertakings and subsidiaries subject to Directive 2013/36/EU must ensure that the suitability standards applied by the subsidiary located in a third country at least meet the ones applied in the European Union. 121. The suitability requirements of Directive 2013/36/EU and these Guidelines apply to CRD institutions independently of the fact that they may be subsidiaries of a parent institution in a third country. Where an EU subsidiary of a parent institution in a third country is a consolidating CRD institution, the scope of prudential consolidation does not include the level of the parent institution located in a third country and other direct subsidiaries of that parent institution. The consolidating CRD institution should ensure that the group-wide policy of the parent institution in a third country is taken into consideration within its own policy insofar as this is not contrary to the requirements set out under relevant EU or national law, including these Guidelines. 122. The management body of subsidiaries that are subject to Directive 2013/36/EU should adopt and implement a suitability policy at individual level which is consistent with the policies established at the consolidated or sub-consolidated level, in a manner that complies with all specific requirements under national law. ## 15. Nomination committee and its tasks 21 123. Significant CRD institutions must have a nomination committee that fulfils the responsibilities and has the resources set out under Article 88(2) of Directive 2013/36/EU. 124. Members of the nomination committee should have adequate collective knowledge, expertise and experience relating to the business of the institution to be able to assess the appropriate composition of the management body, including recommending candidates to fill management body vacancies. 125. Where a nomination committee is not established, the management body in its supervisory function should have the responsibilities set out in the first subparagraph of point (a) and points (b) to (d) of Article 88(2) of Directive 2013/36/EU, and the appropriate resources to this end. Where a nomination committee is not established, the assessment referred to under points (b) and (c) of Article 88(2) of that Directive should be performed at least every two years. 126. The nomination committee, where established, and the management body in its supervisory function, as appropriate, should have access to all necessary information to perform their duties and be able to involve the relevant internal control functions and other competent internal functions, where necessary. 127. In accordance with the last subparagraph of Article 88(2) of Directive 2013/36/EU, where, under national law, the management body does not have competence in the process of selection and appointment of any of its members, this section is not applicable. ## 16. Composition of the management body and the appointment and succession of its members 128. Without prejudice to national company law, the management body should have an adequate number of members and an appropriate composition and should be appointed for 21 Regarding the composition and tasks of committees, s ee also the EBA's Guidelines on Internal Governance: an appropriate period. Nominations for re-appointment should take place only after considering the assessment result regarding the performance of the member that has been observed during the last term. 129. All members of the management body should be suitable. Without prejudice to members being elected by and representing employees, the management body should identify and select qualified and experienced members and ensure appropriate succession planning for the management body that is consistent with all legal requirements regarding composition, appointment or succession of the management body. 130. Without prejudice to the shareholders ' rights to appoint members, when recruiting members of the management body the management body in its supervisory function or, where established, the nomination committee, should actively contribute to the selection of candidates for vacant management body positions in cooperation with human resources and should: 1. prepare a description of the roles of and capabilities for a particular appointment; 2. evaluate the adequate balance of knowledge, skills and experience of the management body; 3. assess the time commitment expected; and 4. consider the objectives of the diversity policy. 131. The recruitment decision should, where possible, take into account a shortlist containing a preselection of suitable candidates which takes into account the diversity objectives set out in the institution's diversity policy and the elements in Title V of these Guidelines. The decision should take into account the fact that a more diverse management body fosters constructive challenge and discussion based on different points of view. Institutions should not however recruit members of the management body with the sole purpose of increasing diversity to the detriment of the functioning and suitability of the management body collectively, or at the expense of the suitability of individual members of the management body. 132. The member of the management body should be aware of the culture, values, behaviours and strategy associated with that institution and its management body, where possible, before taking up the position. 133. Without prejudice to the shareholders' rights to appoint and replace all members of the management body simultaneously, when establishing a succession plan for its members the management body should ensure the continuity of decision-making and prevent, where possible, too many members having to be replaced simultaneously. Succession planning should set out the institution's plans, policies and processes for dealing with sudden or unexpected absences or departures of members of the management body, including any relevant interim arrangements. Succession planning should also take into account the objectives and targets defined in the institution's diversity policy. ## Title VII -Assessment of suitability by institutions ## 17. Common elements for the assessment of the individual and collective suitability of members of the management body 134. Unless otherwise specified in the Guidelines, the management body in its supervisory function or, where established, the nomination committee should ensure that the individual and collective suitability assessments of the members of the management body are carried out before they are appointed. They may liaise with other committees (e.g. risk and audit committee) and internal functions (e.g. human resources, legal or control functions). The management body in its supervisory function should be responsible for determining the final suitability assessments. 135. By way of derogation of paragraph 134 the individual and collective suitability assessments may be performed after the appointment of the member in any of the following cases for which the institution has provided duly justification: 1. shareholders, owners or members of the institution nominate and appoint members of the management body at the shareholders ' or equivalent meeting that have not been proposed by the institution or by the management body, e.g. slate system; 2. a complete suitability assessment prior to the appointment of a member would disrupt the sound functioning of the management body, including as a result of the following situations: 1. where the need to replace members arises suddenly or unexpectedly, e.g. death of a member; and 2. where a member is removed because he or she is no longer suitable. 136. The suitability assessments should take into account all matters relevant to and available for the assessments. Institutions should consider the risks, including the reputational risk, arising in the event that any weaknesses are identified affecting the individual or collective suitability of the members of the management body. 137. Where members are appointed by the general shareholders' meeting and w here the assessment of the individual and collective suitability of members has been performed before the general shareholders' meeting, institutions should provide appropriate information on the assessment results to shareholders before the meeting. Where appropriate, the assessment should comprise various alternative compositions of the management body that can be introduced to the shareholders. 138. Where, in the duly justified cases referred to in paragraph 135, members are appointed by shareholders before an assessment of suitability is made, the appointment should be subject to the positive assessment of their suitability. In these cases, institutions should assess the suitability of the members and the composition of the management body as soon as practicable and at the latest within one month of the appointment of the members. If the subsequent assessment by the institution resulted in a member being considered not suitable for his or her position, the member and the competent authority should be informed without delay. Institutions should also inform shareholders about the assessment made and the need to appoint different members. 139. Institutions should ensure that shareholders have full access to relevant and practical information about the obligation that the members of the management body and the management body collectively must at all times be suitable. The information provided to shareholders regarding the suitability of the management body and its members should enable shareholders to take informed decisions and to address any shortcomings in the composition of the management body or its individual members. 140. Where some members are appointed by the management body, such assessments should be performed before they effectively perform their function. In the duly justified cases referred to in paragraph 135, the assessment of suitability may be performed after the appointment of the member. This should be done as soon as practicable but at the latest within one month from the date of appointment. 141. Institutions should take into account the results of the assessment of the suitability of the individual member of the management body when assessing the collective suitability of the management body and vice versa. Weaknesses identified within the overall composition of the management body or its committees should not necessarily lead to the conclusion that a particular member is individually not suitable. 142. Institutions should document the results of their assessment of suitability, and in particular any weaknesses identified between the necessary and the actual individual and collective suitability of members of the management body, and measures to be taken to overcome these shortcomings. 143. Institutions should transmit to competent authorities the outcome of the suitability assessments for new members of the management body, including the institution's assessment of the collective composition of the management body in line with the specified procedures referred to in section 23. This should include the documentation and information listed in Annex III 22 . 144. Institutions should, at the request of the competent authorities, provide additional information necessary for the individual or collective suitability assessment of the members of the management body. In the case of a re-appointment this information may be limited to relevant changes. ## 18. Assessment of the suitability of individual members of the management body 145. Institutions should require members of the management body to demonstrate their suitability by providing at least the documentation that is required by competent authorities for the assessment of suitability, in accordance with Title VIII and Annex III of these Guidelines. 146. As part of the assessment of the suitability of an individual member of the management body, institutions should: 1. gather information on the member ' s suitability through various channels and instruments (e.g. diplomas and certificates, recommendation letters, curricula vitae, interviews, questionnaires); 2. gather information on the reputation, integrity and honesty of the assessed individual, including assessing whether there are reasonable grounds to suspect that ML/TF is being or has been committed or attempted or that the risk thereof could be increased; 3. evaluate the independence of mind of the assessed individual; 4. require the assessed individual to verify that the information provided is accurate and to provide proof of information, where necessary; 5. require the assessed individual to declare any actual and potential conflicts of interest; 6. validate, to the extent possible, the correctness of the information provided by the assessed individual; 7. evaluate within the management body in its supervisory function or, where established, the nomination committee, the assessment results; and 22 Please also refer to the draft RTS under Article 7(4) of Directive 2014/65/EU and draft ITS under Article 7(5) of Directive 2014/65/EU on the information to be provided at authorisation: and . See also the Consultation Paper on the draft RTS on authorisation published by the EBA. * h. where necessary, adopt corrective measures to ensure the individual suitability of the members of the management body in accordance with section 22. 147. Where there is a matter which causes concern about the suitability of a member of the management body, an assessment of how this concern affects that person's suitability should be undertaken. In this assessment institutions should take into account the existence of reasonable grounds to suspect that ML/TF is being or has been committed or attempted or that the risk thereof could be increased. 148. Institutions should document a description of the position for which an assessment was performed, including the role of that position within the institution, and should specify the results of the suitability assessment in relation to the following criteria: 1. sufficient time commitment; 2. compliance of members of the management body that hold a directorship in a significant CRD institution with the limitation of directorships under Article 91(3) of Directive 2013/36/EU; 3. sufficient knowledge, skills and experience; 4. reputation, honesty and integrity; 5. independence of mind. ## 19. Assessment of the collective suitability of the management body 149. When assessing the collective suitability of the management body, institutions should assess the composition of the management body in its management and supervisory functions separately. The assessment of collective suitability should provide a comparison between the actual composition of the management body and the management body's actual collective knowledge, skills and experience, and the required collective suitability pursuant to Article 91(7) of Directive 2013/36/EU. 150. Institutions should perform an assessment of the collective suitability of the management body using either: 1. the suitability matrix template included in Annex I. Institutions may adapt this template taking into account the criteria described in Title I; or 2. their own appropriate methodology in line with the criteria set out in these Guidelines. 151. When assessing the suitability of an individual member of the management body, institutions should, within the same time period, also assess the collective suitability of the management body in accordance with section 7 as well as whether or not the overall composition of the specialised committees of the management body in its supervisory function is adequate. In particular, it should be assessed what knowledge, skills and experience the individual brings to the collective suitability of the management body and whether the overall composition of the management body reflects an adequately broad range of knowledge, skills and experience to understand the inst itution's activities and main risks. 152. When assessing the collective suitability in line with Title III (7), institutions should also assess whether the management body through its decisions has demonstrated a sufficient understanding of ML/TF risks and how these affect the institution's activi ties, and has demonstrated appropriate management of these risks, including corrective measures where necessary. ## 20. Ongoing monitoring and re-assessment of the individual and collective suitability of the members of the management body 153. The ongoing monitoring of the individual or collective suitability of the members of the management body should focus on whether the individual member or the members collectively remain suitable, taking into account the individual or collective performance and the relevant situation or event which caused a re-assessment and the impact it has on the actual or required suitability. 154. When re-assessing the individual or collective performance of the members of the management body, the members of the management body in its supervisory function or, where established, the nomination committee, should consider in particular: 1. the efficiency of the management body's working processes, including the efficiency of information flows and reporting lines to the management body taking into account the input from internal control functions and any follow-up or recommendations made by those functions; 2. the effective and prudent management of the institution, including whether or not the management body acted in the best interest of the institution including in relation to the fight against money laundering and terrorist financing; 3. the ability of the management body to focus on strategically important matters; 4. the adequacy of the number of meetings held, the degree of attendance, the appropriateness of time committed and the intensity of directors' involvement during the meetings; 5. any changes to the composition of the management body and any weaknesses with regard to individual and collective suitability, taking into account the inst itution's business model and risk strategy and changes thereto; 6. any performance objectives set for the institution and the management body; 7. the independence of mind of members of the management body, including the requirement that decision-making is not dominated by any one individual or small group of individuals, and the compliance of members of the management body with the conflict of interest policy; 8. the degree to which the composition of the management body has met the objectives set in the institutio n's diversity policy in line with Title V ; and 9. any events that may have a material impact on the individual or collective suitability of the members of the management body, including changes to the institution's business model, strategies and organisation; 10. reasonable grounds to suspect that money laundering or terrorist financing is being or has been committed or attempted or other financial crimes, or there is an increased risk thereof, including following such adverse findings made by the internal or external auditors or competent authorities regarding the adequacy of the institution's AML/CFT systems and controls. ## 155. When a re-assessment is triggered, due consideration should be given to: * a. the assigned duties and reporting lines within the institution, including where applicable within the group, in order to establish whether any material fact or finding should be allocated to one or more responsible members of the management body. In this context, assigned duties should be determined taking into account all relevant documentation, including but not limited to governance charters and codes, internal organigrams and other forms of designating areas of responsibility, internal policies, assessments of the suitability available and additional information provided in this context, letters of appointment or job descriptions, and minutes of meetings of the management body; and * b. the credibility and reliability of any fact that triggered the re-assessment, and the seriousness of any allegations of or actual wrongdoing of one or more members of the management body. Institutions should determine the credibility and reliability of information (e.g. the source, the plausibility, any conflicts of interest of the source giving the information) among other considerations. Institutions should note that the absence of criminal convictions alone may not be sufficient to dismiss allegations of wrongdoing. 156. Significant CRD institutions should perform a periodic suitability re-assessment at least annually. Non-significant institutions should perform a suitability re-assessment at least every two years. Institutions should document the results of the periodic re-assessment. Where a re-assessment is triggered by a specific event, institutions may focus the re-assessment on the situation or event that has triggered the re-assessment, i.e. where certain aspects have not changed, these can be omitted from the assessment. 157. The result of the re-assessment, the reason for the re-assessment and any recommendation with regard to identified weaknesses should be documented and submitted to the management body. 158. The management body in its supervisory function or, where established, the nomination committee should report the result of the assessment of collective suitability to the management body even if no changes to its composition or other measures are recommended. Recommendations may include, but are not limited to, training, change of processes, measures to mitigate conflicts of interest, the appointment of additional members with a specific competence and the replacement of members of the management body. 159. The management body in its management function should take note of the report and decide on the recommendations made by the management body in its supervisory function or, where established, the nomination committee, and where recommendations are not adopted, document the underlying reasons. 160. Institutions should inform the competent authority where re-assessments due to material changes occurred. Significant CRD institutions should inform the competent authority at least annually of any re-assessments of collective suitability made. 161. Institutions should document the re-assessments, including their outcome and any measures taken as a result of the re-assessment. Institutions should submit the documentation supporting the re-assessment at the request of the competent authority. 162. In the event that the management body concludes that a member of the management body is not suitable individually, or where the management body is not suitable collectively, the institution should immediately inform the competent authority without delay, including about the measures proposed or taken by the institution to remedy the situation. ## 21. Suitability assessment of key function holders by relevant institutions 163. The responsible function within a relevant institution should carry out the suitability assessment of key function holders before their appointment and should report the assessment results to the appointing function and the management body. Significant CRD institutions, referred to in paragraph 172, should inform competent authorities of the assessment results regarding heads of internal control functions and the CFO, where they are not part of the management body. 164. If a relevant institution 's assessment concludes that a key function holder is not suitable, the relevant institution should either not appoint the individual or take appropriate measures to ensure the appropriate functioning of this position. Significant CRD institutions should inform the competent authority accordingly with regard to the heads of internal control functions and the CFO, where they are not part of the management body. Competent authorities may require such information from all relevant institutions and for all key function holders. 165. Where an assessment by a competent authority is also required, relevant institutions should take the necessary measures (e.g. by applying a probation period or a suspensive condition in the employment contract or by appointing acting heads) when appointing a key function holder to enable the institution to remove the key function holder from the position if he or she is assessed as not being suitable by the competent authority for that position. ## 22. Institutions' corrective measures 166. If an institution's assessment or re -assessment concludes that a person is not suitable to be appointed as a member of the management body, that person should not be appointed or, if the member has already been appointed, the institution should replace that member. With the exception of criteria relevant to the assessment of reputation, honesty and integrity, if an institution's assessment or re -assessment identifies easily remediable shortcomings in the member ' s knowledge, skills or experience the institution should take appropriate corrective measures to overcome those shortcomings in a timely manner. 167. If an institution's assessment or re -assessment concludes that the management body is not collectively suitable, the institution should take appropriate corrective measures in a timely manner. 168. When an institution takes corrective measures it should consider the particular situation and shortcomings of an individual member or the collective composition of the management body. In the case of the authorisation of an institution to take up its business, such measures should be implemented before the authorisation is granted. 24 169. Appropriate corrective measures may include, but are not limited to: adjusting responsibilities between members of the management body; replacing certain members; recruiting additional members; possible measures to mitigate conflicts of interest; training 24 See footnote 28. single members; or training for the management body collectively to ensure the individual and collective suitability of the management body. 170. In any case, competent authorities should be informed without delay of any material shortcomings identified concerning any of the members of the management body and the management bod y's collective composition. Significant CRD institutions should also inform competent authorities about any shortcomings identified regarding heads of internal control functions and the CFO, where they are not part of the management body. The information should include the measures taken or envisaged to remedy those shortcomings and the timeline for their implementation. ## Title VIII -Suitability assessment by competent authorities ## 23. Competent authorities' assessment procedures 171. Competent authorities should specify the supervisory procedures applicable to the suitability assessment of members of the management body of institutions, as well as the heads of internal control functions and the CFO, where they are not part of the management body, in the case of significant CRD institutions. When specifying the supervisory procedures, competent authorities should consider that a suitability assessment performed after the member has taken up his or her position could lead to the need to remove a non-suitable member from the management body or to a situation where the management body collectively has ceased to be suitable. Competent authorities should ensure that a description of those assessment procedures is publicly available. 172. The suitability assessments of heads of internal control functions and the CFO, where they are not part of the management body, for significant CRD institutions, should be performed by competent authorities for: 1. significant consolidating CRD institutions; 2. significant CRD institutions that are part of a group, where the consolidating CRD institution is not a significant institution; 3. significant CRD institutions that are not part of a group. 173. The supervisory procedures should ensure that newly appointed members of the management body, the management body as a collective body and, for significant CRD institutions referred to in paragraph 172, newly appointed heads of internal control functions and the CFO, where they are not part of the management body, are assessed by the competent authorities. The supervisory procedures should also ensure that re-appointed members of the management body are re-assessed by the competent authority in accordance with paragraphs 22 b) ii) and 30 b) ii) where a re-assessment is necessary. 174. Competent authorities should ensure that their supervisory procedures allow them to address cases of non-compliance in a timely manner. 175. As part of the above supervisory procedures, institutions should be required to inform competent authorities without delay of any vacant positions within the management body. Institutions should also be required to notify competent authorities of the intended appointment, in cases where the competent authority assesses the suitability before the appointment, or the appointment, in cases where the competent authorities assess the suitability after the appointment, of a member of the management body. Such notifications should, in cases where the competent authority assesses the suitability before the appointment, be made not later than two weeks after the institution decided to propose the member for appointment or, in cases where the competent authorities assess the suitability after the appointment, two weeks after the appointment and include the complete documentation and information in Annex III. 176. In the duly justified cases referred to in paragraph 136, institutions should be required to provide the complete documentation and information in Annex III, together with the notification to the competent authority within one month of the member being appointed. 177. Significant CRD institutions, for which an assessment of heads of internal control functions and the CFO, where they are not part of the management body, is required in line with paragraphs 172 and 173, should notify competent authorities of the appointment of these functions without delay and at the latest within two weeks of their appointment. Significant CRD institutions should be required to provide the complete documentation and information listed in Annex III, as applicable, together with the notification. 178. Competent authorities may set out the supervisory procedures applicable to the assessment of suitability of heads of internal control functions and the CFO, where they are not part of the management body, in other institutions not referred to in paragraph 172 and, where identified on a risk-based approach, other key function holders in institutions. As part of those procedures, competent authorities may also request those institutions to inform them about the results of the assessment carried out and to submit the relevant documentation to them. 179. Competent authorities should set out a maximum period for their assessment of suitability which should not exceed four months from the date when the notifications referred to in paragraphs 175 to 177 are provided by the institution. Where a competent authority establishes that additional documentation and information are needed to complete the assessment, that period may be suspended from the time when the competent authority requests additional documentation and information necessary to complete the assessment, until the receipt of that documentation and information. Necessary documentation and information should include documents or hearings that have to be requested or conducted in the course of the administrative procedures in cases where a negative decision is intended. 180. In accordance with Article 15 of Directive 2013/36/EU, where the assessment of suitability is performed in the context of an authorisation to take up the business, the maximum period must not exceed six months after receipt of the application or, where the application is incomplete, six months after receipt of the complete information required for the decision. 181. Competent authorities should perform their assessment on the basis of the documentation and information provided by the institution and assessed members, and assess them against the notions defined in Title III, as applicable. 182. The assessment of the individual and collective suitability of the members of the management body and, in case of significant CRD institutions, the assessment of the individual suitability of the heads of internal control functions and the CFO, where they are not part of the management body, should be performed on an ongoing basis by competent authorities, as part of their ongoing supervisory activity. Competent authorities should ensure that necessary re-assessments under sections 1, 2 and 3 of Title II are conducted by institutions. If a re-assessment of suitability by a competent authority is prompted by a re-assessment by an institution, that competent authority should in particular take into account the circumstances that prompted the re-assessment by the institution. In particular, competent authorities should re-assess the individual or collective suitability of the members of the management body and the individual suitability of heads of internal control functions and the CFO, where they are not part of the management body, within significant CRD institutions referred in paragraph 172 whenever significant new facts or evidence are unveiled during the course of ongoing supervision. This should include situations that cast factual material doubt on the past or ongoing compliance with AML/TF requirements by the institution, individual members of the management body and, within significant institutions referred to in paragraph 173, heads of internal control functions and the CFO, where they are not part of the management body. 183. For significant CRD institutions, competent authorities should use interviews where appropriate for the purpose of suitability assessments. Interviews may also be performed for other institutions on a risk-based approach, taking into account the criteria set out in Title I as well as the individual circumstances of the institution, the assessed individual, and the position for which an assessment is made. 184. Where appropriate, the interview process may also serve to re-assess the suitability of a member of the management body or key function holder when there are any new facts or circumstances that may raise concerns about the suitability of the individual. 185. Competent authorities may attend or conduct meetings with the institution, including with some or all members of its management body or key function holders, or participate as an observer in meetings of the management body in order to assess the effective functioning of the management body. The frequency of such meetings should be set using a risk-based approach. 186. A breach of a prudential or other regulatory requirement by an institution can, in some circumstances, support a finding by the competent authority that an individual is no longer suitable -for instance, in the event that the competent authority establishes, following due process, that an individual failed to take such steps as a person in his or her position could reasonably be expected to take in order to prevent, remedy or stop the breach. ## 24. Decision of the competent authority 187. Competent authorities should take a decision based on the assessment of individual and collective suitability of members of the management body and the assessment of heads of internal control functions and the CFO, where they are not members of the management body, within the maximum period referred to in paragraph 179 or, if the period has been suspended, within a maximum period of six months after the start of that period. 188. In the cases referred to in paragraph 181, in accordance with the second subparagraph of Article 15 of Directive 2013/36/EU, a decision to grant or refuse authorisation must, in any event, be taken within 12 months of the receipt of the application. 189. Where an institution fails to provide sufficient information regarding the suitability of an assessed individual to the competent authority, the latter should either inform the institution that the member cannot be a member of the management body or a key function holder because it has not been sufficiently proven that the person is suitable, or decide negatively. 190. Where the outcome of the assessment of suitability by the competent authority concludes that it is not sufficiently proven that the assessed person is suitable, the competent authority should object to or not approve the appointment of that person, unless the identified shortcomings are remediable and can be overcome by other measures taken by the institution. 191. Competent authorities should inform institutions of at least a negative decision taken as soon as possible. Where provided by national law or defined by the competent authority as part of their supervisory processes, a positive decision may be deemed to be taken by silence, when the maximum period for the assessment, as referred to in paragraph 179, is completed and the competent authority has not taken a negative decision. 192. The competent authority, considering the measures already taken by the institution, should take appropriate measures to address the identified shortcomings and set a timeline for the implementation of these measures. Such measures should include as appropriate one or more of the following measures: 1. requiring the institution to organise specific training for the members of the management body individually or collectively; 2. requiring the institution to change the division of tasks amongst the members of the management body; 3. requiring the institution to refuse the proposed member or to replace certain members; 4. requiring the institution to change the composition of the management body to ensure the individual and collective suitability of the management body; 5. removing the member from the management body; 6. where appropriate, imposing administrative penalties or other administrative measures (e.g. setting out specific obligations, recommendations or conditions), including ultimately withdrawing the institution's authorisation. 193. The measures referred to in (a) and (c) should also be applicable in the context of the suitability assessments of the heads of internal control functions and the CFO, where they are not part of the management body, of significant CRD institutions. 194. Where members of the management body do not fulfil the requirements set out in Article 91(1) of Directive 2013/36/EU, competent authorities have the power to remove such members from the management body. The competent authorities should in particular verify whether the requirements set out in Article 91(1) of Directive 2013/36/EU and as further specified in these Guidelines are still fulfilled where they have reasonable grounds to suspect that money laundering or terrorist financing is being or has been committed or attempted, or there is increased risk thereof in connection with that institution. ## 25. Cooperation between competent authorities 195. Competent authorities should provide each other, while respecting the applicable data protection legislation, with any information they hold about a member of the management body or key function holder for the performance of a suitability assessment. The information should also include a justification for the decision taken regarding that person ' s suitability. For this purpose, unless national law permits it without requiring consent, the requesting competent authority should seek from members of the management body or key function holders consent: 1. to request from any competent authority information relating to them which is needed for the suitability assessment; 2. to process and use the provided information for the suitability assessment, if such consent is required by applicable data protection legislation. 196. Competent authorities may take into consideration the results of the assessment of suitability conducted by other competent authorities or other relevant information for the purpose of the assessment of suitability about members of the management body or key function holders and request the necessary information from other competent authorities in order to do so. Where appropriate, competent authorities should contact the AML/CFT supervisor in the relevant Member State to obtain additional information necessary to assess the integrity, honesty, good repute and suitability of an institution's management body or key function holders. In addition, in situations where the risk of ML/TF associated with the institution or member is increased, competent authorities should also, where appropriate, seek information from other relevant stakeholders, including the Financial Intelligence Units and law enforcement agencies, to inform their suitability assessment. 26 197. Competent authorities receiving such requests should, where possible, provide relevant available information on the suitability of individuals as soon as possible to enable the requesting competent authority to comply with the time for assessment laid down in paragraph 179. The information provided should comprise the result of the assessment of suitability, any identified shortcomings, measures taken to ensure the suitability, the responsibilities of the position for which the person was assessed and basic information on the size, nature, scale and complexity of the relevant institution, or other relevant information for the assessment of suitability. 198. Competent authorities should take into account the information provided in the EBA and ESMA databases on administrative penalties in line with Article 69 of Directive 2013/36/EU and Article 71 of Directive 2014/65/EU as a part of their assessment of suitability, by identifying any penalties in the last ten years against institutions where the assessed person was a member of their management body or a key function holder and considering the severity of the underlying cause and the responsibility of the assessed person. 199. Where relevant, competent authorities may also request information from other competent authorities about the assessed individual in cases where the person has not been assessed by another competent authority, but where the other competent authority may be in a position to provide additional information, e.g. on refused registrations or criminal records. Competent authorities receiving such requests should provide relevant available information on the suitability of persons. Where the information originates in another Member State, it shall be disclosed only with the express agreement of the authorities which have provided the information and solely for the purposes for which those authorities gave their agreement. 200. Where a competent authority reaches a decision about the suitability of a person that differs from any previous assessment conducted by another competent authority, the 26 See also: Joint guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions available under competent authority performing the more recent assessment should inform the other competent authorities of the result of its assessment. 201. Where a competent authority decides that a member of the management body or a head of the internal control function and the CFO, where they are not part of the management body, as referred to in paragraph 172, is not suitable based on relevant facts in the context of ML/TF risks or events, the competent authority should, without prejudice to national law, share their findings and decisions with the competent AML/CFT supervisor. 202. When requesting information, the competent authority making the request should provide the name of the individual being assessed together with his or her date of birth or the name of the institution and position for which the individual has already been assessed, to ensure that data for the correct person is provided. ## Title IX - Competent authorities ' and resolution authorities ' suitability assessment in the context of resolution 203. Competent authorities and resolution authorities should specify the procedures applicable to the exchange of information regarding suitability assessments of members of the management body and their replacement in line with Articles 27, 28 and 34(1)(c), having also regard to Article 81(2) of BRRD according to which competent authorities should inform the resolution authorities of the removal of one or more members of the management body and the appointment of one or more members of the management body under Articles 27 and 28 of BRRD. 204. As part of the above procedures, it should be ensured that the suitability of newly appointed members of the management body and the management body as a collective body where relevant as referred to in Articles 27, 28 and Article 34(1)(c) of BRRD are assessed by competent authorities in line with the criteria of Title III. 205. The procedures should ensure that the resolution authorities notify competent authorities without delay of any new appointment of one or more members of the management body. When appointing members of the management body in accordance with Article 34(1)(c) under the resolution powers provided under Article 63(1)(l) of BRRD, resolution authorities should provide competent authorities as soon as possible with the required documents to enable them to perform a suitability assessment. 206. When new members of the management body are appointed under Article[^6], Article 28 or Article 34(1)(c) of BRRD, competent authorities should perform the suitability assessment after the member of the management body or the management body as a collective body has taken up their position given the emergency of the situation and make their decision on the suitability without undue delay, aiming at a time period of one month from the date they receive a notification of appointment as set out in national law (e.g. from the institution) in accordance either with Article 28 of BRRD or from the resolution authority in accordance with Article 34(1)(c) under the resolution powers provided under Article 63(1)(l) of BRRD. The * competent authority should inform the resolution authority without undue delay about the assessment results. 207. The special manager appointed by the resolution authority under resolution and assigned with tasks exclusively related to the implementation of the resolution actions according to Article 35 of BRRD with a temporary mandate not exceeding the resolution period, is not subject to the suitability assessment to be conducted by the competent authority. ## Annex I - Template for a matrix to assess the collective competence of members of the management body Annex I to the Guidelines is provided as a separate Excel file. The Annex has been amended to include compliance with AML/TF requirements, but stays otherwise unchanged. ## Annex II - Skills This is the non-exhaustive list of relevant skills, referred to in paragraph 59, that institutions should consider using when performing their suitability assessments: * a. Authenticity: is consistent in word and deed and behaves in accordance with own stated values and beliefs. Openly communicates his or her intentions, ideas and feelings, encourages an environment of openness and honesty, and correctly informs the supervisor about the actual situation, at the same time acknowledging risks and problems. * b. Language: is able to communicate orally in a structured and conventional way and write in the national language or the working language of the institution 's location. * c. Decisiveness: takes timely and well-informed decisions by acting promptly or by committing to a particular course of action, for example by expressing his or her views and not procrastinating. * d. Communication: is capable of conveying a message in an understandable and acceptable manner, and in an appropriate form. Focuses on providing and obtaining clarity and transparency and encourages active feedback. * e. Judgement: is capable of weighing up data and different courses of action and coming to a logical conclusion. Examines, recognises and understands the essential elements and issues. Has the breadth of vision to look beyond his or her own area of responsibility, especially when dealing with problems that may jeopardise the continuity of the undertaking. * f. Customer and quality-oriented: focuses on providing quality and, wherever possible, finding ways of improving this. Specifically, this means withholding consent from the development and marketing of products and services and to capital expenditure, e.g. on products, office buildings or holdings, in circumstances where he or she is unable to gauge the risks properly owing to a lack of understanding of the architecture, principles or basic assumptions. Identifies and studies the wishes and needs of customers, ensures that customers run no unnecessary risks and arranges for the provision of correct, complete and balanced information to customers. * g. Leadership: provides direction and guidance to a group, develops and maintains teamwork, motivates and encourages the available human resources and ensures that members of staff have the professional competence to achieve a particular goal. Is receptive to criticism and provides scope for critical debate. * h. Loyalty: identifies with the undertaking and has a sense of involvement. Shows that he or she can devote sufficient time to the job and can discharge his or her duties properly, defends the interests of the undertaking and operates objectively and critically. Recognises and anticipates potential conflicts of personal and business interest. * i. External awareness: monitors developments, power bases and attitudes within the undertaking. Is well informed on relevant financial, economic, social and other developments at national and international level that may affect the undertaking and also on the interests of stakeholders and is able to put this information to effective use. * j. Negotiating: identifies and reveals common interests in a manner designed to build consensus, while pursuing the negotiation objectives. * k. Persuasive: is capable of influencing the views of others by exercising persuasive powers and using natural authority and tact. Is a strong personality and capable of standing firm. * l. Teamwork: is aware of the group interest and makes a contribution to the common result; able to function as part of a team. * m. Strategic acumen: is capable of developing a realistic vision of future developments and translating this into long-term objectives, for example by applying scenario analysis. In doing so, takes proper account of risks that the undertaking is exposed to and takes appropriate measures to control them. * n. Stress resistance: is resilient and able to perform consistently even when under great pressure and in times of uncertainty. * o. Sense of responsibility: understands internal and external interests, evaluates them carefully and renders account for them. Has the capacity to learn and realises that his or her actions affect the interests of stakeholders. * p. Chairing meetings: is capable of chairing meetings efficiently and effectively and creating an open atmosphere that encourages everyone to participate on an equal footing; is aware of other people ' s duties and responsibilities. ## Annex III - Documentation elements for initial appointments The following information and/or accompanying documents are required to be submitted to the competent authorities for each requested suitability assessment. ## 1. Personal details and details on the institution and the function concerned * 1.1 Personal individual details including full name, name at birth if different, gender, place and date of birth, address and contact details, nationality, and personal identification number or copy of ID card or equivalent. * 1.2 Details of the position for which the assessment is sought, whether or not the management body position is executive or non-executive, or if the position is for a key function holder. This should also include the following details: * a. the letter of appointment, contract, offer of employment or drafts thereof, as applicable; * b. any associated board minutes or suitability assessment report/document; * c. the planned start date and duration of mandate; * d. the expected time commitment for the position as accepted by the individual; * e. description of the indiv idual's key duties and responsibilities; * f. if the person is replacing someone, the name of this person. * 1.3 A list of reference persons including contact information, preferably for employers in the banking or financial sector, including full name, institution, position, telephone number, email address, nature of the professional relationship and whether or not any nonprofessional relationship exists or existed with this individual. ## 2. Suitability assessment by institution ### 2.1 The following details should be provided: * a. details of the result of any assessment of the suitability of the individual performed by the institution, such as relevant board minutes or suitability assessment report/documents that include the reasoning for the result of the assessment made; * b. whether or not the institution is significant as defined in the Guidelines; and * c. the contact person within the institution. ## 3. Knowledge, skills and experience * 3.1 Curriculum vitae containing details of education and professional experience (including professional experience, academic qualifications and other relevant training), including the name and nature of all organisations for which the individual has worked and the nature and duration of the functions performed, in particular highlighting any activities within the scope of the position sought (banking and/or management experience). * 3.2 The information to be provided should include a statement from the institution of whether or not the individual has been assessed as having the requisite experience as enumerated in these Guidelines and, if not, details of the training plan imposed, including the content, the provider and the date by which the training plan will be completed. ## 4. Reputation, honesty, integrity * 4.1 Criminal records and relevant information on criminal investigations and proceedings, relevant civil and administrative cases, and disciplinary actions (including disqualification as a company director, bankruptcy, insolvency and similar procedures) especially through an official certificate or any reliable source of information concerning the absence of criminal conviction, investigations and proceedings (e.g. third-party investigation, testimony made by a lawyer or a notary established in the EU). * 4.2 Statement of whether or not criminal proceedings are pending or whether or not the person or any organisation managed by him or her has been involved as a debtor in insolvency proceedings or a comparable proceeding. ### 4.3 Information concerning the following: * a. investigations, enforcement proceedings, or sanctions by a supervisory authority in which the individual has been directly or indirectly involved; * b. refusal of registration, authorisation, membership or a licence to carry out a trade, business or profession; or the withdrawal, revocation or termination of registration, authorisation, membership or a licence; or expulsion by a regulatory or government body or by a professional body or association; * c. dismissal from employment or a position of trust, fiduciary relationship, or similar situation, or having been asked to resign from employment in such a position (excluding redundancies); * d. whether or not an assessment of reputation of the individual as an acquirer or a person who directs the business of an institution has already been conducted by another competent authority (including the identity of that authority, the date of the assessment and evidence of the outcome of this assessment) and the consent of the individual where required to seek such information to be able to process and use the provided information for the suitability assessment; and * e. whether or not any previous assessment of the individual by an authority from another, non-financial, sector has already been conducted (including the identity of that authority and evidence of the outcome of this assessment). ## 5. Financial and non-financial interests * 5.1 All financial and non-financial interests that could create potential conflicts of interest should be disclosed, including but not limited to: * a. description of any financial (e.g. loans, shareholdings) and non-financial interests or relationships (e.g. close relations such as a spouse, registered partner, cohabitant, child, parent or other relation with whom the person shares living accommodation) between the individual and his or her close relatives (or any company that the individual is closely connected with) and the institution, its parent or subsidiaries, or any person holding a qualifying holding in such an institution, including any members of those institutions or key function holders; * b. whether or not the individual conducts any business or has any commercial relationship (or has had over the past two years) with any of the above listed institutions or persons or is involved in any legal proceedings with those institutions or persons; * c. whether or not the individual and his or her close relatives have any competing interests with the institution, its parent or subsidiaries; * d. whether or not the individual is being proposed on behalf of any one significant shareholder; * e. any financial obligations to the institution, its parent or its subsidiaries (excluding performing mortgages negotiated at arm's length); and * f. any positions of political influence (nationally or locally) held over the past two years. * 5.2 If a material conflict of interest is identified, the institution should provide a statement on how this conflict has been satisfactorily mitigated or remedied including a reference to the relevant parts of the institution's conflict of interest policy or any bespoke conflict management or mitigation arrangements. ## 6. Time commitment * 6.1 All relevant and necessary details should be provided to show that the individual has sufficient time to commit to the mandate including: * a. information about the minimum time that will be devoted to the performance of the person's functions within the institution (annual and monthly indications); * b. a list of the predominantly commercial mandates that the individual holds including whether or not the privileged counting rules 27 in Article 91(4) of CRD IV apply; * c. where the privileged counting rules apply, an explanation of any synergies that exist between the companies; * d. a list of those mandates which are pursuing predominantly non-commercial activities or are set up for the sole purposes of managing the economic interests of the individual; * e. the size of the companies or organisations where those mandates are held including for example, total assets, whether or not the company is listed, and number of employees; * f. a list of any additional responsibilities associated with those mandates (such as the chair of a committee); * g. estimated time in days per year dedicated to each mandate; and * h. number of meetings per year dedicated to each mandate. ## 7. Collective knowledge, skills and experience * 7.1 The institution should provide a list of the names of the members of the management body and their respective roles and functions in brief. * 7.2 The institution should provide a statement regarding its overall assessment of the collective suitability of the management body as a whole, including a statement on how the individual is to be situated in the overall suitability of the management body (i.e. following an assessment using the suitability matrix in Annex I or another method chosen by the institution or required by the relevant competent authority). This should include a description of how the overall composition of the management body reflects an adequately broad range of experience and the identification of any gaps or weaknesses and the measures imposed to address these. 8. Any and all other relevant information should be submitted as part of the application. [^1]: Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (recast) (OJ L 173, 12.6.2014, p.349). [^2]: Directive 2014/65/EU defines a client in Article 4(1)(9), a professional client in Article 4(1)(10) and a retail client in Article 4(1)(11). Recital 103 of Directive 2014/65/EU also specifies that an eligible counterparty should be considered to be acting as a client, as described in Article 30 of that Directive. [^3]: See footnote 17. [^4]: Please refer to the EBA's Guidelines on Internal Governance regarding the conflict of interest policy for staff. [^5]: See also the EBA's Guidelines on Internal Governance: [^6]: This is where the individual avails himself or herself of the possibility of holding several mandates that are part of the same group, or within undertakings where the institution holds a qualifying holding or in institutions that are part of the same institutional protection schemes. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/eu-level/guidelines/esma35-36-2319-joint-suitability-mgmt-body.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.