Quick Take

The EBA and ESMA have announced targeted amendments and additions to two key guidelines setting out rules that the EU-27 national authorities and the ECB, in its Banking Union role, should follow when supervising existing as well as new licensed and regulated firms. While a number of the targeted amendments are the result of recent rule changes that extend or alter the regulatory perimeter to include financial holding companies and certain investment firms in addition to credit institutions, i.e., banks, the proposed changes also introduce extra-territoriality for some of the guidelines’ provisions to non-EU operations as well as allow the ECB to take a much more active role in financial crime prevention supervision. The new guidelines will also be complemented by longer-term EU legislative proposals, notably on measures to strengthen sustainable corporate governance.

Firms, notably banks and MiFID Investment Firms, will want to review the issues discussed below and with counsel forward plan how to amend or supplement existing documented and non-documented arrangements. Firms would also be advised to update their governance function (management board) as well as to provide training on these changes to the firm generally, as well as to relevant identified persons subject to new compliance expectations more specifically.

On July 31, 2020, the European Banking Authority (EBA) launched a public consultation on new revised guidelines (i.e. rules and supervisory expectations) concerning rules on internal governance (the EBA Internal Governance Guidelines)¹ and its annexes². In addition, the EBA, together with the European Securities and Markets Authority (ESMA), launched a public consultation on their revised joint guidelines on the assessment of the suitability of members of the management body and key function holders (the EBA/ESMA Fit & Proper Guidelines)³ and its annexes. Both of the revised guidelines being consulted upon also include changes stemming from amendments introduced by CRR II/CRD V⁴ and by the Investment Firms Regulation and Investment Firms Directive (IFR/IFD)⁵ regulatory framework, as well as new requirements on anti-money laundering and financial crime prevention.

Both consultations are open for comment until midnight (CET) on October 31, 2020, with a public hearing on October 1 from 2pm to 4pm that Dentons’ Eurozone Hub will attend. Both consultations and draft revised guidelines welcomingly also indicate proposed changes to the existing guidelines in track changes⁶ (although these only show additions and not deletions – deltaviews are available upon request from Dentons’ Eurozone Hub). Once adopted, the new revised guidelines will, in the case of Internal Governance, replace the previous guidelines (from June 21, 2021, in respect of the EBA Internal Governance Guidelines and six months from publication in respect of the EBA/ESMA Fit & Proper Guidelines). Both guidelines will apply both to supervised firms on a solo and consolidated basis, as well as being applicable to the supervisory processes of the (national) competent authorities (NCAs) across the EU-27.

Further changes may also be introduced over time to the EBA Internal Governance Guidelines so as to reflect and implement proposed principles set out in a proposal for an EU Directive on “Sustainable Corporate Governance” (the SGD), which was published for consultation on July 30 and which closes for comments on October 8, 2020.⁷ The SGD aims to ensure that sustainability is further embedded into company law and corporate governance frameworks and encourage better alignment of long-term interests of management, shareholders, stakeholders and society, and incentivize corporate boards to integrate properly stakeholder interests, sustainability risks, dependencies, opportunities and adverse impacts into strategies, decisions and oversight. If adopted, the European Commission will introduce the SGD during the first quarter of 2021 and ensure that this new framework complements the (revised) Non-Financial Reporting Directive, which requires certain large public-interest companies to disclose sustainability-related matters.

In addition, it is conceivable that the EBA Internal Governance Guidelines plus the EBA/ESMA Fit & Proper Guidelines will also be supplemented by further rules and supervisory expectations set by the European Central Bank (ECB), acting in its role at the head of the Banking Union’s Single Supervisory Mechanism. Such amendments would apply to the range of existing supervised Banking Union Supervised Institutions (BUSIs), those relocating due to Brexit, as well as those that will become BUSIs as a result of the CRD V and IFR/IFD frameworks extending the regulatory and thus supervisory perimeter.

Affected firms and relevant stakeholders may also want to take note of the recent organizational changes that the ECB-SSM has implemented as to how and who will supervise existing and new BUSIs, as set out in dedicated coverage from our Eurozone Hub.⁸ Firms may also want to consider the impacts of the final guidelines on the compliance function’s requirements.⁹

This Client Alert looks at the contents of these two new revised guidelines and the impacts they may have for existing financial services firms, notably banks and investment firms, as well as those looking to apply for licenses. In light of these changes, affected firms may want to take preparatory action to meet the new requirements set in the guidelines, both in terms of adopting new policies and procedures but also possibly by revisiting existing policies and procedures and either confirming (in writing and/or minutes of the relevant governance function and/or board) that these remain compliant with the respective guidelines’ requirements or make appropriate amendments both to documented and non-documented arrangements.

Key changes and takeaways from the EBA Internal Governance Guidelines

Weak, superficial or non-existent internal governance in financial services firms can lead to a general lack of growth, financial difficulties and thus result in adverse risks to companies, stakeholders and loss of investors’ confidence. As a result, internal governance has been a key topic for supervisory attention amongst NCAs but more specifically the EBA¹⁰, which has been driving supervisory convergence on standards and supervisory expectations. The original guidelines published in 2018 were put in place to drive convergence forward. The 2020 revisions aim to enhance existing standards that firms have to demonstrate that they are complying with.

Unless the provisions of the EBA Internal Governance Guidelines are amended prior to their finalization, in addition to the CRD V and IFR/IFD driven changes these clarify in the introduced revisions that:

• The EBA Internal Governance Guidelines do not apply to those “institutions” (historically this has meant credit institutions and MiFID Investment Firms) that are solely subject to the MiFIR/MiFID II regime. Those firms will be subject to other guidelines/requirements applicable only to MiFID Investment Firms whereas credit institutions, certain holding companies as a result of CRD V changes, and those firms that are, due to IFR/IFD changes, treated as equivalent to credit institutions will have to comply with the EBA Internal Governance Guidelines;
• Combating money laundering (AML) and terrorist financing (collectively financial crime) is crucial for maintaining stability and integrity in the financial system. Therefore, uncovering any involvement of credit institutions and investment firms in money laundering and terrorist financing can have an impact on the viability and trust in the financial system; and
• Identifying, managing and mitigating financial crime is part of sound internal governance arrangements and credit institutions’ risk management framework. Specifically, Para. 32 of the EBA Internal Governance Guidelines states that credit institutions should assign the responsibility for ensuring the credit institution’s compliance with the national implementation of the EU’s AML Directives to a member of the management body in its management function or where such a body does not exist to the person effectively directing the business of the credit institution.

In terms of these clarifications that financial crime prevention is an “internal governance” priority, the ECB-SSM, which has set up its own AML Task Force and is increasingly looking at the financial crime prevention efforts of the BUSIs within its SSM mandate, can exert greater supervisory scrutiny over a thematic area which historically was a conduct of business topic beyond the SSM’s prudential regulatory and internal governance mandate.¹¹ While this extension of the ECB-SSM’s supervisory interests would have likely caused complaints prior to 2020, the ECB-SSM has access, certainly in respect of supervising BUSIs, to greater resources than the EBA (which is supposed to lead on financial crime prevention and supervision across the EU-27’s banking sector) or many national authorities. This is an important change, especially given some very public failings of financial intelligence units and national AML authorities reinforce the need, as highlighted in European Commission working papers ahead of possible proposals, for a more centralized financial crime prevention supervisor.

The revised EBA Internal Governance Guidelines also specify new details and reinforce rules regarding loans from a supervised firm (or affiliates) to members of the management body and their related parties. Those loans may constitute a specific source of actual or potential conflicts of interest. In the same way, other transactions with members of the management body and their related parties have the potential to create conflicts of interest and, therefore, the EBA is providing guidance on how to properly manage them.

Finally, in line with the requirement to have a gender-neutral remuneration policy, the consultation paper contains new guidance on the code of conduct to ensure that credit institutions take all necessary measures to avoid discrimination and guarantee equal opportunities to staff of all genders.

Key changes and takeaways from the EBA/ESMA Fit & Proper Guidelines

Unless the provisions of the EBA/ESMA Fit & Proper Guidelines are amended prior to their finalization, the provisions, in addition to the CRD V and IFR/IFD driven changes, introduce the similar financial crime prevention concepts as set out in the EBA Internal Governance Guidelines. The EBA/ESMA Fit & Proper Guidelines, however, apply, in addition to credit institutions i.e., banks, to certain holding companies and also to MiFID Investment Firms. Consequently, the revisions to the EBA/ESMA Fit & Proper Guidelines, clarify that:

• the knowledge, experience and skill requirements are important aspects in the fit and proper assessment of members of the management body and key function holders as they contribute to identifying and managing financial crime;
• at least one member of the management body must be appointed as responsible for and take ownership of the relevant firm’s financial crime prevention efforts. This in turn may require dedicated initial and on-going training of that management board member as well as the management board collectively as a new prerequisite for establishing the collective suitability of the board as a whole;
• relevant firms and NCAs must have measures that track the risks and adverse impact that could arise in the event of a possible involvement of a member of the management body and/or a key function holder in financial crime, or in the event that the institution is unwilling to take robust action to manage the risk of the institution’s involvement in furthering or itself becoming or being used as a vehicle furthering financial crime;
• being a member of affiliated companies or affiliated entities does not in itself represent an obstacle for a member of the management body to acting with independence of mind;
• relevant firms that are required to comply with the EBA/ESMA Fit & Proper Guidelines (see para. 27 on page 11) are required to ensure that the supervisory expectations of the EBA and ESMA are:

“well integrated and adequate within the group. In particular, they shall ensure that parent undertakings and subsidiaries subject to this Directive implement such governance arrangements, processes and mechanisms in their subsidiaries not subject to this Directive including those established in offshore financial centers. These arrangements, processes and mechanisms shall also be consistent and well integrated, and those subsidiaries shall also be able to produce any data and information relevant to the purpose of supervision.”

This requirement crystalizes in some ways the supervisory approach taken by certain NCAs on a case-by-case basis, mostly for systemic firms, and extends it across to all relevant supervised firms within the mandates of the NCAs across the EU-27 when dealing with those firms and their operations outside the EU and/or the European Economic Area. The undefined term “offshore financial centers”, both in the guideline and as a matter of EU law and terminology¹², may, unless amended, prove to be problematic or even give rise to disagreement, both for supervisory authorities (including the college of supervisors) and supervised firms.

• as part of early intervention measures and during resolution, the suitability of newly appointed members of the management body and of the management body collectively is relevant and requires an assessment; and
• a gender-balanced composition of the management body is of particular importance. Institutions should respect the principle of equal opportunities for any gender and take measures to improve a more gender-balanced composition of staff in management positions.

Firms, notably those that are supervised in the Banking Union, will want to consider the interrelation between the EBA/ESMA Fit & Proper Guidelines and the ECB-SSM’s Supervisory Guidance on Fitness & Proper Assessments”, which were updated in May 2018.

Outlook and next steps 

The changes imposed by the respective guidelines may seem to be marginal but they may require firms to reassess in their annual reviews whether existing policies, procedures and processes, as well as their compliance systems, controls and monitoring framework and governance arrangements, may need amending. Consequently, some firms need to look at the level of training standards they maintain in respect of compliance and other control functions but also with respect to staff and notably senior management more generally on compliance, risk and governance topics.

If you would like to discuss strategic options in respect of the consultations or the impact of any of the items mentioned above, in particular how to plan ahead for any operationalization in meeting compliance requirements and/or in respect of impact on policies and procedures or how these priorities may affect your business or your clients more generally, please contact our Eurozone Hub key contacts.

1. Details are set out in a Press Release available here.↩
2. Available here.↩
3. Further material available from the EBA (and on-behalf of ESMA) here.↩
4. See latest coverage in our series on this development available here.↩
5. See latest coverage in our series on this development available here.↩
6. In respect of the EBA Internal Governance Guidelines and and in respect of the EBA/ESMA Fit & Proper Guidelines.↩
7. Details of which are set out here.↩
8. Available here.↩
9. Available here.↩
10. Available here.↩
11. For further details and coverage on the EU’s but also the ECB-SSM’s financial crime prevention and supervision efforts please see here.↩
12. As opposed to the established EU usage of the terms referencing a “third country” and “third country entities”. ↩