Skip to the text
In this act Article 20 of 32

Article 20 — Information on internal controls (Article 27da(2), point (d), of Regulation (EU) No 600/2014)

Financial servicesLevel 2RTSMiFIRIn forceOfficial source

20(1)

1.An applicant seeking authorisation to operate a CT pursuant to Article 27db of Regulation (EU) No 600/2014 shall include in its application for authorisation detailed information regarding its internal control’s environment. This shall include information regarding its internal control function, compliance function, risk management function and its internal audit function.

Copy link
20(2)

2.The detailed information set out in paragraph 1 shall contain:

Copy link
20(2)(a)
(a)an outline of the organisation of the applicant’s internal control, risk management, compliance and internal audit functions, including where the applicant relies on outsourced functions;
Copy link
20(2)(b)
(b)an assessment of the key risks that may arise in the operation of the CT;
Copy link
20(2)(c)
(c)the applicant’s internal control policies and procedures to ensure the consistent and effective implementation of those policies;
Copy link
20(2)(d)
(d)any policies, procedures and manuals for monitoring and evaluating the adequacy and effectiveness of the applicant’s systems;
Copy link
20(2)(e)
(e)any policies, procedures and manuals for controlling and safeguarding the applicant’s information processing systems;
Copy link
20(2)(f)
(f)the identity of the internal bodies in charge of evaluating any findings resulting from the performance of the internal control and deciding on their outcome.
Copy link
20(3)

3.With respect to the applicant’s internal audit function, the detailed information referred to in paragraph 1 shall contain the following:

Copy link
20(3)(a)
(a)information on the applicant’s adherence to national or international professional standards;
Copy link
20(3)(b)
(b)any internal audit function charter, methodologies, and procedures;
Copy link
20(3)(c)
(c)an explanation of how the internal audit methodology, if any, is developed and applied taking into account the nature of the applicant’s activities, complexities and risks;
Copy link
20(3)(d)
(d)where there is an Internal Audit Committee:
Copy link
20(3)(d)(i)
(i)information on its composition, competences and responsibilities;
Copy link
20(3)(d)(ii)
(ii)its work plan for the three years following the date of application, taking into account the nature and extent of the applicant’s activities, complexities and risks.
Copy link