Institutions shall have robust governance arrangements, which include a clear organisational structure with well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks they are or might be exposed to, adequate internal control mechanisms, including sound administration and accounting procedures, and remuneration policies and practices that are consistent with and promote sound and effective risk management.

The arrangements, processes and mechanisms referred to in paragraph 1 shall be comprehensive and proportionate to the nature, scale and complexity of the risks inherent in the business model and the institution's activities. The technical criteria established in Articles 76 to 95 shall be taken into account.

EBA shall issue guidelines on the arrangements, processes and mechanisms referred to in paragraph 1, in accordance with paragraph 2.

Competent authorities shall ensure that recovery plans for the restoration of an institution's financial situation following a significant deterioration, and resolution plans are put in place. In accordance with the principle of proportionality, the requirements for an institution to draw up, maintain and update recovery plans and for the resolution authority, after consulting the competent authority, to prepare resolution plans, may be reduced if, after consulting the national macroprudential authority, competent authorities consider that the failure of a specific institution due, inter alia, to its size, to its business model, to its interconnectedness to other institutions, or to the financial system in general, will not have a negative effect on financial markets, on other institutions or on funding conditions.

Institutions shall cooperate closely with resolution authorities and shall provide them with all information necessary for the preparation and drafting of viable resolution plans setting out options for the orderly resolution of the institutions in the case of failure, in accordance with the principle of proportionality.

In accordance with Article 25 of Regulation (EU) No 1093/2010, EBA shall be entitled to participate in and contribute to the development and coordination of effective and consistent recovery and resolution plans.

In that regard EBA shall be informed of, and shall be entitled to participate in, meetings relating to the development and coordination of recovery and resolution plans. Where any such meetings or activities take place, EBA shall be fully informed in advance of the organisation of such meetings, of the main issues to be discussed and of the activities to be considered.

Competent authorities shall collect the information disclosed in accordance with the criteria for disclosure established in points (g), (h) and (i) of Article 450(1) of Regulation (EU) No 575/2013 and shall use it to benchmark remuneration trends and practices. The competent authorities shall provide EBA with that information.

ESMA shall cooperate closely with EBA to develop guidelines on remuneration policies for categories of staff involved in the provision of investment services and activities within the meaning of point 2 of Article 4(1) of Directive 2004/39/EC.

EBA shall use the information received from the competent authorities in accordance with paragraph 1 to benchmark remuneration trends and practices at Union level.

Competent authorities shall collect information on the number of natural persons per institution that are remunerated EUR 1 million or more per financial year, in pay brackets of EUR 1 million, including their job responsibilities, the business area involved and the main elements of salary, bonus, long-term award and pension contribution. That information shall be forwarded to EBA, which shall publish it on an aggregate home Member State basis in a common reporting format. EBA may elaborate guidelines to facilitate the implementation of this paragraph and ensure the consistency of the information collected.

Member States shall ensure that the management body approves and periodically reviews the strategies and policies for taking up, managing, monitoring and mitigating the risks the institution is or might be exposed to, including those posed by the macroeconomic environment in which it operates in relation to the status of the business cycle.

Member States shall ensure that the management body devotes sufficient time to consideration of risk issues. The management body shall be actively involved in and ensure that adequate resources are allocated to the management of all material risks addressed in this Directive and in Regulation (EU) No 575/2013 as well as in the valuation of assets, the use of external credit ratings and internal models relating to those risks. The institution shall establish reporting lines to the management body that cover all material risks and risk management policies and changes thereof.

Member States shall ensure that institutions that are significant in terms of their size, internal organisation and the nature, scope and complexity of their activities establish a risk committee composed of members of the management body who do not perform any executive function in the institution concerned. Members of the risk committee shall have appropriate knowledge, skills and expertise to fully understand and monitor the risk strategy and the risk appetite of the institution.

The risk committee shall advise the management body on the institution's overall current and future risk appetite and strategy and assist the management body in overseeing the implementation of that strategy by senior management. The management body shall retain overall responsibility for risks.

The risk committee shall review whether prices of liabilities and assets offered to clients take fully into account the institution's business model and risk strategy. Where prices do not properly reflect risks in accordance with the business model and risk strategy, the risk committee shall present a remedy plan to the management body.

Competent authorities may allow an institution which is not considered significant as referred to in the first subparagraph to combine the risk committee with the audit committee as referred to in Article 41 of Directive 2006/43/EC. Members of the combined committee shall have the knowledge, skills and expertise required for the risk committee and for the audit committee.

Member States shall ensure that the management body in its supervisory function and, where a risk committee has been established, the risk committee have adequate access to information on the risk situation of the institution and, if necessary and appropriate, to the risk management function and to external expert advice.

The management body in its supervisory function and, where one has been established, the risk committee shall determine the nature, the amount, the format, and the frequency of the information on risk which it is to receive. In order to assist in the establishment of sound remuneration policies and practices, the risk committee shall, without prejudice to the tasks of the remuneration committee, examine whether incentives provided by the remuneration system take into consideration risk, capital, liquidity and the likelihood and timing of earnings.

Member States shall ensure that the risk management function ensures that all material risks are identified, measured and properly reported. They shall ensure that the risk management function is actively involved in elaborating the institution's risk strategy and in all material risk management decisions and that it can deliver a complete view of the whole range of risks of the institution.

Where necessary, Member States shall ensure that the risk management function can report directly to the management body in its supervisory function, independent from senior management, and can raise concerns and warn that body, where appropriate, where specific risk developments affect or may affect the institution, without prejudice to the responsibilities of the management body in its supervisory and/or managerial functions pursuant to this Directive and Regulation (EU) No 575/2013.

The head of the risk management function shall be an independent senior manager with distinct responsibility for the risk management function. Where the nature, scale and complexity of the activities of the institution do not justify a specially appointed person, another senior person within the institution may fulfil that function, provided there is no conflict of interest.

The head of the risk management function shall not be removed without prior approval of the management body in its supervisory function and shall be able to have direct access to the management body in its supervisory function where necessary.

The application of this Directive shall be without prejudice to the application of Directive 2006/73/EC to investment firms.

Competent authorities shall encourage institutions that are significant in terms of their size, internal organisation and the nature, scale and complexity of their activities to develop internal credit risk assessment capacity and to increase use of the internal ratings based approach for calculating own funds requirements for credit risk where their exposures are material in absolute terms and where they have at the same time a large number of material counterparties. This Article shall be without prejudice to the fulfilment of criteria laid down in Part Three, Title I, Chapter 3, Section 1 of Regulation (EU) No 575/2013.

Competent authorities shall, taking into account the nature, scale and complexity of institutions' activities, monitor that they do not solely or mechanistically rely on external credit ratings for assessing the creditworthiness of an entity or financial instrument.

Competent authorities shall encourage institutions, taking into account their size, internal organisation and the nature, scale and complexity of their activities, to develop internal specific risk assessment capacity and to increase use of internal models for calculating own funds requirements for specific risk of debt instruments in the trading book, together with internal models to calculate own funds requirements for default and migration risk where their exposures to specific risk are material in absolute terms and where they have a large number of material positions in debt instruments of different issuers.

This Article shall be without prejudice to the fulfilment of the criteria laid down in Part Three, Title IV, Chapter 5, Sections 1 to 5, of Regulation (EU) No 575/2013.

EBA shall develop draft regulatory technical standards to further define the notion 'exposures to specific risk which are material in absolute terms' referred to in the first subparagraph of paragraph 3 and the thresholds for large numbers of material counterparties and positions in debt instruments of different issuers.

EBA shall submit those draft regulatory technical standards to the Commission by 1 January 2014.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Competent authorities shall ensure that institutions permitted to use internal approaches for the calculation of risk weighted exposure amounts or own fund requirements except for operational risk report the results of the calculations of their internal approaches for their exposures or positions that are included in the benchmark portfolios. Institutions shall submit the results of their calculations, together with an explanation of the methodologies used to produce them, to the competent authorities at an appropriate frequency, and at least annually.

Competent authorities shall ensure that institutions submit the results of the calculations referred to in paragraph 1 in accordance with the template developed by EBA in accordance with paragraph 8 to the competent authorities and to EBA. Where competent authorities choose to develop specific portfolios, they shall do so in consultation with EBA and ensure that institutions report the results of the calculations separately from the results of the calculations for EBA portfolios.

Where particular institutions diverge significantly from the majority of their peers or where there is little commonality in approach leading to a wide variance of results, competent authorities shall investigate the reasons therefor and, if it can be clearly identified that an institution's approach leads to an underestimation of own funds requirements which is not attributable to differences in the underlying risks of the exposures or positions, shall take corrective action.

EBA may issue guidelines and recommendations in accordance with Article 16 of Regulation (EU) No 1093/2010 where it considers them necessary on the basis of the information and assessments referred to in paragraphs 2 and 3 of this Article in order to improve supervisory practices or practices of institutions with regard to internal approaches.

The Commission shall, by 1 April 2015 and after consulting EBA, submit a report to the European Parliament and to the Council on the functioning of the benchmarking of internal models including the scope of the model. Where appropriate, the report shall be followed by a legislative proposal.

Competent authorities shall ensure that the risks arising from securitisation transactions in relation to which the credit institutions are investor, originator or sponsor, including reputational risks, such as arise in relation to complex structures or products, are evaluated and addressed through appropriate policies and procedures, to ensure that the economic substance of the transaction is fully reflected in the risk assessment and management decisions.

Competent authorities shall ensure that liquidity plans to address the implications of both scheduled and early amortisation exist at institutions which are originators of revolving securitisation transactions involving early amortisation provisions.

Competent authorities shall ensure that policies and processes for the identification, measurement and management of all material sources and effects of market risks are implemented.

Where the short position falls due before the long position, competent authorities shall ensure that institutions also take measures against the risk of a shortage of liquidity.

The internal capital shall be adequate for material market risks that are not subject to an own funds requirement.

Institutions, which have, in calculating own funds requirements for position risk in accordance with Part Three, Title IV, Chapter 2, of Regulation (EU) No 575/2013, netted off their positions in one or more of the equities constituting a stock-index against one or more positions in the stock-index future or other stock-index product shall have adequate internal capital to cover the basis risk of loss caused by the future's or other product's value not moving fully in line with that of its constituent equities. Institutions shall also have such adequate internal capital where they hold opposite positions in stock-index futures which are not identical in respect of either their maturity or their composition or both.

Where using the treatment in Article 345 of Regulation (EU) No 575/2013, institutions shall ensure that they hold sufficient internal capital against the risk of loss which exists between the time of the initial commitment and the following working day.

Competent authorities shall ensure that institutions implement policies and processes to evaluate and manage the exposure to operational risk, including model risk, and to cover low-frequency high-severity events. Institutions shall articulate what constitutes operational risk for the purposes of those policies and procedures.

Competent authorities shall ensure that contingency and business continuity plans are in place to ensure an institution's ability to operate on an ongoing basis and limit losses in the event of severe business disruption.

Competent authorities shall ensure that institutions have robust strategies, policies, processes and systems for the identification, measurement, management and monitoring of liquidity risk over an appropriate set of time horizons, including intra-day, so as to ensure that institutions maintain adequate levels of liquidity buffers. Those strategies, policies, processes and systems shall be tailored to business lines, currencies, branches and legal entities and shall include adequate allocation mechanisms of liquidity costs, benefits and risks.

The strategies, policies, processes and systems referred to in paragraph 1 shall be proportionate to the complexity, risk profile, scope of operation of the institutions and risk tolerance set by the management body and reflect the institution's importance in each Member State in which it carries out business. Institutions shall communicate risk tolerance to all relevant business lines.

Competent authorities shall ensure that institutions, taking into account the nature, scale and complexity of their activities, have liquidity risk profiles that are consistent with and, not in excess of, those required for a well-functioning and robust system.

Competent authorities shall monitor developments in relation to liquidity risk profiles, for example product design and volumes, risk management, funding policies and funding concentrations.

Competent authorities shall take effective action where developments referred to in the second subparagraph may lead to individual institution or systemic instability.

Competent authorities shall inform EBA about any actions carried out pursuant to the third subparagraph.

EBA shall make recommendations where appropriate in accordance with Regulation (EU) No 1093/2010.

Competent authorities shall ensure that institutions develop methodologies for the identification, measurement, management and monitoring of funding positions. Those methodologies shall include the current and projected material cash-flows in and arising from assets, liabilities, off-balance-sheet items, including contingent liabilities and the possible impact of reputational risk.

Competent authorities shall ensure that institutions distinguish between pledged and unencumbered assets that are available at all times, in particular during emergency situations. They shall also ensure that institutions take into account the legal entity in which assets reside, the country where assets are legally recorded either in a register or in an account and their eligibility and shall monitor how assets can be mobilised in a timely manner.

Competent authorities shall ensure that institutions also have regard to existing legal, regulatory and operational limitations to potential transfers of liquidity and unencumbered assets amongst entities, both within and outside the European Economic Area.

Competent authorities shall ensure that institutions consider different liquidity risk mitigation tools, including a system of limits and liquidity buffers in order to be able to withstand a range of different stress events and an adequately diversified funding structure and access to funding sources. Those arrangements shall be reviewed regularly.

Competent authorities shall ensure that institutions consider alternative scenarios on liquidity positions and on risk mitigants and review the assumptions underlying decisions concerning the funding position at least annually. For those purposes, alternative scenarios shall address, in particular, off-balance sheet items and other contingent liabilities, including those of Securitisation Special Purpose Entities (SSPE) or other special purpose entities, as referred to in Regulation (EU) No 575/2013, in relation to which the institution acts as sponsor or provides material liquidity support.

Competent authorities shall ensure that institutions consider the potential impact of institution-specific, market-wide and combined alternative scenarios. Different time periods and varying degrees of stress conditions shall be considered.

Competent authorities shall ensure that institutions adjust their strategies, internal policies and limits on liquidity risk and develop effective contingency plans, taking into account the outcome of the alternative scenarios referred to in paragraph 8.

Competent authorities shall ensure that institutions have in place liquidity recovery plans setting out adequate strategies and proper implementation measures in order to address possible liquidity shortfalls, including in relation to branches established in another Member State. Competent authorities shall ensure that those plans are tested by the institutions at least annually, updated on the basis of the outcome of the alternative scenarios set out in paragraph 8, reported to and approved by senior management, so that internal policies and processes can be adjusted accordingly. Institutions shall take the necessary operational steps in advance to ensure that liquidity recovery plans can be implemented immediately. For credit institutions, such operational steps shall include holding collateral immediately available for central bank funding. This includes holding collateral where necessary in the currency of another Member State, or the currency of a third country to which the credit institution has exposures, and where operationally necessary within the territory of a host Member State or of a third country to whose currency it is exposed.

Competent authorities shall ensure that institutions have policies and processes in place for the identification, management and monitoring of the risk of excessive leverage. Indicators for the risk of excessive leverage shall include the leverage ratio determined in accordance with Article 429 of Regulation (EU) No 575/2013 and mismatches between assets and obligations.

Competent authorities shall ensure that institutions address the risk of excessive leverage in a precautionary manner by taking due account of potential increases in the risk of excessive leverage caused by reductions of the institution's own funds through expected or realised losses, depending on the applicable accounting rules. To that end, institutions shall be able to withstand a range of different stress events with respect to the risk of excessive leverage.

Notwithstanding paragraph 1, Member States shall require institutions to disclose the information referred to in paragraph 1(a), (b) and (c) for the first time on 1 July 2014.

By 1 July 2014, all global systemically important institutions authorised within the Union, as identified internationally, shall submit to the Commission the information referred to in paragraph 1(d), (e) and (f) on a confidential basis. The Commission, after consulting EBA, EIOPA and ESMA, as appropriate, shall conduct a general assessment as regards potential negative economic consequences of the public disclosure of such information, including the impact on competitiveness, investment and credit availability and the stability of the financial system. The Commission shall submit its report to the European Parliament and to the Council by 31 December 2014.

In the event that the Commission report identifies significant negative effects, the Commission shall consider making an appropriate legislative proposal for an amendment of the disclosure obligations set out in paragraph 1 and may, in accordance with point (h) of Article 145, decide to defer those obligations. The Commission shall review the necessity to extend deferral annually.

The information referred to in paragraph 1 shall be audited in accordance with Directive 2006/43/EC and shall be published, where possible, as an annex to the annual financial statements or, where applicable, to the consolidated financial statements of the institution concerned.

To the extent that future Union legislative acts for disclosure obligations go beyond those laid down in this Article, this Article shall cease to apply and shall be deleted accordingly.

Members of the management body shall at all times be of sufficiently good repute and possess sufficient knowledge, skills and experience to perform their duties. The overall composition of the management body shall reflect an adequately broad range of experiences. Members of the management body shall, in particular, fulfil the requirements set out in paragraphs 2 to 8.

All members of the management body shall commit sufficient time to perform their functions in the institution.

Directorships in organisations which do not pursue predominantly commercial objectives shall not count for the purposes of paragraph 3.

Competent authorities may authorise members of the management body to hold one additional non-executive directorship. Competent authorities shall regularly inform EBA of such authorisations.

The management body shall possess adequate collective knowledge, skills and experience to be able to understand the institution's activities, including the main risks.

Each member of the management body shall act with honesty, integrity and independence of mind to effectively assess and challenge the decisions of the senior management where necessary and to effectively oversee and monitor management decision-making.

Institutions shall devote adequate human and financial resources to the induction and training of members of the management body.

Member States or competent authorities shall require institutions and their respective nomination committees to engage a broad set of qualities and competences when recruiting members to the management body and for that purpose to put in place a policy promoting diversity on the management body.

Competent authorities shall collect the information disclosed in accordance with Article 435(2)(c) of Regulation (EU) No 575/2013 and shall use it to benchmark diversity practices. The competent authorities shall provide EBA with that information. EBA shall use that information to benchmark diversity practices at Union level.

This Article shall be without prejudice to provisions on the representation of employees in the management body as provided for by national law.

The application of paragraph 2 of this Article and of Articles 93, 94 and 95 shall be ensured by competent authorities for institutions at group, parent company and subsidiary levels, including those established in offshore financial centres.

EBA shall develop draft regulatory technical standards with respect to specifying the classes of instruments that satisfy the conditions set out in point (l)(ii) of paragraph 1 and with respect to qualitative and appropriate quantitative criteria to identify categories of staff whose professional activities have a material impact on the institution's risk profile as referred to in Article 92(2).

EBA shall submit those draft regulatory technical standards to the Commission by 31 March 2014.

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Article 10 to 14 of Regulation (EU) No 1093/2010.

Competent authorities shall ensure that institutions that are significant in terms of their size, internal organisation and the nature, the scope and the complexity of their activities establish a remuneration committee. The remuneration committee shall be constituted in such a way as to enable it to exercise competent and independent judgment on remuneration policies and practices and the incentives created for managing risk, capital and liquidity.

Competent authorities shall ensure that the remuneration committee is responsible for the preparation of decisions regarding remuneration, including those which have implications for the risk and risk management of the institution concerned and which are to be taken by the management body. The Chair and the members of the remuneration committee shall be members of the management body who do not perform any executive function in the institution concerned. If employee representation on the management body is provided for by national law, the remuneration committee shall include one or more employee representatives. When preparing such decisions, the remuneration committee shall take into account the long-term interests of shareholders, investors and other stakeholders in the institution and the public interest.