Internal compliance function

Designated providers must establish a compliance function, independent from operational functions, composed of one or more compliance officers including a head of the compliance function, who reports directly to the management body.

The function must have sufficient authority, stature and resources; compliance officers must have professional qualifications, knowledge and experience appropriate to the task, and may not be dismissed without the management body being informed and given reasons.

Its remit is to cooperate with the Commission and coordinators, ensure risks are identified and mitigated, organise and supervise Article 37 audits, and inform and advise management and staff.

The article also places the duty on the management body itself: it must approve and periodically review the strategies for risk management, and is accountable for them.