S.L. 370.15 Art. 11Supervisoryreview and evaluation.

(1) The competent authority shall, taking into account the technical criteria set out in Schedule I, review the arrangements, strategies, processes and mechanisms implemented by investment firms to comply with the CRR, the Act, regulations or Investment Services Rules issued thereunder and evaluate:

(a) risks to which investment firms are or might be exposed;

(b) risks revealed by stress testing taking into account the nature, scale and complexity of an investment firm’s activities; and

(c) risks revealed by digital operational resilience testing in accordance with Chapter IV of the DORA Regulation.

(2) The scope of the review and evaluation referred to in sub-regulation (1) shall cover all requirements of the CRR, the Act, regulations or Investment Services Rules issued thereunder.

(3) On the basis of the review and evaluation referred to in sub-regulation (1), the competent authority shall determine whether the arrangements, strategies, processes and mechanisms implemented by investment firms and the own funds and liquidity held by them ensure a sound management and coverage of their risks.

(4) The competent authority shall establish the frequency and intensity of the review and evaluation referred to in sub-regulation

(1) having regard to the size, systemic importance, nature, scale and complexity of the activities of the investment firm concerned and taking into account the principle of proportionality. The review and evaluation shall be updated at least on an annual basis for investment firms covered by the supervisory examination programme referred to in regulation 13: Provided that when conducting the review and evaluation referred to in sub-regulation (1), the competent authority shall apply the principle of proportionality in accordance with the criteria disclosed pursuant to Regulation 21(1)(c).

(4A) The competent authority may tailor the methodologies for the application of the review and evaluation referred to in sub-regulation (1) to take into account investment firms with a similar risk profile, such as similar business models or geographical location of exposures. Such tailored methodologies may include risk-oriented benchmarks and quantitative indicators, shall allow for due consideration of the specific risks that each investment firm may be exposed to, and shall not affect the institution-specific nature of measures imposed in accordance with paragraph 1 of Schedule III: Provided that where the competent authority uses tailored methodologies pursuant to this paragraph, it shall notify the EBA.

(5) Where a review shows that an investment firm may pose systemic risk in accordance with the EBA’s technical criteria for the identification and measurement of systemic risk established in terms of Article 23 of Regulation (EU) No. 1093/2010, the competent authority shall inform the EBA without delay about the results of the review.

(6) Where a review, in particular the evaluation of governance arrangements, the business model, or the activities of an investment firm, gives the competent authority reasonable grounds to suspect that, in connection with that investment firm, money laundering or terrorist financing is being or has been committed or attempted, or there is increased risk thereof, the competent authority shall immediately notify the EBA and the authority or body that supervises the investment firm in accordance with Directive (EU) 2015/849 and is competent for ensuring compliance with the said Directive. In the event of potential increased risk of money laundering or terrorist financing, the competent authority and the authority or body that supervises the investment firm in accordance with Directive (EU) 2015/849 and is competent for ensuring compliance with the said Directive shall liaise and notify their common assessment immediately to the EBA. The competent authority shall take the necessary measures, as it deems appropriate, in accordance with the CRD as transposed in Maltese Law.