S.L. 371.16 Art. 3Supervisoryreview and evaluation.

(1) The competent authority shall, taking into account the technical criteria set out in regulation 4, review the arrangements, strategies, processes and mechanisms implemented by credit institutions to comply with the Act and any regulations or Banking

Rules issued thereunder, with any binding legal instruments issued under the CRD and with the CRR, and evaluate:

(a) risks to which credit institutions are or might be exposed; and (b) deleted by Legal Notice 493 of 2021;

(c) risks revealed by stress testing taking into account the nature, scale and complexity of a credit institution’s activities; and

(d) risk revealed by digital operational resilience testing in accordance with Chapter IV of the DORA Regulation.

(2) The scope of the review and evaluation referred to in sub-regulation (1) shall cover all requirements of the Act and any regulations or Banking Rules issued thereunder, of any binding legal instruments issued under the CRD and of the CRR.

(3) On the basis of the review and evaluation referred to in sub-regulation (1), the competent authority shall determine whether the arrangements, strategies, processes and mechanisms implemented by credit institutions and the own funds and liquidity held by them ensure a sound management and coverage of their risks.

(4) The competent authority shall establish the frequency and intensity of the review and evaluation referred to in sub-regulation

(1) having regard to the size, systemic importance, nature, scale and complexity of the activities of the credit institution concerned and taking into account the principle of proportionality. The review and evaluation shall be updated at least on an annual basis for credit institutions covered by the supervisory examination programme referred to in regulation 5(2):

Provided that when conducting the review and evaluation referred to in sub-regulation (1), the competent authority shall apply the principle of proportionality in accordance with the criteria disclosed pursuant to regulation 17(1)(c).

(4A) The competent authority may tailor the methodologies for the application of the review and evaluation referred to in sub-regulation (1) to take into account credit institutions with a similar risk profile, such as similar business models or geographical location of exposures. Such tailored methodologies may include risk-oriented benchmarks and quantitative indicators, shall allow for due consideration of the specific risks that each credit institution may be exposed to, and shall not affect the institution-specific nature of measures imposed in accordance with regulation 9:

Provided that where the competent authority uses tailored methodologies pursuant to this sub-regulation, it shall notify the EBA.

(5) Where a review shows that a credit institution may pose systemic risk in accordance with Article 23 of Regulation (EU) No 1093/2010, the competent authority shall inform the EBA without delay about the results of the review.

(6) Where a review, in particular the evaluation of governance arrangements, the business model, or the activities of a credit institution, gives the competent authority reasonable grounds to suspect that, in connection with that credit institution, money laundering or terrorist financing is being or has been committed or attempted, or there is increased risk thereof, the competent authority shall immediately notify the EBA and the Financial Intelligence Analysis Unit established in terms of the Prevention of Money Laundering Act. In the event of potential increased risk of money laundering or terrorist financing, the competent authority together with the Financial Intelligence Analysis Unit shall conduct a joint assessment. Such assessment shall be immediately notified to the EBA. The competent authority shall take, as appropriate and without prejudice to the power of other authorities to take any action or regulatory measures available to them under any other applicable law, measures in accordance with the Act and any regulations made and Banking Rules issued thereunder transposing the CRD and with any binding legal instruments issued under the CRD:

Provided that this sub-regulation shall be without prejudice to the obligations of the competent authority arising out of any other applicable legislation relating to the prevention of money laundering and the funding of terrorism.