ESG risks in risk management

(1) As part of risk management under section 25a, ESG risks must be taken into account as follows:
1. an ESG risk plan under section 26d must be drawn up as part of the risk strategy;
2. the strategies provided for in section 25a(1), point 1, and the processes established for them to take account of risks arising from the short-, medium-, and long-term effects of ESG factors, must be reviewed, and adapted where necessary, every two years by small and non-complex institutions within the meaning of Article 4(1), first subparagraph, point 145, of Regulation (EU) No 575/2013, and regularly, but at least every two years, by other institutions, depending on the type, scale, complexity, and risk content of their business activities;
3. the procedures under section 25a(1), point 2, must also capture the ESG risks for which the institution expressly takes into account the short-, medium-, and long-term perspective;
4. the processes in section 25a(1), point 3, letter b, must also take account of the scale, type, and complexity of the ESG risks of the business model, and processes appropriate to the scale of the institution's activities with regard to ESG risks to be considered over the short, medium, and long term of at least 10 years;
5. the institution's staffing and technical-organisational resources under section 25a(1), point 4, must be suitable to also enable the identification, assessment, management, and monitoring of ESG risks over the short, medium, and long term of at least 10 years, and
6. the remuneration systems for managers and employees under section 25a(1), point 6, must also take account of the institution's risk appetite in relation to ESG risks.
(2) The managers' knowledge, skills, and experience for understanding the activities and main risks under section 25c(1a) must comprise ESG risks over the short, medium, and long term, and the effects caused by the institution on ESG factors.
(3) Institutions must also deploy the adequate personnel and financial resources under section 25c(4) to ensure the professional qualification of the members of the management body also in relation to ESG risks and their effects.
(4) The strategies, processes, procedures, functions, and concepts under section 25c(4a), which are part of the managers' overall responsibility for the proper business organisation under section 25a(1), second sentence, must take account of ESG risks as follows:
1. the overall strategy under section 25c(4a), point 1, letter a, must also document objectives designed appropriately to the ESG risks of the business model and to the scale of the institution's activities, with regard to the current ESG risks considered over the short, medium, and long term of at least 10 years;
2. the risk management objectives of the material business activities named in the risk strategy under section 25c(4a), point 1, letter b, must also comprise principles, key indicators, and limits, designed appropriately to the ESG risks of the business model and to the scale of the institution's activities, for managing and monitoring the relevant ESG risks considered on a current, short-, medium-, and long-term basis of at least 10 years;
3. the effects of ESG risks over the short, medium, and long term must be taken into account when identifying and defining risks as part of the risk inventory under section 25c(4a), point 2, letter a, and
4. as part of the stress tests to be carried out regularly within the internal control procedures under section 25c(4a), point 3, letter f, the managers must ensure that these stress tests also adequately take account of the effects of ESG risks; institutions must, further, test the long-term resilience of their business model to ESG risks, foremost among them climate risks, using a range of scenarios relating to ESG factors that are based on scenarios developed by recognised international organisations.
(5) The strategies, processes, procedures, functions, and concepts under section 25c(4b) must comprise ESG risks in accordance with the requirements of subsection (4), on the basis that the group's objectives, activities, and business model take the place of the institution's objectives, activities, and business model.
(6) Institutions, financial holding companies, and mixed financial holding companies must, as part of section 25d(4), also ensure the required expertise of the members of the administrative or supervisory body in relation to ESG risks and their effects.
(7) The risk committee's review of the incentives set by the remuneration system under section 25d(8), fourth sentence, also includes ESG risks when taking the risk structure into account.