(1) The managers must ensure that a specific plan for monitoring and managing ESG risks (ESG risk plan) is drawn up, together with processes for planning, implementing, assessing, and adapting this plan. At a minimum, the managers must ensure that
1. the ESG risk plan addresses the financial risks arising from environmental, social, and governance factors (ESG factors), including the risks arising from the adjustment process in connection with the relevant regulatory objectives and legal acts of the European Union and the member states relating to ESG factors, and — where relevant for internationally active institutions — with the relevant legal and regulatory objectives of third countries;
2. the risks named in point 1 are monitored and managed over the short, medium, and long term of at least 10 years;
3. the ESG risk plan sets quantifiable targets and key indicators, appropriate to the ESG risks of the business model and to the scale of the institution's activities, for managing the risks named in point 1, and defines procedures for monitoring them;
4. the targets and procedures named in point 3 take into account the most recent reports of the European Scientific Advisory Board on Climate Change and the measures it determines, in particular with regard to achieving the European Union's climate targets, and
5. the ESG risk plan is coherent with other particulars to be disclosed. In doing so, small and non-complex institutions within the meaning of Article 4(1), point 145, of Regulation (EU) No 575/2013, and institutions comparable to them by type, scale, complexity, and risk content of their business activities, may set targets, key indicators, and procedures, taking into account the type, scale, and complexity of their business model, by which they monitor and manage ESG risks; in doing so, they should take into account any limitations on the availability of ESG information from the institutions' various counterparties arising from the statutory requirements applicable to those counterparties for accounting and for other reporting relevant to ESG risks, or for corresponding duties of care, as well as established industry standards. In particular, the institutions named in the third sentence may describe their targets and procedures in purely qualitative terms, taking into account their respective institution-specific risk profile. By way of derogation from the first sentence, point 1, of this subsection, the institutions named in the third sentence may, until 31 December 2029, limit their ESG risk plan to financial risks connected with environment-related risks, in particular climate risks. By way of derogation from the first sentence, point 4, of this subsection, the institutions named in the third sentence decide to what extent they take into account the most recent reports of the European Scientific Advisory Board on Climate Change and the measures it determines in their ESG risk plan.
(2) The duty under subsection (1) also applies to groups under section 25c(4b), first sentence.
6.
Audit and appointment of auditors