Measures in the case of organisational deficiencies

(1) Where an institution does not have a proper business organisation within the meaning of section 25a(1), the supervisory authority may, even already before or together with an order under section 25a(2), second sentence, or under section 25c(4c), also in conjunction with a statutory instrument under section 25a(4) or (6) or under section 25b, also in conjunction with a statutory instrument under section 25b(5), in particular order that the institution
1. take measures to reduce risks, insofar as these arise from particular types of business and products, or the use of particular systems, or the outsourcing of activities and processes to another undertaking,
2. may establish further branches only with the supervisory authority's consent, and
3. may not conduct, or may conduct only to a restricted extent, particular types of business, namely the acceptance of deposits, funds, or securities from customers, and the granting of loans under section 19(1). The supervisory authority is entitled to order measures under the first sentence in addition to a determination of increased own funds requirements under section 10(3), second sentence, point 2, and together with or in addition to a determination of increased own funds requirements under section 51a(2), point 4.
(2) Subsection (1) applies correspondingly to the respective superordinate undertaking within the meaning of section 10a and to an institution obliged to carry out sub-consolidation under Article 22 of Regulation (EU) No 575/2013, where an institutional group, a financial holding group, or a mixed financial holding group does not have a proper business organisation, contrary to section 25a(1) and section 25b; subsection (1), first sentence, point 3, applies correspondingly on the basis that, instead of prohibiting or restricting the granting of loans, the supervisory authority may lower the large exposure limits applicable to the institutional group, financial holding group, or mixed financial holding group under Articles 387 to 403 of Regulation (EU) No 575/2013, as amended from time to time. Where a branch of the institution in a third country does not have an appropriate business organisation, or is not in a position to provide the particulars required to assess its business organisation or for inclusion in the institution's organisation, or is not effectively supervised in the third country, or the supervisory body responsible for the branch is not willing to cooperate satisfactorily with the supervisory authority, the supervisory authority may also restrict the branch's business activity or order its closure and winding-up.
(3) Subsection (1), first sentence, point 1, applies correspondingly to outsourcing undertakings, insofar as an institution or a superordinate undertaking has outsourced material activities and processes within the meaning of section 25b(1), first sentence.