Function of the management or supervisory body in risk management; establishment of committees

(1) The management or supervisory body of the securities institution regularly oversees the risk strategy and the internal principles of the securities institution for dealing with risks. It oversees the appropriate design of the remuneration systems, including their implementation at the securities institution, and regularly reviews them. It is also responsible for the design of the remuneration systems for managers.
(2) The management or supervisory body has access to the information necessary to perform its control and monitoring function. This includes, in particular, access to information on the risks to which the securities institution is, or could be, exposed.
(3) The management or supervisory body of a securities institution must establish, from among its members, a risk committee and a remuneration control committee. A securities institution may dispense with establishing a risk committee and a remuneration control committee where
1. its on- and off-balance-sheet assets, measured as an average over the preceding four financial years, do not exceed EUR 100 million; or
2. its on- and off-balance-sheet assets, measured as an average over the preceding four financial years, do not exceed EUR 300 million, where
a) it is not, measured by balance-sheet total, among the three largest medium-sized securities institutions having their seat in Germany;
b) it is not subject to the requirements relating to recovery and resolution planning, or, under sections 19 and 41 of the Recovery and Resolution Act, to the simplified requirements relating to recovery and resolution planning;
c) the scope of its on- and off-balance-sheet trading-book activity does not exceed EUR 150 million; and
d) the scope of its on- and off-balance-sheet derivatives business does not exceed EUR 100 million. In derogation from the second sentence, the Bundesanstalt may, in an individual case, order a securities institution to establish a risk committee where this is warranted by the nature and scale of the securities institution's activity, its internal organisation, or the characteristics of the group to which the securities institution belongs.
(4) The risk committee advises the management or supervisory body on the securities institution's current and future overall risk appetite and strategy. It supports the management or supervisory body in overseeing the implementation of the risk strategy by the managers.
(5) The members of the risk committee must have sufficient knowledge, skills and experience to understand and monitor the securities institution's risk strategy and risk appetite.
(6) The remuneration control committee supports the management or supervisory body in reviewing the remuneration systems and the incentives created for risk, capital and liquidity management. It is responsible for preparing decisions of the management or supervisory body on remuneration systems, including those affecting the risk and risk management of the securities institution concerned. In preparing such decisions, the remuneration control committee has regard to the public interest and to the long-term interests of the shareholders, investors and other stakeholders of the securities institution.
(7) The remuneration control committee must have a balanced composition of women and men. The members of the remuneration control committee must be able competently and independently to assess the remuneration systems and the incentives created for risk, capital and liquidity management. Where employee representation on the management or supervisory body is provided for, the remuneration control committee includes one or more employee representatives. The remuneration control committee may be established at group level.