Supervisory review and evaluation

(1) The Bundesanstalt reviews and evaluates the arrangements, strategies, procedures and mechanisms that a medium-sized securities institution has put in place to comply with this Act and Regulation (EU) 2019/2033; in doing so the Bundesanstalt takes into account the size, risk profile and business model of the medium-sized securities institution.
(2) To assess and establish whether a medium-sized securities institution has sound risk management and risk coverage, the Bundesanstalt may in particular take into account:
1. the risks referred to in section 45;
2. the location of the securities institution's risk exposures;
3. the securities institution's business model;
4. the assessment of systemic risks, having regard to the identification and measurement of systemic risk under Article 23 of Regulation (EU) No 1093/2010 or the recommendations of the European Systemic Risk Board;
5. the risks to the security of the network and information systems that the securities institution uses to ensure the confidentiality, integrity and availability of its processes, data and assets;
6. the interest-rate risk to which the securities institution is exposed in respect of non-trading-book business;
7. the securities institution's governance arrangements and the ability of the managers and the members of the supervisory or administrative body to perform their duties; and
8. whether the securities institution has taken out professional indemnity insurance.
(2a) Where a medium-sized securities institution holds exposures to central counterparties, the Bundesanstalt reviews and evaluates
1. those exposures with regard to the management of the concentration risk arising from them;
2. the plans developed under section 45(3), second sentence; and
3. progress in adapting its business model to the requirements laid down in Article 7a of Regulation (EU) No 648/2012.
(3) The Bundesanstalt may, in an individual case, having regard to the size, nature, scale and complexity of the business of a medium-sized securities institution and its systemic importance, dispense with the review and evaluation under subsection (2). In that decision, the requirements of section 84 of the Securities Trading Act and section 10 of the Regulation on Conduct of Business and Organisational Requirements for Investment Services concerning the segregation of customer funds held from the securities institution's own funds must be taken into account.
(4) The Bundesanstalt decides, in an individual case, whether and in what form the review and evaluation under subsections (1) to (2a) is carried out in respect of a small securities institution, where the Bundesanstalt considers this necessary on account of the size, nature, scale and complexity of the securities institution's business.
(5) The securities institution must, for the purposes of the assessment and determination to be carried out under subsections (1) to (2a), give the Bundesanstalt access to the agendas, minutes and supporting documents of the meetings of the management or supervisory body and its committees, and to the results of the internal or external assessment of the performance of the managers.