Bank governance rules ease documentation but retain accountability
Revised European Banking Authority (EBA) guidelines give banks more flexibility in documenting governance while preserving board accountability. They clarify responsibility mapping, control functions and requirements for third-country branches.
Less duplication, duties still mapped
The revised guidelines implement CRD VI governance requirements and reflect the Digital Operational Resilience Act (DORA).
Banks must maintain board-approved mappings of duties and signed individual statements for executive board members, senior management and key function holders.
Existing document repositories, including group systems, may support compliance; the statement template is optional.
Smaller, less complex institutions may use simpler arrangements.
Risk and compliance functions may be combined with documented justification and conflict safeguards, but internal audit must remain separate.
The EBA removed duplicative provisions, a standalone third-party risk section and prescriptive diversity indicators.
Collective board responsibility remains unchanged.
Local substance remains mandatory
Third-country branches need at least two people directing business locally and sufficient resources to avoid becoming empty shells.
EU-linked back-to-back transactions must be risk-managed from the EU.
Class 2 branches may combine risk and compliance, subject to supervisory requirements.
Former CEOs becoming chair within two years require conflict safeguards, not a blanket ban.
ESG risk assessment covers at least 10 years; board-related loans above €200,000 require additional information on request.
Flexibility is not an exemption
Proportionality changes how banks implement governance, not their CRD obligations.
The EBA anticipates low implementation costs, while stakeholders challenged the burden of responsibility mapping.
The supplied report leaves application, repeal and supervisory compliance-notification dates unspecified.