TITLE III

CONDITIONS GOVERNING ACTIVITIES
CHAPTER 1

System of governance
Section 1

General provisions

Responsibility of the management or supervisory body
Article 20
1
Member States shall ensure that the management or supervisory body of an IORP has ultimate responsibility under national law for the compliance, by the IORP concerned, with the laws, regulations and administrative provisions adopted pursuant to this Directive.
2
This Directive is without prejudice to the role of social partners in the management of IORPs.

General governance requirements
Article 21
1
Member States shall require all IORPs to have in place an effective system of governance which provides for sound and prudent management of their activities. That system shall include an adequate and transparent organisational structure with a clear allocation and appropriate segregation of responsibilities and an effective system for ensuring the transmission of information. The system of governance shall include consideration of environmental, social and governance factors related to investment assets in investment decisions, and shall be subject to regular internal review.
2
The system of governance referred to in paragraph 1 shall be proportionate to the size, nature, scale and complexity of the activities of the IORP.
3
Member States shall ensure that IORPs establish and apply written policies in relation to risk management, internal audit and, where relevant, actuarial and outsourced activities. Those written policies shall be subject to prior approval by the management or supervisory body of the IORP and shall be reviewed at least every three years and adapted in view of any significant change in the system or area concerned.
4
Member States shall ensure that IORPs have in place an effective internal control system. That system shall include administrative and accounting procedures, an internal control framework, and appropriate reporting arrangements at all levels of the IORP.
5
Member States shall ensure that IORPs take reasonable steps to ensure continuity and regularity in the performance of their activities, including the development of contingency plans. To that end, IORPs shall employ appropriate and proportionate systems, resources and procedures.
6
Member States shall require IORPs to have at least two persons who effectively run the IORP. Member States may allow that only one person effectively runs the IORP, on the basis of a reasoned assessment conducted by the competent authorities. That assessment shall take into account the role of social partners in the overall management of the IORP, as well as the size, nature, scale and complexity of the activities of the IORP.

Requirements for fit and proper management
Article 22
1
Member States shall require IORPs to ensure that persons who effectively run the IORP, persons who carry out key functions and, where applicable, persons or entities to which a key function has been outsourced in accordance with Article 31 fulfil the following requirements when carrying out their tasks:
a
the requirement to be fit:
1. for persons who effectively run the IORP, this means their qualifications, knowledge and experience are collectively adequate to enable them to ensure a sound and prudent management of the IORP;
2. for persons who carry out the actuarial or internal audit key functions this means their professional qualifications, knowledge and experience are adequate to properly carry out their key functions;
3. for persons who carry out other key functions this means their qualifications, knowledge and experience are adequate to properly carry out their key functions; and
b
the requirement to be proper: they are of good repute and integrity.
2
Member States shall ensure that the competent authorities are able to assess whether the persons who effectively run the IORP or carry out key functions fulfil the requirements laid down in paragraph 1.
3
Where a home Member State requires proof of good repute, proof of no previous bankruptcy, or both, from the persons referred to in paragraph 1, that Member State shall accept as sufficient evidence in respect of nationals of other Member States the production of an extract from the judicial record of the other Member State or, in the absence of a judicial record in the other Member State, an equivalent document, showing that those requirements have been met, issued by a competent judicial or administrative authority either in the Member State of which the concerned person is a national or in the home Member State.
4
Where no competent judicial or administrative authority in either the Member State of which the concerned person is a national or in the home Member State issues an equivalent document as referred to in paragraph 3, that person shall be allowed to produce in its place a declaration on oath.
However, in home Member States where there is no provision for declarations on oath to be made the nationals of other Member States concerned shall be allowed to produce a solemn declaration made by him or her before a competent judicial or administrative authority in the home Member State or the Member State of which they are a national or before a notary in one of those Member States. Such authority or notary shall issue a certificate attesting the authenticity of the declaration on oath or solemn declaration.
5
The proof in respect of no previous bankruptcy referred to in paragraph 3 may also be provided in the form of a declaration made by the national of the other Member State concerned before a competent judicial, professional or trade body in that other Member State.
6
The documents referred to in paragraphs 3, 4 and 5 shall be presented within three months of their date of issue.
7
Member States shall designate the authorities and bodies competent to issue the documents referred to in paragraphs 3, 4 and 5 and shall immediately inform the other Member States and the Commission thereof.
Member States shall also inform the other Member States and the Commission of the authorities or bodies to which the documents referred to in paragraphs 3, 4 and 5 are to be submitted in support of an application to pursue the activities referred to in Article 11 in the territory of that Member State.

Remuneration policy
Article 23
1
Member States shall require IORPs to establish and apply a sound remuneration policy for all those persons who effectively run the IORP, carry out key functions and other categories of staff whose professional activities have a material impact on the risk profile of the IORP in a manner that is proportionate to their size and internal organisation, as well as to the size, nature, scale and complexity of their activities.
2
Unless otherwise provided for in Regulation (EU) 2016/679, IORPs shall regularly disclose publicly relevant information regarding their remuneration policy.
3
When establishing and applying the remuneration policy referred to in paragraph 1, IORPs shall comply with the following principles:
a
the remuneration policy shall be established, implemented and maintained in line with the activities, risk profile, objectives, and the long-term interest, financial stability and performance of the IORP as a whole, and shall support the sound, prudent and effective management of IORPs;
b
the remuneration policy shall be in line with the long-term interests of members and beneficiaries of pension schemes operated by the IORP;
c
the remuneration policy shall include measures aimed at avoiding conflicts of interest;
d
the remuneration policy shall be consistent with sound and effective risk management and shall not encourage risk-taking which is inconsistent with the risk profiles and rules of the IORP;
e
the remuneration policy shall apply to the IORP and to the service providers referred to in Article 31(1), unless those service providers are covered by the Directives referred to in point (b) of Article 2(2);
f
the IORP shall establish the general principles of the remuneration policy, shall review and update it at least every three years, and shall be responsible for its implementation;
g
there shall be clear, transparent and effective governance with regard to remuneration and its oversight.
Section 2

Key functions

General provisions
Article 24
1
Member States shall require IORPs to have in place the following key functions: a risk-management function, an internal audit function, and, where applicable, an actuarial function. IORPs shall enable the holders of key functions to undertake their duties effectively in an objective, fair and independent manner.
2
IORPs may allow a single person or organisational unit to carry out more than one key function, with the exception of the internal audit function referred to in Article 26, which shall be independent from the other key functions.
3
The single person or organisational unit carrying out the key function shall be different from the one carrying out a similar key function in the sponsoring undertaking. Member States may, taking into account the size, nature, scale and complexity of the activities of the IORP, allow the IORP to carry out key functions through the same single person or organisational unit as in the sponsoring undertaking, provided that the IORP explains how it prevents or manages any conflicts of interest with the sponsoring undertaking.
4
The holders of a key function shall report any material findings and recommendations in the area of their responsibility to the administrative, management or supervisory body of the IORP which shall determine what actions are to be taken.
5
Without prejudice to the privilege against self-incrimination, the holder of a key function shall inform the competent authority of the IORP if the administrative, management or supervisory body of the IORP does not take appropriate and timely remedial action in the following cases:
a
where the person or organisational unit carrying out the key function has detected a substantial risk that the IORP will not comply with a materially significant statutory requirement and reported it to the administrative, management or supervisory body of the IORP and where this could have a significant impact on the interests of members and beneficiaries; or
b
where the person or organisational unit carrying out the key function has observed a significant material breach of the laws, regulations or administrative provisions applicable to the IORP and its activities in the context of the key function of that person or organisational unit and reported it to the administrative, management or supervisory body of the IORP.
6
Member States shall ensure the legal protection of persons informing the competent authority in accordance with paragraph 5.

Risk-management
Article 25
1
Member States shall require IORPs, in a manner that is proportionate to their size and internal organisation, as well as to the size, nature, scale and complexity of their activities, to have in place an effective risk-management function. That function shall be structured in such a way as to facilitate the functioning of a risk-management system for which the IORPs shall adopt strategies, processes and reporting procedures necessary to identify, measure, monitor, manage and report to the administrative, management or supervisory body of the IORP regularly the risks, at an individual and at an aggregated level, to which the IORPs and the pension schemes operated by them are or could be exposed, and their interdependencies.
That risk-management system shall be effective and well-integrated into the organisational structure and in the decision-making processes of the IORP.
2
The risk-management system shall cover, in a manner that is proportionate to the size and internal organisation of IORPs, as well as to the size, nature, scale and complexity of their activities, risks which can occur in IORPs or in undertakings to which tasks or activities of an IORP have been outsourced, at least in the following areas, where applicable:
a
underwriting and reserving;
b
asset–liability management;
c
investment, in particular derivatives, securitisations and similar commitments;
d
liquidity and concentration risk management;
e
operational risk management;
f
insurance and other risk-mitigation techniques;
g
environmental, social and governance risks relating to the investment portfolio and the management thereof.
3
Where, in accordance with the conditions of the pension scheme, members and beneficiaries bear risks, the risk management system shall also consider those risks from the perspective of members and beneficiaries.

Internal audit function
Article 26
Member States shall require IORPs in a manner that is proportionate to their size and internal organisation, as well as to the size, nature, scale and complexity of their activities, to provide for an effective internal audit function. The internal audit function shall include an evaluation of the adequacy and effectiveness of the internal control system and other elements of the system of governance, including, where applicable, outsourced activities.

Actuarial function
Article 27
1
Where an IORP itself provides cover against biometric risks or guarantees either an investment performance or a given level of benefits, Member States shall require that IORP to provide for an effective actuarial function to:
a
coordinate and oversee the calculation of technical provisions;
b
assess the appropriateness of the methodologies and underlying models used in the calculation of technical provisions and the assumptions made for this purpose;
c
assess the sufficiency and quality of the data used in the calculation of technical provisions;
d
compare the assumptions underlying the calculation of the technical provisions with the experience;
e
inform the administrative, management or supervisory body of the IORP of the reliability and adequacy of the calculation of technical provisions;
f
express an opinion on the overall underwriting policy in the event of the IORP having such a policy;
g
express an opinion on the adequacy of insurance arrangements in the event of the IORP having such arrangements; and
h
contribute to the effective implementation of the risk management system.
2
Member States shall require IORPs to designate at least one independent person, inside or outside the IORP, who is responsible for the actuarial function.
Section 3

Documents concerning governance

Own-risk assessment
Article 28
1
Member States shall require IORPs, in a manner that is proportionate to their size and internal organisation, as well as to the size, nature, scale and complexity of their activities, to carry out and document their own-risk assessment.
That risk assessment shall be performed at least every three years or without delay following any significant change in the risk profile of the IORP or of the pension schemes operated by the IORP. Where there is a significant change in the risk profile of a specific pension scheme, the risk assessment may be limited to that pension scheme.
2
Member States shall ensure that the risk assessment referred to in paragraph 1, having regard to the size and internal organisation of the IORP, as well as to the size, nature, scale and complexity of the IORP's activities, includes the following:
a
a description of how own-risk assessment is integrated into the management process and into the decision-making processes of the IORP;
b
an assessment of the effectiveness of the risk-management system;
c
a description of how the IORP prevents conflicts of interest with the sponsoring undertaking, where the IORP outsources key functions to the sponsoring undertaking in accordance with Article 24(3);
d
an assessment of the overall funding needs of the IORP, including a description of the recovery plan where applicable;
e
an assessment of the risks to members and beneficiaries relating to the paying out of their retirement benefits and the effectiveness of any remedial action taking into account, where applicable:
1. indexation mechanisms;
2. benefit reduction mechanisms, including the extent to which accrued pension benefits can be reduced, under which conditions and by whom;
f
a qualitative assessment of the mechanisms protecting retirement benefits, including, as applicable, guarantees, covenants or any other type of financial support by the sponsoring undertaking, insurance or reinsurance by an undertaking covered by Directive 2009/138/EC or coverage by a pension protection scheme, in favour of the IORP or the members and beneficiaries;
g
a qualitative assessment of the operational risks;
h
where environmental, social and governance factors are considered in investment decisions, an assessment of new or emerging risks, including risks related to climate change, use of resources and the environment, social risks and risks related to the depreciation of assets due to regulatory change.
3
For the purposes of paragraph 2, IORPs shall have in place methods to identify and assess the risks they are or could be exposed to in the short and in the long term and that may have an impact on the IORP's ability to meet its obligations. Those methods shall be proportionate to the size, nature, scale and complexity of the risks inherent in its activities. The methods shall be described in the own-risk assessment.
4
The own-risk assessment shall be taken into account in the strategic decisions of the IORP.

Annual accounts and annual reports
Article 29
Member States shall require every IORP registered or authorised in their territories to draw up and publicly disclose annual accounts and annual reports taking into account each pension scheme operated by the IORP and, where applicable, annual accounts and annual reports for each pension scheme. The annual accounts and the annual reports shall give a true and fair view of the IORP's assets, liabilities and financial position and include disclosure of significant investment holdings. The annual accounts and information in the reports shall be consistent, comprehensive, fairly presented and duly approved by authorised persons, in accordance with national law.

Statement of investment policy principles
Article 30
Member States shall ensure that every IORP registered or authorised in their territories prepares and, at least every three years, reviews a written statement of investment-policy principles. That statement is to be revised without delay after any significant change in the investment policy. Member States shall provide for this statement to contain, at least, such matters as the investment risk measurement methods, the risk-management processes implemented and the strategic asset allocation with respect to the nature and duration of pension liabilities and how the investment policy takes environmental, social and governance factors into account. The statement shall be made publicly available.
CHAPTER 2

Outsourcing and investment management

Outsourcing
Article 31
1
Member States may permit or require IORPs registered or authorised in their territories to entrust any activities including key functions and the management of those IORPs, in whole or in part, to service providers operating on behalf of those IORPs.
2
Member States shall ensure that IORPs remain fully responsible for compliance with their obligations under this Directive when they outsource key functions or any other activities.
3
Outsourcing of key functions or any other activities shall not be undertaken in such a way as to lead to any of the following:
a
impairing the quality of the system of governance of the IORP concerned;
b
unduly increasing the operational risk;
c
impairing the ability of the competent authorities to monitor the compliance of the IORP with its obligations;
d
undermining continuous and satisfactory service to members and beneficiaries.
4
IORPs shall ensure the proper functioning of the outsourced activities through the process of selecting a service provider and the ongoing monitoring of the activities of that service provider.
5
Member States shall ensure that IORPs outsourcing key functions, the management of those IORPs, or other activities covered by this Directive enter into a written agreement with the service provider. Such agreement shall be legally enforceable and shall clearly define the rights and obligations of the IORP and the service provider.
6
Member States shall ensure that IORPs notify competent authorities in a timely manner of any outsourcing of the activities covered by this Directive. Where the outsourcing relates to the key functions or management of IORPs, this shall be notified to competent authorities before the agreement in respect of any such outsourcing enters into force. Member States shall also ensure that IORPs notify competent authorities of any subsequent important developments with respect to any outsourced activities.
7
Member States shall ensure that competent authorities have the power to request information from IORPs and from service providers about outsourced key functions or any other activities at any time.

Investment management
Article 32
Member States shall not restrict IORPs from appointing, for the management of the investment portfolio, investment managers established in another Member State and duly authorised for this activity, in accordance with Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU and 2014/65/EU, as well as the authorised entities referred to in Article 2(1) of this Directive.
CHAPTER 3

Depositary

Appointment of a depositary
Article 33
1
In the case of an occupational pension scheme where members and beneficiaries fully bear the investment risk, the home Member State may require the IORP to appoint one or more depositaries for the safe-keeping of assets and oversight duties in accordance with Articles 34 and 35. The host Member State may require such IORPs to appoint one or more depositaries for the safe-keeping of assets and oversight duties in accordance with Articles 34 and 35 when carrying out cross-border activity in accordance with Article 11, provided that the appointment of a depositary is required under its national law.
2
For occupational pension schemes in which the members and beneficiaries do not fully bear the investment risk, the home Member State may require the IORP to appoint one or more depositaries for safe-keeping of assets or for safe-keeping of assets and oversight duties in accordance with Articles 34 and 35.
3
Member States shall not restrict IORPs from appointing depositaries established in another Member State and duly authorised in accordance with Directive 2013/36/EU or Directive 2014/65/EU, or accepted as a depositary for the purposes of Directive 2009/65/EC or Directive 2011/61/EU.
4
Member States shall take the necessary steps to enable competent authorities under their national law to prohibit, in accordance with Article 48, the free disposal of assets held by a depositary or custodian located within their territory at the request of the competent authority of the IORP's home Member State.
5
The depositary shall be appointed by means of a written contract. The contract shall stipulate the transmission of the information necessary for the depositary to perform its duties as set out in this Directive and in other relevant laws, regulations or administrative provisions.
6
When carrying out the tasks laid down in Articles 34 and 35, the IORP and the depositary shall act honestly, fairly, professionally, independently and in the interest of the scheme's members and beneficiaries.
7
A depositary shall not carry out activities with regard to the IORP which may create conflicts of interest between the IORP, the scheme's members and beneficiaries and itself, unless the depositary has functionally and hierarchically separated the performance of its depositary tasks from its other potentially conflicting tasks, and the potential conflicts of interest are properly identified, managed, monitored and disclosed to the scheme's members and beneficiaries and to the administrative, management or supervisory body of the IORP.
8
Where no depositary is appointed, IORPs shall make arrangements to prevent and resolve any conflict of interest in the course of tasks otherwise performed by a depositary and an asset manager.

Safekeeping of assets and depositary liability
Article 34
1
Where the assets of an IORP relating to a pension scheme consisting of financial instruments which can be held in custody are entrusted to a depositary for safekeeping, the depositary shall hold in custody all financial instruments which can be registered in a financial instruments account opened in the depositary's books and all financial instruments which can be physically delivered to the depositary.
For those purposes, the depositary shall ensure that the financial instruments which can be registered in a financial instruments account opened in the depositary's books are registered in the depositary's books within segregated accounts in accordance with the rules laid down in Directive 2014/65/EU, opened in the name of the IORP, so that they can be clearly identified as belonging to the IORP or the pension scheme's members and beneficiaries at all times.
2
Where the assets of an IORP relating to a pension scheme consist of other assets than those referred to in paragraph 1, the depositary shall verify that the IORP is the owner of the assets and shall maintain a record of those assets. The verification shall be carried out on the basis of information or documents provided by the IORP and, where available, on the basis of external evidence. The depositary shall keep its record up-to-date.
3
Member States shall ensure that a depositary is liable to the IORP and the members and beneficiaries for any loss suffered by them as a result of its unjustifiable failure to perform its obligations or its improper performance of them.
4
Member States shall ensure that a depositary's liability, as referred to in paragraph 3, shall not be affected by the fact that it has entrusted to a third party all or some of the assets in its safe-keeping.
5
Where no depositary is appointed for the safe-keeping of assets, IORPs shall, at least be required to:
a
ensure that financial instruments are subject to due care and protection;
b
keep records that enable the IORP to identify all assets at all times and without delay;
c
take the necessary measures to avoid conflicts of interest in relation to the safe-keeping of assets;
d
inform the competent authorities, upon request, about the manner in which assets are kept.

Oversight duties
Article 35
1
In addition to the tasks referred to in Article 34(1) and (2), the depositary appointed for oversight duties shall:
a
carry out instructions of the IORP, unless they conflict with national law or the IORP's rules;
b
ensure that in transactions involving the assets of an IORP relating to a pension scheme any consideration is remitted to the IORP within the usual time limits; and
c
ensure that income produced by assets is applied in accordance with the rules of the IORP.
2
Notwithstanding paragraph 1, the home Member State of the IORP may establish other oversight duties to be performed by the depositary.
3
Where no depositary is appointed for oversight duties, the IORP shall implement procedures which ensure that the tasks, otherwise subject to oversight by depositaries, are being duly performed within the IORP.