1.Member States shall require all insurance and reinsurance undertakings to have in place an effective system of governance which provides for sound and prudent management of the business.
That system shall at least include an adequate transparent organisational structure with a clear allocation and appropriate segregation of responsibilities and an effective system for ensuring the transmission of information. It shall include compliance with the requirements laid down in Articles 42 to 49.
The system of governance shall be subject to regular internal review. Such internal review shall include an assessment of the adequacy of the composition, effectiveness and internal governance of the administrative, management or supervisory body, taking into account the nature, scale and complexity of the risks inherent in the business of the undertaking.
Insurance and reinsurance undertakings shall put in place a policy promoting diversity in the administrative, management or supervisory body, including setting individual quantitative objectives related to gender-balance.
EIOPA shall issue guidelines on the notion of diversity to be taken into account for the selection of members of the administrative, management or supervisory body.
2.The system of governance shall be proportionate to the nature, scale and complexity of the operations of the insurance or reinsurance undertaking.
2a.Member States shall require that insurance and reinsurance undertakings appoint different persons to carry out the key functions of risk management, actuarial, compliance and internal audit, and that each such function is performed in an independent manner from the other functions in order to avoid conflicts of interest.
When an undertaking has been classified as a small and non-complex undertaking, pursuant to Article 29b, or when an undertaking has obtained prior supervisory approval, pursuant to Article 29d, the persons responsible for the key functions of risk management, actuarial and compliance may also perform any other key function different from internal audit, any other function, or be a member of the administrative, management or supervisory body, provided that the following conditions are met:
potential conflicts of interest are properly managed;
the combination of functions or the combination of a function with the condition of membership of the administrative, management or supervisory body does not compromise the person’s ability to carry out her or his responsibilities.
3.Insurance and reinsurance undertakings shall have written policies in relation to at least risk management, internal control, internal audit, remuneration and, where relevant, outsourcing. They shall ensure that those policies are implemented.
Those written policies shall be reviewed at least annually. They shall be subject to prior approval by the administrative, management or supervisory body and be adapted in view of any significant change in the system or area concerned. Small and non-complex undertakings may perform a less frequent review, at least every five years, unless the supervisory authority concludes, based on the specific circumstances of that undertaking, that a more frequent review is needed.
4.Insurance and reinsurance undertakings shall take reasonable steps to ensure continuity and regularity in the performance of their activities, including the development of contingency plans. To that end, the undertakings shall employ appropriate and proportionate systems, resources and procedures, and shall, in particular, set up and manage network and information systems in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council 12.
5.The supervisory authorities shall have appropriate means, methods and powers for verifying the system of governance of the insurance and reinsurance undertakings and for evaluating emerging risks identified by those undertakings which may affect their financial soundness.
The Member States shall ensure that the supervisory authorities have the powers necessary to require that the system of governance be improved and strengthened to ensure compliance with the requirements set out in Articles 42 to 49.