(29)It is necessary to specify concrete organisational requirements and procedures for investment firms performing such services or activities. In particular, rigorous procedures should be provided for with regard to matters such as compliance, risk management, complaints handling, personal transactions, outsourcing and the identification, management and disclosure of conflicts of interest.