1. The ECB and NCAs shall take necessary measures to ensure that they have a dedicated ethics and/or compliance function – which shall be a core risk management function – to support their decision-making bodies in implementing the SSM Ethics Framework. The ethics and/or compliance function shall be equipped with the appropriate standing, authority and independence necessary to perform its tasks. It shall report directly – hierarchically or functionally – to the highest management level within the ECB or the relevant NCA, as applicable. It shall be provided with adequate resources to carry out its tasks, and to keep abreast of pertinent developments and to keep its expert knowledge current.
2. The responsibilities of the ethics and/or compliance function in relation to the SSM Ethics Framework shall include: (a) giving advice and guidance on the interpretation and application of the SSM Ethics Framework; (b) raising awareness and conducting compulsory training; (c) identifying and assessing compliance risks; (d) monitoring and checking compliance; (e) reporting cases of non-compliance; (f) drafting or contributing to the drafting of the internal rules and practices of the ECB or the relevant NCA, as applicable; and (g) preparing the annual report by the ECB or the relevant NCA, as applicable and as referred to in Article 15 (1).
3. The ECB and NCAs shall take the necessary measures to ensure that their ethics and/or compliance function is involved, properly and in a timely manner, in issues which may have an impact on the SSM Ethics Framework.
4. The ethics and/or compliance function of the ECB and the NCAs shall treat information obtained in the conduct of their responsibilities with the utmost confidentiality and shall process and retain any personal data according to the applicable data protection rules.
5. In cases where the ethics and/or compliance function of the ECB and the NCAs carries out and fulfils other tasks and duties, the ECB and the NCAs shall take the necessary measures to ensure that any such tasks and duties are compatible with the ethics and/or compliance function itself or the tasks and duties of the organisational unit to which the ethics and/or compliance function is organisationally linked.