The regulation makes it mandatory for a payment institution or electronic money institution to establish internal control and risk management units. Is it mandatory to employ staff for these units? Can the same staff carry out the activities of both units?
The regulation provides that internal control activities shall be carried out by internal control staff with no executive duties, in a number consistent with the institution's structure and scope of activities, reporting to the board of directors or to a board member other than the general manager designated by the board; and that risk management activities shall be carried out by risk management staff with no executive duties, reporting to the board of directors or to a board member other than the general manager designated by the board. Accordingly, at least one person must be employed in each of the internal control and risk management units. It is not possible for internal control and risk management activities to be carried out by the same person.
The purpose of separating the functions
Risk management and internal control are structures that check each other. If the same person both measures risk and evaluates the adequacy of controls, a conflict of interest arises.
Even though small institutions have limited resources, the legislation's principles of independence and adequacy must be observed. If necessary, outsourcing or consultancy support can be used.
The structure and job descriptions of these units should be clearly shown in the license application file.
