PRU 8.1 1Group risk systems and controls requirement

Subject to PRU 8.1.3 R to PRU 8.1.5 R, PRU 8.1 applies to each of the following which is a member of a group:

1. (1)

   a firm that falls into any of the following categories:

   1. (a)

      a regulated entity;

   2. (b)

      a bank, ELMI or building society;

   3. (c)

      an insurer;

   4. (d)

      an own account dealer;

   5. (e)

      a matched principal broker;

   6. (f)

      a UCITS investment firm; and

   7. (g)

      a broker/manager or an arranger that satisfies the following conditions:

      1. (i)

         it is an ISD investment firm; and

      2. (ii)

         it is not an exempt CAD firm;

2. (2)

   a UCITS firm, but only if its group contains a firm falling into (1); and

3. (3)

   the Society.

Except as set out in PRU 8.1.5 R, PRU 8.1 applies with respect to different types of group as follows:

1. (1)

   PRU 8.1.9 R and PRU 8.1.11 R apply with respect to all groups, including FSA regulated EEA financial conglomerates, other financial conglomerates and groups dealt with in PRU 8.1.14 R and PRU 8.1.15 R;

2. (2)

   the additional requirements set out in PRU 8.1.12 R and PRU 8.1.13 R only apply with respect to FSA regulated EEA financial conglomerates; and

3. (3)

   the additional requirements set out in PRU 8.1.14 R and PRU 8.1.15 R only apply with respect to groups of the kind dealt with by whichever of those rules apply.

PRU 8.1 does not apply to:

1. (1)

   an incoming EEA firm; or

2. (2)

   an incoming Treaty firm; or

3. (3)

   a UCITS qualifier; or

4. (4)

   an ICVC.

A venture capital firm that would otherwise be included in PRU 8.1.1 R (1)(d) to PRU 8.1.1 R (1)(g) is excluded from those rules if it is not an ISD investment firm.

1. (1)

   This rule applies to:

   1. (a)

      PRU 8.1.9 R (2);

   2. (b)

      PRU 8.1.11 R (1), so far as it relates to PRU 8.1.9 R (2);

   3. (c)

      PRU 8.1.11 R (2); and

   4. (d)

      PRU 8.1.12 R to PRU 8.1.14 R.

2. (2)

   The rules referred to in (1):

   1. (a)

      only apply with respect to a financial conglomerate if it is an FSA regulated EEA financial conglomerate;

   2. (b)

      (so far as they apply with respect to a group that is not a financial conglomerate) do not apply with respect to a group for which a competent authority in another EEA state is lead regulator;

   3. (c)

      (so far as they apply with respect to a financial conglomerate) do not apply to a firm with respect to a financial conglomerate of which it is a member if the interest of the financial conglomerate in that firm is no more than a participation;

   4. (d)

      (so far as they apply with respect to other groups) do not apply to a firm with respect to a group of which it is a member if the only relationship of the kind set out in paragraph (3) of the definition of group between it and the other members of the group is nothing more than a participation; and

   5. (e)

      do not apply with respect to a third-country group.

A firm must:

1. (1)

   have adequate, sound and appropriate risk management processes and internal control mechanisms for the purpose of assessing and managing its own exposure to group risk, including sound administrative and accounting procedures; and

2. (2)

   ensure that its group has adequate, sound and appropriate risk management processes and internal control mechanisms at the level of the group, including sound administrative and accounting procedures.

The internal control mechanisms referred to in PRU 8.1.9 R must include:

1. (1)

   mechanisms that are adequate for the purpose of producing any data and information which would be relevant for the purpose of monitoring compliance with any prudential requirements (including any reporting requirements and any requirements relating to capital adequacy, solvency and large exposures):

   1. (a)

      to which the firm is subject with respect to its membership of a group; or

   2. (b)

      that apply to or with respect to that group or part of it; and

2. (2)

   mechanisms that are adequate to monitor funding within the group.

Where PRU 8.1 applies with respect to a financial conglomerate, the risk management processes referred to in PRU 8.1.9 R (2) must include:

1. (1)

   sound governance and management processes, which must include the approval and periodic review by the appropriate managing bodies within the financial conglomerate of the strategies and policies of the financial conglomerate in respect of all the risks assumed by the financial conglomerate, such review and approval being carried out at the level of the financial conglomerate;

2. (2)

   adequate capital adequacy policies at the level of the financial conglomerate, one of the purposes of which must be to anticipate the impact of the business strategy of the financial conglomerate on its risk profile and on the capital adequacy requirements to which it and its members are subject;

3. (3)

   adequate procedures for the purpose of ensuring that the risk monitoring systems of the financial conglomerate and its members are well integrated into their organisation; and

4. (4)

   adequate procedures for the purpose of ensuring that the systems and controls of the members of the financial conglomerate are consistent and that the risks can be measured, monitored and controlled at the level of the financial conglomerate.

Where PRU 8.1 applies with respect to a financial conglomerate, the internal control mechanisms referred to in PRU 8.1.9 R (2) must include:

1. (1)

   mechanisms that are adequate to identify and measure all material risks incurred by members of the financial conglomerate and appropriately relate capital in the financial conglomerate to risks; and

2. (2)

   sound reporting and accounting procedures for the purpose of identifying, measuring, monitoring and controlling intra-group transactions and risk concentrations.

In the case of a firm that:

1. (1)

   is a credit institution or investment firm; and

2. (2)

   has a mixed-activity holding company as a parent undertaking;

the risk management processes and internal control mechanisms referred to in PRU 8.1.9 R must include sound reporting and accounting procedures and other mechanisms that are adequate to identify, measure, monitor and control transactions between the firm's parent undertaking mixed-activity holding company and any of the mixed-activity holding company's subsidiary undertakings.

In the case of an insurer that has a mixed-activity insurance holding company as a parent undertaking, the risk management processes and internal control mechanisms referred to in PRU 8.1.9 R must include sound reporting and accounting procedures and other mechanisms that are adequate to identify, measure, monitor and control transactions between the firm's parent undertaking mixed-activity insurance holding company and any of the mixed-activity insurance holding company's subsidiary undertakings.