The second line is made up of:
■
the Compliance Department, which coordinates, controls and supervises the tasks involving the
bank’s management of compliance risk and performs the control function in ensuring compliance,
■
other units of the second line of defence, in a situation where part of the compliance process tasks
has been delegated to them.
The third line is the Internal Audit Department, which carries out an independent and objective
assessment of the adequacy and effectiveness of the internal control and risk management system
functioning in the bank. The Internal Audit Department takes into account the adequacy and
effectiveness of controls and independent monitoring of their use within those three lines. It also verifies
the compliance of the bank’s internal regulations and processes with external requirements from time to
time. Audits are carried out with regard to, among other things, the following aspects:
■
implementation of the anti-money laundering programme and the sanctions policy;
■
protection of personal data,
■
compliance with the law in the area of trading in financial instruments,
■
compliance risk management,
■
prevention of fraud (and corruption).
The implementation of the provisions of the "Compliance Policy" is the responsibility of all of the bank’s
employees, in accordance with their respective responsibilities and powers.
Employees are required to comply with the law, follow internal regulations and market standards, apply
controls and independently monitor compliance therewith.
Business units directors are required to monitor and analyse the regulatory environment, properly
identify changes in the law that affect the activities of the business unit under their management and
incorporate them into internal regulations. The Compliance Department is obliged to:
■
introduce identification procedures and methodologies,
■
define and apply selected risk control mechanisms,
■
design and implement procedures and methodologies for monitoring compliance risk,
■
inform the bank’s management bodies about the process of risk identification, assessment, control
and monitoring.
Effective management of compliance risk is the responsibility of the bank’s Management Board, which
reports annually on this process to the Supervisory Board and the Audit Committee.
The Supervisory Board assesses the adequacy and effectiveness of compliance risk management. It also
supervises the Management Board’s performance of compliance obligations.
The Compliance Department also supervises compliance issues in Group companies.
The compliance policies specify, in particular, the rules of:
■
counteracting money laundering and terrorist financing,
■
proper handling of confidential information,
■
personal data protection,
■
supervising the legality of brokerage and fiduciary activities in accordance with applicable law,
■
managing conflicts of interest,
■
offering and acceptance of gifts by members of the bank’s authorities and employees,
■
verification of the complianceof bank’s outsourcing with applicable law,
■
mandatory disclosure of legally required information on events related to the bank’s operations to
the public and to supervisory authorities,
■
advising the business units on the application of newly introduced and already applicable laws and
market standards.