Commission Decision (EU, Euratom) 2025/369 of 21 February 2025 establishing the role of the Chief Risk Officer overseeing the financial risks arising from the Union’s financial operations
SECTION 1 — SUBJECT MATTER AND DEFINITIONS
Subject matter
1. This Decision defines the role, responsibilities and tasks of the Chief Risk Officer for the Union’s financial operations (the ‘Chief Risk Officer’). The Chief Risk Officer, as a second line of defence at corporate level, shall have the mandate to develop, implement and monitor the Commission’s risk management and compliance framework for financial risks arising from the Union’s financial operations. The Chief Risk Officer provides an independent assessment of the risks associated with the Union’s financial operations and performs an ongoing monitoring of the portfolio to monitor credit, market and liquidity risks and to identify appropriate risk management actions.
2. The Decision shall be based on the standard financial risk management practice of the ‘three lines of defence’ model, under which the first line of defence shall be the Directorates-General responsible for the Union’s financial operations, the corporate second line of defence shall be the Chief Risk Officer and the third line of defence shall be the Internal Audit Service.
Definitions
For the purposes of this Decision, the following definitions apply:
(a)
‘Union’s financial operation’ means loans provided directly by the Union, whether provisioned or not, the Union’s budgetary guarantees covering operations on the basis of guarantee agreements with the implementing partners, debt issuance and debt management including related liquidity management, asset management operations and tasks related to the function of asset management designated service for outsourced portfolio management;
(b)
‘programmes or instruments authorising budgetary guarantees and loans’ means the basic act within the meaning of Article 2(4) of the Financial Regulation which authorises financial liability from budgetary guarantee or a loan in accordance with Article 213(1)(b) and (c) of the Financial Regulation;
(c)
‘financial risk’ means a risk of losses or other adverse events that arise or may arise in the design, execution and management of different categories of the Union’s financial operations due to materialisation of, in particular, credit, market, liquidity, funding, counterparty, operational, reputational and compliance risk;
(d)
‘contingent liability’ means contingent liability as defined in Article 2(16) of the Financial Regulation;
(e)
‘thematic risk and compliance policy’ means a policy, guideline, methodology or any other act referred to in Article 9, which sets out specific procedures and limits related to the Union’s financial operations that shall be followed by the Directorates-General responsible for the implementation of the Union’s financial operations;
(f)
‘risk methodologies’ means the quantitative approach and risk parameters for the assessment, measurement, monitoring and reporting of the financial risks arising from the Union’s financial operations which is implemented in risk management tools and risk management models;
(g)
‘risk appetite’ means the level of risk that the Commission is prepared to accept in order to achieve its policy objectives. The risk appetite per type of risk is to be defined, as appropriate, in the relevant legal acts, the risk management framework, internal policies and manuals and other documents that complement the relevant legal acts and the High Level Risk and Compliance Policy;
(h)
‘risk tolerance’ means the quantified acceptable deviation from the level of risk that shall not be exceeded. The tolerance levels for a specific type of risk and metrics shall allow measuring of and reporting on the risk exposure when implementing the relevant Union’s financial operations. The risk tolerance may be set from zero to full acceptance, depending on the legal framework, policy mandate and the availability and strength of the risk mitigation measures applied to the different identified risks, the framework governing the financial risk management and compliance for the different types or categories of the Union’s financial operations.
Close cooperation on financial risk management
1. The Chief Risk Officer and the Directorates-General responsible for the Union’s financial operations shall implement any steps under this Decision, ensuring close cooperation, shall establish and promote risk culture and apply the requirements of prudence and the principle of sound financial management in their approach to financial risks arising from the Union’s financial operations.
2. The development of the High Level Risk and Compliance Policy and thematic risk and compliance polices shall take place through interservice working groups composed of participants of the Directorates-General responsible for the Union’s financial operations concerned.
3. The services of the Directorates-General responsible for the Union’s financial operations and of the Chief Risk Officer shall, from the outset, work in close cooperation and in a coordinated fashion within the Risk and Compliance Committee and its sub-committees on all tasks resulting from the implementation of this Decision, in particular in the preparation of the draft High Level Risk and Compliance Policy referred to in Article 8, of the thematic risk and compliance policies referred to in Article 9 and during the process on assessment of financial risks of programmes or instruments authorising budgetary guarantees and loans referred to in Article 10.
4. The work on financial risk management pursuant to this Decision shall in particular take into account evaluations, lessons learned and experience gained during the implementation of programmes and instruments authorising budgetary guarantees and loans, including, as appropriate, existing risk frameworks, feedback received from counterparts, implementing partners and other stakeholders, best market practices and international standards, as well as relevant legislation related to financial risk management and compliance.
SECTION 2 — ROLE OF THE CHIEF RISK OFFICER
Status and independence of the Chief Risk Officer
1. The Chief Risk Officer shall serve as the corporate second line of defence for the financial risk assessment of the Union’s financial operations. The Chief Risk Officer shall enjoy autonomy in carrying out the tasks and responsibilities set out in this Decision.
2. The post of the Chief Risk Officer shall constitute a specific function which shall be occupied by a senior manager with adequate professional experience in financial risk management and shall be supported by a dedicated team having relevant expertise. The Chief Risk Officer shall report directly to the Member of the College responsible for the Budget with respect to the responsibilities set out in this Decision.
3. The Chief Risk Officer shall exercise its role independently of functions and tasks related to the design, planning, implementation, management, execution of, and accounting for the Union’s financial operations. The function of the Chief Risk Officer shall not be compatible with the functions of an authorising officer by delegation for the Union’s financial operations and of the Accounting Officer.
4. The Chief Risk Officer shall be considered equivalent to the service responsible within the meaning of Article 55 of the Rules of Procedure of the Commission in respect of the High Level Risk and Compliance Policy and the thematic risk and compliance policies. The Directorates General responsible for the Union’s financial operations shall be services with a legitimate interest who shall be consulted in interservice consultations on the High Level Risk and Compliance Policy and on those thematic risk and compliance policies which concern them.
5. The Chief Risk Officer shall be considered equivalent to the service with legitimate interest within the meaning of Article 58 of the Rules of Procedure of the Commission and shall be consulted in interservice consultations in particular on legislative proposals for programmes or instruments authorising budgetary guarantees and loans, as well as on acts implementing programmes or instruments authorising budgetary guarantees and loans and on acts concerning any Union financial operation. This shall include interservice consultations on draft guarantee agreements and loan agreements as well as decisions approving the main elements of guarantee agreements. When being consulted, the Chief Risk Officer shall exclusively assess aspects of the financial risk management and compliance with the High Level Risk and Compliance Policy and the thematic risk and compliance policies.
General tasks of the Chief Risk Officer
The Chief Risk Officer shall oversee the financial risks stemming from the Union’s financial operations and shall be responsible for the following general tasks:
(a)
lead the development of the risk framework governing the financial risk management and compliance for the Union’s financial operations, in particular drawing up a High Level Risk and Compliance Policy, supplemented by thematic risk and compliance policies;
(b)
set up and lead interservice working groups on the development of the High Level Risk and Compliance Policy and the thematic risk and compliance policies with participation of the Directorates General responsible for the Union’s financial operations and other Directorates General concerned;
(c)
oversee the implementation of the risk framework, including systems and processes needed to give effect to the High Level Risk and Compliance Policy and thematic policies by Directorates-General responsible for the Union’s financial operations concerned;
(d)
assess the financial risks arising from borrowing operations, liquidity management operations and programmes or instruments authorising budgetary guarantees and loans before proposals for these programmes or instruments are adopted by the Commission;
(e)
independently assess, consolidate, and report on the risks arising from the Union’s financial operations, taking into account the data and input from the Directorates General responsible for the Union’s financial operations, and on compliance with the risk management framework and specified limits, including any relevant provisions set out in the basic acts establishing the individual programmes and the Financial Regulation;
(f)
identify potential breaches of and non-compliance with the High Level Risk and Compliance Policy, thematic risk and compliance policies or other risk related guidelines, legal acts and policies and provide advice on mitigation measures where necessary, and/or review management and mitigating measures implemented or proposed by the Directorates-General responsible for the Union’s financial operations;
(g)
promote best practices, risk culture, consistent and harmonised risk approaches across Commission services in the management of the risks arising from the Union’s financial operations.
Specific tasks in respect of EU borrowing, debt management, liquidity management and asset management operations
In addition to the general tasks, the Chief Risk Officer shall have the following tasks in respect of EU borrowing, debt management, liquidity management and asset management operations:
(a)
define within the relevant thematic risk policy, where feasible, the risk appetite, and risk tolerance applicable for the different types of financial operations;
(b)
issue an opinion on the draft funding plan and its subsequent amendments;
(c)
issue an opinion on the liquidity management strategy for liquidity management operations prior to their adoption or amendment;
(d)
be consulted on the asset management guidelines, the strategic asset allocation, and the applicable benchmarks for asset management operations, before their adoption by the Directorate-General responsible for these operations;
(e)
define eligibility criteria for authorised counterparties and potential issuers that may be considered for investment opportunities;
(f)
define appropriate risk limits to ensure that the credit risk, market risk and liquidity risk undertaken through the asset management and liquidity management operations remain compliant with the risk objectives, risk capacity, risk appetite and risk tolerance set in the relevant investment guidelines, the High Level Risk and Compliance Policy and the thematic policies. The risk limits may be set up at counterparty level or instrument level, or set up at the level of the aggregated exposures;
(g)
assess, consolidate and report on risk exposures, executed by the Directorate-General for the Budget or, when relevant, outsourced to a third party.
Specific tasks related to assessment of financial risks of programmes or instruments authorising budgetary guarantees and loans
The Chief Risk Officer shall in respect of programmes or instruments authorising budgetary guarantees and loans:
(a)
conduct regular and independent portfolio risk assessments based on the approved risk methodologies and based on data provided by Directorates-General responsible for the Union’s financial operations;
(b)
provide relevant input on financial risks and contingent liabilities to reports adopted by the Commission on these issues, such as the risk assessment for reporting under Article 41(5) and Article 256 of the Financial Regulation based on information from the Directorates General responsible for the Union’s financial operations.
The High Level Risk and Compliance Policy
1. In furtherance of the general task referred to in Article 5(1)(a), the Chief Risk Officer shall prepare a High Level Risk and Compliance Policy.
2. The High Level Risk and Compliance Policy shall:
(a)
set the strategic risk objectives guiding the management of the different categories of financial risk arising from the implementation of the Union’s financial operations;
(b)
describe the risk governance framework which outlines the main roles and responsibilities related to the risk management and compliance framework of the Union’s financial operations;
(c)
present the Commission’s high level risk appetite statement;
(d)
identify the principal risks to the financial interests of the Union arising from the implementation of the Union’s financial operations and provide a high-level risk management and compliance framework for the assessment, measurement, mitigation and monitoring of those risks.
Thematic risk and compliance policies
1. The thematic risk and compliance policies shall set out the systems, rules, risk methodologies, procedures and processes for the risk management, reporting and compliance related to the main categories of financial risks arising from the Union’s financial operations and shall describe the roles and responsibilities of the different services involved in the management of the identified risks. Those policies shall take into account the specificities of different categories of the Union’s financial operations.
2. The thematic risk and compliance policies shall be in line with the High Level Risk and Compliance Policy.
Specific elements of thematic risk and compliance policies establishing risk framework for the Union’s budgetary guarantees and loans
1. The relevant thematic risk and compliance policy in respect to budgetary guarantees and loans shall:
(a)
establish the risk methodologies, including risk parameters and tools to evaluate potential losses resulting from budgetary guarantees and loans, which shall, inter alia, constitute guidance for the setting of the provisioning rate;
(b)
define the risk methodologies as appropriate to ensure Commission-wide consistency and convergence relevant in the process of the designing, negotiating, implementing and monitoring of budgetary guarantees and loans;
(c)
define the methodology to measure the level of financial risks to be provisioned as adequate safety buffer referred to in Article 214(2), second subparagraph of the Financial Regulation.
2. The risk methodologies and tools established in the thematic risk and compliance policies shall be used by both the first and second lines of defence when assessing envisaged programmes or instruments authorising budgetary guarantees and loans.
Implementation of the High Level Risk and Compliance Policy and thematic risk and compliance policies
1. The Chief Risk Officer shall oversee the implementation of the High Level Risk and Compliance Policy and the thematic risk and compliance policies by the Directorates-General responsible for the Union’s financial operations.
2. The Directorates-Generals responsible for the Union’s financial operations shall monitor the risks related to the respective Union’s financial operations and ensure compliance with the High Level Risk and Compliance Policy and thematic risk and compliance policies. To this effect, the Directorates-Generals responsible for the Union’s financial operations shall in particular:
(a)
take all necessary measures to implement controls and reporting systems needed to comply with the systems, methodologies and processes resulting from those policies;
(b)
ensure in the implementation of the Union’s financial operations that financial risks remain within the risk appetite and risk limits defined, where relevant, for the programme or instruments establishing the budgetary guarantee and loans;
(c)
provide regular reports to the Chief Risk Officer on compliance with the High Level Risk and Compliance policy and thematic risk and compliance policies;
(d)
document thoroughly the implementation of the Union’s financial operations which they oversee, report on situations where the risk of the portfolio of operations deviates or may deviate from the set risk levels;
(e)
respond in a timely manner to requests for additional information from the Chief Risk Officer, including relevant information available on operations guaranteed by the Union budget and conducted by implementing partners and counterparts, where this is required to enable the Chief Risk Officer to establish an independent assessment of the risks;
(f)
when working with third parties, notably implementing partners and counterparts, obtain the necessary information, available in particular in line with the respective guarantee agreements, about financial risks related to the Union’s financial operations.
3. The Directorates-General responsible for the Union’s financial operations shall establish the rules and procedures to ensure effective compliance with the High Level Risk and Compliance Policy and the relevant thematic risk and compliance policies for the Union’s financial operations for which they are responsible. The Chief Risk Officer may be consulted on these rules and procedures with a view to review their compliance with the High Level Risk and Compliance Policy and the thematic risk and compliance policies.
Advice to mitigate financial risks
1. The Chief Risk Officer may advise the Directorates-General responsible for the Union’s financial operations on the implementation of the High Level Risk and Compliance Policy or thematic risk and compliance policies or on the management of specific risks. Such advice may include appropriate remedial measures.
2. The Directorates-General responsible for the Union’s financial operations shall, without undue delay, address the advice or, as applicable, other non-compliance or breach of limits as referred to in the Article 5(f) and provide to the Chief Risk Officer explanations on the measures taken.
3. The Chief Risk Officer may, as appropriate, inform the Member of the College responsible for the Budget and the Member(s) of the College responsible for the Union’s financial operations concerned about the advice referred to in paragraph (1) and, where relevant, about the deliberations of the Risk and Compliance Committee. Such information may also include assessment of the rules and procedures referred to in Article 11(3).
4. The Chief Risk Officer shall regularly inform the Risk and Compliance Committee on the advice provided and on the follow up by the Directorates-General responsible for the Union’s financial operations.
Reports and information on financial risks
1. The Chief Risk Officer shall submit regular reports to the Member of the College responsible for the Budget, the Members of the College responsible for the Union’s financial operations, to the Risk and Compliance Committee, to the Director-General of the Directorate-General for the Budget, to the Accounting Officer and to the Directors-General responsible for the Union’s financial operations, respectively for their areas of competence, on financial risks arising from the Union’s financial operations in accordance with this Decision.
2. The Chief Risk Officer shall promptly inform the Member of the College responsible for the Budget in the event of material developments which call for urgent consideration. In addition, the Directorates-General concerned shall be timely and duly informed.
3. The Chief Risk Officer shall regularly inform the Risk and Compliance Committee, the Director-General of the Directorate-General for the Budget, the Accounting Officer and the Directorates-General responsible for the Union’s financial operations, on risks and non-compliance with rules and procedures or breaches of limits in respect of the Union’s financial operations, respectively for their areas of competence.
4. The Chief Risk Officer shall submit a report on the implementation and functioning of the High Level Risk and Compliance Policy to the College once per year, which may be accompanied by a proposal to review the policy.
SECTION 3 — SUPPORT TO THE CHIEF RISK OFFICER
Compliance Officer
1. A staff member entrusted with the role of Compliance Officer shall report directly to the Chief Risk Officer on matters regarding conformity with the High Level Risk and Compliance Policy and thematic risk and compliance policies, and rules for anti-money laundering and terrorist financing in respect of the Union’s financial operations and shall perform the compliance function.
2. The compliance function shall in particular include:
(a)
in respect of the Union’s financial operations:
(i)
compliance related support to relevant services responsible for the operational implementation and execution of the Union’s financial operations; and
(ii)
support for the observance of the Commission-wide rules on ethical behaviour and integrity applicable to relevant services involved in the Union’s financial operations;
(b)
in respect of the Union’s financial operations other than operations implemented in indirect management, guidance addressing the prevention of money laundering and countering terrorism financing, tax avoidance, tax fraud or tax evasion for the execution of the Union’s financial operations other than budgetary guarantees in indirect management, by entities incorporated in or established in jurisdictions listed under the relevant policy on non-cooperative jurisdictions or that are identified as high-risk third countries pursuant to Article 9(2) of Directive (EU) 2015/849 or that do not effectively comply with the Union or internationally agreed tax standards on transparency and exchange of information, breach sanction regimes or perform other relevant financial irregularities.
3. Guidelines on compliance shall be adopted in accordance with Article 18. These guidelines shall apply to financial operations other than those implemented in indirect management.
The Compliance Officer may also, under the authority of the Chief Risk Officer, where necessary and appropriate, provide advice in line with Article 12.
Risk and Compliance Committee
1. A Risk and Compliance Committee shall be established to support the Chief Risk Officer in the conduct of responsibilities of that officer.
2. The Risk and Compliance Committee shall:
(a)
discuss the draft High Level Risk and Compliance Policy and thematic risk and compliance policies prepared by the Chief Risk Officer, as well as their amendments;
(b)
support the Chief Risk Officer in the tasks referred to in Article 5 of this Decision;
(c)
support the Chief Risk Officer in evaluating, monitoring and approving practices regarding the implementation of the High Level Risk and Compliance Policy and relating to the financial risk management and compliance of the Union’s financial operations;
(d)
support the Chief Risk Officer in managing of the financial risks in connection with the Union’s financial operations and be consulted by the Chief Risk Officer about non-compliance with the High Level Risk and Compliance Policy or breaches of other related guidelines, thematic risk and compliance policies and limits.
3. The Chief Risk Officer may decide to establish sub-committees for specific topics, in particular for specific categories of the Union’s financial operations or for a specific category of risk.
4. The sub-committees shall facilitate the efficient functioning of the Risk and Compliance Committee through:
(a)
assisting the Chief Risk Officer in assessing and mitigating risks elaborated in thematic risk and compliance policies;
(b)
preparing matters to be brought to the Risk and Compliance Committee;
(c)
providing input on technical issues related to the assessment and mitigation of those risks.
Members and organisation of the Risk and Compliance Committee and the sub-committees
1. The Chief Risk Officer chairs the Risk and Compliance Committee.
2. The Risk and Compliance Committee shall be composed of the following members:
(a)
the Chief Risk Officer;
(b)
the Accounting Officer of the Commission;
(c)
a representative from the Directorate-General for the Budget overseeing the issuance of debt to finance Union programme;
(d)
the Compliance Officer;
(e)
a representative from the Secretariat-General designated by the Secretary-General;
(f)
a representative from each Directorate-General responsible for budgetary guarantees or loans programmes.
3. The representative from the Directorate-General for the Budget in charge of the multiannual financial framework and a representative from the Directorate-General for the Budget in charge of the annual budget shall be permanent observers to the Risk and Compliance Committee.
4. The Chief Risk Officer may invite other observers to the Risk and Compliance Committee whose opinion and functions is deemed appropriate for the matters discussed at the Risk and Compliance Committee.
5. The level of the representatives under points (c), (e) and (f) of paragraph 2 of this Article shall be Director-General or Deputy Director-General, who may appoint an alternate at the level of senior manager to ensure compliance with the mandate and responsibilities laid down in this Decision.
6. The Compliance Officer referred to in point (d) of paragraph 2 of this Article shall be a non-voting member of the Risk and Compliance Committee.
7. The Chief Risk Officer shall appoint up to three external experts to participate in the meetings of the Risk and Compliance Committee. The external experts shall give opinions and participate in deliberations without voting rights on matters brought before the Committee.
8. The decision to establish a sub-committee pursuant to Article 15(3) shall determine the members which shall participate. A member of the Risk and Compliance Committee, if designated as a sub-committee member, may either be a member of the sub-committee themself or designate the members of the sub-committee from the staff of the respective Directorate-General. The designated members shall possess adequate knowledge and competencies in areas relevant for the work of the sub-committee. A sub-committee shall be chaired by the Chief Risk Officer or by a chair designated by the Chief Risk Officer.
9. The Risk and Compliance Committee shall adopt by a majority of two thirds of its members its rules of procedure and the rules of procedure of sub-committees established in accordance with Article 15(3). The majority vote shall include votes of the members referred to in points (a) and (e) of paragraph 2 of this Article.
Secretariat of the Risk and Compliance Committee
The staff of the Chief Risk Officer shall ensure the secretariat of the Risk and Compliance Committee covering at least the following tasks:
(a)
contacting and consulting with relevant Commission services when preparing input for the Risk and Compliance Committee;
(b)
organising meetings of the Risk and Compliance Committee, including the preparation of the agenda, documents, and minutes of those meetings;
(c)
performing other administrative and organisational tasks related to the organisation of the Risk and Compliance Committee.
Pre-consultations on the High Level Risk and Compliance Policy and of thematic risk and compliance policies
1. The draft High Level Risk and Compliance Policy and draft thematic risk and compliance policies shall be drawn up by the Chief Risk Officer and discussed in an interservice working group in which the Directorates General responsible for the Union’s financial operations shall participate. The Secretariat-General and the Legal Service shall be invited to such a working group.
2. Prior to initiating the interservice consultation, the Chief Risk Officer shall present the draft High Level Risk and Compliance Policy and draft thematic risk and compliance policies for discussion in the Risk and Compliance Committee in accordance with Article 15(2), point (a).
3. When submitting the draft policies to the interservice consultation and to the Commission for adoption, the Chief Risk Officer shall provide information regarding the outcome of the discussion in the Risk and Compliance Committee referred to in Article 15(2)(a) and its assessment.
4. The members’ comments shall be given due and fair consideration and the Chief Risk Officer shall provide information on how the comments have been reflected, or not, in the High Level Risk and Compliance Policy or the thematic risk and compliance policies.
SECTION 4 — FINAL AND TRANSITIONAL PROVISIONS
Repeal
1. Decision C(2020) 5154 on establishing the Steering Committee on Contingent Liabilities arising from Budgetary Guarantees is repealed.
2. References to the repealed Decision shall be construed as references to this Decision.
3. Decision C(2024) 745 on the adoption of a Charter of tasks and responsibilities for the Commission’s Chief Risk Officer for borrowing, debt management and lending operations is repealed.
Transitional provisions
1. The High Level and Risk Compliance Policy adopted under Decision (EU) 2023/2825 shall remain valid in respect to categories of the Union’s financial operations covered therein until replaced by the High Level and Risk Compliance Policy referred to in Article 8.
2. Manuals and other relevant documents relating to the risk management of asset management operations adopted prior to the entry into force of this Decision shall be reviewed by the Chief Risk Officer. The manuals and other relevant documents approved by the Steering Committee on Contingent Liabilities as well as the manuals and documents of the Directorates-General responsible for the Union’s financial operations setting out the financial risk management rules for existing programmes shall remain valid until their replacement by thematic risk and compliance policies.
3. Appointments of the members of the Risk and Compliance Committee pursuant to points (c), (e) and (f) of Article 16(2) shall be notified to the Chief Risk Officer within one month from the entry into force of this Decision or from the date a Directorate-General receives authorising officer responsibilities for the Union’s financial operations.
4. The decision adopting the High Level Risk and Compliance Policy and thematic risk and compliance policies shall provide for transitory provisions to ensure that the risks are managed within the risk appetite as defined for the programmes or instruments authorising budgetary guarantees adopted before the entry into force of this Decision.
5. Without prejudice to the risk appetite determined by the legislative acts establishing those programmes, the ex post assessment, monitoring and reporting on financial risks of programmes and instruments authorising budgetary guarantees and loans adopted before the entry into force of this Decision shall be carried out by using the methodologies set out in the thematic risk and compliance policies adopted on the basis of this decision.
Entry into force and application
1. This Decision shall enter into force on the third day following that of its publication in the Official Journal of the European Union .
2. Article 18 and paragraph 1 of Article 19 shall apply as of the day of the first meeting of the Risk and Compliance Committee, which shall be duly convened by the Chief Risk Officer.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
