The competent authorities may , based on an evaluation of the risk - management processes , risk loss data base and internal control mechanisms of the payment institution , require the payment institution to hold an amount of own funds which is up to 20 % higher than the amount which would result from the application of the method chosen in accordance with paragraph 1 , or permit the payment institution to hold an amount of own funds which is up to 20 % lower than the amount which would result from the application of the method chosen in accordance with paragraph 1 .