Banks should be able to respond promptly to material developments such as rapid growth, an excessive concentration on funding sources, ineffective asset-liability management, misconduct incidents, changes in the economic environment (such as policy normalisation or economic growth), or their ability to consider stress-test scenarios. 2  Non-banking financial institutions. 3  Hernandez de Cos, April 2023 https://www.bde.es/bde/es/secciones/prensa/intervpub/Discursos_del_Go/gobernador--bis-innovation-hubeurosystem-centre---regtech-and-suptech-in-the-context-of-cryptocurrencies-and-decentralised-finance-.html. 4 https://www.bis.org/bcbs/publ/d328.htm. 2  Based on our experience in the SSM, banks have improved their governance structure and design in recent years. However, challenges remain in implementing these changes and making them effective. The thematic review conducted in 2015 was the first horizontal exercise that led to tangible improvements in the design of banks’ management bodies. However, efforts still need to be made to improve boards’ oversight role and challenging capacity. Progress has been made in some areas such as board composition (collective knowledge and diversity), self-reflection on board effectiveness and the quality of board documentation and minutes. However, some challenges remain, particularly with regard to boards’ oversight and challenging capacity, insufficient internal suitability policies for the recruitment and assessment of board members, the inclusion of an appropriate risk perspective in discussions and decision-making, boards’ collective skillset and the degree of formal independence within the board. Governance is an area where supervisors pay a lot of attention, because we are aware of the importance of a robust governance structure and functioning. An example of this is that 7,371 findings have been raised in this area since the SSM was created, of which 1,303 remain open.

(vi)  there has been a slight increase in the staffing of control functions (especially compliance), but there are still shortages of qualified staff in some specialised areas (e.g. cyber, digitalisation, internal models). 4  (vii)  the scope covered by compliance is often not comprehensive, clear or well documented. The role of the board of directors, in particular through its oversight committees (Audit, Risk, Appointments and Remunerations) is key to ensure that the internal control functions have the appropriate stature within the institution and are sufficiently resourced. Moreover, the board of directors and its committees should empower the internal control functions to complement the role of the first line of defence. The board of directors needs to challenge the control functions and properly oversee the follow-up of the findings and weaknesses flagged by these functions. It must also demonstrate a willingness to take ownership and be actively involved (“tone from the top”). Risk data aggregation The last point I would like to make is the importance of accurate, relevant and timely data. The SSM pays close attention to supervised institutions’ general data quality, risk data aggregation and risk reporting (RDAR) capabilities, which are deemed essential for proper risk governance and sound risk-based decision-making. Indeed, they have been a key aspect of the ECB’s supervisory roadmap since the SSM was created.