(second subparagraph of Article 13(5) of Directive 2004/39/EC)

1. Member States shall require investment firms to take the following actions:

(a) to establish, implement and maintain adequate risk management policies and procedures which identify the risks relating to the firm's activities, processes and systems, and where appropriate, set the level of risk tolerated by the firm;

(b) to adopt effective arrangements, processes and mechanisms to manage the risks relating to the firm's activities, processes and systems, in light of that level of risk tolerance;

(c) to monitor the following:

(i) the adequacy and effectiveness of the investment firm's risk management policies and procedures;

(ii) the level of compliance by the investment firm and its relevant persons with the arrangements, processes and mechanisms adopted in accordance with point (b);

(iii) the adequacy and effectiveness of measures taken to address any deficiencies in those policies, procedures, arrangements, processes and mechanisms, including failures by the relevant persons to comply with such arrangements, processes and mechanisms or follow such policies and procedures.