1. Member States shall require management companies to establish and maintain a permanent risk management function.

2. The permanent risk management function referred to in paragraph 1 shall be hierarchically and functionally independent from operating units.

However, Member States may allow management companies to derogate from that obligation where the derogation is appropriate and proportionate in view of the nature, scale and complexity of the management company's business and of the UCITS it manages.

A management company shall be able to demonstrate that appropriate safeguards against conflicts of interest have been adopted so as to allow an independent performance of risk management activities and that its risk management process satisfies the requirements of Article 51 of Directive 2009/65/EC.

3. The permanent risk management function shall:

(a) implement the risk management policy and procedures;

(b) ensure compliance with the UCITS risk limit system, including statutory limits concerning global exposure and counterparty risk in accordance with Articles 41, 42 and 43;

(c) provide advice to the board of directors as regards the identification of the risk profile of each managed UCITS;