1. At the time of its appointment, a depositary shall assess the risks associated with the nature, scale and complexity of the investment policy and strategy of the UCITS' and with the organisation of the management company or the investment company. On the basis of that assessment, the depositary shall devise oversight procedures which are appropriate to the UCITS and the assets in which it invests and which are then implemented and applied. Those procedures shall be regularly updated.

2. In performing its oversight duties under Article 22(3) of Directive 2009/65/EC, a depositary shall perform ex post controls and verifications of processes and procedures that are under the responsibility of the management company or the investment company or an appointed third party. The depositary shall in all circumstances ensure that an appropriate verification and reconciliation procedure exists which is implemented and applied and frequently reviewed. The management company or the investment company shall ensure that all instructions related to the UCITS' assets and operations are sent to the depositary, so that the depositary is able to perform its own verification or reconciliation procedure.

3. A depositary shall establish a clear and comprehensive escalation procedure to deal with situations where potential discrepancies are detected in the course of its oversight duties, the details of which shall be made available to the competent authorities of the management company or the investment company upon request.