(1) The competent authority must review the arrangements, strategies, processes and mechanisms implemented by an institution to comply with Directive 2013/36/EU UK law, the capital requirements regulation and CRR rules and evaluate -

(a) in the case of the PRA -

(i) risks to which that institution is or might be exposed, and

(ii) risks revealed by stress testing, taking account of the nature, scale and complexity of that institution's activities;

(b) [deleted]

(2) On the basis of the review and evaluation referred to in paragraph (1), the competent authority must determine whether the arrangements, strategies, processes and mechanisms implemented by an institution and the own funds and liquidity held by it ensures a sound management and coverage of its risks.

(3) The competent authority must establish the frequency and intensity of the review and evaluation referred to in paragraph (1) having regard to the size, systemic importance, nature, scale and complexity of the activities of the institution concerned.