35. The outsourcing of functions cannot result in the delegation of the management body’s responsibilities. Institutions and payment institutions remain fully responsible and accountable for complying with all of their regulatory obligations, including the ability to oversee the outsourcing of critical or important functions.
36. The management body is at all times fully responsible and accountable for at least:
a. ensuring that the institution or payment institution meets on an ongoing basis the conditions with which it must comply to remain authorised, including any conditions imposed by the competent authority;
b. the internal organisation of the institution or the payment institution;
c. the identification, assessment and management of conflicts of interest;
d. the setting of the institution’s or payment institution’s strategies and policies (e.g. the business model, the risk appetite, the risk management framework);
e. overseeing the day-to-day management of the institution
…