1. Member States shall ensure that investment firms have robust governance arrangements, including all of the following:

(a) a clear organisational structure with well-defined, transparent and consistent lines of responsibility;

(b) effective processes to identify, manage, monitor and report the risks that investment firms are or might be exposed to, or the risks that they pose or might pose to others, including concentration risk arising from exposures towards central counterparties, taking into account the conditions set out in Article 7a of Regulation (EU) No 648/2012;

(c) adequate internal control mechanisms, including sound administration and accounting procedures;

(d) remuneration policies and practices that are consistent with and promote sound and effective risk management.

The remuneration policies and practices referred to in point (d) of the first subparagraph shall be gender neutral.

2. When establishing the arrangements referred to in paragraph 1, the criteria set out in Articles 28 to 33 shall be taken into account.

3. The arrangements referred to in paragraph 1 shall be appropriate and proportionate to the nature, scale and complexity of the risks inherent in the business model and the activities of the investment firm.