(1) The Bank shall review, to the extent relevant and necessary, taking into account the investment firm’s size, risk profile and business model, the arrangements, strategies, processes and mechanisms implemented by an investment firm to comply with these Regulations and with Regulation (EU) 2019/2033 and evaluate the following, as appropriate and relevant, so as to ensure a sound management and coverage of the investment firm’s risks:

(a) the risks referred to in Regulation 26;

(b) the geographical location of an investment firm’s exposures;

(c) the business model of the investment firm;

(d) the assessment of systemic risk, taking into account the identification and measurement of systemic risk under Article 23 of Regulation (EU) No 1093/2010 or recommendations of the ESRB;

(e) the risks posed to the security of the investment firm’s network and information systems to ensure confidentiality, integrity and availability of its processes, data and assets;

(f) the exposure of the investment firm to the interest rate risk arising from non-trading book activities;

(g) governance arrangements of the investment firm and the ability of members of the management body to perform their duties.