(1) Every authorised regulated entity within a financial conglomerate shall ensure that adequate risk management processes and internal control mechanisms, including sound administrative and accounting procedures, are established and maintained at the level of the conglomerate.

(2) The risk management processes referred to in paragraph (1) must include the following:

(a) sound governance and management, with the approval and periodical review of the strategies and policies by the appropriate governing body at the level of the financial conglomerate with respect to all the risks that it assumes;

(b) adequate capital adequacy policies in order to anticipate the impact of the business strategy of that conglomerate on risk profile and on capital requirements, as determined in accordance with Regulation 8 and Schedule 1;

(c) adequate procedures to ensure that -

(i) the risk monitoring systems at the level of the financial conglomerate are well integrated into the regulated entities concerned, and

(ii) all measures are taken to ensure that the systems implemented within each of the undertakings within that conglomerate and that are within the scope of supplementary supervision are consistent so that the risks can be measured, monitored and controlled at the level of that conglomerates;