Commission Decision (EU, Euratom) 2025/369

Contents

THE EUROPEAN COMMISSION,Having regard to the Treaty on European Union,Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249 thereof,Having regard to the Treaty establishing the European Atomic Energy Community, and in particular Article 106a thereof,Whereas:

(1)Regulation (EU, Euratom) 2024/2509 of the European Parliament and of the Council (the ‘Financial Regulation’)^note provides for the possibility that the Union provides loans backed by the budget and budgetary guarantees where these prove to be the most appropriate way to achieve policy objectives of the Union and in accordance with the definitions laid down in their respective basic act. The Union’s financial operations undertaken to implement these instruments might give rise to a range of financial risks (such as credit, market, liquidity, operational, reputational and compliance) with possible consequences for the Union budget.

(2)The Union’s financial operations have expanded significantly – in volume and scope – over the course of the present Multiannual Financial Framework. Loans, budgetary guarantees and financing of EU policies through issuance of debt securities have been used on a large scale to fund responses to emerging challenges and successive crises. In view of these developments, the Commission’s financial risk management and compliance framework developed and implemented in respect of the Union’s borrowing, lending and debt management operations should be enhanced and its coverage extended also to financial risks arising from asset management operations and budgetary guarantees.

(3)The role of the Chief Risk Officer under this Decision is a continuation of developments in financial risk management which started with the establishment of the role of Chief Risk Officer by Commission Implementing Decision C(2021) 2502 of 14 April 2021 for borrowing, debt management and lending operations under NextGenerationEU. Following the introduction of the diversified funding strategy as a general borrowing method, the Chief Risk Officer oversight was then extended to all borrowing, debt management, liquidity management and lending operations with Commission Implementing Decision (EU, Euratom) 2022/2544,^note which was subsequently amended by Commission Implementing Decision (EU, Euratom) 2023/2825^note.

(4)The financial risks arising from the implementation of the Union’s financial operations should be properly identified, mitigated, managed and communicated. The risk framework should be robust and provide a comprehensive, rigorous and independent capacity for supervising the financial risks arising across all the Union’s financial operations undertaken. The framework should ensure that the Union’s financial operations should be conducted in a manner consistent with the highest standards of integrity and sound financial and risk management.

(5)In enhancing its financial risk management and compliance framework for the Union’s financial operations, this Decision establishes a specific Commission governance solely regarding the financial risks arising from the Union’s financial operations. The rules of this Decision should complement the Rules of Procedure of the Commission^note of the financial risks arising from the Union’s financial operations and have the intention to align with best practices and standards in financial risk management and compliance as implemented by peer institutions engaged in the conduct of similar financial operations, while respecting the legal and institutional framework established by the Treaties.

(6)The Decision should therefore be based on the ‘three lines of defence’ model. The ‘first line of defence’ should be the Directorates-General responsible for the Union’s financial operations who should remain responsible for the design, implementation, management, planning and execution of operations under their responsibility in line with the Financial Regulation. The Chief Risk Officer should be an independent function, acting as the ‘second line of defence’ at a corporate level with primary responsibility to establish a sound financial risk management framework for the oversight of the Union’s financial operations and oversee its implementation. The ‘third line of defence’ should be the Internal Audit Service which should exercise its role in line with Article 118 of the Financial Regulation.

(7)In keeping with the model of three lines of defence, the Directorates-General responsible for the Union’s financial operations, acting in their capacity as first line of defence, should implement sound financial risk management processes and ensure compliance with the High Level Risk and Compliance Policy and thematic risk and compliance policies.

(8)The financial risk management and compliance framework is to be implemented together with other acts establishing Commission governance, in particular the Internal Rules^note, the Rules of Procedure of the Commission, the Communication from the President to the Commission P(2024)5 of 4 December 2024 ‘The Working Methods of the European Commission’ and the Commission Communication SEC(2000) 560^note announcing the establishment of the Internal Audit Service. The close cooperation from the very early stages of preparation, pursuant to the Working Methods of the European Commission, should be ensured also in relation to the financial risk management laid down in this Decision and in particular should involve the Chief Risk Officer.

(9)The Chief Risk Officer and the Directorates-General responsible for the Union’s financial operations should implement any steps under this Decision loyally, should establish and promote risk culture and apply the requirements of prudence and the principle of sound financial management in their approach to financial risks arising from the Union’s financial operations, ensuring close cooperation. This would entail developing policies through interservice working groups composed of participants of the Directorates-General responsible for the Union’s financial operations concerned, and working in a coordinated fashion from the outset. Furthermore, the work on financial risk management carried out pursuant to this Decision should take into account evaluations, lessons learned and experience gained by the services during the implementation of programmes and instruments authorising budgetary guarantees and loans, inclusive, as appropriate, existing risk frameworks, best market practices and international standards, as well as relevant legislation related to financial risk management and compliance.

(10)This Decision should accordingly extend the role, responsibilities and tasks of the Chief Risk Officer to all the Union’s financial operations concerned. The Chief Risk Officer should develop the financial risk management and compliance framework for all the Union’s financial operations including through the completion of specific tasks set out in this Decision, oversee the financial risks and report on them. In keeping with the function of second line of defence, the Chief Risk Officer should continue to act in full independence from the Directorates-General responsible for the Union’s financial operations and should not be hierarchically subordinated to the Director-General for the Budget and should continue to have a direct reporting line to the Member of the College responsible for the Budget.

(11)In line with the independence of the Chief Risk Officer from the Commission services implementing the Union’s financial operations, the post of Chief Risk Officer should be occupied by a senior manager with adequate professional experience in financial risk management who is to be supported by a dedicated team having relevant expertise. The function of the Chief Risk Officer should not be compatible with the functions of authorising officer by delegation for the Union’s financial operations and of the Accounting Officer.

(12)Despite the Chief Risk Officer not being a service within the meaning of Article 45(1) of the Rules of Procedure of the Commission, it is of essence for the independence of the function to be considered equivalent to a service responsible and service having legitimate interests for the purposes of respectively Articles 55 and 58 of the Rules of Procedure of the Commission. To this effect, the Chief Risk Officer should in particular be the service responsible for inter-service consultations on the High Level Risk and Compliance Policy and the thematic risk and compliance policies. As service having legitimate interests, the Chief Risk Officer should be consulted in interservice consultations in particular on legislative proposals for programmes or instruments authorising budgetary guarantees and loans, as well as on acts implementing programmes or instruments authorising budgetary guarantees and loans and on acts concerning any Union’s financial operations.

(13)The Chief Risk Officer should have general and specific tasks. The Chief Risk Officer should develop the framework governing the financial risk management and compliance for the different categories of the Union’s financial operations, consisting of High Level Risk and Compliance Policy and thematic risk and compliance policies in close cooperation with the Directorates-General responsible for the Union’s financial operations. The Chief Risk Officer should oversee the implementation and the compliance with the risk and compliance framework pursuant to this Decision. The High Level Risk and Compliance Policy should contain risk and compliance guidelines for the implementation of the Union’s financial operations. This over-arching framework should define the risk objectives, the risk management governance, should identify the main risks and the principles for sound financial risk management to manage and mitigate those risks.

(14)In addition to these tasks of a general nature, the Chief Risk Officer should be assigned specific tasks relating to the main processes for planning important categories of the Union’s financial operations. This Decision should set out a non-exhaustive list of specific tasks which should be accomplished. This should include the issuance of opinions on the funding plan for borrowing and debt management operations, internal acts, and measures for the implementation of the Union’s borrowing, debt management, liquidity management and asset management operations. Furthermore, the Chief Risk Officer should develop, in close cooperation with the Directorates-General responsible for the Union’s financial operations, guidelines and common tools to underpin the methodologies and systems needed for effective risk management and reporting on the Union’s budgetary guarantees and loans whether provisioned or not. On the basis of the information provided by the Directorates-General responsible for the Union’s financial operations, the Chief Risk Officer should also provide relevant input on financial risks arising from the Union’s financial operations and contingent liabilities to reports encompassing these issues adopted by the Commission, in particular those referred to in Articles 41(5) and 256 of the Financial Regulation.

(15)The thematic risk and compliance policies should set out the details for the risk management and compliance related to the financial risks, such as credit, market, liquidity, operational, reputational and compliance risks arising from the Union’s financial operations, in accordance with their specificities at the programme or instrument level. These policies should set the risk appetite framework, and define the risk methodologies, which are used to assess, quantify, evaluate, and report on the relevant financial risks. For budgetary guarantees and loans, in view of the need to continuously assess the risks, it is appropriate that the thematic risk and compliance policies establish particular tools, define risk methodologies, including risk parameters, and ensure Commission-wide consistency as appropriate and to measure the level of financial risks to be provisioned.

(16)The internal rules and procedures, including internal guidelines, technical guidance and manuals put in place by Directorates-General responsible for the Union’s financial operations should permit the early and accurate identification of risks and the implementation of relevant risk mitigation and management measures and reliable and timely reporting to the Chief Risk Officer. With a view of ensuring coherent implementation of the High Level Risk and Compliance Policy and thematic risk and compliance policies, it should be possible for the Directorates-General responsible for the Union’s financial operations to consult the Chief Risk Officer on the internal rules and procedures, including internal guidelines, technical guidance, and manuals on their compliance with those policies.

(17)The Chief Risk Officer should provide advice, where necessary to the Directorates-General responsible for the Union’s financial operations on the implementation of the High Level Risk and Compliance Policy, thematic risk and compliance policies, and the management of specific risks. The Directorates-General responsible for the Union’s financial operations should address such advice and provide explanations on the measures taken.

(18)To enable effective and efficient monitoring by the Chief Risk Officer, the respective Directorates-General working with third parties, notably implementing partners for budgetary guarantees, should obtain the necessary input about financial risks related to the Union’s financial operations from the implementing partners and share this upon request with the Chief Risk Officer.

(19)To ensure that all relevant actors are consistently informed on the financial risk management of the Union’s financial operations, appropriate reporting obligations for the Chief Risk Officer should be established. The Chief Risk Officer should in particular report regularly to the Member of the College for the Budget, the Members of the College responsible for the Union’s financial operations, and to the Director-General of the Directorate-General for the Budget and the Directors-General responsible for the Union’s financial operations. Reporting by the Chief Risk Officer should build on the programme-specific reporting by the Directorates-General responsible for the Union’s financial operations. The financial risk reporting and monitoring should enable the early identification of any emerging financial risks arising from the Union’s financial operations.

(20)The Chief Risk Officer should be supported by a Compliance Officer. The latter should report directly to the Chief Risk Officer and act under their authority. Compliance functions should comprise matters regarding (i) compliance of the institution and conduct of the Union’s financial operations by Commission services and their counterparties with rules and procedures and (ii) prevention of money laundering, terrorist financing, tax avoidance, tax fraud or tax evasion. With respect to the Union’s financial operations implemented in indirect management, the compliance officer should not directly provide recommendations and guidelines, as these operations already benefit from a robust system of controls, and the rules of entrusted entities are pillar assessed under Title VI of the Financial Regulation.

(21)Currently, three different committees co-exist. Firstly, the Steering Committee on Contingent Liabilities was established by Commission Decision C(2020) 5154^note to provide coordination and oversight of a common risk management framework for contingent liabilities. Secondly, for borrowing, debt management, liquidity management and lending operations, the Chief Risk Officer, as currently in place, is supported by the Risk and Compliance Committee, as defined in Implementing Decision (EU, Euratom) 2023/2825. Thirdly, within the Directorate-General for the Budget, an internal risk committee oversees the functioning of the asset management operations, with transmission of outputs to the Asset Management Board. With a view to creating an integrated risk and compliance management framework, a single Risk and Compliance Committee, replacing the above-mentioned committees, should be established to support the Chief Risk Officer with respect to all Union’s financial operations. Decision C(2020) 5154 establishing the Steering Committee on Contingent Liabilities should accordingly be repealed.

(22)The composition of the Risk and Compliance Committee should bring together expertise in matters of financial risk and budgetary management, as well as the policy and operational perspectives and the risk management expertise of Directorates-General involved in the implementation of the Union’s financial operations. The Members of the Risk and Compliance Committee should be representatives having senior management function of the Directorate-General for the Budget, of the Secretariat-General and from each Directorate-General responsible for managing the Union’s financial operations.

(23)The Risk and Compliance Committee should support the Chief Risk Officer in the conduct of their duties related to financial risk management and oversight and the development and implementation of the relevant risk framework applicable for the Union’s financial operations.

(24)The High-Level Risk and Compliance Policy and the thematic and risk compliance policies should be adopted by the Commission. With a view to drawing on the expertise of the Risk and Compliance Committee and in view of the need to involve all the services concerned from early stages of preparation of the High Level Risk and Compliance Policy and the thematic and risk compliance policies, the Chief Risk Officer should submit the draft of the policy to the Risk and Compliance Committee for discussion ahead of the interservice consultation.

(25)To ensure a smooth transition from the current governance setup which includes three committees, all existing risk management governance arrangements including the Steering Committee on Contingent Liabilities should remain in place until the first meeting of the Risk and Compliance Committee foreseen in this Decision. Several manuals and documents of the Directorate-General for the Budget as well as of the Directorates-General responsible for the Union’s financial operations set out the financial risk management rules for asset management operations and budgetary guarantees, including the risk management frameworks applicable to programmes or instruments authorising budgetary guarantees already adopted at the date of entry into force of this Decision. In the field of borrowing and lending, a High Level Risk and Compliance Policy and several supporting thematic policies have been adopted by the Commissioner for the Budget. These documents are the basis for the execution of ongoing financial operations and they should remain in force pending review by the Chief Risk Officer and until such time as replaced by the High Level Risk and Compliance Policy, as well as thematic risk and compliance policies adopted in accordance with this Decision. To take account of the requirements of legal certainty and legitimate expectations of implementing partners and counterparts implementing already concluded guarantee agreements, it is appropriate to provide that the decisions approving the High Level Risk and Compliance Policy and thematic risk and compliance policies provide for transitory provisions. Those transitory provisions should ensure that the risks are managed within the risk appetite as defined for the programmes or instruments authorising budgetary guarantees adopted before the entry into force of this Decision. When developing and implementing agreed risk measurement methodologies in respect of budgetary guarantees and loan programmes established before the entry into force of this Decision, the Chief Risk Officer and the Directorates-General in charge of the Union’s financial operations should respect the risk appetite as well as results from the programme or instrument authorising the budgetary guarantee or a loan and relevant implementing measures. This should also apply to any signed guarantee agreements, as well as to agreements that are yet to be signed based on programmes or instruments authorising budgetary guarantee already adopted at the date of entry into force of this Decision.

HAS ADOPTED THIS DECISION: