(Art. 9 FinIA)
Managers of collective assets must have an appropriately defined risk management system in place as well as an effective internal control structure to ensure in particular compliance with legal and internal provisions.
They shall set out guidelines for the basic principles of risk management and define their risk tolerance.
They will keep the functions of risk management and compliance functionally and hierarchically separate from the operational business units, in particular from the function of investment decisions (portfolio management).
The body responsible for the governance, supervision and control of the manager of collective assets is charged with establishing, securing and monitoring the internal control system (ICS). This body also defines risk tolerance.
The body responsible for management implements the corresponding requirements stipulated by the body for governance, supervision and control, it develops suitable guidelines, procedures and processes, and reports periodically to the body responsible for governance, supervision and control.
Paragraphs 4 and 5 do not apply to managers of collective assets which are granted an exemption in accordance with Article 37 paragraph 5.
If a body responsible for governance, supervision and control has been appointed in accordance with Article 37 paragraph 4, FINMA may also require that internal auditors who are independent of management be appointed where the nature and scope of activity so dictate.
Where there are legitimate grounds for so doing, FINMA may depart from these requirements.
FINMA shall regulate the details.