Banking and Finance Sector
Support for banks, cooperative credit banks, financial intermediaries under Article 106 TUB, asset management companies, payment and electronic money institutions: internal control system, anti-money laundering, transparency, digital operational resilience and oversight of the obligations towards Banca d’Italia, Consob and the UIF.
Sector challenges
Risk management, compliance, internal audit and the anti-money laundering function must have adequate mandates, resources and independence, produce reports that are of use to the governing bodies and not overlap with one another: in smaller intermediaries this is the tightest organisational constraint.
Customer risk profiling, proportionate due diligence, the reporting of suspicious transactions to the UIF (the Italian financial intelligence unit) and second- and third-level controls have to be kept running efficiently while the 2024 European anti-money laundering package, which set up a dedicated authority, will move part of the framework onto a directly applicable regulation.
Core banking, cloud services, payment processors and IT outsourcers concentrate operational risk outside the boundaries of the business: DORA calls for a register of contractual arrangements, specific clauses, an exit strategy and the reporting of major incidents.
Pre-contractual information, summary documents, unilateral amendments, complaint response times, claims before the Arbitro Bancario Finanziario (the Italian banking and financial ombudsman) and, for investment services, MiFID II suitability and product governance: obligations that feed through to contracts, systems and distribution networks.
Creditworthiness assessment, scoring models, credit information systems, the central credit register (Centrale dei rischi) and anti-fraud tools: high-impact processing that calls for correct legal bases, intelligible privacy notices and safeguards for decisions taken solely by automated means.
Supervisory expectations on climate-related and environmental risks require these to be built into governance, credit processes and reporting, while Pillar 3 ESG disclosure and sustainability reporting call for data and for controls over the quality of the information.
Areas of work
We review the mandates, procedures and information flows of the internal control functions against the applicable supervisory provisions (Circular 285/2013 for banks, Circular 288/2015 for intermediaries under Article 106 TUB, dedicated provisions for payment and electronic money institutions) and propose a design proportionate to the organisation, including where the anti-money laundering function should sit.
We take on the internal audit function in full or work alongside the existing one: audit universe, risk-based plan approved by the governing bodies, work programmes, testing of controls, graded findings and follow-up, with reporting to the board of directors and the board of statutory auditors.
We work on the risk assessment, due diligence procedures, profiling criteria, the handling of anomalies and the review of suspicious transaction reports, with training plans and sample testing of customer files, so that the controls are verifiable and not merely formalised.
We build or revise the ICT risk management framework, the register of arrangements with ICT third-party service providers, the contractual clauses and exit strategies, the process for classifying and reporting major incidents and the resilience testing programme.
We put home banking, apps, portals and payment interfaces through penetration testing and vulnerability assessments and feed the results into the digital operational resilience testing programme. For entities designated for advanced threat-led penetration testing we prepare the scope and the documentation, check that the appointed tester meets the requirements and handle the coordination with the authority. Security and continuity remain aligned with ISO 27001 and ISO 22301.
We review pre-contractual information, summary documents and customer communications against Title VI of the TUB and the Banca d’Italia transparency provisions, reconstruct the complaints cycle up to the Arbitro Bancario Finanziario and, for investment services, check the suitability assessment, product governance and cost disclosure.
We analyse the predicate offences that weigh on an intermediary: tax offences, market abuse, receiving stolen goods, money laundering and self-laundering, bribery, false corporate communications, obstructing the supervisory authorities, computer crime. The protocols are grafted onto the existing supervisory procedures.
We oversee privacy notices, legal bases, impact assessments on scoring and anti-fraud tools, retention periods, relations with credit information systems and the rights of data subjects in relation to automated decisions, with an outsourced DPO where the role is not covered in-house.
Banking and financial business is a reserved and supervised activity: entry requires an authorisation, and remaining in the market depends on continuing to meet organisational and capital requirements. Banca d’Italia carries out prudential supervision within the Single Supervisory Mechanism, which entrusts the ECB with direct supervision of significant banks; Consob, the Italian securities regulator, oversees investment services; the UIF, the Italian financial intelligence unit, receives reports of suspicious transactions. The regulatory perimeter is a varied one, ranging from banks to supervised mutual guarantee institutions (confidi).
The underlying framework, however, is common to all. Every intermediary must have separate internal control functions (risk management, compliance and internal audit) and officers who meet the fit and proper requirements. The anti-money laundering provisions of Banca d’Italia add to these the anti-money laundering function: an autonomous second-level control function, with its own head and with the separate role of the officer responsible for reporting suspicious transactions; in less complex intermediaries it may be assigned, subject to the conditions laid down, to the head of compliance.
Prudential requirements, by contrast, differ. ICAAP, ILAAP and the capital and liquidity rules revised by the 2024 European banking package (CRR3 and CRD6) apply to banks, while other intermediaries follow the provisions applicable to them, with the safeguarding of customer funds for payment and electronic money institutions.
Alongside prudential supervision run customer protection and anti-money laundering: Title VI of the TUB (the Italian consolidated banking law, Italian Legislative Decree 385/1993) and the transparency provisions of Banca d’Italia govern the relationship with the customer, up to claims before the Arbitro Bancario Finanziario, while investment services are governed by the TUF (the Italian consolidated law on finance) and MiFID II. Italian Legislative Decree 231/2007 and the implementing measures issued by Banca d’Italia govern customer due diligence obligations and the reporting of suspicious transactions; the 2024 European anti-money laundering package will move much of the framework onto a directly applicable regulation, but with deferred application: today the operating obligations remain those of the decree.
On the technology front the reference point is Regulation (EU) 2022/2554 (DORA), which brings dependence on ICT service providers within the scope of supervision, down to the register of arrangements reported to the authority. The picture is completed by the GDPR on profiling and credit scoring, by Italian Legislative Decree 231/2001 and by supervisory expectations on climate-related and environmental risks.
A single point of contact who knows supervisory regulation, anti-money laundering and information systems works with the control functions, IT, the credit department and the governing bodies, instead of separate consultants for each set of rules. We start from the documents the intermediary already produces: the reports of the control functions, the money laundering risk self-assessment, the complaints register, the outcome of inspections.
On the third line of defence we provide internal audit on an outsourced or co-sourced basis, with reporting to the governing bodies and coordination between the board of statutory auditors, the external auditor and the Supervisory Body (Organismo di Vigilanza).
ICT risk is kept under control by building the DORA framework and then putting it to the test: penetration testing and vulnerability assessments on the digital channels verify what the procedures claim.
Transparency is measured against the documents that reach the customer and against the complaints cycle, up to claims before the Arbitro Bancario Finanziario: the most direct source of signals about processes that do not hold up. On the same front sit the anti-money laundering procedures, the data protection obligations on scoring and marketing, and the Decree 231 Model grafted onto the existing controls.
Sustainability data follow the same principle: a single data chain, with controls over estimates and full traceability, serving both Pillar 3 ESG disclosure and sustainability reporting.
The scope is defined together and the decisions remain with the governing bodies of the intermediary: we bring regulatory insight, a method of verification and evidence, with responsibilities and timescales agreed at the outset.
Frequently asked questions
The banking and financial sector is among the sectors covered by NIS2, but Regulation (EU) 2022/2554 operates as sector-specific legislation with equivalent requirements: for the management of ICT risk and for incident notification, DORA and the reporting channels to the financial supervisory authorities apply, rather than the corresponding obligations of Italian Legislative Decree 138/2024. Particular cases still have to be checked, for example group companies carrying out activities unrelated to financial services, which may fall within the scope of NIS2 in their own right. The first task is therefore a reasoned and documented determination of the entity’s status, so as to avoid duplicated controls and notifications addressed to the wrong authority.
The supervisory provisions allow the internal control functions to be outsourced subject to certain conditions, which vary with the nature, size and complexity of the intermediary and as a rule require the appointment of an internal contact person, a contract governing service levels and access to information, and the retention of responsibility by the governing bodies. Checking that outsourcing is permissible is the first step in the engagement: where the conditions are not met, the workable arrangement is co-sourcing in support of an in-house function.
The risk self-assessment exercise and a sample test of the customer due diligence files: together they show whether the profiling criteria are consistent with the business as it actually operates and whether the information collected is complete and up to date. Next comes the route followed by anomalies, from the generation of the alert through to a reasoned decision to close it or a report to the UIF, measuring the timescales and the quality of the review. This is the same evidence that is called for during an inspection, which is why it is worth building it beforehand.
By reconstructing the whole chain: data sources, the legal basis for each processing operation, the notice given to the customer, the logic of the model described in intelligible terms, retention periods, contracts with data providers and with credit information systems. Where the assessment produces significant effects solely by automated means, provision has to be made for human intervention, for contesting the decision and for tracing the requests of data subjects. An up-to-date impact assessment holds these elements together and reduces the risk of challenge.
The offences that weigh most are those arising from the typical business of an intermediary: market abuse, receiving stolen goods, money laundering and self-laundering, tax offences, bribery, false corporate communications and obstructing the exercise of the functions of the public supervisory authorities, together with computer crime. The mapping has to be built on the business as actually conducted: deposit-taking, lending, investment services, payments, management of non-performing loans. The protocols rest on the controls already required by supervisory regulation, so as to avoid a second, parallel body of procedures.
The starting point is where climate-related and environmental risks already touch existing processes: credit policies and loan underwriting, valuation of collateral, reporting to the governing bodies, Pillar 3 ESG disclosure where it is required. The most demanding part concerns the data: the origin of the information collected from customers, the criteria applied to estimates where the data is missing, quality controls, traceability of who produced the figure. The same information feeds the sustainability reporting of the intermediaries subject to it, so it is worth building a single data chain instead of two separate reporting streams.
Related services
An internal audit function delivered on an outsourced or co-sourced basis: risk-based audit plans, testing of controls and reporting to the board.
Find out moreTechnical security testing of networks, applications and infrastructure: we find vulnerabilities before an attacker does.
Find out moreOrganisation, Management and Control Models under Italian Legislative Decree 231/2001, predicate offence risk assessment and support for the Supervisory Body (OdV).
Find out moreCompliance with EU Regulation 2016/679 and the Italian Privacy Code: assessment, record of processing, DPIA, policies and training.
Find out moreESG reporting under CSRD, ESRS, GRI and the VSME standard: materiality assessment, data collection, drafting and assurance readiness.
Find out moreDesign, implementation and maintenance of certifiable management systems: ISO 9001, 14001, 45001, 27001, 37001, 50001 and the main sector and supply chain schemes.
Find out moreLet’s talk
Tell us your business priorities: in a first meeting with no obligation we look at your context and propose a concrete way forward, with clear timescales and measurable results.