Art. 68

(Art. 9 FinIA)

1. Securities firms must have an appropriately defined risk management system in place as well as an effective internal control structure to ensure in particular compliance with legal and internal provisions.
2. They shall set out guidelines for the basic principles of risk management and define their risk tolerance.
3. They will keep the functions of risk management and compliance functionally and hierarchically separate from the operational business units, in particular from the function of trading.
4. Firms trading for the account of clients and firms acting as market makers within the meaning of Article 41 letters a and c FinIA shall appoint internal auditors who are independent of management. Internal auditors must be provided with sufficient resources and have unlimited audit rights.
5. Where there are legitimate grounds for so doing, FINMA may allow relaxations of these requirements or it may impose more stringent requirements.
6. FINMA shall regulate the requirements on disclosure of information on risks, and in particular on risk management.¹