## cr17199 — EXECUTIVE SUMMARY AND KEY RECOMMENDATIONS

## Source details

**Canonical URL:** [cr17199 — EXECUTIVE SUMMARY AND KEY RECOMMENDATIONS](https://www.imf.org/-/media/files/publications/cr/2017/cr17199.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2017/cr17199.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2017/cr17199.pdf.json)

---

### Background and scope
- Purpose: Stocktaking of implementation of key recommendations from the IMF and World Bank 2015 assessment report on observance of Basel Core Principles (BCPs) for effective banking supervision in Bulgaria.
- Scope: Focus on the eight principles found to be materially non-compliant in 2015 and on six principles rated as largely compliant with important bearing on supervisory effectiveness.
- 2015 BCP assessment results:
  - Out of a total of 29 BCPs: 9 principles as compliant, 12 as largely compliant, and 8 as materially non-compliant.
- Material deficiencies identified in 2015 (exact text):
  - (1) inadequate governance model of exercising the BNB’s supervision functions;
  - (2) weaknesses in the internal organization of the Banking Supervision Department;
  - (3) incompleteness in regulatory acts, and internal rules and guidelines regulating banking supervision;
  - (4) absence of an institutional framework for crisis management and bank resolution;
  - (5) deficient IT and communication support for the supervisory function;
  - (6) insufficient coordination and information exchange with other institutions relevant to the supervisory function.
- Concern: BNB was too resource-constrained to deliver effective minimum levels of supervision.

### Progress and structural reforms undertaken
- BNB responses and initiatives:
  - Endorsed a Plan on Reforms and Development of Banking Supervision; implementation ongoing.
  - Priority given to the 2016 Asset Quality Review (AQR) and stress testing, which has put heavy pressure on BSD resources and delayed some BCP implementations.
  - New policies, manuals, and ordinances are being or will be adopted (BSPM renewal, new risk-focus Onsite Inspection Manual aligned to EBA/GL/2014/13).
- Governance changes:
  - New governance model for supervision adopted; BSD activities governed by new formal policies adopted by the Governing Council (GC).
  - New quarterly reporting to GC: one macro-level report and one supervisory-focused report (details on onsite inspections, supervisory risk ratings, enforcement actions, shareholding changes).
  - BSD now subject to annual internal audit (Order of the Governor No. BNB-85275/21.09.2016).
  - Advisory Council (AC) provides collective opinion to the Deputy Governor in charge of supervision (DGS); DGS remains by law the sole authority for supervision except GC powers on licensing and special supervision measures.
- Organizational and resourcing changes:
  - New Offsite Directorate established and segregated from Onsite Inspection Directorate.
  - Inspection teams increased from five to six.
  - Special Supervision Directorate split into Analysis of Market Behavior and Risk Division and AML Division (renamed units: AMBRU; AML and Other Specific Supervisory Activities).
  - Three new Memoranda of Understanding (MoU) signed to improve cooperation and information sharing with domestic partners.
  - New staff recruited though target capacity not yet reached (see Staffing below).
  - External assessment of adequacy of IT systems for banking supervision and failing bank resolution initiated.
  - Key ordinances awaiting drafting to adopt EBA standards (e.g., Article 45 on related-party transactions).
- Methodology and process reforms:
  - BSPM to be amended to support new governance model; renewed Banking Supervision Process Manual to be approved in February 2017 and new risk-focus onsite inspection manual to adopt EBA/GL/2014/13 guidelines.
  - Need to recalibrate risk assessment methodology: develop benchmark key risk indicators and more granular criteria/control points for assessing central governance functions (CAEL and CAMELOS coordination).
  - Need to formalize comprehensive SREP including an explicit Pillar 2 capital requirement and ways to factor concentration and untreated hidden risks.
  - 2017 supervisory plan intended to follow up on 2016 AQR outcomes and bank compliance progress.

### Key analytical observations and outstanding gaps
- Governance and strategy:
  - Strategic decisions remaining for GC:
    - Formalize a strategy detailing prudential policy objectives and specify tolerance to supervisory risk of failure.
    - Adopt an explicit framework to assess delivery on selected policy objectives.
    - Adopt formal policies on escalation and early intervention measures, including specifying severity of enforcement actions.
  - Recommendation: Align risk tolerance of GC with BSD response and escalation stance by adopting a method combining risk profile and systemic impact of each institution to guide supervisory response (reference: APRA risk assessment and response policies).
  - Need to assess ex post combined effectiveness of GC and BSD by success in containing or resolving assessed risks.
- Capacity, tools, and workload:
  - Reinforce BSD capacity considering engagement model:
    - Review intensity of activities and annual operational objectives in light of governance changes.
    - Estimate workload and align staffing and specialist needs (number of staff, credit experts, ITs, statisticians).
    - Implement curriculum and training program and adopt attractive remuneration system.
    - Provide modern software tools to support integrated, efficient, and auditable risk assessment and response processes aligned with GC risk tolerance (example: electronic onsite inspection working papers upload to shared risk assessment/scoring database).
- Risk assessment and supervisory practices:
  - Recalibrate CAEL and CAMELOS with benchmark key risk indicators and set entry scores guided by those indicators.
  - Formalize a comprehensive SREP consistent with EBA/GL/2014/13 and related EBA guidelines, including a detailed Pillar 2 capital regime to address excess idiosyncratic/local risks (connectedness, relatedness, other relevant risks).
  - Adopt processes to assess effectiveness of supervision (objectives, impact, accountability).
  - Develop capacity, processes and practice to oversee effective implementation of IFRS 9.
  - Complete revision of AML/CFT oversight methodology reflecting latest EU reforms.

### Table 1 — Main recommendations (action items and priorities)
- Short-Term Priorities (suggested targets during 2017)
  - Adopt a multi-year Action Plan, with detailed activities to continue strengthening the BSD. (Paras. 12, 52 & 54g)
  - Implement a comprehensive supervisory strategy for the target banks under the AQR. (Para. 57)
  - Adopt the Banking Supervision Process Manual (including measures to track effectiveness). (Paras. 15–31b)
  - Estimate workload; align resources to it; provide further key capacities (credit, ITs, statisticians). (Paras. 52d & 50a)
  - Regulate Article 45 of the LCI on related parties, setting criteria to typify circumvention practices. (Paras. 36–38)
  - Develop capacity, processes and practice to oversee an effective implementation of IFRS 9. (Para. 58 (a) (f))
  - Complete the revision of the AML/CFT oversight methodology, reflecting the latest reforms in the European Union. (Para. 65)
  - Adopt the new the risk focus Onsite Inspection Manual being developed (adapt CAMELOS to it). (Paras. 50c & 52k)
  - Start developing a range of software tools to support effective and efficient operations of the BSD. (Para. 52i)
- Medium-Term Priorities (suggested targets during 2018)
  - Enforce remedies to concentration and related-party risks based on the 2017 inspections. (Para. 34)
  - Adopt an internal “response and escalation policy” anchored in the rating (web a light version). (Paras. 9 & 16)
  - Adapt current ordinances expanding the EBA’s guidelines, for concentration risks, inter-alia. (Para. 33d)
  - Recalibrate CAEL and CAMELOS, with entry scores guided by benchmark key risk indicators. (Paras. 50 & 52j)
  - Combine CAMELOS and impact measures to set the risk tolerance of the GC and DGS. (Para. 5)
  - Complete the existing SREP components, adopting a detailed Pillar II capital regime. (Para. 52h)
  - Use the above to solve residual local risk excesses (i.e., connectedness, relatedness, other relevant). (Paras. 34–37g)
  - Adopt a process to assess the effectiveness of supervision (objectives, impact, accountability). (Paras. 6–8 & 52f)
- Long-term (suggested targets during 2019)
  - Review progress achieved under the Action Plan and adjust to prepare for a BCP Update. (Paras. 52–54)
  - Update the BSD’s internal Self-Assessment of Compliance with the BCP. (Paras. 52–54)
  - Submit to a formal BCP Update, including all principles. (Paras. 52–54)

### Governance model, decision-making, and advisory council
- Governance concerns (exact text excerpt):
  - “The existing governance model concentrates an extremely broad range of powers and responsibilities in the hands of the Deputy Governor in charge of the banking supervision, without providing for reliable information channels and control mechanisms by the other members of the BNB Governing Council.”
  - No legal options existed for effective delegation of supervisory powers if the Deputy Governor for Supervision (DGS) becomes unavailable or incapacitated (though GC motions in 2015 designate alternates in practice).
- Advisory Council (AC):
  - Composition: heads of the six Directorates of the BSD, the advisor of the DGS, and the director of the newly established Banking Resolution Directorate.
  - Functions: provides nonbinding advice; meets every Monday; to be formalized in BSPM (planned approval in February 2017).
  - Recommendations: formalize role, bifurcate operational/strategic issues, dedicate sessions to strategic issues, and use AC to lead a multi-year Action Plan and monitor BSD effectiveness.
- Reporting to GC:
  - Two quarterly reports instituted: macro-level banking conditions and a supervisory-focused report with onsite inspection metrics, supervisory risk ratings, enforcement measures, and shareholding structure changes.
  - Stocktaking mission suggests reporting combine supervisory rating and systemic impact for GC alignment.

### Internal organization, staffing, and capacity gaps
- Structural changes:
  - Offsite and Onsite supervision split into distinct directorates; Onsite Inspection Directorate continues field inspections.
  - Special Supervision Directorate renamed Specific Supervisory Activities (SSA); AMBRU created for market behavior and product transparency; AML and Other Specific Supervisory Activities unit strengthened.
  - Inspection teams increased from five to six to improve field coverage and rotation.
- Staffing numbers (as of August 30, 2016):
  - Offsite Supervision Directorate staffed with 18 inspectors (plan total: 20 inspectors, excluding head).
  - SSA staff increased with five experts.
  - AML Unit headcount increased by four, resulting in nine inspectors dedicated mainly to AML/CFT.
  - Supervisory Policy Directorate staff increased with one person.
  - Onsite Supervision Directorate staff increased with four experts.
  - Legal Supervisory Directorate staff increased with two experts.
  - Two additional experts assigned to Macroprudential Supervision and Financial Stability Directorate.
- Target capacity and gap:
  - The target for the BSD has not been attained yet; there is still a gap of about 25 percent (31 positions less 6 new onsite inspectors recently recruited and being trained).
  - Lack of additional office space may delay further reaching planned headcount.
- Mission recommendations on staffing:
  - Complete staff recruitment plan; prioritize specialists in credit, IT, statistical experts for internal models review, and key risk control disciplines.
  - Implement curriculum and remuneration policies and training (IFRS 9, risk management tools).

### Asset Quality Review (AQR) — method, quantitative result, and follow-up
- AQR features:
  - Larger-than-usual coverage due to target sampling, including possible related-party transactions.
  - PMO and QA process with Deloitte & Touch oversight; participation by EU’s DG Commission and EBA in steering committee.
  - Rich, auditable working papers; final long report per bank with follow-up suggestions.
- Quantitative result:
  - The AQR resulted in aggregate adjustments, as per IFRS accounting policies, of BGN 665 million to be reflected in the banks’ financial statements as of December 31, 2016, after taking into consideration events after December 31, 2015.
  - The BNB requested recovery plans for three banks whose CET1 was likely to fall below the minimum buffers, aimed at restoring minimum capital buffers by June 30, 2017 at the latest.
  - One bank already restored buffer coverage by raising needed capital; two others are subject to capital raising plans.
- Follow-up and supervisory implications:
  - AQR followed by remediation orders, ad hoc offsite reports, and a broad 2017 inspections program.
  - Major task: calibrate Pillar II policies, processes, and capital buffers, taking into account projection of findings and stress test results regarding sustainability of business models and conservatism of collective provisioning and collateral valuation in gone-concern nonperforming corporate loans.
  - Use AQR findings to build guidance on collective provisioning and to prepare for IFRS 9 implementation (training, supervisory guidance, FINREP 19 reporting enhancements).

### Asset classification, provisioning, IFRS 9 readiness
- Status and recommendations:
  - Pillar 2 policy and approach remain to be developed; AQR provides basis for designing compliant Pillar 2 approach and better compliance with CP standards.
  - Recommendations to: expand guidance on impairment accounting, use AQR to enrich corporate database, enhance NPL reporting (accruals vs. cash interest) for FINREP 19, set supervisory provisioning thresholds via SREP, provide supervisory guidance for write-downs and market price discovery, and train BSD staff for IFRS 9.

### Concentration risk and large exposures (Core Principle 19)
- AQR and subsequent actions:
  - System-wide horizontal review of concentration risks undertaken as part of the AQR.
  - BSD indicates AQR findings did not provide indications of significant under-reporting of large exposures (10 percent regulatory threshold), though ECB methodology focused less on economic interconnectedness.
  - Targeted inspections planned post-AQR to focus on connectedness and relatedness.
  - BNB to update Guidelines on large exposures per incoming EBA work (proposed guidelines on connected clients).
- Four actions under consideration to strengthen regime (exact text):
  - (i) imposing a general capital charge under Pillar 2 capital based on an index for sectorial and individual/unit risk counterparties;
  - (ii) imposing an additional individual capital charge under Pillar 2 to banks suspected of exceeding the large exposure limits, including those with identified material deficiencies in their internal concentration risk management frameworks for investigating and flagging interconnectedness;
  - (iii) expanding the scope of Article 45 of the LCI, both in terms of counterparties as well as in terms of transactions and methodologies; this would include as well communicating to banks the means and control systems required to avoid circumvention of prudential regulations through schemes that obscure ownership and control;
  - (iv) updating the RASM by devising to identify connectivity between parties; for example, by data-mining the information obtained from the AQR in combination with the monthly corporate data set currently reported by banks.
- Note: Footnote indicates HHI (Herfindahl-Hirschman Index) discussed as a generally accepted measure of concentration risk.

### Related-party risks (Core Principle 20)
- Key 2015 recommendations reiterated:
  - Define related-party transaction types in guidelines/regulations; enhance surveillance via thematic inspections; require banks to be more diligent identifying ultimate owners.
- BNB intended measures once AQR finalized:
  - Evaluate amending Article 45 of the LCI to strengthen definitions; develop guidelines with typology of circumvention practices based on AQR; update RASM to identify interconnections; develop thematic examination programs; adapt to EBA guidelines on large exposures; evaluate imposing additional capital requirements for breaches or material control gaps.
- Stocktaking mission complementary measures suggested (exact text list a–g):
  - a. Adopt a consistent strategy to systematically identify risks with reference to volume of suspected transactions, inadequate practices, and unreliable controls/systems; subject these to in-depth investigation with dedicated resources.
  - b. Review presumptive powers to officially declare suspected transactions as related-party transactions using a set of publicly known criteria for presumption (see Appendix III in source).
  - c. Seek development of legal interpretation and litigation practice for shifting the burden of proof to bank’s management subject to an executive rebuttal process.
  - d. Compile typology of circumvention practices to create warning signals enabling implementation of presumption criteria.
  - e. Continue efforts with service providers to develop profiling tools for data mining existing information, including to enable a database of relatedness and connections, as deemed practical.
  - f. Specify by ordinance or supervisory guideline the expected de minimis components the BNB wishes to see in operation as part of a ‘banking group and related-party’ risks management contention program.
  - g. Develop terms and conditions to require risk exposure reduction plans, including through deduction from capital of material risk concentrations or the imposition of additional Pillar 2 requirements.
- Regulatory alternative:
  - Consider formally regulating Article 45 of the LCI on related-party transactions under Article 16.5 of the BNB’s Law to issue binding regulations rather than guidelines.

### AML/CFT and ownership transparency (Core Principles 5, 6, and 29)
- Structural and organizational reforms:
  - AMBRU created to segregate consumer/market conduct tasks from AML/CFT oversight; AML/CFT Unit staff increased from five to nine inspectors (note: seven assigned to AML in 2015, two remapped to AMBRU in 2016).
  - AML/CFT oversight methodology being revised to reflect EBA guidance and the fourth EU AML Directive (EU 2015/849).
- UBO identification and offshore transparency:
  - Remaining recommendation: include clear definition of ultimate beneficiary owner (UBO) in LCI consistent with AML Law.
  - MoU with State Agency for National Security (SANS) and enhanced FIU cooperation used to investigate origin of funds of shareholders.
  - Offshore Law (July 2016) requires offshore companies participating in restricted entities to register with Commercial Register and disclose beneficial owners; concerns remain re: bearer shares (~1,800 entities cited) and use of SVPs.
- Operational issues:
  - AML inspection reports consolidated into single inspection reports with consumer lending findings—methodology being changed to segregate AML reporting.
  - Recommendation: strengthen banks’ due diligence (notary affidavit proposals, typify perjury/falsehood under AML law) and improve trade registry data access and quality.

### Bank governance and risk management (CP 14 and CP 15)
- Bank governance:
  - Need more structured approach to assess and guide corporate governance (CG); revisions to LCI expanded BNB powers to require Board changes but scope unclear.
  - Ordinance 10 (internal control) and Ordinance 20 (fit-and-proper) revisions pending; BNB issuing reminders to industry to follow EBA guidelines.
  - Onsite and AQR provide system-wide insights for CG assessment; Onsite Inspection manual to adapt EBA SREP Guidelines (EBA/GL/2014/13).
- Risk management:
  - Actions: reinforcement of staff (Onsite from 23 to 27 staff already achieved; target headcount 43 organized into six teams; Offsite increased from 11 to 15 staff with target headcount 18 organized into four teams — footnote details).
  - AQR’s Work Block 1 reviewed processes, policies, accounting and internal controls.
  - BSD to update risk assessment manual, calibrate benchmarks/proxies for CAEL-CAMELOS input, and align onsite/offsite manuals; drafts planned for finalization during 1Q17.
  - Mission complementary measures: prioritize recruitment of risk specialists, advance training, design changes to RASM/CAMELOS to visualize risk drivers and controls, and set basic Pillar 2 procedures linked with formal response and escalation policy.

### Supervisory activities, QA, IT and external expertise
- Supervisory approach status (summary):
  - Three-level Quality Assurance Procedures (QAP) in place; rotation of inspection teams adopted.
  - System-wide AQR performed in 2016; targeted inspections planned for 2017 covering about half of banks.
  - Public procurement IT review being launched to upgrade systems and integration for querying data.
  - Permitted use of external experts under LCI Art. 80 ¶3.4 amendment.
- Recommendations:
  - Formalize sampling policies to increase onsite efficiency; relate portfolio coverage to controls/MIS reliability; use attribute sampling and third-party reviews paid by banks under BSD TOR when error levels exceed thresholds.
  - Develop software tools to support integrated supervisory processes, shared databases, and auditable workflows.

### Financial reporting, external audit, and supervisory access (CP 27)
- Legislative and supervisory items:
  - Draft Statutory Law on Audit will require compulsory rotation of audit firm every seven years and reduce rotation of audit partner from seven to four years.
  - BNB has banned a major audit firm and objected to an auditor nomination under LCI Article 76 ¶4 and ¶6.
  - BNB lacks explicit powers to gain access to audit documentation and working papers; intends to comply by March 31, 2017 with upcoming EBA Guidelines on communication between competent authorities and auditors.
- Practical supervisory actions recommended:
  - Assess external audit reliability as a component in risk assessment; seek ex ante access to audit engagement plans and ex post to management letters/working papers; select proxy indicators for audit intensity; conduct annual meetings with each bank’s audit firm; host annual meeting with audit professionals on IFRS 9 implementation and supervisory guidance.

### Monitoring, timelines, and readiness for BCP update
- Monitoring and timing:
  - Table 1 provides suggested priorities through end-2019; mission suggests reforms may not warrant a formal complete BCP update until late 2019 to allow BSD time to implement new policies and procedures in practice.
  - Approval by the GC of the new Banking Supervision Process Manual expected in February 2017; further policies/procedures to follow during 2017.
- Actions required to achieve full compliance (programmatic):
  - Draft legislative amendments to expand powers for imposing supervisory measures.
  - Conduct full review of ordinances, internal rules, and guidelines regulating supervision activities.
  - Adopt supervisory review and risk assessment procedures in line with EBA common procedures and methodologies; complete SREP components including Pillar 2.

*Source: cr17199 - EXECUTIVE SUMMARY AND KEY RECOMMENDATIONS*

### EXECUTIVE SUMMARY AND KEY RECOMMENDATIONS _______________________________________ 4

### EXECUTIVE SUMMARY AND KEY RECOMMENDATIONS

### A. Background
- Purpose: Stocktaking of implementation of key recommendations from the IMF and World Bank 2015 assessment report on observance of Basel Core Principles (BCPs) for effective banking supervision in Bulgaria.
- Scope: Focus on the eight principles found to be materially non-compliant in 2015 and on six principles rated as largely compliant with important bearing on supervisory effectiveness.
- 2015 BCP assessment results:
  - Out of a total of 29 BCPs: 9 principles as compliant, 12 as largely compliant, and 8 as materially non-compliant.
  - Material deficiencies identified in six areas:
    - (1) inadequate governance model of exercising the BNB’s supervision functions;
    - (2) weaknesses in the internal organization of the Banking Supervision Department;
    - (3) incompleteness in regulatory acts, and internal rules and guidelines regulating banking supervision;
    - (4) absence of an institutional framework for crisis management and bank resolution;
    - (5) deficient IT and communication support for the supervisory function;
    - (6) insufficient coordination and information exchange with other institutions relevant to the supervisory function.
  - Concern that the BNB was too resource-constrained to deliver effective minimum levels of supervision.

### Progress and Structural Reforms Undertaken
- BNB responses and initiatives:
  - Endorsed a Plan on Reforms and Development of Banking Supervision to address 2015 BCP issues; implementation ongoing.
  - Priority given to the 2016 Asset Quality Review (AQR) and stress testing, which has put heavy pressure on BSD resources and delayed some BCP implementations.
  - New policies, manuals, and ordinances are being or will be adopted.
- Governance changes:
  - New governance model for supervision adopted; activities of BSD now governed by new formal policies adopted by the Governing Council (GC).
  - New quarterly report to GC on banking risks and progress.
  - BSD now subject to annual internal audit.
  - Advisory Council (AC) provides collective opinion to Deputy Governor in charge of supervision (DGS) on supervisory matters, including enforcement; DGS remains by law the sole authority responsible for supervision except for GC powers on licensing and special supervision measures.
- Organizational and resourcing changes:
  - New Offsite Directorate established and segregated from Onsite Inspection Directorate.
  - Inspection teams increased from five to six.
  - Special Supervision Directorate split into Analysis of Market Behavior and Risk Division and AML Division.
  - Three new Memoranda of Understanding (MoU) signed to improve cooperation and information sharing with domestic partners.
  - New staff recruited though desired levels not yet reached.
  - External assessment of adequacy of IT systems for banking supervision and failing bank resolution initiated.
  - Key ordinances awaiting drafting to adopt EBA standards (e.g., Article 45 on related-party transactions).
- Methodology and process reforms:
  - BSPM to be amended to support new governance model; renewed Banking Supervision Process Manual to be approved in February 2017 and a new risk focus onsite inspection manual to adopt EBA/GL/2014/13 guidelines.
  - Need to recalibrate risk assessment methodology by developing benchmark key risk indicators and more granular criteria and control points for assessing central governance functions.
  - Need to coordinate CAEL (offsite) and CAMELOS (onsite) for combined rating and to formalize a comprehensive SREP including an explicit Pillar 2 capital requirement and ways to factor concentration and untreated hidden risks.
  - Intention to use 2017 supervisory plan to follow up on 2016 AQR outcomes and bank compliance progress; Onsite Inspection Directorate adopted an inspections plan; Offsite Inspection Directorate monitoring via ad hoc reporting.

### Key Analytical Observations and Outstanding Gaps
- Governance and strategy:
  - Strategic decisions remaining for GC:
    - Formalize a strategy detailing prudential policy objectives and specify tolerance to supervisory risk of failure.
    - Adopt an explicit framework to assess delivery on selected policy objectives.
    - Adopt formal policies on escalation and early intervention measures, including specifying severity of enforcement actions.
  - Recommendation to align risk tolerance of GC with BSD response and escalation stance by adopting a method combining risk profile and systemic impact of each institution to guide supervisory response.
  - Need to assess ex post combined effectiveness of GC and BSD by success in containing or resolving assessed risks.
- Capacity, tools, and workload:
  - Reinforcement of BSD capacity required considering engagement model:
    - Review intensity of activities and annual operational objectives in light of governance changes.
    - Estimate workload and align staffing and specialist needs (number of staff, credit experts, ITs, statisticians).
    - Implement curriculum and training program and adopt attractive remuneration system.
    - Provide modern software tools to support integrated, efficient, and auditable risk assessment and response processes aligned with GC risk tolerance; example: electronic onsite inspection working papers with upload features to a shared risk assessment and scoring database.
- Risk assessment and supervisory practices:
  - Need to recalibrate CAEL and CAMELOS with benchmark key risk indicators and set entry scores guided by those indicators.
  - Need to formalize a comprehensive SREP consistent with EBA/GL/2014/13 and related EBA guidelines, including a detailed Pillar 2 capital regime to address excess idiosyncratic/local risks (connectedness, relatedness, other relevant risks).
  - Adopt processes to assess effectiveness of supervision (objectives, impact, accountability).
  - Develop capacity, processes and practice to oversee effective implementation of IFRS 9.
  - Complete revision of AML/CFT oversight methodology reflecting latest EU reforms.

### Table 1 — Main Recommendations (Action Items and Priorities)
- Short-Term Priorities (suggested targets during 2017)
  - Adopt a multi-year Action Plan, with detailed activities to continue strengthening the BSD. (Paras. 12, 52 & 54g)
  - Implement a comprehensive supervisory strategy for the target banks under the AQR. (Para. 57)
  - Adopt the Banking Supervision Process Manual (including measures to track effectiveness). (Paras. 15–31b)
  - Estimate workload; align resources to it; provide further key capacities (credit, ITs, statisticians). (Paras. 52d & 50a)
  - Regulate Article 45 of the LCI on related parties, setting criteria to typify circumvention practices. (Paras. 36–38)
  - Develop capacity, processes and practice to oversee an effective implementation of IFRS 9. (Para. 58 (a) (f))
  - Complete the revision of the AML/CFT oversight methodology, reflecting the latest reforms in the European Union. (Para. 65)
  - Adopt the new the risk focus Onsite Inspection Manual being developed (adapt CAMELOS to it). (Paras. 50c & 52k)
  - Start developing a range of software tools to support effective and efficient operations of the BSD. (Para. 52i)
- Medium-Term Priorities (suggested targets during 2018)
  - Enforce remedies to concentration and related-party risks based on the 2017 inspections. (Para. 34)
  - Adopt an internal “response and escalation policy” anchored in the rating (web a light version). (Paras. 9 & 16)
  - Adapt current ordinances expanding the EBA’s guidelines, for concentration risks, inter-alia. (Para. 33d)
  - Recalibrate CAEL and CAMELOS, with entry scores guided by benchmark key risk indicators. (Paras. 50 & 52j)
  - Combine CAMELOS and impact measures to set the risk tolerance of the GC and DGS. (Para. 5)
  - Complete the existing SREP components, adopting a detailed Pillar II capital regime. (Para. 52h)
  - Use the above to solve residual local risk excesses (i.e., connectedness, relatedness, other relevant). (Paras. 34–37g)
  - Adopt a process to assess the effectiveness of supervision (objectives, impact, accountability). (Paras. 6–8 & 52f)
- Long-term (suggested targets during 2019)
  - Review progress achieved under the Action Plan and adjust to prepare for a BCP Update. (Paras. 52–54)
  - Update the BSD’s internal Self-Assessment of Compliance with the BCP. (Paras. 52–54)
  - Submit to a formal BCP Update, including all principles. (Paras. 52–54)

### Other Notable Items from the Executive Summary
- Organizational changes already implemented or underway:
  - Offsite Directorate created; Onsite Inspection Directorate segregated.
  - Special Supervision Directorate reorganized for greater AML/CFT focus.
  - Increase in inspection teams (from five to six).
- Tools and standards alignment:
  - Renewed BSPM and new risk focus Onsite Inspection Manual to align to EBA/GL/2014/13.
  - Ongoing work to adopt EBA standards via ordinance revisions (e.g., Article 45 related-party transactions).
- Monitoring and timing:
  - Table 1 provides suggested priorities through end-2019; mission suggests that until late 2019 reforms may not warrant a formal complete BCP update to allow BSD time to implement new policies and procedures in practice.

*Source: cr17199 - EXECUTIVE SUMMARY AND KEY RECOMMENDATIONS*

### 1.      As observed by BCP assessors and acknowledged clearly in the BNB Plan on Reforms,

### 1.      As observed by BCP assessors and acknowledged clearly in the BNB Plan on Reforms,

### Revision of the BNB governance model and role of the Governing Council (GC)
- The “existing governance model concentrates an extremely broad range of powers and responsibilities in the hands of the Deputy Governor in charge of the banking supervision, without providing for reliable information channels and control mechanisms by the other members of the BNB Governing Council.”
- No legal options exist for effective delegation of supervisory powers if the Deputy Governor for Supervision (DGS) becomes unavailable or incapacitated.
- Governance changes underway aim to:
  - Increase GC participation in banking supervision matters.
  - Adopt a new set of revised rules and procedures.
  - Streamline the decision-making process for supervision with a more active role for the advisory council to the deputy governor in charge of supervision.
  - Revise conditions for enforcing prudential laws and regulations in the next quarters.

### Internal rules, manuals, and implementation timetable
- The GC is set to adopt a package of rules and internal guidelines as part of the BNB’s Plan on Reforms, including:
  - Revised manuals and a set of principles defining supervisory tone, business analysis, and risk tolerance for each bank.
  - New criteria for enforcement, working arrangements between Deputy Governors (DGs), and between DGs and the GC.
- Most, if not all, supervisory manuals for both onsite and offsite supervision are being revised by relevant directorates within the Banking Supervision Department (BSD).
- The review progress to date indicates that targets will be achieved by end-2017.
  - The BSD has assigned substantive resources: two heads of inspection team, two inspectors from the On-site Inspections Directorate and two heads of team from Off-site Directorate full-time dedicated.
  - Drafting work evidences intention to make BSD supervisory procedures fully compliant with the standards of EBA/GL/2014/13 while preserving a risk focus inspection approach.
- A consultant from Belgium (deputy chief of supervision) provided advice in the course of 2015 and a fresh perspective from an SSM standpoint.

### Enhanced internal scrutiny and audit arrangements
- Annual internal audit of compliance with supervision rules and fulfillment of the Plan on Reforms:
  - Audit team composition: Head of the Financial Audit Division (lead), the Chief Internal Auditor, and the Head of the Information Systems Audit.
  - Scope: comprehensive review of adequacy and effectiveness of the internal regulatory framework regulating supervisory processes and the Single Data Repository information system developed for supervisory activities.
  - The review shall be structured in accordance with the Plan of Reforms and focus on: “Governance Model,” “Internal Organization of the Banking Supervision Department,” and “Regulatory Framework.”
  - Order of the Governor No. BNB-85275/21.09.2016.
- Concerns and mission recommendation:
  - Past audit recommendations have not always resulted in concrete actions (outdated regulations, insufficient manpower, unclear allocations of resources, inadequate follow-up of recommendations to banks, decreased effectiveness of supervisory processes).
  - Mission recommends strict follow-up at the GC level of audit recommendations to ensure completion of the Plan of Reforms within a reasonable timeframe.
  - The Internal Auditor was apprised of the findings of the 2015 BCP report to ensure maximum impact of its work.
  - Reviews should evaluate effectiveness of supervision rather than solely compliance with internal manuals.

### Quarterly reporting enhancements to the GC
- New reporting regime: two quarterly reports to the GC
  - Macro-level report on conditions affecting the banking system and individual banks (previous single report).
  - Supervisory-focused report detailing:
    - (i) onsite inspections (e.g., number of visits, findings, and issues);
    - (ii) supervisory risk ratings and problems identified (including number and type of infringements) and recommended corrective actions;
    - (iii) enforcement measures taken or considered against specific institutions and progress achieved to date.
  - Offsite department inputs provide granular details on follow-up measures and adoption of corrective measures by banks.
  - Quarterly reports include information on changes in the shareholding structure of banks.
- Stocktaking mission suggestion:
  - Use a combination of supervisory rating and systemic impact of each bank for reporting to the council to align the council’s risk tolerance to BSD’s response and escalation policies.
  - Reference example: APRA risk assessment and response policies combining supervisory rating (probability of failure) and systemic impact (potential for loss given default).

### Need for explicit prudential objectives, assessment framework, and response policies
- Three crucial strategic decisions required from the GC:
  - Formalize a strategy detailing prudential policy objectives and specify GC tolerance to the BNB’s risk of failing to effectively contain or resolve an idiosyncratic crisis.
  - Adopt an explicit framework to enable assessment of delivery on selected policy objectives.
  - Adopt formal policies specifying conditions under which the GC and the DGS will respond to defuse, contain, or resolve risk accumulation, including severity of enforcement stance.
- Types of objectives to be formalized:
  - Strategic long-term goals of the GC (furthering Article 2 of the BNB’s Law: price stability, regulate and supervise banks to ensure financial stability and protect depositors).
  - Tactical medium-term objectives of the DGS to implement actions delivering on GC strategic goals.
  - Annual operational targets of each Directorate and Technical Supervision Line Unit implementing Council goals and DGS objectives.
- Assessment and accountability framework:
  - An impact and accountability framework with a few relevant indicators is required to assess the footprint and consequences of supervision and its response.
  - Referenced: Basel Committee October 2015 Report on the impact and accountability of banking supervision.
  - Challenge: determine when risks are so intense (per risk assessment measures such as CAMELOS) that Directorate, DGS, or full GC response is required.

### Formalization of response, intervention, and enforcement criteria
- Importance:
  - Criteria needed to specify thresholds for implementing supervisory measures and administrative penalties per the LCI (Articles 36, 103, 115, and 152) and the RRL (Articles 13 and 44).
  - Decisions by the GC and DGS would then address risk accumulation in a predictable, proportional, and consistent manner, including explicit Pillar 2 capital risk regime for hidden risks (poor internal governance, inside abuse, related-party transactions).
- Current status:
  - Internal guidelines are envisaged to assist the DGS in determining adequate responses in case of breach or violation — a key 2015 BCP recommendation for predictability and transparency.
  - No concrete decisions made so far partly due to AQR process mobilizing personnel.
  - BNB plans in-depth discussions to provide guidance linking supervisory findings to remedial actions and establishing procedures for exceptions.
  - Mission reiterates importance of adopting a “response and escalation policy” and an enforcement policy with criteria for sanctions according to gravity of the offense.
  - These policies should form part of the Banking Supervision Process Manual (BSPM) under development and to be approved by the GC sometime in 2017.

### Decision-making process, advisory council (AC), and delegation of powers
- Decision-making structure remains legally unchanged; concerns from 2015 BCP assessors that concentration of powers in the DGS makes the position vulnerable to external pressure and influence.
- Measures introduced by the Plan aim to promote transparency in supervisory decisions:
  - DGS now presents two quarterly reports and can be challenged by GC members though final decision rests with the DGS.
  - DGS assisted by an Internal advisory council providing guidance on supervisory measures.
- Internal advisory council (AC):
  - Established and operating for several years; enhanced role and formal internal organization are being pursued.
  - Composition: heads of the six Directorates of the BSD, the advisor of the DGS, and the director of the newly established Banking Resolution Directorate.
  - Functions to date: discussions on micro- and macro-supervisory issues, scope of onsite inspections, developments in European banking regulations and guidance.
  - Going forward: AC will discuss specific banks and measures in light of AQR outcomes.
  - Operational details:
    - AC meets every Monday and can be scheduled upon request of the DGS.
    - Stocktaking mission suggests AC design a robust multi-year Action Plan and mechanisms to evaluate and report BSD effectiveness.
  - AC has no legal responsibilities and provides nonbinding advice to the DGS; it should not replace the DGS as the decision-maker.
  - AC expected roles: challenge supervisory decisions, provide unbiased insights, facilitate higher quality assurance (QA), and focus response and escalation advice to the DGS.
  - AC internal organization, functioning, and mandate are being formalized as part of internal rules to be adopted by the GC (planned BSPM adoption in February 2017).
- Clarification of delegation regime:
  - Prior gap: if the deputy governor position fell vacant unexpectedly, enforcement powers could not be delegated.
  - Legal basis cited: art. 19 of the law on the BNB — “on a motion by a DG, the Governing Council shall designate an alternate deputy governor to exercise his powers when he is absent.” This provision is reiterated in the Rules of Procedure of the BNB’s GC.
  - July 2015 motion: GC designates the DG heading the Issues Department to perform the DGS’s powers in the absence of the latter.
  - In case of simultaneous absence of both DGs, the DG in charge of the Banking Department is designated to act on behalf of the DGS.
  - The GC decision is applicable for unlimited numbers of instances.
  - Note: the notion of “absence” is not defined in text, however.

*Source: https://www.imf.org/-/media/files/publications/cr/2017/cr17199.pdf*

### 17.      Recent decisions against two banks suggest a shift in the BNB’s approach to serious

### 17.      Recent decisions against two banks suggest a shift in the BNB’s approach to serious

### Enforcement actions and supervisory stance
- More forceful actions have been taken against two institutions that breached regulations, pursuant to article 103, paragraph 2, items 3, 4, 10, 11, and 15 of the LCI.
- Written orders have been issued instructing a bank to cease and eliminate the violations.
- Other measures included:
  - corrective actions to improve the respective banks’ financial positions,
  - limits on the volume of certain types of activities,
  - capital increase,
  - changes in the banks’ internal rules and procedures.
- In one case, the bank was instructed to terminate certain operations or to transfer non-transparent credit portfolios managed outside the country borders back into the scope of detailed supervisory surveillance (see discussion under CP 29).
- The report states: “This approach is welcome and should become a general practice going forward.”

### B. Internal Organization of the Banking Supervision — background and reform objectives
- The existing internal organization of the Banking Supervision Department (BSD) previously failed to ensure necessary coordination and quality assurance of prudential oversight activities, including effective internal communication (as indicated by the BCP assessors in 2015 and acknowledged in the BNB Plan of Reforms).
- Measures taken are a mix of structural and operational reforms intended to improve conformity with CP 01, 08, and 29.
- Objectives of the reform:
  - increase efficiency,
  - promote better allocation of resources,
  - ensure mutual quality control.

### Separation of offsite and onsite supervision
- Offsite and onsite supervision activities have been split into two distinct directorates within the Banking Supervision Department.
- Onsite inspections continue to be conducted by the Onsite Inspection Directorate.
- Working arrangements have been established to ensure cooperation and information exchange between the directorates.
- The split follows lessons from the failure of Corporate Commercial Bank AD (KTB) and aims to prevent recurrence.

### Improvements in onsite supervisory work
- The BNB increased the number of inspection teams from five to six to:
  - improve frequency of field visits,
  - enable team rotation to ensure a fresh perspective on banks.

### New and renamed units; mandate allocation
- A new Analysis of Market Behavior-Related Risk Unit (AMBRU) has been established within the Specific Supervisory Activities (SSA) Directorate (formerly the Special Supervisory Directorate, SSD).
  - AMBRU responsibilities: monitoring and analyzing business practices in areas such as consumer and mortgage lending, offering of deposit and other banking products, product transparency, and analysis of customer complaints (not connected to money laundering and terrorist financing).
  - AMBRU has four permanent staff positions and additional resources are being considered in anticipation of the implementation of the new law on Real Estate Loans for Consumers (LRELC) transposing the requirements of the Directive 2014/17/EU on credit agreements for consumers relating to residential immovable property.
- The SSD was renamed “Specific Supervisory Activities (SSA)” to avoid confusion with the special supervision regime under the Law on Credit Institutions.
- The AML/CFT Unit was renamed “AML and Other Specific Supervisory Activities” and its staff was increased to nine inspectors dedicated mainly to AML/CFT issues.
- The distinction between AMBRU (non-AML activities) and the AML Unit is noted as an important improvement, while the capacity of the SSA to focus on its core mandate “remains to be seen.”

### Staffing changes and capacity gaps
- As of August 30, 2016:
  - Offsite Supervision Directorate established and staffed with 18 inspectors.
  - The total number of employees of the directorate, according to the plan, is 20 inspectors, excluding the head of the directorate.
  - Specific Supervisory Activities staff increased with five experts.
  - AML Unit headcount increased by four, resulting in an amount of nine inspectors dedicated mainly to AML/CFT.
  - Supervisory Policy Directorate staff increased with one person.
  - Onsite Supervision Directorate staff increased with four experts.
  - Legal Supervisory Directorate staff increased with two experts.
  - Two additional experts assigned to the Macroprudential Supervision and Financial Stability Directorate.
- Target capacity and gap:
  - The target for the BSD has not been attained yet, and there is still a gap of about 25 percent (31 positions less 6 new onsite inspectors, recently recruited and being trained).
  - The lack of additional office space may delay further reaching the planned headcount.

### C. Institutional Framework for Crisis Management — resolution regime and implementation
- The BNB has been designated the banking resolution authority, and a new resolution regime for banks has been established with the adoption of the Law on Recovery and Resolution of Credit Institutions and Investment Firms.
  - The new Act was published in the State Gazette on August 14, 2015, with most provisions entering into force on set dates, including in 2017 and 2025 respectively.
  - The Act implements the EU Bank Recovery and Resolution Directive 2014/59/EU.
  - The law requires all institutions to produce a recovery plan (on a group or an individual basis) and update it annually and as needed. The recovery plans of local banks are subject to review by the BSD.
  - The BNB should prepare individual resolution plans for each institution without a parent undertaking in the European Union, identify material impediments to resolution and possible actions to remove them, and participates in EU resolution colleges.
  - The BNB is empowered to intervene early and to impose measures whenever an institution infringes or is imminently likely to infringe requirements of EU Regulation or applicable Bulgarian legislation.
- Operationalization steps:
  - A new Bank Resolution Directorate (Resolution of Credit Institutions Directorate, RCI) outside of the BSD has been established and staffed.
  - Draft internal rules governing interaction and current exchange of information between the RCI and other structural units of the BNB (including the BSD, Banking and Legal Departments) have been established and shared with the mission.
  - Work to make the new resolution regime operational is ongoing and includes completion of operational procedures, interface between the Directorate for Resolution and the GC (sole resolution authority), resolvability assessment, and resolution planning and strategies for each bank.
- Status of recovery plans and cross-border cooperation:
  - Banks have prepared and completed their recovery plans (RP). Some plans submitted in 2016 4Q remain to be reviewed based on template procedures for analyzing recovery plans already adopted.
  - Three meetings with the industry have taken place to explain further improvements to the RP.
  - The mechanism for cross-border cooperation with home resolution authorities (mainly the Single Resolution Board (SRB) and the Magyar Nemzeti Bank) has been established.
  - Relevant Multilateral Cooperation and Coordination Agreements for setting up and functioning of resolution colleges have been concluded.

### OTHER CORE PRINCIPLES REQUIRING FURTHER ACTION — programmatic activities
- Three key activities to achieve full compliance with relevant Basel Core Principles:
  1. draft legislative amendments to expand powers for imposing supervisory measures;
  2. conduct a full review of ordinances, internal rules, and guidelines regulating supervision activities;
  3. adopt supervisory review and risk assessment procedures in line with the decisions of the European Banking Authority (EBA) on common procedures and methodologies.
- After the reorganization of the BSD and once the AQR was finalized in August 2016, these actions are being undertaken with focus on principles assessed as Materially Non-Compliant in March 2015.

### A. Banking Risks — Ownership Aspects (Core Principles 5 and 6)
- Remaining key recommendations from March 2015 BCP assessment:
  - include a clear definition of ultimate beneficiary owner (UBO) in the LCI consistent with the AML Law;
  - require in the LCI that banks notify of material negative information regarding the suitability of a major shareholder, enabling the BNB to take measures when a material negative event might affect a bank through contagion or reputational impact.
- Planned and undertaken actions:
  - Once the fourth Anti-Money Laundering Directive (EU 2015/849) is transposed, the BNB plans to submit amendments to align the definition of UBO and to obtain appropriate powers to address negative information instances.
  - MoU signed in August 2015 with the State Agency for National Security (SANS) has reinforced communication and information exchange with the Financial Intelligence Unit (FIU); used recently to expand investigation of origin of funds of a number of shareholders of banks and nonbank financial institutions, including active exchange of information with the Prosecutor’s Office.
  - The Banking Supervision Process Manual and other internal rules are being updated with a formal mechanism for interview of applicants, including exchange of information with other Directorates of the BSD regarding tracking funds proceeds and sourcing.
  - Changes planned in the Risk Assessment Manual (RASM) to enhance relevant components of the risk assessment system (CAMELOS).
  - The BNB plans to update, as deemed necessary, its Ordinance 20 on the Issuance of Approvals for Members of the Management and Supervisory Boards, following the review of the Joint ESMA and EBA Guidelines on suitability assessments.

### Concentration Risks (Core Principle 19)
- Background: March 2015 BCP assessment recommended:
  1. conduct horizontal reviews of conformity;
  2. instruct the industry to increase efforts in understanding customers’ ownership structures;
  3. take forceful measures against banks to promote observance.
- Actions initiated by the BNB:
  a. AQR review:
     - The BNB conducted a system-wide first horizontal review of concentration risks as part of the AQR.
     - The eighth task of Work Block 1 of the AQR (Policies, processes, and accounting review) included a high-level review of connected client IDs and countries of ultimate borrower ID policies.
     - AQR providers were instructed to review groups of connected clients where flags were identified, including other material exposures identified subject to the two largest in a group of connected clients, and to use publicly available sources to challenge identified groups of connected clients.
     - The BSD indicates that the findings of the AQR did not provide indications of significant under-reporting of large exposures (set at the standard 10 percent level of regulatory requirement) and that, in general, there were no material discrepancies identified in the reviews. The BSD also noted that the ECB methodology used meant the analysis of economic interconnectedness was not the focus, and further efforts are advisable.
  b. Targeted inspections:
     - After finalization of the AQR, the BSD will conduct a plan of targeted inspections where review of connectedness and relatedness is a central theme.
  c. Redrafting manuals and risk assessment:
     - BSD is re-drafting onsite inspection manuals and the RASM to develop specific procedures for review of banks’ internal risk management frameworks, including practices and internal audit programs associated with concentration risks.
  d. Update of Guidelines on large exposures:
     - BNB’s guidelines on large exposures will be reviewed and updated per the new regime being prepared by the EBA (proposed guidelines for connected clients were to be available for public consultation since end-October 2016).
     - Enhanced guidelines will provide instructions to the industry, drawing on experience from the AQR and targeted inspections, and will expand criteria for establishing connections beyond formal ownership factors.

*Source: IMF country report chapter text.*

### 34.      In addition, the BSD is considering a number of possible actions to strengthen the

### 34.      In addition, the BSD is considering a number of possible actions to strengthen the supervisory regime for Concentration Risk and Large Exposures.

### Concentration Risk and Large Exposures
- Four actions under consideration:
  - (i) imposing a general capital charge under Pillar 2 capital based on an index for sectorial and individual/unit risk counterparties; 32
  - (ii) imposing an additional individual capital charge under Pillar 2 to banks suspected of exceeding the large exposure limits, including those with identified material deficiencies in their internal concentration risk management frameworks for investigating and flagging interconnectedness;
  - (iii) expanding the scope of Article 45 of the LCI, both in terms of counterparties as well as in terms of transactions and methodologies; this would include as well communicating to banks the means and control systems required to avoid circumvention of prudential regulations through schemes that obscure ownership and control;
  - (iv) updating the RASM by devising to identify connectivity between parties; for example, by data-mining the information obtained from the AQR in combination with the monthly corporate data set currently reported by banks.

*Footnotes in source:*
- 32: The use of the Herfindahl-Hirschman Index (HHI) is a generally accepted measure of concentration risk discussed with the mission by reference to similar treatment in another SSM country.

### Related-Party Risks (Core Principle 20)
- Background findings from March 2015 BCP assessment:
  - Three key recommendations to strengthen supervision of related-party transactions:
    - (i) define in guidelines or in regulations the types of transactions that give rise to related-party exposures;
    - (ii) enhance surveillance of such transactions across the industry through thematic inspections;
    - (iii) provide recommendations to the industry to be more diligent in identifying their customers’ ultimate owners.
  - These recommendations stemmed from the absence of specific provisions in the LCI and the BNB’s Ordinances regarding a number of relevant standards.
- BNB intended measures once the AQR is finalized: 33
  - Evaluate convenience of amending Article 45 of the LCI to strengthen definitions of related parties and transactions, and the terms and conditions for their approval.
  - Develop a concrete set of guidelines to communicate to banks the diversity of inappropriate practices seen to circumvent ownership and other control standards, based on AQR results.
  - BSD to update risk assessment procedures to better identify interconnections and relatedness, and develop a dedicated examination work program to review related-party transactions and banks’ dedicated risk management frameworks, with the intention of using these during thematic line reviews.
  - Adapt guidelines and examination programs to the incoming revision of the EBA’s guidelines on large exposures.
  - BNB evaluating possibility of imposing additional capital requirements for actual or suspected breach of limits and material control gaps.

- Stocktaking mission complementary measures suggested:
  - a. Adopt a consistent strategy to systematically identify risks with reference to volume of suspected transactions, inadequate practices, and unreliable controls/systems; subject these to in-depth investigation with dedicated resources.
  - b. Review presumptive powers to officially declare suspected transactions as related-party transactions using a set of publicly known criteria for presumption (see Appendix III in source).
  - c. Seek development of legal interpretation and litigation practice for shifting the burden of proof to bank’s management subject to an executive rebuttal process.
  - d. Compile typology of circumvention practices to create warning signals enabling implementation of presumption criteria.
  - e. Continue efforts with service providers to develop profiling tools for data mining existing information, including to enable a database of relatedness and connections, as deemed practical.
  - f. Specify by ordinance or supervisory guideline the expected de minimis components the BNB wishes to see in operation as part of a ‘banking group and related-party’ risks management contention program.
  - g. Develop terms and conditions to require risk exposure reduction plans, including through deduction from capital of material risk concentrations or the imposition of additional Pillar 2 requirements.

- Regulatory alternative:
  - Consider formally regulating Article 45 of the LCI on related-party transactions. Under Article 16.5 of the BNB’s Law, the Governing Council may specify binding regulations rather than establishing guidelines.
  - Include specification of the meaning of Article 103 of the LCI on Supervisory Measures regarding unsound and unsafe practices (circumvention, use of fictitious persons), setting clear presumption criteria along lines suggested by the mission (Appendix III).

*Footnote in source:*
- 33: Except for a number of transactions flagged by the service providers as “unknown” due to difficulty identifying ultimate beneficial owners of borrower entities located in offshore centers, the BNB indicates related-party exposures identified during the AQR would not seem to be relevant to significantly altering the risk profile of the banks, for which the aforementioned officially reported transactions continue to be within prudential limits, notwithstanding that the AQR was not explicitly designed as a forensic exercise. These transactions are currently under investigation through standard supervisory procedures including inspections conducted under the 2017 plan already adopted.

### Country and Transfer Risks (Core Principle 21)
- Background: 2015 BCP assessment found flaws in the regime for country and transfer risks; a regulation on country and transfer risks was still missing.
- Current BNB practices noted:
  - BNB pays close attention to cross-border exposure risks.
  - Adoption by the BNB’s internal ICAAP manual identifies cases when country and transfer risks must be examined to supplement supervisory view on credit risk. When a bank conducts significant operations in other countries (with a high share of foreign assets), it shall consider risks such as country risk and transfer risk.34
  - Offsite Supervision Directorate receives regular written information from Macroprudential and Financial Stability Directorate regarding country and other risks related to subsidiaries of foreign banks and parent companies.
  - Example: concerns over political and economic situation in Greece, Italy, and Turkey prompted requests for additional data on exposures to these countries; degree of concentration within sovereign exposures to Italy, Greece, and Turkey in proportion to whole institutions’ credit portfolio was assessed.
  - For banks reporting loans granted by foreign branches, transfer risk linked to cross-border foreign currency lending and exposure in foreign currencies was found immaterial.
  - Outcomes of these assessments shared with BNB senior management in quarterly reports.
- Measures being considered to improve surveillance:
  - Revision of the BNB’s internal manual for the SREP to adapt and harmonize prescriptions with EBA guidelines on the SREP and BNB practices.
  - Drafting more detailed requirements regarding management of exposures and instruments that carry sovereign risk.
  - Sovereign risk included in banks’ capital assessment as part of macroprudential stress test.

*Footnote in source:*
- 34: The share of loans extended in foreign currencies can also serve as an indication of concentration risk. If this CP 11 share is very large, movements in currency prices could affect the credit quality of clients.

### Bank Governance and Risk Management

#### Bank Governance (Core Principle 14)
- Background:
  - 2015 BCP report: corporate governance (CG) practices in banking sector transitioning toward international good practices and require closer attention and possible deepening of BNB skillset.
  - Limited progress achieved; need for more structured approach to assessment and guidance for supervisors.
- Legal and regulatory observations:
  - Revision of the LCI expanded BNB’s power to require changes in the Board’s composition, but scope unclear: revised Art. 103 paragraph 2 of the LCI does not explicitly cover power to require Board composition changes where individual(s) failed to discharge responsibilities effectively.
  - Revisions to BNB secondary regulations to foster CG risk management still pending.
  - Need to refresh Ordinance 10 (on internal control) to elaborate BNB requirements and expectations on CG; meetings held with Association of Internal Auditors to discuss amendments.
  - BNB issued a note reminding industry to comply with existing EBA guidelines on internal governance.
  - Awaiting publication of upcoming EBA guidelines on legal protection for individuals who notify BNB of material issues affecting fitness and propriety of Board/senior management; similar awaiting for Ordinance 20 regarding fit-and-proper requirements for Board members.
- Onsite monitoring and AQR:
  - AQR provides system-wide view on risk management practices, including corporate governance; lessons can inform RAS Manual and ICAAP process.
  - Onsite Inspection Directorate amending its manual in accordance with EBA SREP Guidelines; new process/procedures to assess corporate governance anticipated.37
  - AQR facilitated closer contacts with Boards and senior management — recommended to continue systematic senior-level contact to reinforce messages and assess Boards’ qualities and capacities.

*Footnote in source:*
- 35 and 36 reference earlier assessments and technical note; 37: Mission understands Onsite inspection manual review will adapt risk assessment to EBA’s standard (EBA/GL/2014/13), transforming Management component under CAMELOS into assessment of Internal Governance and Controls differentiating five core elements (board, management and controls, risk management, internal audit, and compliance functions), individually risk assessed and scored consistent with EBA standards.

#### Risk Management (Core Principle 15)
- Background: March 2015 BCP assessment provided four key recommendations:
  - (i) review proportion of resources dedicated to assess risk management in onsite programs;
  - (ii) consider horizontal reviews to evaluate state of risk management in sector;
  - (iii) revise Ordinance 10 to confirm and enhance supervisory requirements;
  - (iv) review RAS Manual to give inspectors greater guidance to test quality of RM and reflect findings in analysis, ratings, and supervisory actions.
- BNB initiated activities to improve conformity with CP 15:
  - a. Reinforcement of staff:
    - After separation of Onsite and Offsite activities in 4Q15 into two Directorates, head-count is being expanded and recruitment started.38
    - Onsite and offsite assessments combine review of risk management as per current risk assessment manual being updated in line with EU practice. Teams dedicated to risk management issues, especially due to AQR and 2016 inspection plan.
  - b. AQR and 2016 inspection plan:
    - Work Block 1 “Processes, policies and accounting review” (PPA) of AQR performed in-depth assessment of banks’ internal policies, procedures and processes, including internal controls and governing asset impairments.
    - Three targeted onsite inspections in progress focusing on market, operational and related party risks.
    - 2016 plan of targeted inspections expected to cover about half of the banks in the system.
  - c. Risk manual reviews:
    - BSD set up team dedicated to: (i) update current risk assessment manual and procedures for onsite inspections; (ii) calibrate benchmarks and proxies used for scoring risks and management and controls for input in CAEL-CAMELOS;39 and (iii) align manuals of offsite and onsite inspection to changes above.40
    - Work to proceed in close coordination with update of Supervisory Review and Evaluation Process (SREP) of BSD, including Pillar 2 approach.41

*Footnote in source:*
- 38: Increase of four staff in the Onsite Directorate from 23 to 27 staff already achieved with an overall target headcount of 43 inspectors organized into six teams. And, increase of 4 staff in the Offsite Directorate from 11 to 15 staff, already achieved, with an overall target headcount of 18 inspectors organized into four teams (Box 1).
- 39: Calibration of benchmarks and proxies for input in risk assessment planned as joint project of four key Directorates of BSD; preparatory work included initial expanded set of indicators under discussion.
- 40: Stocktaking mission views this as essential to refine CAMELOS as a forward-looking indicator and input for escalation/response, including Pillar 2 approach.
- 41: Drafts planned for finalization during 1Q17 and were not available for review by this mission.

- Stocktaking mission complementary measures recommended:
  - a. Complete staff recruitment plan as priority, focusing on creating minimum body of risk specialists in IT, statistical experts for internal models review, and key risk control disciplines.
  - b. Advance training of new and existing staff in risk management using class lectures, professional books/publications, field work assisted target onsite reviews, and online certified program acquisition.
  - c. Design changes to risk assessment manual and CAMELOS to guide supervisors through structured risk assessment program that visualizes each risk’s drivers, intermediary and proxy indicators to approximate quantity, and target RM and control elements assessing quality (reliability, effectiveness, integrity).
  - d. Set up basic policies and procedures to implement Pillar 2 procedures and its outcome linked with formal response and escalation policy as soon as possible.

### Supervisory Activities
- Background:
  - March 2015 BCP assessment provided 10 key recommendations to strengthen supervisory approach, techniques and tools.
  - Two CPs dedicated to supervision activities were rated Largely Compliant; assessors noted reliance on onsite inspections and lack of sufficient resources for fully effective supervisory program, especially IT examination capacity.
  - BSD reports ongoing progress across recommendations and structural changes in departmental organization.
  - After finalization of AQR, BSD expects implementation of measures within its Plan on Reforms and Development to proceed more fluidly in following quarters.
- Table 2 summary of status of recommendations (supervisory approach, techniques and tools) — summary items and reported status:
  - Complete resolution assessments after transposing BRRD. — Foreign banks in draft form (local to be started)
  - Refresh the internal crisis management framework. — Supervisory Process Manuals being updated.
  - Improve information sharing across directorates of BSD. — Cross communication directory (“ALL DIR”) established.
  - Initiate communication with banks’ boards. — Key Directorates started a contact program.
  - Ensure that inspection teams do not remain static. — Rotation practices have been adopted.
  - Introduce quality assurance procedures (QAP). — A three level QAP in place, and credit card test.
  - Carry on horizontal reviews and communicate findings to banks. — System wide AQR performed in 2016.
  - Consider the use of external experts to support supervision. — Permitted through LCI Art. 80 ¶3.4 amendment
  - Upgrade systems and enable their integration for querying data. — Public procurement IT review being launched.
  - Set a committee to review supervisory processes and practices. — To be performed by the AC to de DGS.
  - Require banks ex ante notification of substantive changes. — Practice being achieved by Offsite Directorate.

*Italic line attribution:*
*Source: cr17199 - 34. In addition, the BSD is considering a number of possible actions to strengthen the supervisory regime for Concentration Risk and Large Exposures (excerpt).*

### 52.      The stocktaking mission sees additional opportunities to ensure that the measures

### cr17199 - 52.      The stocktaking mission sees additional opportunities to ensure that the measures

### Strategic oversight, multi-year action plan, and Advisory Committee (AC)
- Finding: Achieving full compliance with relevant standards is an ongoing process; adoption of a detailed multi-year action plan will help lead and monitor progress in the overall targets of the BNB’s plan of reforms.
- Recommendation: Formalize and operationalize the role of the Advisory Committee (AC) to the DG as the central locus to lead strategic change and to set reasonable time-bound targets for monitoring progress, including by considering:
  - a. Formalize the role and objectives of the AC, bifurcating operational from strategic issues.
  - b. Dedicate one session of the AC periodically (say, one per month) exclusively to strategic issues.
  - c. Select the agenda of key strategic themes to move forward (see paragraph 57).
  - d. Reasonably estimate the needs from the work load associated to the supervisory approach.
  - e. Develop a human resource management plan, including curriculum and remuneration policies.
  - f. Adopt a method to communicate supervisory risks to the GC based on risk ratings.
  - g. Adopt a process to assess how supervisory responses mitigate, contain, or resolve identified risks.
  - h. Adopt an objective Pillar 2 capital risk regime, considering progress per the above.
  - i. Develop a number of software tools to support and integrate the supervisory process.
  - j. Review current key risk indicators for assessing risk quantities and the regime for their use.
  - k. Update supervisory manuals to the decisions on the above strategic themes, inter-alia.
- Implementation note: The Table of Key Measures of the Plan could be made more granular using a detailed template anchored in the detailed recommendations of the March 2015 BCP assessment, with adequate Project Management Organization (PMO) tools (activities, timing, responsibilities, output, etc.).

### Operational tools, sampling, and onsite efficiency
- Finding: Loan coverage during inspection is high generally due to concentrations in loan portfolios; sampling has not been actively used.
- Recommendations to formalize sampling policies to gain efficiency:
  - Relate portfolio coverage to scores assigned to the reliability and effectiveness of management, controls and MIS in the area.
  - Use attribute sampling to specify levels of supervisory tolerance to failures in controls operating in a concrete area or bank activity.
  - Support resource allocation decisions by resorting to third party reviews paid by banks for selected areas, under terms of reference and control of the BSD, when the level of errors identified exceed the policy thresholds adopted by policy.

### Strategic themes for supervisory approach and model design
- Recommendation: Determine strategic direction ex ante to realign supervisory process, methodologies, and manuals, and internalize EBA’s SREP guidelines (EBA/GL/2014/13) adapted to the Bulgarian context and BNB resources.
- Strategic themes to consider:
  - a. Possibility of bifurcating the supervisory model for local subsidiaries of well-rated EU banking groups to reduce dependence on intensive onsite activities (only if risk assessments warrant).
  - b. Risk-focusing onsite inspection model for local banking groups with varying reliability in internal governance, requiring improvements that are ‘costed’ via profit and loss.
  - c. Adopt means and processes to formalize supervisory strategies for each type of bank and industry segment, including template reports and follow-up procedures, with sufficient resources for in-depth onsite monitoring of internal governance measures.
  - d. Accommodate incremental workload via development of tools in progress, including use of service providers for ad hoc specialized reviews or assisted inspections.
  - e. Formalize an internal supervisory escalation policy and response regime.
  - f. Improve risk-assessment process and guidance to ensure a granular view of qualitative reliability and integrity of internal governance building blocks.
  - g. Track progress in institutional development of the BSD via selected targets built around the suggested multi-year Action Plan, including maintaining a reasonable update of the BSD’s internal self-assessment of compliance with the BCP and selecting the moment to submit for a formal update of all Basel Core Principles.

### Asset Classification and Provisioning (Principle 18)
- Background: March 2015 BCP assessment recommendations included:
  - (i) assess and be ready to operationalize the Pillar 2 for banks demonstrating weaknesses in problem exposures;
  - (ii) consider horizontal reviews of the state of NPL management.
- Status: A Pillar 2 policy and approach remain to be developed; the comprehensive AQR (2016) assists in fulfilling recommendations and provides the basis for designing a compliant Pillar 2 approach and better compliance with CP standards through active implementation.
- AQR outcomes and supervisory actions:
  - The 2016 AQR quantified asset provisioning deficits due to IAS 39 implementation issues when applying IFRS.
  - Following ECB policy, the BNB allocated a number of provisions and adjustments via impairments through the Profit and Loss Account where they arise from issues unrelated to discretional parameters or supervisory decisions.
  - Part of the adjustments were allocated as Pillar 2 additional capital requirements and will be dealt with as part of the incoming SREP update.
  - BSD actions after the AQR:
    - Seven banks with minor asset quality issues: recommended to enhance credit risk management procedures, recalibrate collective provisioning methodologies, and review business models.
    - Three banks with higher impact adjustments: implementing remedial plans under formal BSD orders, including actions, targets for explicit loan workout, provisioning, and capital conservation measures.
  - Recommendation: Close follow-up of risk-mitigation activities via 2017 inspection plans and readiness to escalate supervisory intervention stance.

### Box 1 — Asset Quality Review (AQR) (summary of AQR method and results)
- Method and process features:
  - Larger than usual coverage due to target sampling, including possible related-party transactions.
  - Possibly more discretional collateral valuation to account for local market characteristics.
  - Relatively lower disclosure compared to the ECB (e.g., less detailed breakdowns of adjustments).
  - A well-crafted PMO and QA process with ultimate oversight on behalf of the BNB’s CMPO by Deloitte & Touch.
  - Participation by representatives of the EU’s DG Commission and EBA as members of the steering committee.
  - Rich, well organized, auditable working papers documentation.
  - Final long report of the service providers for each bank reviewed, including follow-up suggestions.
- Quantitative result:
  - The AQR resulted in aggregate adjustments, as per IFRS accounting policies, of BGN 665 million to be reflected in the banks’ financial statements as of December 31, 2016, after taking into consideration events after December 31, 2015.
  - The BNB requested recovery plans for three banks whose CET1 was likely to fall below the minimum buffers, aimed at restoring minimum capital buffers by June 30, 2017 at the latest.
  - One bank already restored buffer coverage by raising needed capital; two others are subject to capital raising plans.
- Follow-up:
  - AQR largely achieved its purpose and is being followed up with remediation orders, ad hoc offsite reports, and a broad program of inspections for 2017.
  - Major task: calibrate Pillar II policies, processes, and capital buffers, taking into account projection of findings and ST results regarding sustainability of business models and conservatism of collective provisioning and collateral valuation in gone-concern nonperforming corporate loans.

### Using AQR findings to strengthen IAS 39/IFRS 9 readiness and supervisory tools
- Recommendations and actions:
  - a. Expand scope of guidance and dialogue on implementing impairment accounting principles in practice, notably to prepare for the introduction of IFRS 9.
  - b. Use findings from the AQR to build guidance (e.g., collective provisioning) and enrich the corporate database.
  - c. Enhance NPL reporting on interest performance (accruals vs. cash interest) for FINREP 19, including via the corporate database.
  - d. Once adopted, use the SREP more actively to set supervisory target thresholds for provisioning.
  - e. Provide supervisory guidance for write-downs and to start up market price discovery.
  - f. Further train BSD staff for IFRS 9 and start systematic dialogue with banks and auditors.

### Financial Reporting and External Audit (Core Principle 27) and Abuse of Financial Services (Core Principle 29)
- Background: March 2015 BCP assessment recommendations:
  - (i) ensure BNB’s ability to change and rotate auditors and gain access to working papers;
  - (ii) establish framework for regular dialogue with audit professionals, including on implementing IFRS 9;
  - (iii) perform skills mapping and needs assessment for BNB staff on IFRS understanding.
- Legislative and supervisory developments:
  - Draft Statutory Law on Audit (when approved) will require compulsory rotation of the audit firm every seven years and reduce the term of rotation of the audit partner from seven to four years.
  - BNB has banned a major audit firm and recently objected to an auditor’s nomination using authority under LCI Article 76, paragraphs 4 and 6.
  - BNB still lacks explicit powers to gain access to audit documentation and working papers.
  - BNB intends to comply by March 31, 2017, with upcoming EBA Guidelines on communication between competent authorities and auditors.
  - In connection with the AQR, Supervisory Policy Directorate developed IFRS memos for staff on key topics (currently available in Bulgarian).
- Practical implementation activities recommended to enhance external audit value for prudential supervision:
  - a. Singling out assessment of external audit reliability and effectiveness as part of the identified component within the risk assessment.
  - b. Ensure supervisory Boards and Audit Committees understand audit relevance for systemic stability and systematically grant BNB supervisors access to audit engagement/work plans ex ante, and management letters and working papers ex post, for risk assessment purposes.
  - c. Select proxy indicators to approximate intensity and effectiveness of audit programs to support risk assessment (examples provided in footnote 58).
  - d. Conduct an annual formal meeting with each bank’s audit firm to discuss supervisory-relevant issues and the auditor’s views on audit contract and plan coverage.
  - e. Host an annual meeting with audit professionals on ongoing and nascent topics (e.g., IFRS 9 implementation) to provide supervisory guidance on asset valuation and revenue recognition.
  - f. Review the structure of the long report format to focus on key areas (detailed opinion on internal controls in working papers, attribute testing results, scope of IT issues, operational risk aspects).

*Source: cr17199 - 52.      The stocktaking mission sees additional opportunities to ensure that the measures*

### 62.      Background. In 2015, BCP assessors identified several areas where further progress was

### cr17199 - 62.      Background. In 2015, BCP assessors identified several areas where further progress was

### Background and Key Findings (2015 assessment)
- In 2015, BCP assessors identified several areas where further progress was deemed necessary.
- The then Special Supervision Directorate (SSD) had been assigned many activities not related to supervision, including transparency of banking products, which assessors judged distracted SSD from its core AML/CFT mandate.
- Limited cooperation and information exchange existed between the Supervision of Credit Institutions Directorate and the SSD.
- AML/CFT issues were not integrated into the overall supervisory review and evaluation process.
- No sanctions had been applied by the BNB for AML matters and very few by the FID.
- Banks’ practices to establish the true identity of their customers, especially for legal entities located overseas with undisclosed UBO, were found to be questionable.
- Post-BCP mission, several initiatives were taken by the BNB to address these issues; other aspects remained unresolved.

*Authorities’ claim*: the BNB managed to obtain all necessary information in relation to these companies and that they are no longer worried about transparency in these banks.

### Structural and Organizational Reforms
- Creation of AMBRU to segregate consumer protection-related work from AML/CFT oversight within the same department.
- Unit name changed to “AML and Other Specific Supervisory Activities” to emphasize tasks entrusted to the AML/CFT Unit.
- SSD renamed to “Specific Supervisory Activities” (SSA) to avoid confusion with the special supervision regime under the Law on Credit Institutions, as recommended by BCP assessors.

### Staffing and Capacity
- AMBRU staffed with four specialists, including two staff who previously exercised AML duties; consideration underway to increase staff number to six to cope with additional workload on increasing transparency of banking products.
- AML/CFT Unit headcount increased from five to nine, mostly via external recruitments.
  - Note: Seven people were assigned to AML in 2015, but two of them were remapped to AMBRU in 2016.
  - Of the recent recruits: one staff has an academic background, while the other three possess AML experience in banks.
- By assigning non-AML related activities to AMBRU and increasing manpower, BNB aims to allow SSA to better exercise its core AML mandate.

### Internal Processes and Methodology Development
- Newly established advisory council to the deputy governor for supervision (all heads of directorates, including AML) provides collegial forum to discuss integrity concerns, changes in shareholders’ structure, outcomes of AML inspections, and corrective measures.
- SSA revising AML/CFT oversight methodology to reflect latest changes in the EBA guidelines and in the fourth EU directive on AML/CFT (adopted in May 2015), which will lead to a revision of the Bulgarian AML law.
  - One prominent change: a definition of the UBO consistent with the EU directive, as the current law’s definition is still imperfect.

### Onsite and Offsite Work Issues
- Onsite inspection for AML/CFT purposes continues to be performed together with monitoring of business practices in consumer lending; outcomes of both work streams are consolidated into a single inspection report (noted as unusual in 2015).
- BSD indicates AML inspection findings are communicated to both the Onsite and the Offsite Directorates and therefore reflected in the CAMELOS rating.
- Inspection report is not shared outside the AML/CFT unit of the SSA because information on Suspicious Transaction Reports are confidential; SSA staff prohibited by law to share this information even within the BSD.

### UBO Identification Challenges and Recommendations
- Banks request documents per Article 6 of the AML Act (for legal entities: certificate of incorporation and list of registered shareholders).
- As a last-resort, banks may request the applicant to complete a simple declaration and compare information with the trade registry.
- Trade registry provides limited information: names of companies, address, activity, and Board composition; no shareholder details for joint-stock companies with more than one shareholder.
- As a result, banks continue to have problems identifying who is truly behind a legal entity.
- Mission advice (observations suggested by assessors):
  - Reinforce practice by requiring an affidavit before a notary from an appropriate senior officer of the legal entity, including a declaration of UBO and related parties, and committing to provide the bank all necessary information to comply with AML provisions at any time.
  - Perjury, falsehood, and lack of collaboration resulting from the affidavit declaration should be typified as a crime under the AML Law, including typifying the use of third interposed parties to circumvent the Act.

### Offshore Law and Ownership Transparency
- Enactment of the Offshore Law (Act for Economic and Financial Relations with Companies Registered in Jurisdictions with Preferential Tax Regime, their Related Parties and Beneficial Owners, July 2016) requires offshore companies that participate (or intend to participate) directly or indirectly in a restricted entity to:
  - register with the Bulgarian Commercial Register and disclose their beneficial owners; and
  - provide the Commercial Register with information about all companies under their control that also participate in a restricted entity.
- Assessment:
  - Law is welcome, but current regime appears more stringent on foreign entities and companies than on Bulgarian companies.
  - Remaining concerns: existence of bearer shares and use of SVPs to obscure ownership.
  - BSD indicates number of companies with bearer shares is very low, about 1,800 entities—a number seen as immaterial compared to the total number of registered companies.

### BSD Supervisory Development Plan (selected reforms and status)
- Governance Model
  - 1.1 Council’s decision on rules & guidelines — CP2 — Underway — 1Q2017 — To be approved
  - 1.2 Annual internal audit — CP2 — Underway — Annual — The first annual audit has started in 10/16 — On-going
  - 1.3 Quarterly report to Governing Council — CP2 — Implemented — Quart. — Two quarterly reports already delivered — On going
- BSD’s Internal Organization
  - 2.1 New Offsite Directorate — CP2 — Implemented — 10/15 — Directorate fully functional — Achieved
  - 2.2 Advisory council (AC) to Deputy Director — CP2 — Underway — 10/15 — AC’s mandate, role and functions pending — To be formalized
  - 2.3 Increase to “6” inspection teams — CP2 — Underway — 12/15 — Teams formed but complete staffing pending — In progress
  - 2.4 Set Market Conduct Risk Division — CP2 — Implemented — 12/15 — AML inspection segregated and operational — Achieved
- Regulatory Framework
  - 3.1 Drafting legislative amendments — Several — Underway — 03/16 — Some amendments made, others pending — In progress
  - 3.2 Conduct full review of Ordinances — Several — Underway — 2017 — Reviews pending publication of EBA Guidelines — In progress
  - 3.3 Adopt BSS SREP Manual aligned to EBA — CP8-9 — Implemented — 4Q17 — SREP being drafted - Pillar 2 to be designed — In progress
- CMG Framework and other items noted with targets and statuses (see plan for full list).

Notes on timelines:
- Tentative list of amendments of LCI and Ordinances pending; target dates provided as indicative during the mission.
- Decision by the GC to approve key policies and procedures was adopted in 2015.
- Approval by the GC of the new Banking Supervision Process Manual is expected in February 2017; further policies and procedures to follow during 2017.

### Progress on March 2015 BCP Assessment Recommendations (selected)
- CP 01 – Responsibilities, objectives and powers
  - Refocus the activities of the SSD — High — Achieved through the Plan on Reforms (PoR)
  - Empower BNB to request changes in organization/officers — High — Achieved through amendments to the LIC (art. 103)
- CP 02 – Independence, accountability, resourcing and legal protection
  - Revise internal governance design of BNB-BSD — High — Achieved through the PoR (full effectiveness to be monitored)
  - Ensure Council is timely informed to take decisions — High — Achieved through new quarterly report
  - Increase resource allocation, skill set and IT toolkit — Medium — Additional staffing in progress and IT review starting
  - Map skills and adopt a strategy to address any gaps — Low — Skills mapping pending and workload to be estimated
  - Ensure BNB will cover legal costs of staff if needed — Low — BNB disagrees with the recommendation
- CP 11 – Corrective and sanctioning powers of supervisors
  - Set internal guidelines to assist decisions of the DG — Low — Enforcement policies to be drafted
  - Apply gradual response for lack of compliance — Pending — Based on recent examples as per AQR results
  - Take more forceful actions against persistent offenders — Pending — To be confirmed through further case practice
  - Broaden grounds to initiate Special Supervision — High — Through adoption of the RRL law (Response policy pending)
- CP 14 – Corporate governance (selected)
  - Empower BNB to require changes of board members — Medium — Through amendments of the LCI but not yet used
  - Require notification of F&P issues — Low — To be confirmed
  - Refresh Ordinance 10 with requirements and expectations — Low — Amendments pending to revision of EBA guidelines
  - Conduct more frequent assessments (horizontal reviews) — Low — AQR provides first insights
  - Expand guidance in the RAS manual for assessments — Low — SREP and manual pending to adapt to EBA

(Additional CP recommendations and progress statuses are listed in the source material, including CP 19, CP 20, CP 21, CP 27.)

### Proposed Official Presumption Criteria (summary of attributes indicating related-party or non-arm’s-length transactions)
- By nature of relationships
  - Exclusivity (e.g., no other financial institutions lending; no credit history with other FIs)
  - Economic dependence (e.g., revenues from bank or related parties; nominee or shell companies)
  - Common infrastructure (e.g., common addresses, IT, managers, legal advisors, suppliers)
  - Lack of transparency (e.g., opaque ownership structure; UBO unknown; non-cooperation with BNB; offshore incorporations without economic reason)
- By nature of transactions
  - Purpose/use of funds inconsistent with stated activity or used by related parties
  - Documentation deficiencies (missing or inconsistent documentation)
  - Underwriting standards lacking or inconsistent with arm’s-length terms
  - Indebtedness and creditworthiness concerns (loans unlikely to be repaid; credit quality below bank’s minimum)
  - Internal controls weaknesses (procedural deviations, negative or missing Risk Department opinion, excessive exposures beyond internal limits)
  - Interest rates, fees, and pricing markedly different from market for similar counterparties
  - Collateral and guarantees issues (provided by bank or related parties; insufficient or improperly registered collateral; improper classification or provisioning)

*BULGARIA — INTERNATIONAL MONETARY FUND*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2017/cr17199.pdf_