## cr18340 ## Source details **Canonical URL:** [cr18340](https://www.imf.org/-/media/files/publications/cr/2018/cr18340.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2018/cr18340.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2018/cr18340.pdf.json) --- ### Summary and Key Findings - The Central Bank of Brazil (BCB) has shown determined commitment to enhancing banking supervision standards and practices, emphasizing integration across internal operations and expectations for financial institutions. - Notable developments: - Contagion analysis at systemic and firm level embedded in supervision. - Boosting staff levels in conduct supervision. - Introduction of a form of twin peaks. - Adoption of the prudential conglomerate approach (Resolution 4280). - Assessment against Basel Core Principles (BCPs, BCBS September 2012 methodology): - Revised BCPs contain 247 separate essential and additional criteria; the BCB was assessed on both essential and additional criteria. - High degree of compliance overall, with notable gaps: - Lack of formal legal independence and legal protections for BCB staff; Governor removable “for any reason and without the cause being stated.” - Supervisory practices can be cautious and protracted; pending legislation expected to improve flexibility and speed. - Solo supervision of banks was dis-applied historically; recommendation to re-instate solo-level oversight alongside conglomerate-level oversight. - Gaps in supervisory data at solo level and for some prudential aspects. - Prudential framework highlights: - Tiered/segment approach aligns supervisory expectations with institution complexity and systemic relevance. - Enforcement of capital adequacy, liquidity, large exposures at prudential conglomerate level; some requirements more conservative than Basel. - Areas for improvement: concentration risk beyond counterparty concentration, related party norms, guidance for country and transfer risk. - Supervisory resourcing and cycles: - S1 institutions: supervisory cycle is one year; S3 and S4: up to three-year cycle unless specific issues identified. - Corporate law allows unlisted small banks to operate without a non-executive board and, when small, without an audit committee. ### Introduction and Assessment Methodology - Assessment context: - Part of 2017 FSAP update; mission October 30th–November 21st, 2017. - Ratings not directly comparable to previous assessments due to revised BCP methodology (BCBS, September 2012). - Team activities: - Reviewed laws, rules, guidance; extensive meetings with BCB, MoF, auditing firms, banking participants. - Authorities provided a comprehensive self-assessment and detailed questionnaires; cooperation rated “very high quality.” - Proportionality: - Evaluations conducted in context of Brazil’s financial system sophistication and complexity; CPs employ proportionate approach. ### Institutional and Market Structure — Overview - Legal and institutional framework: - Banking Law (Law 4,595, of 1964) established SFN, National Monetary Council (CMN) and BCB. - CMN composition: Minister of Finance (Chair); Minister of Planning, Development and Management; Governor of the BCB. - CMN issues Resolutions; BCB issues Circulars; CMN does not have supervisory powers. - Regulatory structure: - Four sectoral regulators under CMN: CVM, BCB, SUSEP, PREVIC. - BCB is single prudential supervisory authority of the banking system; CVM and BCB share regulatory authority over financial intermediaries. - Market concentration and interconnectedness (data as at June 2016): - The six largest banks account for almost 70 percent of the financial system and nearly 94 percent of GDP. - Largest 13 banks account for 88 percent of the financial system and 119 percent of GDP. - Six largest banks account for nearly 96 percent of international activity. - Key system-wide indicators (end 2016 / March 2017): - System-wide capitalization at end-2016: 11.5 percent CET1 and 16.1 percent total capital. - Minimum regulatory requirements: 4.5 percent CET1 and 11 percent total capital. - Problem assets in total loans to non-financial corporates: doubled in two years to 8 percent. - Household problem assets reached their highest level since 2013. - ROE for the banking sector at end March 2017: 13.3 percent (compared with 22.8 percent at last FSAP). - Bank counts by ownership (Totals): - Total banks: 2012 Dec 160 / 2013 Dec 155 / 2014 Dec 153 / 2015 Dec 154 / 2016 Dec 155. - Public banks: 9 / 9 / 10 / 10 / 10. - Private banks: 151 / 146 / 143 / 144 / 145 (breakdowns by national/foreign participation provided in source). ### Preconditions for Effective Banking Supervision - Macroeconomic context: - From beginning of 2015 through 2017, real output contracted by nearly 8 percent cumulatively. - Around 3 million formal jobs lost; unemployment rate almost doubled. - Government passed law to cap growth in federal noninterest spending in real terms; structural problems remain a threat to fiscal sustainability. - National elections scheduled for 2018. - Financial stability policy system: - “Well-Established Financial Stability Policy System” with BCB in leadership role due to data capacity and bank-centric system. ### Roles, Coordination, Legal Framework and Data Infrastructure - Roles and coordination: - BCB and CMN central in macroprudential policy; COREMEC (BCB, CVM, Susep, Previc) provides consultative coordination. - Legal framework and dispute resolution: - Law 4,595 defines CMN and BCB roles; Code of Civil Procedure (2016) modernized dispute resolution; approximately 74 million suits awaiting judgment at end 2015. - Accounting, auditing and reporting: - Federal Accounting Council (CFC) approves Accounting Norms (NBC) based on ISA as of end 2010. - Cosif accounting standards require semi-annual solo financial statements and disclosure; Circular 3,678 prescribes risk management and regulatory capital disclosures. - Consolidated IFRS statements required for publicly listed financial institutions and entities required to establish an Audit Committee. - Credit reporting: - Three main credit bureaux: SPC, Serasa Experian and Boa Vista – SCPC. - BCB’s Credit Information System (SCR): reporting threshold lowered to R$200 in 2016. - New credit scoring company (GIC) launched by five large banks received conditional approval in June 2016; expected operational around 2020 (per source). - Public statistics: - Main data providers: BCB and IBGE; Financial Stability Report published semi-annually. ### Crisis Management, Resolution and Public Safety Net - Resolution authority: - BCB sole resolution authority for non-state owned banks; state-owned (federal) banks not subject to resolution. - Resolution powers based on Law 6,024, Decree-Law 2,321 and Law 9,447. - Emergency liquidity assistance: - BCB discretion to provide ELAs with maturities up to 359 days; longer maturities require Ministry of Finance/Government liaison under Fiscal Responsibility Law (Complementary Law 101, Article 28, paragraph 2). - Deposit insurance: - Deposit insurance provided by FGC and FGCoop; coverage up to R$250,000 per investor. - Ordinary monthly contribution of associated institutions: 0.0125 percent of balance of guaranteed accounts. - FGC can act as pay box and provide financial support measures as needed. - Recovery and resolution developments: - Draft Bank Resolution Bill prepared by BCB to align with FSB Key Attributes (at assessment time under consideration). - D-SIBs required to submit recovery plans (Resolution 4,502); phase-in started December 2016 and due to end July 2018. ### Supervisory Powers, Licensing and Corrective Measures (Principles 1–6, 11) - Legal basis: - Banking Law (Article 1) defines SFN; BCB exclusive authority to license banks (Art 10, Section X), conduct inspections (Art 10, Section IX) and corrective actions (Chapter V). - Laws 6,024 and 9,447 and Decree-Law 2,321 grant resolution powers. - Powers to enforce prudential standards (examples): - Resolution 4557 (mandatory risk management practices). - Resolutions 4192/4193 (Regulatory Capital definitions). - Resolution 4019 empowers wide range of preventive/ corrective measures (I–IX listed in source). - Corrective actions under Resolution 4,019 include: - Restricting activities; requiring additional capital and remediation plans; barring individuals; replacing management; facilitating takeovers; interim management; revoking licenses; imposing fines; intervention/liquidation. - Licensing (Resolution 4122, Annex I): - Six-stage process including submission of business plan, fit-and-proper assessments, technical interviews, inspections and post-inspection documentary proof. - Initial post-approval period: 180 days to meet conditions; extension of further 90 days discretionary. - Minimum initial capital amounts (EC6): - R$ 17,500,000.00 for commercial and universal banks with commercial portfolio; - R$ 12,500,000.00 for investment, development banks; - R$ 7,000,000.00 for credit, financing and investment societies, leasing, etc. - Additional R$ 6,500,000.00 for foreign exchange operations. - Independence, governance and accountability (Principle 2): - BCB described as “a semi-autonomous federal agency” (Article 8); CMN approves internal bylaws and budget. - No fixed terms for Governor or Board members; Governors removable by President (Decree 91,961, Art 1) with no reasons required. - Assessment of Principle 2: Materially Non-Compliant. - Assessment of Principle 1: Compliant. - Assessment of Principle 5: Compliant. - Assessment of Principle 11: Largely Compliant (range of powers retained; Law 13,506 passed mid-November 2017 introducing fines up to R$2bn and procedural changes). ### Cooperation, Colleges and Information Exchange (Principles 3, 13) - Domestic cooperation: - COREMEC established by Decree 5,685; formal domestic MoUs with PREVIC, CVM, RFB, SUSEP, Senacon. - Foreign cooperation: - Complementary Law 105 provides basis for MoUs; BCB had 25 MoUs with 29 foreign authorities from 23 countries and the ECB at assessment time. - Supervisory colleges hosted for Itaú-Unibanco and Banco do Brasil; participation in colleges for major foreign banks; Cross-border Cooperation Agreement for Santander Group since 2013. - Confidentiality: - MoUs require information be used only for supervisory purposes; BCB uses Complementary Law 105 protections. - Assessment of Principle 3: Compliant. - Assessment of Principle 13: Compliant. ### Supervisory Methodology: SRC, ARC and ANEF (Principle 8 & related) - SRC methodology components: - ARC (Risks and Controls Assessment) and ANEF (Economic-Financial Assessment). - ARC considers 10 risk types: Credit; Market; Liquidity; Contagion; Reputation; Strategy; Operational; IT; AML/CFT; Relationship with Customers. - ANEF assesses Solvency, Liquidity and Profitability. - Scoring and tools: - Final ARC score weighted by importance of each business/activity; results stored in SisAPS database. - Outputs feed Supervisor’s priority matrix and supervisory cycle (one year for SIFIs/high priority; three years for low priority). - Formal segmentation (Resolution 4553) into 5 segments; S1 on one-year cycle. - On-site and off-site procedures: - On-site inspections: targeted, focused or horizontal; Special Examinations (VEs) evaluate risk exposure and compliance. - Off-site continuous monitoring: SCR, DLO, DRM, DRL, Cosif and other Cadocs. - Stress testing enhancements: - Top-down and bottom-up models (TEMTD, TEBU); DESIG project initiated end-2015 to integrate stress tests into macro/micro prudential approaches. - Top-down stages: macro econometric VAR model (stage i) and dynamic panel model for NPLs (stage ii). - Contagion analysis: - Uses clearing houses and Brazilian Payments System to simulate contagion and interconnections. ### Consolidated Supervision, Prudential Conglomerate and Solo Supervision (Principle 12) - Prudential Conglomerate (Resolution 4280) concept: - Broad definition includes entities in wider group not solely linked by ownership; scope determined by BCB inclusion/exclusion powers. - Consolidated supervision: - Regulatory instruments include Circulars and Resolutions (exact lists provided in source), with capital, liquidity, large exposures and other limits applied on consolidated basis. - Information captured on consolidated basis: Cadocs 4060/4066 (Prudential Conglomerate Financial Statement), Cadoc 4343 (Foreign Consolidated), Cadoc 2061 (DLO), Cadoc 2160 (DRL), Cadoc 2060 (DRM), Cadoc 2011 (DDR). - Solo information: Cadocs 4010/4016 and Cadocs 4303/4313. - Supervisory stance on solo banks within conglomerates: - BCB does not systematically supervise solo bank on proactive basis; supervisory action on individual basis taken if necessary. - Assessment of Principle 12: Largely Compliant. - Recommendations: apply prudential framework to solo banks within conglomerates and establish thresholds for supervisory action. ### Corporate Governance, Risk Management and Model Validation (Principles 14–16) - Corporate governance: - Resolution 4557 requires board approval and annual review of risk management policies; guidance published March 2018. - Audit committee required for specified size/systemic criteria (e.g., equity ≥ 1bn reais or assets/deposits ≥ 5bn reais thresholds in source). - Assessment of Principle 14: Largely Compliant. - Risk management (Resolution CMN 4,557 of 2017): - Segmentation criteria (exact text preserved): Segment 1 includes institutions with size ≥ 10% of GDP or foreign assets ≥ USD 10 billion; Segment 2: less than 10% and ≥ 1% of GDP; Segment 3: <1% and ≥ 0.1% of GDP; Segment 4: <0.1% of GDP; Segment 5: <0.1% of GDP with optional simplified capital methodology. - Required elements: policies, systems, procedures for identification/measurement/monitoring/reporting/control and mitigation across major risk types; stress testing; business continuity; reporting to senior management and board. - Assessment of Principle 15: Compliant. - Model approval and validation: - Internal models governed by Circulars BCB 3,646–3,648; validation required at least once in three years; internal audit independent and testing requirements specified. - Four-phase internal model approval process: pre-application, documentation assessment, onsite examination (multi-team), approval by Internal Models Committee when satisfied. - Capital adequacy (Basel III implementation): - Key instruments: Resolution CMN 4,192 (2013), Resolution CMN 4,193 (2013), Circulars BCB 3,768/3,769 (2015). - Implementation status: - Basel III effective 1 October 2013; CET1 minimum 4.5 percent from 1 October 2013. - Capital regime applies in graded manner to segments S1–S5; Pillar 2 ICAAP applies to S1. - Deferred Tax Assets (DTAs): - Aggregate gross DTAs around R$280 billion; DTAs from loan loss provisions R$146 billion and constitute about 25 percent of CET1 capital. - Law No. 12,838 (July 2013) allows conversion of DTAs from loan loss provisions into DTCs when taxable income negative or bank bankrupt/subject to extra-judicial liquidation. - Assessment of Principle 16: Compliant. - Areas for improvement suggested: require solo-level capital compliance, distribution of capital within groups, establish supervisory thresholds. ### Credit Risk, Problem Assets and Provisioning (Principles 17–18) - Credit risk management: - Regulatory basis includes CMN Resolutions 3,721 (2009), 4,557 (2017), and others. - Requirements: documented policies, segregation of credit risk management, limits, monitoring, stress testing, board oversight. - SCR provides granular borrower data; supervisors conduct on-site and off-site checks. - Assessment of Principle 17: Compliant. - Problem assets and provisioning: - Revised framework (Resolution 4,557 of 2017) defines problem asset as classification ‘E’ or worse and sets rules on reclassification and forborne exposures. - Minimum provisioning matrix (days past due → provisioning) preserved exactly in source (e.g., Under 15 — AA — 0.50%; 15–30 — B — 1%; 31–60 — C — 3%; 61–90 — D — 10%; 91–120 — E — 30%; 121–150 — F — 50%; 151–180 — G — 70%; 180–360 — H — 100%; Over 360 — Transferred to Compensation Account — 100%). - Banks cannot recognize interest in P&L on loans past-due for 60 days or longer (Resolution CMN 2,682/1999). - Supervisory methodologies: Cash-Flow Analysis and Massive Analysis to test classification/provisioning adequacy. - Assessment of Principle 18: Largely Compliant. - Areas for improvement (verbatim from source): - Clear definition of “exposure” to include OBS exposures, securities and other amounts due; - Clear norms for reclassification of problem/restructured assets; - Explicit requirement to adopt expected loss approach for all exposure types; - Harmonize norms irrespective of maturity; - Establish explicit norms for collateral eligibility and valuation; - Articulate board responsibilities for oversight of problem assets; - Introduce periodical reporting on asset classification and provisioning. ### Concentration Risk, Large Exposures and Related Parties (Principles 19–20) - Concentration risk and large exposures: - Revised regulation (Resolution CMN 4,557) improves definition and management of concentration risk. - Prudential exposure limits (as percent of regulatory capital) preserved from source: - Single private sector counterparty: 25 - Group of connected private sector counterparties: 25 - Single public sector counterparty: 25 - Group of connected Federal public sector counterparties: 45 (excludes exposure to the federal government) - Group of State and state related public sector counterparties: 45 - Group of Municipal and municipality related public sector counterparties: 45 - Aggregate large exposures: 600 - Foreign currency/gold net exposure limit: 30% of Regulatory Capital (Res. CMN 3,488 of 2007). - Assessment of Principle 19: Largely Compliant. - Areas for improvement: define “exposure” explicitly, review collateral exemptions, consider Tier 1 as reference, apply framework to solo banks, introduce periodical reporting on concentration exposures. - Transactions with related parties: - Legal/regulatory gaps: no full prudential definition/list of related parties; prior prohibitions on loans to related parties revoked and reinstated with amendments (Law 13,506 of 2017); post-amendment operations allowed under market-compatible conditions with safeguards. - Supervisory practice: use SCR, Unicad and TRs to identify related-party transactions; seven Punitive Administrative Processes (PAP) since 2012 for violations. - Assessment of Principle 20: Materially Non-Compliant. - Verbatim recommended actions (selected): - Enhanced Board oversight requirements for related party exposures; - Explicit definition/list of “related parties” and “related party transactions” for prudential purposes; - Introduce prudential limit for aggregate exposures to related parties; - Periodical focused reporting by supervised institutions on exposures, transactions, exceptions and write-offs; - Apply prudential framework to solo banks within prudential conglomerates; - Improve supervisory manual accordingly. ### Country and Transfer Risk (Principle 21) - Findings: - Country and transfer risks treated as components of credit risk but regulations do not align fully with Basel definition; immediate/direct exposure focus rather than “ultimate risk” perspective. - Regulatory and supervisory requirements lack explicit standalone policies/processes for identification, measurement, monitoring and mitigation of country and transfer risks. - Assessment of Principle 21: Materially Non-Compliant. - Verbatim recommended actions: - Revise definition of country risk to align with Basel and adopt “ultimate risk” approach; - Issue explicit regulations for identification, measurement, monitoring and management including grading and provisioning distinct from counterparty risk; - Extend “ultimate risk” approach to branches and group entities abroad; - Introduce prudential reporting requirements to monitor exposures to these risks; - Improve supervisory manual and apply elements to solo banks within prudential conglomerates. ### Market Risk, IRRBB and Liquidity (Principles 22–24) - Market risk (Principle 22): - Trading book and main instruments: government bonds, repos, BRL/USD futures, DI futures, swaps. - Market risk composition (As of December 2016, share in RWA): - interest rate risk: 57.8 percent - foreign exchange: 28.6 percent - credit risk and other exposures: 13.2 percent - equity price: 0.6 percent - commodities: 0.04 percent - Assessment of Principle 22: Compliant. - Recommendation: review market risk frameworks in relevant S3 and S4 banks more frequently; issue explicit guidance for shifting exposures between trading and banking book. - Interest rate risk in the banking book (IRRBB, Principle 23): - Revised rules (Resolution CMN 4,557) require both Economic Value (EVA) and Earnings-Based (EBA) approaches for S1, S2, S3. - Measurement requirements: quarterly EVA using shocks corresponding to 1st and 99th percentiles of five-year historical distribution; banks to estimate basis point shocks leading to 5%, 10% and 20% reductions of Total Capital (Circular BCB 3,365 of 2007). - Assessment of Principle 23: Compliant. - Liquidity risk (Principle 24): - LCR: Resolution CMN 4,401 and Circular 3,749 of 2015; phased implementation: 60% in 2015, 70% in 2016, 80% in 2017, 90% in 2018, and 100% by January 2019; applied at prudential conglomerate level. - NSFR: BCB working toward implementation; draft regulation and impact studies underway. - Supervisory tools: SMM, LCR by currency, ELR, LCR proxy for non-LCR banks. - Assessment of Principle 24: Compliant. ### Operational Risk, Internal Control, Audit and Reporting (Principles 25–29) - Operational risk (Principle 25): - Legal/regulatory basis updated via Resolution CMN 4,557 (effective Aug 2017 for S1; Feb 2018 for others). - Key quantitative finding: legal risk ~70 percent of operational risk losses; external fraud ~20 percent. - Assessment: Largely Compliant. - Areas for improvement: standardized internal loss data compilation and periodical reporting; cybersecurity regulation and prompt reporting. - Internal control and audit (Principle 26): - Resolutions CMN 4,588 and 4,595 effective Dec 31, 2017 introduced prescriptive internal audit and compliance requirements. - Concern: many unlisted banks not required to have non-executive boards or audit committees; supervision to pay greater attention to these banks. - Assessment: Largely Compliant. - Financial reporting and external audit (Principle 27): - COSIF and IFRS alignment; semi-annual solo disclosures required; external auditors registered with CVM; supervisor can require complementary examinations and access working papers. - Assessment: Compliant. - Disclosure and transparency (Principle 28): - Semi-annual solo and consolidated disclosures; Pillar 3 (Circular 3,678) quantitative updates quarterly and qualitative annually; LCR and leverage ratio disclosures per regulations. - Assessment: Compliant. - AML/CFT (Principle 29): - Legal basis: Law 9,613; Circular 3461 requires AML/CFT policies and senior manager nomination; COAF is FIU. - Supervisory approach: twin peaks with DECON/AML differentiation; 28 institutions under continuous conduct monitoring (ACC); remote monitoring (ICR/IDR) for others. - Reporting statistics to COAF (Table 9): - 2014: Total 32,009; 2015: 43,217; 2016: 53,002; 2017 (as of June 28): 26,473; Aggregate total: 154,701. - Average grade of reports to COAF (Table 10): 2014 3,7 / 2015 3,7 / 2016 3,8 / 2017 (as of June 28) 4,5. - Assessment of Principle 29: Largely Compliant. - Recommendations: deepen KYC effectiveness testing, improve reporting requirements, faster remedial/enforcement timelines, more outreach/guidance. ### Supervisory Assessments and Grades (selected CPs) - CP1 Responsibilities, objectives and powers: Compliant. - CP2 Independence, accountability, resourcing and legal protection for supervisors: Materially Non-Compliant. - CP3 Cooperation and collaboration: Compliant. - CP4 Permissible activities: Compliant. - CP5 Licensing criteria: Compliant. - CP6 Transfer of significant ownership: Compliant. - CP7 Major acquisitions: Compliant. - CP8 Supervisory approach: Largely Compliant. - CP9 Supervisory techniques and tools: Compliant. - CP10 Supervisory reporting: Compliant (gap: require solo prudential returns for all banks). - CP11 Corrective and sanctioning powers: Largely Compliant. - CP12 Consolidated supervision: Largely Compliant. - CP13 Home-host relationships: Compliant. - CP14 Corporate governance: Largely Compliant. - CP15 Risk management process: Compliant. - CP16 Capital adequacy: Compliant. - CP17 Credit risk: Compliant. - CP18 Problem assets, provisioning and reserves: Largely Compliant. - CP19 Concentration risk and large exposures: Largely Compliant. - CP20 Transactions with related parties: Materially Non-Compliant. - CP21 Country and transfer risks: Materially Non-Compliant. - CP22 Market risk: Compliant. - CP23 IRRBB: Compliant. - CP24 Liquidity risk: Compliant. - CP25 Operational risk: Largely Compliant. - CP26 Internal control and audit: Largely Compliant. - CP27 Financial reporting and external audit: Compliant. - CP28 Disclosure and transparency: Compliant. - CP29 Abuse of financial services (AML/CFT): Largely Compliant. ### Key Recommendations (verbatim and selected from source) - Principle 20 (related parties): - Introduce enhanced and explicit Board oversight requirements for related party exposures and transactions. - Provide explicit definition/list of “related parties” and “related party transactions” for prudential purposes. - Introduce a prudential limit for aggregate exposures to related parties. - Introduce periodical focused reporting on exposures, transactions, exceptions and write-offs. - Apply framework to solo banks within prudential conglomerates; improve supervisory manual. - Principle 21 (country and transfer risk): - Revise definition of country risk to align with Basel and adopt “ultimate risk” approach. - Issue explicit regulations on identification/measurement/monitoring/management and provision guidance distinct from counterparty risk. - Introduce prudential reporting requirements and apply to solo banks in conglomerates. - Other selected actions: - Principle 22: review market risk frameworks in S3/S4 banks more frequently; issue guidance on trading/banking book shifts. - Principle 25: standardize internal loss data reporting and cybersecurity reporting. - Principle 26: increase supervisory focus on internal control/compliance/internal audit in unlisted banks. - Principle 29: deepen effective KYC testing and speed up remedial/enforcement actions; complete BCB access to RFB database for beneficial owner verification. ### Authorities’ Response (selected highlights) - Authorities express support for FSAP, commit to adopt many recommendations, and note recent regulatory advances not fully reflected in assessment (e.g., Resolution 4,557 of 2017, Resolutions 4,588 and 4,595 effective Dec 31, 2017). - On independence: authorities disagree with some staff characterizations; note de facto operational independence and procedural accountability. - On corrective powers and AML/CFT: authorities defend remote inspection methodology and moral suasion; note Law 13,506 (Nov 13, 2017) improving sanction procedures and timelines. - On problem assets and provisioning: authorities state Brazilian framework requires expected loss approach and are implementing IFRS9-aligned rules; draft rules replacing Resolution 2,682 in public consultation with final rules expected in 2018. - On concentration and large exposures: authorities plan revisions replacing Resolution 2,844 to align with BCBS 283; consultative document published Feb 9, 2018. - On related parties: authorities note Law 13,506 amended rules and plan supervisory/regulatory adjustments including disclosure requirements (Resolution 4,636 of 2018) and prudential limits applied more broadly. - On country and transfer risks: authorities consider exposures low and will address clarity and reporting in IFRS9-implementing regulation. *Detailed Assessment prepared by Katharine Seal, IMF and Damodaran Krishnamurti, World Bank. Source: Detailed Assessment Report (FSAP update mission October 30th–November 21st, 2017).* ### INTRODUCTION AND METHODOLOGY ________________________________________________________ 6 ### INTRODUCTION AND METHODOLOGY ### Summary and Key Findings - The Central Bank of Brazil (BCB) has shown a determined commitment to enhancing its standards and practices of banking supervision, guided by the principle of integration across internal operations and expectations for financial institutions. - Examples of recent developments include: - Innovative and challenging work in contagion analysis at the systemic level and embedding contagion risk analysis at firm level. - Boosting staff levels in conduct supervision. - Introduction of a form of twin peaks. - Adoption of the prudential conglomerate approach. - The BCB has achieved a high degree of compliance with the Basel Core Principles for Effective Banking Supervision (BCPs), assessed against the BCP methodology issued by the Basel Committee on Banking Supervision (BCBS) in September 2012. - The revised BCPs contain 247 separate essential and additional criteria. - The BCB was assessed on both essential and additional criteria. - Noted gaps and shortcomings: - Lack of formal legal independence and legal protections for BCB staff; operational independence exists but without statutory protection. - The Governor of the BCB can be dismissed “for any reason and without the cause being stated,” creating potential vulnerability. - Supervisory practices can be cautious and protracted; passage of pending legislation at the time of the mission was expected to improve the flexibility and speed of supervisory actions. - Solo supervision of banks was dis-applied following the last FSAP; the prudential conglomerate concept (Resolution 4280) is valuable, but oversight of individual banking institutions at the solo level should be re-instated alongside conglomerate-level oversight. - Extensive use of data by the BCB is a strength but risks complacency by banks if the onus is not kept on banks to manage, monitor and report their own risks; there are gaps in supervisory data at solo level and in respect of some prudential aspects. - Prudential framework and supervisory approach: - The regulatory and supervisory frameworks promote risk management culture and require compliance with key elements: identify, measure, monitor and manage. - Adoption of a tiered or “segment” approach aligns supervisory expectations with institution complexity and systemic relevance. - Regulations explicitly set expectations for credit, market, operational and liquidity risk management and related governance. - Recovery and resolution work for large banks is progressing; stress testing and contingency planning requirements support resilience across other banks. - The BCB enforces key prudential requirements (capital adequacy, liquidity, large exposures) at the prudential conglomerate level, generally consistent with international standards though some requirements are more conservative. - Areas for improvement include: - Nuanced approach to concentration risk beyond counterparty risk concentration. - Strengthening norms for related party transactions. - Guidance for country and transfer risk management in supervised institutions. - Supervisory resourcing and cycles: - Emphasis on large institutions: for S1 (large and internationally active) institutions the supervisory cycle is one year; for smaller banks (S3 and S4) it can be a three-year cycle unless specific issues are identified. - Corporate law allows unlisted small banks to operate without a non-executive board of directors and, when small, without an audit committee; shareholders can constitute senior management. This may require nuanced allocation of supervisory resources to small banks. ### Introduction and Assessment Methodology - The assessment is part of the 2017 FSAP update and was completed by the IMF and World Bank; the BCP assessment mission took place from October 30th to November 21st, 2017. - Ratings in this assessment are not directly comparable to previous assessments due to the revised BCP methodology (BCBS, September 2012) and substantive changes. - The 2012 revision of the Core Principles: - Sought to reflect lessons from the global financial crisis and raise the bar for sound supervision. - Added new principles and new essential criteria for each principle, increasing detail and expectations. - Placed heightened focus on the actual use of supervisory powers and a forward-looking approach through early intervention. - The assessment team: - Reviewed laws, rules, guidance and held extensive meetings with BCB, Ministry of Finance (MoF), auditing firms, and banking sector participants. - Received a comprehensive self-assessment and detailed questionnaire responses from the authorities. - Noted “very high quality of cooperation” from the authorities. - Proportionality and context: - Evaluations were conducted in context of Brazil’s financial system sophistication and complexity. - The CPs employ a proportionate approach; supervisory practices and expectations should be commensurate with complexity, interconnectedness, size, risk profile, and cross-border operations of banks. - Assessments require judgment and are not exact; they provide an internationally consistent measure of supervisory quality relative to the revised CPs. ### Institutional and Market Structure — Overview - Legal and institutional framework: - The Brazilian national financial system (SFN) was established under Banking Law (Law 4,595, of 1964), creating the National Monetary Council (Conselho Monetário Nacional—CMN) and the Central Bank of Brazil (BCB). - The CMN is the highest decision-making body of the SFN, responsible for formulating monetary and credit policy, aiming at price stability and social and economic development. - CMN composition: i) the Minister of Finance, as Chair; ii) the Minister of Planning, Development and Management; iii) the Governor of the BCB. The BCB acts as the permanent executive secretariat of the CMN. - Policy proposals—most from the BCB—are debated by the Technical Commission on Currency and Credit (Comoc), which also includes the President of the CVM. - The CMN issues Resolutions (general framework); the BCB issues Circulars (calibrate requirements and methodological details). The CMN does not have supervisory powers. - Regulatory structure: - Four sectoral regulators function under the CMN: - CVM (securities) - BCB (prudential & financial institution supervision) - SUSEP (insurance) - PREVIC (pension) - The BCB is the single prudential supervisory authority of the banking system. - CVM and BCB share regulatory authority over financial intermediaries, each having licensing authority: - CVM: business conduct and market regulation of intermediaries and secondary markets (equity, derivatives, non-governmental debt). - BCB: prudential surveillance, principally capital adequacy, and oversight of the currency and government debt markets; BCB laws and regulations apply equally to financial institutions (banks and capital market intermediaries). - Market concentration and interconnectedness: - The banking sector is concentrated and interconnected: - The six largest banks account for almost 70 percent of the financial system and nearly 94 percent of GDP. - Expanding to the largest 13 banks accounts for 88 percent of the financial system and 119 percent of GDP. - The six largest banks account for nearly 96 percent of international activity. - (Source cited: BCB Financial Stability Report, data as at June 2016.) - Key system-wide indicators (end 2016 / March 2017): - System-wide capitalization at end-2016: 11.5 percent CET1 and 16.1 percent total capital. - Minimum regulatory requirements: 4.5 percent CET1 and 11 percent total capital. - Asset quality: problem assets in total loans to non-financial corporates doubled in two years to 8 percent. - Household problem assets reached their highest level since 2013 (may have peaked). - Profitability: ROE for the banking sector at end March 2017 was 13.3 percent, compared with 22.8 percent at the time of the last FSAP. - Bank counts by ownership (Table 1: Number of Banks in Brazil by Ownership) - Banks: 2012 Dec / 2013 Dec / 2014 Dec / 2015 Dec / 2016 Dec - Public: 9 / 9 / 10 / 10 / 10 - Private: 151 / 146 / 143 / 144 / 145 - National: 70 / 67 / 63 / 72 / 63 - with Foreign Participation: 16 / 15 / 16 / 6 / 17 - under Foreign Control: 59 / 58 / 58 / 60 / 59 - Foreign Full Branches: 6 / 6 / 6 / 6 / 6 - Total: 160 / 155 / 153 / 154 / 155 - Source: Unicad / Capef ### Preconditions for Effective Banking Supervision - Macroeconomic context and fiscal policy: - Since the last FSAP, Brazil experienced a long and deep recession with recovery underway. - From the beginning of 2015 through 2017, real output contracted by nearly 8 percent on a cumulative basis. - Around 3 million formal jobs were lost and the unemployment rate almost doubled. - The recession was triggered by large macroeconomic imbalances and a loss of confidence, and was exacerbated by declining terms of trade, tight financing conditions, and a political crisis. - The new government pursued a reform agenda and passed a law to cap growth in federal noninterest spending in real terms. - Structural problems remain a threat to fiscal sustainability; the government’s ability to deliver on social security reform is uncertain. - National elections were scheduled for 2018. - Financial stability policy system: - The document notes a “Well-Established Financial Stability Policy System” (heading introduced in the source). *Detailed Assessment prepared by Katharine Seal, IMF and Damodaran Krishnamurti, World Bank. Source: Detailed Assessment Report (FSAP update mission October 30th–November 21st, 2017).* ### 21. The CMN is responsible for formulating the overarching monetary and credit policy. ### The CMN is responsible for formulating the overarching monetary and credit policy. ### Roles and institutional responsibilities - The National Monetary Council (CMN) formulates overarching monetary and credit policy. - The Central Bank of Brazil (BCB) and the CMN take a central role in shaping macroprudential policies, working with the Ministry of Finance (MoF) and other financial regulators: Securities and Exchange Commission of Brazil (CVM), Superintendence of Private Insurance (Susep), and National Superintendence of Complementary Pension (Previc). - The BCB can design and implement tools to address financial stability vulnerabilities directly or indirectly by supporting CMN policymaking; when done indirectly CMN Resolutions set the framework and BCB Circulars calibrate requirements or define methodological details. - Bodies similar to the CMN exist for insurance and pensions: National Council for Private Insurance (CNSP) and National Council for Complementary Pensions (CNPC). ### Coordination and supervisory forums - Committee of Regulation and Supervision of Financial, Securities, Insurance, and Complementary Pension Markets (COREMEC): - Composed of BCB, CVM, Susep, and Previc with a rotating presidency. - Provides a consultative forum for coordination of supervisory policies and information-sharing; members’ recommendations and advice are not binding on each other. - BCB, CVM, Susep and Previc are responsible for macro-prudential surveillance; BCB takes a leadership position due to data capacity and the bank-centric nature of Brazil’s financial system and is widely perceived to have a financial stability mandate. ### Legal framework and dispute resolution - The individual responsibilities of the CMN and the BCB are defined in Law 4,595. - Brazilian legal system: civil law tradition; Federal Supreme Court is highest court safeguarding the Constitution; Superior Court of Justice (STJ) is highest court of law for federal law matters. - Code of Civil Procedure of 2016 aimed to modernize and make dispute resolution more flexible; the Brazilian National Council of Justice reported approximately 74 million suits awaiting judgment in Brazil at the end of 2015. - Under the new Code, higher court decisions will be binding on lower courts, including decisions in respect of repetitive cases or repetitive appeals. ### Accounting, auditing and financial reporting - Federal Accounting Council (CFC) approves Brazilian Accounting Norms (NBC) based on ISA as of end 2010. - BCB enforces audit standards when an external auditor is auditing a banking group and issues accounting norms for the banking sector pursuant to the Banking Law and Law 11941 of 2009. - Consolidated statements based on IFRS are required for publicly listed financial institutions and entities required to establish an Audit Committee. - CMN has promoted approximation with international accounting standards for individual financial and regulatory financial statements; BCB committed to revising accounting of financial instruments to enhance convergence with IFRS 9. - Financial institutions must obtain an external auditor’s opinion on financial statements (Resolution 3,198). - Only audit firms registered with the CVM may audit financial statements of listed companies and financial institutions; CVM requires all members of the audit firms to be accountants (Instruction 308). - The CVM conducts periodic audits on the work of external auditors of listed or foreign entities and found no irregularities in 2016. - External auditors are subject to regulations issued by CMN and BCB, and by CVM, CFC and Ibracon when not in conflict with CMN or BCB rules (Resolution 3,198). ### Regulation and supervision of financial markets and infrastructure - BCB’s oversight role includes banking and financial market infrastructure, licensing, supervising and monitoring institutions with regard to systemic soundness. - Susep regulates and supervises insurance and re-insurance companies, private pension, and capitalization plans. - Previc oversees pension funds. - CVM regulates and supervises participants in securities and derivatives markets—including the investment fund industry—and both exchange-traded and OTC markets. - CMN is responsible for regulation of payment systems (PSs), central counterparties (CCPs) and securities settlement systems (SSSs); under CMN general regulation BCB issues specific regulation, authorizes functioning of, supervises and oversees PSs, SSSs and CCPs (shared with CVM for SSSs). - BCB and CVM are responsible for regulation, authorization, supervision and oversight of central securities depositories (CSDs) and trade repositories (TRs). ### Credit reporting and borrower data - Three main credit bureaux: SPC, Serasa Experian and Boa Vista – SCPC; they maintain databases on positive and negative credit information and are supervised by Consumer Protection Agencies. - Regulations from 2011 onward set scope of information to be held; financial institutions and other BCB-licensed institutions provide data per CMN guidelines. - A new credit scoring company (GIC) launched by five large banks (Bradesco, Itaú-Unibanco, Banco do Brasil, Santander and Caixa Econômica Federal) received conditional approval from the competition agency in June 2016 and should be operational in around 2020; GIC will work in parallel with the Positive Credit Bureau, share information with credit bureaus or sell credit information, act as a registry of compliant and non-compliant borrowers and provide fraud protection services. - BCB’s Credit Information System (SCR) provides FIs access to potential borrowers’ credit history and size of aggregated financial responsibilities; the reporting threshold to the SCR was lowered to R$200 (approximately USD 50) in 2016. ### Publicly accessible statistics - Main data providers: BCB and Brazilian Institute of Geography and Statistics (IBGE). - Financial data and statistics are available through BCB and presented in the semi-annual Financial Stability Report. - IBGE produces a wide range of statistical, geographic and environmental data and publishes economic and social indicators, including National Household Sample Survey, National Census (every ten years), and Quarterly National Accounts (current values and quarterly volume indexes (1995=100) for GDP). - Since 2012 IBGE has improved some databases, including national accounts and labor market data. ### Crisis management, resolution and cross-border cooperation - BCB is the sole resolution authority for non-state owned banks and has the power to trigger resolution and apply resolution powers; state-owned (federal) banks are not subject to resolution. - Resolution powers based on “temporary special administration regime”, “intervention” and “extrajudicial liquidation” prescribed in Law 6,024, Decree-Law 2,321 and Law 9,447. - Emergency liquidity assistance can be provided at BCB’s discretion with maturities up to 359 days; longer maturities require liaison with the Ministry of Finance and Government to set and approve specific legal provisions, subject to the Fiscal Responsibility Law (Complementary Law 101, Article 28, paragraph 2). - BCB can share information with national and foreign authorities based on signed cooperation agreements and is home resolution authority of a resolution entity of a G-SIB—Santander—in a Multiple Point of Entry approach; BCB has been part of a Cross-border Cooperation Agreement in relation to the Santander Group since 2013 with authorities from EU, Spain and the United Kingdom. - At assessment time a draft Bank Resolution Bill prepared by BCB to align Brazil’s Resolution Framework to the FSB Key Attributes was under consideration; the draft proposed to make existing tools more effective (reorganization, good-bank/bad-bank policy, liquidation) and proposed new measures such as creation of bridge banks. ### Public safety net and deposit insurance - Deposit insurance provided by Credit Guarantee Fund (FGC) and Cooperative Guarantee Fund (FGCoop); both are private non-profit entities regulated by CMN and BCB. - Coverage: deposits and deposit-like instruments are covered up to R$250,000 per investor. - Pay-out funds sources include contributions of associated institutions, credit rights subrogated by FGC/FGCoop from associated institutions under resolution regime, results of services rendered by FGC/FGCoop and proceeds from investments made by them. - Current monthly ordinary contribution of associated institutions is set at 0.0125 percent of the balance of the guaranteed accounts. - FGC can act as pay box in intervention or extrajudicial liquidation and can provide financial support (loans, portfolio purchases, additional limit of insurance for certain affiliates’ operations) to support financial stability, and can promote transfer of control, split, merger or other corporate reorganization as needed. - Recent regulation amended FGC’s statute to restrict insurance coverage in cases of institutional investors (Resolution 4,469); similar regulation under evaluation for FGCoop to allow the fund to act as paybox and offer liquidity assistance to associates. ### Market discipline - Banks are subject to information disclosure standards for accounting and prudential information. - Listed banks and those required to establish an Audit Committee must publish accounting statements in accordance with IFRS annually. *Content based on IMF assessment text in the supplied PDF chapter.* ### 42. Cosif, the accounting standards set by the BCB and applied to supervised institutions, ### 42. Cosif, the accounting standards set by the BCB and applied to supervised institutions, ### Accounting and disclosure requirements - Cosif requires that a complete set of financial statements be prepared, audited and disclosed semi-annually on a solo basis. - Disclosure of information on risk management, capital requirements and regulatory capital on both quantitative and qualitative basis is set out in Circular 3,678. - Consolidated disclosure is required for institutions belonging to the same prudential conglomerate, in a form commensurate with the scope and complexity of operations and of systems and processes employed in risk management. - Semi-annual disclosures required of banks incorporated as a joint stock company or subject to the constitution of an audit committee include: - individual balance sheet of the institution or the prudential conglomerate’s balance sheet, if applicable; - individual balance sheet of the institution or the prudential conglomerate’s balance sheet, in comparison with the published financial statements; - list the institutions that comprise the scope of consolidation of the balance sheet, as well as the published consolidated balance sheet; - disclose the values of total assets, net worth and area of activities of any of the institutions where individual disclosures have been made. - Additional periodic disclosures: - quarterly disclosure related to the calculation of the LCR (Resolution 4,401); - quarterly and semi-annual disclosure related to the calculation of the leverage ratio (Circular 3,748); - four-monthly and annual disclosure pertaining to the assessment of global systemic importance (IAISG) (Circular BCB 3,751). ### Supervisory framework and legal basis (Principle 1: Responsibilities, objectives and powers) - The regulatory structure of the national financial system (SFN) is established by Law 4595 (the “Banking Law”). - The Banking Law (Article 1) defines the SFN components and provides the BCB with exclusive authority to license banks (Art 10, Section X), conduct inspections (Art 10, Section IX) and carry out corrective and remedial actions (Chapter V). - No other authority in Brazil is granted supervisory powers over the financial system, though the BCB’s powers and execution of tasks are subject to scrutiny by and report to the CMN. - Laws 6,024 and 9,447 and Decree-Law 2,321 grant the BCB resolution powers, including intervention, liquidation or temporary special administration regime. - The BCB holds AML/CFT supervisory authority under Law 9,613. - Scope of BCB supervision includes commercial banks, universal banks (“bancos multiplos”), exchange banks, development banks, investment banks, the Federal Savings Bank and credit/finance investment societies, plus brokers, credit cooperatives, leasing companies and micro credit companies. - Assessment of Principle 1: Compliant. ### Powers to set and enforce prudential standards (EC3) and corrective actions (EC6) - CMN and the BCB have authority to define prudential standards; examples of regulations establishing minimum prudential standards include: - Resolution 4557 (mandatory risk management practices); - Resolutions 4192 and 4193 (definition of Regulatory Capital (PR) and Tier 1 and Core Capital); - Circulars 3402, 3630, 3678 and 3717 and Resolution 4280 (transmission of accounting and prudential information); - Resolution 3198 (external auditing services); - Resolutions 2554 and 4329 (internal auditing and controls); - Circulars 3461, 3583 and 3654 (prevention of money laundering and countering terrorism financing). - Resolution 4019 provides the BCB with powers to increase prudential requirements and imposes a range of measures, including: I – Adoption of additional controls and operational procedures; II – Reduction in the degree of risk of exposure; III – Capital requirements add-on; IV – More restrictive operational limits; V – Restoration of liquidity levels; VI – Administration in a regime of co-management for certain credit unions; VII – Limitation to or suspension of: (a) Increase in management staff’s salary; (b) Payment of variable remuneration to management; (c) Distribution of earnings or surplus above legal minimums; VIII – Limitation to or suspension of: (a) Operational modalities or specified types of financial transactions; (b) Development of new business lines; (c) Acquisition of participation in the capital of other entities; (d) Installation of new branches; IX – Asset transfer. - Range of corrective actions under Resolution 4,019 (as described under EC6) includes: - Restricting current activities and operations; - Requiring additional capital and remediation plans; - Withholding or conditioning approval of new activities or acquisitions; - Restricting or suspending payments to shareholders or share repurchases; - Restricting asset transfers; - Barring individuals from acting as controlling shareholders, officers or board members; - Replacing or restricting powers of officers, board members or controlling shareholders; - Facilitating takeovers or mergers with healthier institutions; - Interim management of the bank; - Revoking or recommending revocation of banking license; - Imposing fines on institutions and individuals; - Intervention or liquidation in critical situations. - Regulatory developments: - June 2017 Provisional Measure 784/17 introduced a new legal framework for corrective and punitive action; it lapsed in October but key provisions were included in a proposal for an Ordinary Law (mentioned as ordinary law (13,506)). - New framework intended to allow revocation for a grave infraction (not only repeat infractions) and immediate revocation if an institution is a danger to itself or the market. - Cooperation for resolution: - Complementary Law 105 creates a framework for information exchange and cooperation with foreign and domestic authorities relevant for resolution. - A Bill prepared by the BCB aims to align the Brazilian Resolution Framework with the 2014 FSB Key Attributes and to enhance cooperation provisions with foreign resolution authorities. ### Independence, governance, accountability and resourcing of the supervisor (Principle 2) - Legal and governance features: - Banking Law (Law 4595) denotes the BCB as “a semi-autonomous federal agency” (Article 8). - CMN decides upon administrative structure, staff, benefits, and approves BCB internal bylaws, accounts, budget and accounting systems (Article 4 items XXV and XXVII). - Governance provisions: BCB’s Board of Directors has five members including the Governor (Art 14). Members are appointed by the President and approved by the Senate. - The Governor has ministerial status and is accountable to the President. - Appointment and removal: - No established mandate or fixed-term for Governor or Board members; recent Governors’ tenure ranged from three to eight years. - Governor and Deputy Governors may be summarily dismissed at any time by the President (Decree 91,961, Art 1); reasons for dismissal are not specified in law nor required to be publicly disclosed. - Transparency and accountability: - The BCB publishes Supervisory Manual and Financial Statements; the Financial Stability Report (FSR) is released biannually. - Governor appears before Congress committees twice yearly and quarterly meetings with Committee of Economic Affairs. - Internal governance: - Management Operational Manuals and delegation of powers allow timely decisions; Deputy Governor for Supervision can apply all sanctions and preventative measures. - Department of supervisory methodology designs decision making processes; procedures under revision due to ordinary law (13,506). - Staffing, resources and training: - Budget composed of two elements; supervisory activities funded from the organizational budget within the General Federal Government Budget (OGU). - Access to Reserve for Institutional Development of BCB (REDI-BC) for strategic projects, staff development and IT. - BCB considers budget allocation adequate but assessors noted some meetings/events restricted due to budget constraint. - Recruitment is via public examinations (Law 9,650); BCB may hire external consulting services if needed. - Examples of staff development: Post-Graduate Programs, in-house training, attendance at ASBA, FSI, IMF, WB. - Budget constraints expected to continue due to a law imposing a limit on government expenses. - Risk-based supervision and resource allocation: - Risk-based supervisory approach uses a 1-4 rating system, subdivided into 10 grades overall; supervisory cycle accounts for risk and impact and uses asset size thresholds and supervisory rating criteria. - Legal protection: - Governor, Deputy Governors and certain other staff have right to representation by BCB’s General Counsel (PGBC) pursuant to Law 9,028. - PGBC may represent before the Federal Public Prosecutor for charges in course of duties; Governor’s actions can only be challenged in the STJ or STF. - Ordinary staff do not enjoy automatic PGBC services; legal assistance is subject to PGBC review and Board approval under Directive 088. - Proposed provisions in the Bank Resolution Bill would provide enhanced legal protection: no central bank official or staff member shall be held liable for acts or omissions related to performance of legal duties provided they do not arise from wilful misconduct or fraud (Bill not yet passed at assessment time). - Assessment of Principle 2: Materially Non-Compliant. - Comments summarizing deficiencies: - Lack of full de jure independence (no fixed terms, Governor removable at will without required reasons or public disclosure). - Legal protection for BCB staff is lacking and legislative initiatives to address this were in progress. - Budget and personnel decisions are highlighted as ancillary points that should fall within BCB discretion to safeguard independence. ### Cooperation and collaboration (Principle 3) - Domestic cooperation arrangements (Complementary Law 105 basis) and existing agreements with: - PREVIC (National Complementary Pension Superintendence) renewed February 2016; - CVM (Securities and Exchange Commission) agreement since 2014; - Federal Revenue of Brazil (RFB) since 2002; - SUSEP (Private Insurance Superintendence) since July 2005; - Senacon (National Consumer Bureau) since July 2010. - COREMEC (Committee of Regulation and Supervision of Financial, Securities, Insurance, and Complementary Pension Markets) established by Decree 5,685; COREMEC meets quarterly and exchanges information on financial stability, risk-based supervision, information standardization, AML, and financial education/inclusion. - Foreign cooperation: - Complementary Law 105 provides basis for cooperation agreements with foreign supervisory authorities for supervising branches/subsidiaries and mutual cooperation/information exchange for investigations. - At assessment time BCB had 25 Memoranda of Understanding (MoUs) with 29 foreign supervisory authorities from 23 countries and the European Central Bank (ECB). - Countries with MoUs include: South Africa, Germany, Argentina, Bahamas, Cayman Islands, China, Chile, Colombia, South Korea, Spain, United States of America (OCC, FDIC, FED and Department of Financial Services), India, Indonesia, Italy, Luxembourg, Mexico, Panama, Portugal, Paraguay, Peru, the United Kingdom, Switzerland and Uruguay; a further MoU was signed with Austria during the assessment. - BCB maintains frequent exchanges under MoUs and also responds to requests where no MoU exists, subject to Complementary Law 105 requirements. - BCB hosts supervisory colleges for Itaú-Unibanco and Banco do Brasil and participates in colleges for Citibank, JP Morgan Chase, Credit Suisse, Deutsche Bank, UBS, GMAC, and Rabobank; participates in core colleges and Crisis Management Group - Santander with Banco de España under a specific MoU (CoAg). - Confidentiality and use of information: - MoUs and agreements require information be used only for supervisory purposes and confidentiality be preserved to the extent legally possible. - BCB uses Complementary Law 105 protections and routinely confirms confidentiality requirements when exchanging information. - BCB may deny requests not covered by Complementary Law 105; disclosures shielded by bank secrecy laws occur only in specific cases of Congress/Justice requests as prescribed. - Resolution support: - BCB is single supervisory and resolution authority; governance architecture created in January 2017 with Resolution Committee (COPAR) to support coordination between supervision and resolution departments. - Supervision reviews banks’ Recovery Plans; D-SIBs required to submit recovery plans. - First versions of resolution plans are in place; enhancement and finalization planned by end of phase-in period for recovery plans due in July 2018. - BCB participates in FSB Cross-Border Crisis Management Group (CBCM) and FSB Resolution Steering Group (ReSG). - Assessment of Principle 3: Compliant. ### Permissible activities, naming and deposit taking (Principle 4) - The term “bank” is not specifically defined in laws or regulations; banks are recognized as a subset of financial institutions licensed and supervised by the BCB. - Banking Law (Article 17) defines financial institutions broadly and the BCB licenses and supervises 19 types of financial institutions; each subset is subject to its own set of Resolutions. - Permissible activities are set out in regulations: - Commercial Banks, Investment banks, Development banks, Universal (“multiple”) banks, Credit cooperatives and Exchange banks covered in Resolutions 2624; 394; 2099; 2788; and 3426 respectively. - Use of the word “bank”: - Article 34 of Law 8,934 requires business names to obey principles of veracity and novelty; Credit cooperatives are prohibited from using the term “Bank” (Article 5 of Law 5764). - No general outright prohibition on the use of “bank,” but registration and trade boards mitigate misuse. - Deposit taking: - Only institutions licensed and supervised by the BCB may engage in deposit taking. - Commercial and universal (“multiple”) banks, and credit cooperatives, are the only institutions permitted to receive demand deposits. - Law 7492 (Article 16) stipulates imprisonment of 1 to 4 years and a fine for operating a financial institution without authorization or based on false statements. - Payments institutions may receive funds solely to convert into electronic money via pre-paid payment accounts; these are not considered “deposits” as they cannot finance payments institutions’ operations; such payment institutions are licensed and supervised by the BCB and must segregate customer accounts. - Public registry: - BCB maintains and publishes a registry of all financial institutions and provides standard basic information; registry URLs given in source content. - Assessment of Principle 4: Compliant. ### Licensing criteria and process (Principle 5) - The Banking Law (Article 10, subsection X) grants the BCB exclusive competence to authorize financial institutions to operate, establish headquarters/offices, transform, merge, incorporate or transfer equity control. - Constitutional constraint: establishment of new foreign branches or increases in foreign equity participation require presidential approval; BCB must submit foreign banks’ license applications for presidential approval and may decline deficient applications prior to submission. - Resolution 4122 sets information requirements for licensing; BCB can amend authorization criteria via CMN proposals. - Licensing can be rejected for inadequate information or reputational concerns; discovery of false or misleading information at any stage leads to automatic revocation. - Licensing process is a six-stage process (Regulation Annex I to Resolution 4122). Summary of stages: a) Submission of initial documentation including: - draft statements of purpose; - executive summary of the business plan; - identification of members of the control group and holders of qualified participation with respective stockholdings; - statements concerning fulfillment of conditions required for holding offices (supervisory board, executive board and fiscal council); - identification of natural persons and legal entities composing the institution’s economic group; - statements and documents showing control group knowledge of the business/market segment; - identification of source of funds to finance the project; - express authorizations to the Brazilian Internal Revenue Service and the BCB granting access to information for authorization proceedings (Article 4). b) Technical interview with control group members (may be waived under certain conditions) (Article 5). c) If approved, within 60 days applicant must: - publish statement of purpose; - submit complete business plan containing at least a five-year forecast regarding financial market and operating plans; - submit drafts of acts of incorporation; - demonstrate economic and financial capability commensurate with the project’s size, nature and purpose; - confirm absence of restrictions affecting reputation of owners of controlling interest and holders of qualified participation (Article 6). - Assessment of Principle 5: licensing authority (BCB) has powers to set criteria and reject inadequate applications. *Source: 42. Cosif, the accounting standards set by the BCB and applied to supervised institutions,* ### Annex I of Resolution 4122); ### Annex I of Resolution 4122) ### Licensing process and timelines - Initial post-approval period: - Applicant has a further 180 days to meet conditions in section (d) after requirements in section (c) are met to the BCB’s satisfaction. - This 180-day period may be extended for a further 90 days at the discretion of the BCB (Article 7 of Annex I of Resolution 4122). - Conditions to be met within the 180-day (or extended) period: - i) completion of legal incorporation of the entity; - ii) execution of the organizational structure envisaged in the business plan; - iii) submission of a request to the BCB for an inspection to verify the corporate structure. - Inspection and post-inspection steps: - BCB conducts inspection within 90 days of receipt of the request (Article 8 of Regulation Annex I of Resolution 4122). - Failure to satisfy the BCB’s inspection results in opportunity to make rectification; a second failure results in rejection of the application. - If BCB inspection is satisfactory, the institution has 90 days to present documentation proving adoption of measures relating to legal establishment, election of officers, and proof of the evidence of the source of funds (Article 9 of Regulation Annex I of Resolution 4122). - Once the BCB verifies submissions under (“f”), the license is issued. - False claims and revocation: - If at any time during the licensing process the BCB establishes that false claims have been made, the BCB may reject the application or, depending on circumstances, grant time for justifications to be submitted. ### EC3 — Consistency of licensing criteria with ongoing supervision - Findings: - Licensing criteria are consistent with continuous supervisory criteria. - Licensing assesses ownership structure and governance (including fit and proper assessments of the control group, board members and senior management), internal controls, risk management and projected financial condition (including the capital base). - All persons proposed as members of the “control bodies” (Supervisory and Executive Boards and Fiscal council) are assessed against fit and proper standards on an ongoing basis. ### EC4 — Assessment of structures for effective supervision - Findings: - Licensing process requires considerable information on corporate ownership and individuals who will direct and execute the bank’s strategy. - Circular 518 establishes information requirements on capital structure and control structure for the proposed institution. - Circular 518 requires capital structure breakdown until the final controlling interest is identified, giving BCB access to assess whether effective supervision could be impeded. - License is not granted unless BCB concludes legal structure, chain of control or organizational arrangements do not constitute obstacles. ### EC5 — Identification, suitability and source of funds of major shareholders - Identification: - Resolution 4122 requires identification of members of the control group, their stockholdings, and identification of natural persons and legal entities in the wider mixed activity group. - Circular 3649 requires complete organisational chart of the economic group, identifying companies with CNPJ or foreign headquarters country and percentage of total and voting capital or statement of non-membership of economic conglomerate. - Direct shareholding control of banks is restricted to: natural persons; financial institutions and other financial system members licensed by the BCB; and other legal entities whose exclusive business purpose is to invest in the equity of financial institutions and other institutions licensed by the BCB. - If ownership structure is not clearly defined, BCB requires shareholder agreement to scrutinize controlling group structure (e.g. Article 6, Resolution 4122; Annex 1, Article 6, Paragraph 1, Section II of Resolution 4122). - Suitability: - Members of controlling group required to be knowledgeable about the business and market sector. - For new entrants to the National Financial System (SFN), further verification may include criminal checks through Interpol (if not Brazilian national) and checks with relevant foreign supervisory authority. - Prospective controlling group must authorize BCB to consult any public or private registration or information system containing their data. - BCB investigates holders with direct or indirect 15 percent or more of shares. - Financial support and source of funds: - BCB examines whether controlling interest holders have financial capacity compatible with initial and future capital necessities as indicated by business plan and viability study. - Analyses based on tax returns (individuals), financial statements and audited accounts (legal entities). - BCB analyses net worth of controlling interest holders and consistency with Credit Information System (SCR) records. - Where discrepancies or suspicious transaction indications exist, BCB will request additional information, including previous three years’ tax records from the Federal Revenue of Brazil. - Holders must provide evidence of source of funds through income tax returns, the previous financial year’s balance sheet and three years’ auditor reports as well as bank statements, invoices, deeds, purchase and sale contracts, etc. ### EC6 — Minimum initial capital amounts - According to Resolution 2,099 and Resolution 2,607 the minimum limits of paid-in capital and net stockholders’ equity: - I - R$ 17,500,000.00: for commercial banks and universal banks (“multiple banks”) with commercial portfolio; - II - R$ 12,500,000.00: for investment banks, development banks, and corresponding portfolios of universal banks and savings banks; - III - R$ 7,000,000.00: for credit, financing and investment societies, real estate credit society, leasing society and corresponding portfolios of universal banks. - Additional requirements: - If an institution wishes to undertake foreign exchange operations, the minimum capital level is increased by R$ 6,500,000.00. - Additional capital requirements exist for installation of branches beyond the threshold established by the BCB. ### EC7 — Fit and proper assessment of board and senior management - Legal and regulatory basis: - Banking Law requires BCB to establish conditions for occupation and exercise of positions in management and advisory/supervisory bodies. - Resolution 4122 restricts exercise of positions in statutory bodies to those ratified by the BCB meeting specified conditions. - Fit and proper criteria (as set out in Resolution 4122): - (i) have unblemished reputation; - (ii) be resident in Brazil, in the case of directors and managing partners; - (iii) not be under restriction by special laws, or having been convicted for any bankruptcy crime, tax evasion, prevarication, corruption, graft, embezzlement, crime against the public economy or the SFN, or of any crime that restricts, even temporarily, access to public offices; - (iv) not be held as unfit, or suspended for the performance of duties as member of statutory audit committee, board of directors, executive board or managing partner in institutions mentioned in Article 1 or in private pension entities, insurance companies, capitalization companies, publicly held companies or entities subject to supervision by Comissão de Valores Mobiliários; - (v) not be subject to, nor must any company of which he or she is a controlling interest holder or administrator, any contested securities, judicial collection, issuance of checks without funds, default of obligations or similar circumstances; - (vi) not have been declared bankrupt or insolvent; - (vii) not have been either a controlling interest holder or administrator, over the 2 (two) years preceding the election or appointment, of a firm or company object of declaration of insolvency, liquidation, intervention, bankruptcy or judicial reorganization. - Additional procedures and checks: - When nominees live abroad: Interpol checks via Federal Police Department (DPF). - When nominee worked in financial or similar institution abroad: checks with respective foreign supervision authority. - Checks with INSS, Susep, CVM registries as applicable. - BCB may consult other public or private registry systems as necessary. - Requirement of technical capacity compatible with the job; assessed via reasoned statement, résumé, and interview if necessary. - BCB can revoke ratification at its discretion if irregularities or false declarations/documents are uncovered. ### EC8 — Review of strategic and operating plans, governance, risk management and controls - Documentation and review: - Resolution 4122 and Circular 3649 set extensive documentation requirements for strategy and operating plans. - Business plan must include at a minimum: - Details of the proposed organizational structure; - Specification of the internal control structure; - Establishment of strategic goals; - Definition of the main products and services to be offered, as well as the intended target audience; - The information technology infrastructure to be deployed and estimated size of the service network; - Deadline to begin operations; - Description of criteria used in recruitment of upper management. - BCB conducts inspection during licensing to assess consistency between implemented organizational structure and business plan. ### EC9 — Review of pro forma financials and shareholder financial information - Findings: - Proposal must include information to support financial capacity of controlling shareholders. - Approval depends on evaluation of owner financial capacity, origin of invested funds, and estimates of initial and future capital needs as indicated by business plan and viability study. - Pro forma financial statements are provided and used to determine controlling interest holders’ ability to support future growth. ### EC10 — Foreign banks and home supervisor consultation - Procedures: - For foreign bank subsidiaries in Brazil, Circular 3317 (Article 3) allows BCB to request information from home supervisor regarding legal status and intended investment; it is typical for BCB to make such a request. - Consultation often done under an MoU; absence of MoU does not prevent consultation. - Information sought from home supervisor aims to assess whether the foreign supervisory authority: - a) certifies adequate procedures to monitor and control activities in other countries; - b) receives information on condition of the entity and subsidiaries/foreign offices via supervision/auditing reports; - c) receives information on commercial transactions and relationships between entity and affiliates; - d) receives consolidated financial statements or similar global financial information; - e) evaluates prudential standards such as compliance with minimum capital ratios and risk exposure limits at a global level; - f) certifies existence of adequate procedures to control and prevent money laundering and financing of terrorist activities; - g) exercises consolidated global supervision. ### EC11 — Monitoring progress of new entrants - Requirements and monitoring: - For the first five years of operation, new institutions must report performance against strategic objectives in their business plan; information must be presented in financial statements. - If operations are inadequate relative to strategic objectives, institution must present justification; BCB may establish a timetable to meet additional conditions. - Grounds for revocation of authorisation (Resolution 4122, Annex I, Article 21): - I – failure to meet regulations in carrying out essential operations; - II - lack of operating activity; - III – failure to occupy the address notified to the BCB; - IV – delay of over four months in submitting legally required financial statements to the BCB without adequate justification; - V – failure to follow the business plan. - Assessment of Principle 5: - Compliant. - Comments: Licensing model is comprehensive, from identification of ultimate beneficial control to operational inspection and post-licensing monitoring. - Historical outcome: In the last X years, the BCB has received five applications for banking authorizations, of which only one was approved; one was denied outright; three applications withdrew during the process. - BCB prefers due process and parity of treatment for all applicants rather than informal decision or advice. ### Principle 6 — Transfer of significant ownership - EC1 — Definitions: - Corporate law (Law 6404, Article 116) defines controlling shareholder as the individual, legal entity, group of people joined by voting agreement or group of legal entities under common control (control group), which: - Hold voting rights that assure, in a permanent way, the majority of votes in the decisions of the general shareholders’ meeting and the power to appoint the company’s upper management; and - Use that power effectively to direct corporate activities. - Resolution 4122 (Article 6) defines qualified ownership as direct or indirect participation equivalent to 15 percent or more of the shares or representative quotas of the total capital of a financial institution. - “Control group” under Resolution 4122 (Article 6) is individuals or groups bound by a voting agreement or common control and hold shareholding rights equivalent to majority (50 percent) of voting capital of a public company or at least 75 percent of shareholding capital of a limited liability company. Article 6 permits BCB to use additional criteria (“other elements”) to identify the control group if needed. - Participation is calculated on the basis of both direct and indirect investments. - EC2 — Requirements for supervisory approval of changes in ownership: - Resolution 4122 (preamble, purpose, and Regulatory Annex II) establishes requirements and procedures for authorisation and for changes of control and corporate reorganisation. - BCB authorization is required for transfer of corporate control and any change, direct or indirect, in the control group that might imply change in effective control of institutional business. *Source: Annex I of Resolution 4122), cr18340 - Annex I of Resolution 4122) — IMF content unit.* ### Chapter II of the Regulatory Annex to Resolution 4122 sets out requirements for change of ### Chapter II of the Regulatory Annex to Resolution 4122 sets out requirements for change of ### Approval process and triggering conditions - The approval process is not triggered (Article 13 of the regulatory annex) where there is no change in the ultimate beneficial controller (“final controller”) of the institution. - Chapter I relates to new authorisation as discussed in CP5. - The requirements for a transfer or change in the control group are essentially the same as those applied in the licensing of a financial institution and are set out in Resolution 4122. ### Authorisation thresholds - Authorisation is needed for a proposed participation equal to or greater than 15 percent in a financial institution (Article 16 of Chapter II of the Regulatory Annex). ### Notification requirements - There is a notification requirement to the BCB in respect of changes of voting or non-voting capital above 5 percent (essentially creating a 5 percent threshold for notification); any change in control; and/or any change in foreign capital ownership (Circular 624, amending item 2 of Circular 518). - The notification in Circular 624 is triggered when the change is direct or indirect. ### Responsible authority and assessment - The Licensing Department (DEORF) is responsible for analysis and approval of any change in control through the application of a fit and proper test, using a broad definition of control in these instances. *Source: Chapter II of the Regulatory Annex to Resolution 4122 (cr18340).* ### Annex II. ### Annex II. ### Principle 6 — Transfer of Significant Ownership: powers and reporting - EC3: Supervisor powers to reject or reverse changes in significant ownership - The 1964 Banking Law (Article 10, Section X) establishes that the BCB has exclusive responsibility for initial authorisation and for approving changes of control. - Only the BCB can authorize financial institutions to “transform, merge, incorporated, or taken over.” - The BCB “will analyse the requests formulated and will decide to grant or to deny the requested authorization (...).” - Operations that result in transfer of control and/or corporate reorganization are subject to the same requirements as licensing new banking institutions as iterated in Resolution 4122 (presentation of business plan, economic and financial capability studies, origin of funds, access to information about the controllers and qualified participants, among others). - Resolution 4122 allows the BCB to waive some requirements at its discretion (e.g., a business plan is typically requested only if major strategic changes are planned). - A transfer of control is only finalised after the approval of the BCB has been issued. - If authorisation was based on false information, the BCB may review the decision, take into consideration public interest and the circumstances of each case, and require the situation (transaction) to be regularised. (Resolution 4122, Article 8) - EC4: Reporting of significant shareholders and beneficial owners - According to Circular 3649 transactions that involve the transfer of control—directly or indirectly—or newly qualified shareholders must be reported to the BCB within 15 days. - EC5: Powers to address unapproved changes of control - Changes of control that fail to comply with regulation can lead to punitive measures such as: - the immediate reversal of the transaction; - ruling of ineligibility of the relevant administrators for management positions in financial institutions; and - revocation of the entity’s operating license (Banking Law, article 10, clause IX). - EC6: Requirement to notify supervisor of material information affecting suitability - Resolution 4567 (Article 1) requires financial institutions and other institutions authorized to operate by BCB to report any information that may affect the reputation of their: - Controlling shareholder and qualified shareholders; - Members of statutory and contractual bodies. - The information expected includes police investigations, criminal proceedings or judicial or administrative proceedings related to the National Financial System, within 10 working days from the institution having access to the information. - Assessment of Principle 6: Compliant - Comments: - BCB powers for initial authorisation and change of control are very similar. - BCB practices focus on determination of ultimate control and clarity of group structures. - BCB is ready to deny changes of control if unsatisfied with proposals or information received. - The market has not developed markedly complex group structures, though foreign owned banks with greater complexity exist. ### Principle 7 — Major acquisitions: approval, criteria, and supervisory oversight - EC1: Definitions and thresholds for prior supervisory approval - The Banking Law and Resolutions 2723 and 4062 set requirements and guidance for acquisitions and investments requiring BCB notification and approval. - There is no minimum threshold that triggers a requirement for prior approval; any capital investment, other than investment firm activity, is subject to approval. - Article 30 of the Banking Law states: “private credit institutions, with the exception of investment institutions, may participate in the capital of any company only with prior authorization from the BCB.” - BCB has proposed an amendment to Article 30 to introduce a de minimis level up to which no authorization would be required, but indicated amending the approval threshold is not a priority. - Exception for investment (trading) activity governed by Resolution 4062: direct or indirect investment in the capital of any domestic or foreign companies by financial institutions is dependent on prior authorization by the BCB, with specified exceptions for investment portfolios held by investment and development banks, development agencies or universal banks with an investment or development portfolio. - Authorization for investment shall be granted only where the invested company’s activities complement or support the investing entity’s activities. - Resolution 2723 (Article 8, paragraph 1) requires prior BCB authorization for participation, increased percentage of participation and any case in which the preparation of financial statements is required; applies to investments abroad, including in “tax havens”. - Conditions for a domestic financial institution seeking investment or establishment abroad: - I – to be in operation for a minimum of six years; - II – to be in compliance with the operational limits established in the current regulation; - III – to be in compliance with the regulatory minimum paid-in capital and net worth limits, as well as the equivalent to 300% of the value required for the establishment of a commercial bank domestically (300% of R$ 17.5 million = R$ 52.500.000,00); - IV – the presentation of an economic and financial feasibility study containing at least: - The planned operational strategy, identifying the types of funding operations and the investments to be pursued, as well as the market segments to be targeted; - Expected profitability, specifying expected returns for each time period. - Since 2012 the BCB has examined 602 applications filed by financial institutions seeking approval for investments in the capital of other companies, as required by Resolution 2723. - Mutual participation (cross shareholding) between financial institutions is prohibited pursuant to Article 7 of Resolution 2723. - EC2: Criteria to judge individual proposals - See EC1. - EC3: Supervisory criteria consistent with licensing requirements and consolidated supervision - Resolution 2723 (Article 9): any investment subject to consolidation, irrespective of business area, requires that the financial institution grant full and unrestricted access to the BCB to all information and documents necessary for correct assessment of the risk. - Financial institutions must prepare consolidated financial statements including companies in which they have any of: - Predominance in corporate deliberations; - Power to appoint or dismiss the majority of managers; - Effective operational control, characterized by common administration or management; or - Ownership of controlling interest represented by the sum of the shares held by the institution, irrespective of its percentage, with the sum of shares owned by their managers, owners of controlling interest and connected companies, as well as the sum of shares acquired, directly or indirectly, by means of investment funds. - Consolidation scope includes financial institutions and similar companies licensed by the BCB which are bound by effective operational control, defined as under common management or operating in the market under the same brand or commercial name—applies even when there is no shareholding participation. - Consolidated statements may encompass mutual funds, where banks face substantial risk exposure. - BCB may only grant authorization where it has full information required to evaluate cross-border investments and to ensure global consolidated supervision. - Banks that establish foreign branches or control foreign financial institutions should submit reports and queries addressed to their branches or subsidiaries by the host supervision authority to the BCB. - Applicant must present a declaration committing to provide the BCB complete and unrestrictedly with all information, data, documents and verifications needed to evaluate operations and risks assumed by affiliated institutions. - EC4: Assessment of bank’s resources to handle acquisitions/investments - For acquisitions of controlling interest in domestic financial institutions, BCB performs the type of analysis required for changes in control as described in CP 6. - In other investment cases BCB requests at least “[.] the description of the invested company’s activities and business purpose, the expected synergies stemming from the investment and its alignment with the participating entity’s business strategy [.]” (Resolution 4062). - Authorization for investment may be granted only where the activities of the investment target complement or support the investing entity’s activities. - EC5: Awareness and mitigation of risks from non-banking activities - BCB can prevent investment in non-banking activities since Banking Law requires prior approval of acquisitions. - Circular 2981 requires banks to detail direct or indirect investment in: - all foreign companies; - domestic companies subject to consolidation; - companies where the bank investment exceeds 10 percent of the company’s shares; - where the book value of the investment exceeds 10 percent of the net worth of the participant. - BCB includes these investments in bank supervision and can require information needed for supervisory purposes. - BCB’s SRC aims to perform comprehensive assessment of risks each supervised institution is subject to, considering relevant activities and general risk structure; in conglomerates with relevant pension fund and insurance activities, risks are assessed within methodological limits and, when necessary, information is sought with respective supervisory bodies. - Resolution 4019 enables BCB to take preventive actions to mitigate systemic risks, including restricting or putting bank investments on hold, or even requiring asset disposal. - AC1: Review of major acquisitions by other entities in the banking group - Resolution 4062 requires BCB pre-authorisation for any acquisition by a financial institution (including the bank) whether the investment is direct or indirect. - Acquisitions by controlling shareholders of the financial institution do not require BCB authorization. - BCB does not have legal powers to review and approve acquisitions made by related entities outside the BCB’s supervisory perimeter, but related risks are considered in ongoing supervisory process. - Exposure of a financial institution to risks from related entities outside the supervisory perimeter is assessed in supervisory analysis of contagion risk within the SRC process. - Supervisory work gathers information regarding the conglomerate’s management quality, including non-financial industries. - “Management Special Verification – Corporate Governance” includes analysis of performance monitoring relative to planned goals and strategies, including non-financial objectives. - “Management Special Verification – Operational Risk” assesses procedures to identify and track operational risk of non-financial companies in the consolidated group. - “Special Verification – Other Assets and Non-Financial Liabilities” assesses quality of management of non-financial assets and liabilities, with emphasis on internal controls and bookkeeping procedures. - Resolution 4122: acquisitions of 15 percent or more of the capital of any financial institution is subject to subsequent authorization by the BCB, which considers possible relevant interference on management and strategic decisions of the invested company. - As noted (EC5), Resolution 4019 provides a range of measures, including asset disposal, to remedy concerns arising in this scenario. - Assessment of Principle 7: Compliant - Comments: - BCB operates under a tight legal regime requiring authorization for all acquisitions, significant or otherwise, whether direct or indirect. - BCB carries out assessments and approvals conscientiously and rigorously; ongoing supervisory process is alert to risks triggered by major acquisitions (reputational, strategic, contagion). - BCB would benefit from a de minimis threshold inscribed in the Banking Law while retaining discretionary powers to examine acquisitions if necessary. - Over the past five years, the BCB has had to assess 563 acquisitions, of which approximately only 20 percent related to financial institutions. ### Principle 8 — Supervisory approach: SRC methodology and risk assessment - EC1: Methodology for ongoing determination and assessment of risks - BCB has refreshed its supervisory approach via the Risks and Controls Assessment System—the SRC—a consolidated methodology supported by guidelines (supervisory manuals), parameters and structured processes to support risk analysis of financial institutions (FIs). - SRC includes two main assessment modules: - Risks and Controls Assessment (ARC); - Economic-Financial Assessment (ANEF). - ARC and ANEF are independent but interrelated, updated throughout the supervisory cycle using on-site and off-site procedures and both quantitative and qualitative information. - ARC considers 10 types of risk: Credit; Market; Liquidity; Contagion; Reputation; Strategy; Operational; Information Technology; Anti Money Laundering; and Relationship with Customers and Users of the Banking System. - ANEF combines quantitative and qualitative analysis to assess Solvency (including liabilities, quality of assets and capital adequacy), Liquidity and Profitability. - SRC methodology is applied to significant business activities of the institution; significant business lines are identified based on parameters such as relevancy to assets, contribution to income, off balance sheet activities, potential impact on capital, etc. - Some risk components are considered for each significant business activity; corporate risks (Reputation; Strategy; Operational; Information Technology; Anti Money Laundering; Relationship with Customers) are considered on a consolidated basis. - Risks and Controls Assessment evaluates inherent risks of business lines and residual risks after considering mitigating controls, including corporate governance; results are summarized in the risk and control matrix of the FI. - Results of the ANEF are combined with the ARC outputs (text ends). *Source: cr18340 - Annex II.* ### conclusions of the risks and controls assessment. The final score of the Risks and Controls ### conclusions of the risks and controls assessment. The final score of the Risks and Controls ### Overview of the Risks and Controls Assessment (SRC) - The final score of the Risks and Controls Assessment module is based on a weighting of the relative importance of each business or activity to the FI. - Scores have been made more granular to allow greater distinction when comparing peer groups of banks. - Activities of the FI and scores assigned to associated risks and controls are shown in a risk matrix of the FI (held in the SisAPS database). - Supervisor uses the matrix to identify fragilities or areas warranting special monitoring, in-depth reviews, or required action plans. - Assessments’ findings, scores, and weights of significant businesses/activities can be adjusted at any point during the supervisory cycle in response to continuous evaluation. - All outputs and conclusions from SRC assessments and follow-up monitoring are input into SisAPS (Supervision Process Automation System). - An extensive supervisory manual guides staff in analysis and scoring; Credit, Market and Operational Risk modules were published in the second half of 2017. Modules on corporate governance and IT risks targeted for publication by end 2017; modules on Liquidity Risk, Reputational Risk, Contagion Risk and AML/CFT were due by end 2018. ### Integration of Prudential and Conduct Supervision - Two risks—AML/CFT and client relations—are examined by the conduct supervision department (DECON) rather than the prudential supervision department (DESUP); integrated assessment depends on coordination between DESUP and DESIG (offsite monitoring). ### Supervisory cycle, prioritization and planning (EC2) - Supervisory cycle duration depends on supervisory priority/rating: - one year for FIs classified as SIFIs and High or Medium-High priority; - three-year cycle for low priority FIs. - Priority set using combination of systemic importance (quantitative) and risk profile (SRC). - Priority/ratings matrix updated a minimum once a year. - Formal segmentation introduced in 2017 (Resolution 4553) into 5 segments; segment 1 (S1) reserved for DSIBs and always on a 1 year cycle. - Supervisory planning inputs include: - Deputy Governor for Supervision and Heads of Departments guidance; - Priority Matrix; - macroeconomic scenarios; - results of previous work, SRC process, ongoing monitoring; - information from other BCB areas, international bodies, government entities, external auditors. - At end of supervisory cycle, supervisor presents conclusions to SRC Committee—COREC, which undertakes challenge process and decides rating and specific supervisory actions. - Supervisors can amend component scores or ratings at any point during cycle; can call COREC if necessary to change supervisory cycle (e.g., move an FI from three-year to shorter cycle). - Principle of proportionality applied to scope and intensity of supervisory actions. - Frequency of meetings with senior management varies by priority: - for one major systemic bank, an excess of 60 meetings per year may be required; - lower priority banks are allocated 40 working days per year for completion of supervisory tasks and rely more on quantitative analysis. - Monitoring of PAS (Annual Supervision Program) via SIGAS; SIGAS records reasons for activity delays and alternative monitoring actions. ### On-site procedures and continuous monitoring - On-site procedures are integral to SRC; supervisors can carry out targeted inspections for specific risks and regulatory compliance verification. - Continuous offsite monitoring under SRC uses multiple information sources: - Regular reports (examples: Credit Information System (SCR), Report on operational limits (DLO), report on market risk (DRM), report on liquidity risk (DRL), Standardized Accounting report (Cosif)); - FI’s management information (supervisors define which reports must be regularly submitted); - Data feeds from clearing entities or registries. ### Stress testing enhancements and framework - Off-site supervisory department conducts stress tests: macroeconomic top-down and sensitivity analyses. - Improvements since last FSAP include: i. Calculation and disclosure by the Financial Stability Report (FSR) of the Capital Needs both for sensitivity analysis and macroeconomic tests; ii. Capital Adequacy Ratio (CAR) estimates based on Basel III framework; iii. Full revision of the top down macroeconomic stress test; iv. Improvements in scenario design model with addition of new variables characterizing external shocks; v. Breakdown of loans/ non-performing loans (NPLs) portfolio in corporate, real estate and households; vi. Creation and Disclosure in the FSR of new adverse scenarios such as historic and structural break; vii. Development and disclosure (FSR) of a real estate price sensitivity analysis; viii. Development and disclosure (FSR) of a contagion analysis including the real sector network model using Brazilian Payments System data. - DESIG project (initiated end-2015) to integrate stress tests into macro and micro prudential approaches includes: i. development of a bottom-up stress test (TEBU) for SIFIs; ii. application of the TEBU in the regular banking supervisory process; iii. improvement of the macroeconomic top down stress test (TEMTD) through improvement of credit models, incorporation of stress impact in standardized market and operational exposures, incorporation of forecasted expenses and revenues, modeling of assumption variables, incorporation of contagion risk; iv. establishment of systemic risk indicators for TEMTD; development of specific TEMTD scenarios per FI and FI based TEMTD reports; v. updated procedures for evaluation of micro-prudential stress tests; vi. evaluation methodology of assumptions used in FIs’ stress tests; vii. improvement of the liquidity stress test; viii. establishment of institutional governance and approval of macro-prudential scenarios. - Top-down stress testing model stages: - Stage (i): macro econometric VAR model estimating stressed macro variables (FX, GDP, CPI, IR (US and BR)); - Stage (ii): dynamic panel model estimating delinquency and credit portfolios (NPLs) bank-by-bank using VAR predictions and BCB parameters. - Objective: TEBU, TEMTD and ICAAP stress tests together provide comprehensive insight into solvency of large banks; smaller banks apply a simpler ICAAP. ### Contagion Analysis - Contagion Analysis uses clearing houses data in BCB databases to assess interconnections and contagion potential via interbank exposures. - Analysis extended to include real sector network model using Brazilian Payments System to simulate contagion from real economy to financial system. ### Compliance with prudential regulations and special examinations (EC3) - Supervision Manual (MSU) focuses on assessment of risks and controls and checking compliance with laws and regulations. - Special Examinations (VEs) evaluate level of risk exposure, quality and reliability of accounting/financial information, and compliance with BCB laws and regulations. - SRC process includes verification of compliance with minimum Basel capital ratio, credit concentration limits, currency exposure and immobilization, and risk management standards; requires FIs to correct deficiencies. - Offsite monitoring (DESIG) identifies and assesses compliance; noncompliance reported via Integrated Monitoring System—SIM—monthly or ad hoc. - SIM can issue signals on: a) significant changes in economic/financial indicators and scores; b) situations that may represent a particular type of risk; c) occurrence of events indicating irregularities; d) possible changes in operational profile; e) possible non-compliance with operational/regulatory limits; f) Special studies to deepen specific risks/themes. - Conduct Supervision Department (DECON) responsible for consumer regulation, ALM and CFT compliance; DECON issues letters or propose punitive process and must communicate conclusions to Supervision Department for incorporation into SRC. ### Macro and cross-sectoral analysis (EC4, EC5) - BCB monitors multiple financial sectors and sources (SCR, FX operations, derivatives, securities, TRs). - Information sources include SCR, other regulators, central registries, clearinghouses, external auditors, rating agencies, government data, private data, international agencies (FSB) and MoUs. - Stress tests, interconnectivity and systemic tests conducted on macro level. - Financial Stability Report (FSR) published twice a year and includes forecast baseline and adverse scenarios for BCB macro stress test. - BCB members of COMEF (internal) and COREMEC (cross-sectoral) for systemic risk coordination. - Tools developed for monitoring non-bank financial entities (e.g., step-in risk for investment funds liquidity). ### Resolvability, recovery planning and resolution framework (EC6, EC7) - BCB is single resolution authority but resolvability assessment is in progress; legislative changes in resolution law anticipated. - Current resolution framework: Law 6,024 and Decree-law 2,321; Law 9,447 regulates responsibilities of owners, directors, executives and auditors and grants complementary intervention powers (I - capitalization; II - transfer of control; III - corporate reorganization). - Main conditions for entry into resolution: severe economic and/or financial distress (insolvency, failing or likely to fail) and severe violation of banking laws. - BCB has discretion to decide resolution tools; decisions approved by BCB’s Board of Governors (includes Deputy Governor for supervision and Deputy Governor for resolution). - Cross-border cooperation: since 2013, Cross-border Cooperation Agreement for Santander Group with EU, Spain and UK authorities; resolution department and supervisory area jointly head Santander CMG work. - Recovery planning: - In 2016 recovery planning extended to all D-SIBs under Resolution 4,502; - Phase-in started December 2016 and will end in July 2018; thereafter D-SIBs update recovery plans annually. - Department of Resolution Regimes (Deres) created in 2016 to develop resolution plans and conduct resolvability assessments. - COPAR (strategic Resolution Committee) created January 2017 to coordinate supervision and resolution for resolution planning and assessment. - BCB participates in FSB CBCM and ReSG and was preparing a new resolution law to align with FSB Key Attributes. - Until new law passed, BCB lacks power to require changes in firms’ structures to improve resolvability. - Financial Crisis Management Plan (FCMP) revised 2017 establishes alert triggers that may lead to an “Alarm Situation.” ### Handling stress, escalation and supervisory actions (EC7, EC8, EC9) - Daily information and early warning alerts allow prompt supervisory response to severe stress. - BCB has department focused on resolution and a coordinating committee to support communication between supervision and resolution. - Early warning indicators include delinquency, provisions, credit migration, condition of individual debtors. - Supervisory escalation on signals ranges from discussions and corrective actions to prudential preventive measures or resolution strategies. - FCMP provides prior identification of actions and coordination among BCB areas and national/international authorities. - Communication and remedial monitoring: - Closing meetings held at end of on-site inspections; final conclusions communicated via Official Letter describing findings (irregularities, accounting adjustments, control weaknesses). - FI has 30 days to comply with Official Letter requirements. - Official Letter at end of supervisory cycle informs FI of SRC conclusions, scores and final grade; Letter is confidential and delivered in meeting with Board or executive directors. - Disciplinary instrument “Term of Attendance” can summon legal representatives and controlling shareholders to commit to corrective action. - Follow-up for remediation tracked via Supervision Memory System (SMF); escalation tools include Reiteration Letter (to Board), Term of Attendance, punitive administrative procedures, Watch List. ### Off-perimeter activities and restructuring (EC8) - Supervisors have authority to prevent restructuring aimed at evading regulation. - Prudential perimeter expanded by Resolution 4,280 (from 2015 onward) to include consortium managers, credit card acquirers, securitization companies, special purpose entities and investment funds where majority of risk/economic benefits held by financial conglomerate. - BCB given responsibility for authorization and supervision of significant part of Brazilian Payment System entities (Law 12,865). ### Assessment summary and recommendations (Principle 8 assessment) - Assessment: Largely Compliant. - Positive developments: twin-peak model integration, emphasis on corporate governance, formal segmentation into 5 segments enabling proportionate supervisory action. - Work on recovery and resolvability underway but incomplete; new resolution bill not yet passed at time of assessment. - Recommendation: ensure a clear decision-making process to avoid undue delay in moving to recovery or resolution if needed. ### Supervisory techniques and tools (Principle 9) — key elements - Supervisory model documented in Supervision Manual (MSU) and based on twin peaks: Monitoring (DESIG), Supervision (DESUP and DECON), Strategy/Integration/Support. - Committees for governance and integration: strategic (DIFIS Board), tactical (COFIS), operational (CTCRE, CTLIM, CTCON). - Supervisory Action Plan (PAS) sets supervisory cycle actions and budget; proposed by on-site supervisor and agreed at COMEF; PAS monitored and adjusted through year; execution recorded in SIGAS and APS. - On-site inspections can be focused, targeted (VE), or horizontal; inspections scope/intensity determined by proportionality. - DESIG notifies DESUP via SIM when irregularities or outliers detected. - Assessment: Compliant. - Comment: BCB noted for pioneering trade reporting and use in systemic risk monitoring. ### Supervisory reporting (Principle 10) — powers, standards and data systems - BCB has powers to require information on solo and consolidated basis; consolidation under Resolution 4280 and Resolution 4,193 for exposures. - Circular 3,764 allows supervision to request information as needed on non-specified dates; records retention generally up to five years (e.g., Article 85 of Circular 3467). - Standardized reports received monthly include: SCR, DLO, DRM, DRL, Cosif. - Cadocs and reporting templates captured: - Prudential Conglomerate Financial Statement (Cadocs 4060/4066 – Cosif); - Domestic Individual Entity Financial Statement (Cadocs 4010/4016); - Foreign Individual and Consolidated Financial Statement (Cadocs 4303/4313/4343); - Operational Limits Statement (Cadoc 2061 – DLO); - Liquidity Risk Statement (Cadoc 2160 – DRL); - Market Risk Statement (Cadoc 2060 – DRM); - Daily Risk Statement (Cadoc 2011 – DDR); - Credit Information System (Cadoc 3040 – SCR). - Accounting standards: COSIF (Circular 1,273) consistent with CFC and IFRS; Resolution 3,786 requires certain consolidated statements to follow IASB standards as of December 31, 2010. - Data quality and trading repositories: - Mandatory reporting to TRs for most transaction types and nearly all asset classes (examples: Sisbacen, Selic, SCR, RDE-ROF, CIP-C3, B3). - BCB data quality framework uses validation checks; many TRs operated by BCB have automatic validation procedures. - Validation and verification: - Continuous multi-stage validation on submission (XSD tests, internal consistency, external cross-checks against clearing houses, IRS, Ministry of Labor, National Social Security Institute). - Special examinations verify integrity and quality of regulatory information and controls. - Assessment: Compliant. - Comment and recommended improvement: BCB should ensure all banks also submit solo prudential returns covering standard prudential data (large exposures, related party exposure, problem assets) to strengthen solo-level supervision. ### Corrective and sanctioning powers (Principle 11) - BCB legal and enforcement powers include corrective measures, prudential preventive measures, sanctions, and intervention/resolution/liquidation (Law 4,595; Resolution 4019; Law 6,024; Decree-law 2,321; Law 9,447). - Resolution 4019 allows preventive intervention earlier than prior frameworks, including requiring corrective action based on judgmental views on internal controls and governance. - Recent legislative developments: - Provisional Measure 784 (June–October 2017) lapsed; Ordinary Law 13,506 passed mid-November, largely preserving measures including fines and sanctions. - Under Law 13,506: BCB may impose a fine up to R$2bn; fines in excess of R$50mn require automatic reexamination by a collegiate body before becoming effective. - Term of Commitment cannot be used for “serious violations” as defined in article 4 of Law 13,506; serious violations require sanctioning administrative process. - Supervisory instruments and practice: - Inspection Letter for minor deficiencies; - Attendance Order to summon managers and controlling shareholders to present corrective action plan; - Prudential preventive measures under Resolution 4019 (supplementary capital, restrictions on activities, dividends, etc.); - Watch List and heightened monitoring. - Range of possible measures includes capital requirements, operational limits, increasing liquidity, restricting activities/acquisitions, restricting dividends/compensation, asset sales, temporary special administration, intervention, extrajudicial liquidation. - BCB may apply sanctions to banks and, where necessary, to management, Board or individuals. Law 13,506 confirms powers to sanction managers, directors and auditors. - Assessment: Compliant for Principle 11 elements described (ECs). *Source: cr18340 - conclusions of the risks and controls assessment. The final score of the Risks and Controls (extracted text).* ### conclusions are then used by the Judiciary Branch to recover amounts from managers ### cr18340 - conclusions are then used by the Judiciary Branch to recover amounts from managers ### Recovery, Judiciary referral, and sanctions - Conclusions are then used by the Judiciary Branch to recover amounts from managers and board members and apply them towards the reimbursement of creditors or of the institution; and, if applicable, impose criminal sanctions. - If there are no losses to creditors, there is no obligation to forward the dossier to the Judiciary, but if a dossier is forwarded, the BCB sets out its view on why the losses were caused. - The BCB noted that absent willful misconduct, a case was unlikely to proceed. ### EC6 — Supervisor powers to take corrective actions and ring-fencing - The supervisor has the power to take corrective actions, including ring-fencing of the bank from the actions of parent companies, subsidiaries, parallel-owned banking structures, and other related entities in matters that could impair the safety and soundness of the bank or the banking system. - Description and findings re EC6: - Possible risks that the activities of holding companies and their affiliates (including non-consolidated affiliates) may bring to the safety and soundness of a bank or banking conglomerate are assessed in the SRC methodology (as described in CP12 EC1), through the Contagion Risk Module. - Contagion analysis is used by the BCB to assess how the default of one entity affects other entities in the financial system and real economy. - Resolution 4280 defines the concept of Prudential Conglomerate and establishes that BCB may determine the inclusion or exclusion of entities in order to have a better representation of qualitative and quantitative aspects of the conglomerates. - The power to take corrective actions in order to prevent safety and soundness of the bank and the banking system that arises from contagion risk is established by the Resolution 4019. The BCB may determine the following preventive prudential measures: - (ii) reduction of the risk of exposures; - (iii) increase of minimum capital levels; - (iv) adoption of more restrictive operational limits; - (v) increase of liquidity level; - (vii) restriction on payments to shareholders; - (viii) restriction on operations, new activities and acquisitions; - (ix) sale of assets. - According article 34 of Banking Law, prior to the amendments of Law 13, 506, the BCB forbade loans to certain related parties and the BCB did not approve nor authorize operations considered inappropriate among related parties. - Under Law 13,506, loans to certain related parties are forbidden if undertaken on more favorable terms than corresponding transactions with unrelated counterparties. ### EC7 — Cooperation and coordination on orderly resolution - The supervisor cooperates and collaborates with relevant authorities in deciding when and how to affect the orderly resolution of a problem bank situation (which could include closure, or assisting in restructuring, or merger with a stronger institution). - Description and findings re EC7: - As the BCB is both the supervisor and the resolution authority, most of the decisions are made inside the same organizational body, allowing responsibilities and decisions to be centralized and due action to be taken promptly. - Regarding cooperation with foreign authorities, the BCB participates in the Crisis Management Group of Banco Santander, alongside Bank of England and Banco de España. ### AC1 — Legal safeguards against undue delay by supervisors - Laws or regulations guard against the supervisor unduly delaying appropriate corrective actions. - Description and findings re AC1: - Financial supervisors are federal public servants in Brazil and must follow a strict standard of conduct provided for in federal statutes (Law 8,112, Law 8,429, Criminal Code etc.). - Breach of their legal duties must give rise to criminal and administrative sanctions, as follows: - Criminal: unduly delaying or not taking appropriate actions when necessary in order to fulfill a private interest or a personal feeling constitutes a felony according to Article 319 of the Brazilian Criminal Code (Prevarication). The sanction is imprisonment of 3 months to 1 year. - Administrative: unduly delaying or not taking appropriate action when necessary can be considered an administrative misdemeanor the Statue of Federal Civil Servants (Law 8,112). Sanctions for such misdemeanor range from a simple a warning to the dismissal of public office and shall only be applied after a thorough investigation led by the Public Institution involved in which due process must be observed. - Depending on the severity, a federal civil servant could also be prosecuted for breaching the Statute of Administrative Dishonesty (Law 8,429) which would give rise to sanctions including suspension of political rights, loss of public function, prohibition to transfer personal property and reimbursement to the Public Treasury. ### AC2 — Communication and coordination with other supervisors - When taking formal corrective action in relation to a bank, the supervisor informs the supervisor of non-bank related financial entities of its actions and, where appropriate, coordinates its actions with them. - Description and findings re AC2: - The BCB has agreements with CVM, Previc and Susep covering the exchange of confidential information and the coordination of activities involving common interests. - The agreements prescribe the communication to all mentioned entities of formal corrective actions taken in relation to a financial institution. ### Assessment — Principle 11 (summary) - Assessment re Principle 11: Largely Compliant - Comments: - The BCB has a wide range of powers and tools to impose corrective and remedial measures. - A Provisional Measure (784) which provided the BCB with greater flexibility had lapsed and the BCB was waiting for new legislation to pass in order to regain these powers. In the interim, the BCB retained its core powers to act. - Passage of replacement legislation took place mid-way through the BCP assessment. On November 13th, 2017, the president of Brazil sanctioned Law no. 13,506. The BCB issued Circular 3,857 on 14th November which complements the law and provides for the rite of the administrative sanctioning process, the application of penalties, the term of commitment, the precautionary measures, the coercive fine and the administrative agreement in the supervision process. - The BCB is attentive to real or potential deterioration in the condition and governance of an institution and is ready to use available tools to act at an early stage as well as to escalate its actions as needed. - The overall timescales of process are a possible concern; the lapse of the Provisional Measure may have reduced nuance of escalation in instruments. The replacement legislation is welcome, but there is no opportunity for the BCB to demonstrate track record for the purposes of the current assessment. - The grading of this CP also addresses remedial actions discussed in the summary comments to CP29 (AML/CFT supervisory action). ### Principle 12 — Consolidated supervision (EC1) - EC1 — Supervisor understands the banking group structure and material activities: - The BCB’s supervisory practice focuses primarily on the Prudential Conglomerate (PC) concept defined in Resolution 4280; the PC comprises not only financial entities directly controlled by the authorized bank, but also entities in the wider group and does not rely on an ownership link. - The concept allows entities such as two financial institutions both fully owned by the same foreign parent to be considered a prudential conglomerate, even when they are sister entities with no ownership or control link between them. - There is also the concept of “financial conglomerate” which depends on control/ownership relationships. Neither the prudential nor the financial conglomerate would include insurance companies, although the concept of “economic conglomerate” does include all ownership relationships, even for non-financial entities. The concept of economic conglomerate is no longer used in the supervisory approach, but information is obtained, periodically, on the financial conglomerate. - The BCB’s SRC methodology for supervision is predicated on analyzing relevant business activities within the prudential conglomerate. Aspects of SRC assisting the BCB include: - Identification of significant activities and functional activities under ARC (risk and controls assessment) based on criteria such as potential impact on capital and profits, and includes non-banking activities not supervised by the BCB. - Contagion Risk is defined as the potential for losses to entities belonging to the Prudential Conglomerate (PC), including the parent bank, arising from their relationship with: - Subsidiaries that are not consolidated within the PC; - Affiliates; - The controlling company of the parent bank; - Entities belonging to parallel structures, directly or indirectly owned by the controller of the parent bank; and - Non-consolidated entities which, irrespective of capital participation, may generate a need for future financial support, even though there is no legal or contractual obligation to provide the support. - Stress tests associated with contagion assessment are conducted to verify systemic risk and the financial institution’s soundness. The solvency and liquidity of banks are evaluated taking into account adverse scenarios for the macroeconomy, delinquency rate, market risk and confidence. - Reputational Risk is addressed: use of a common logo or brand by non-financial companies (which may or may not be part of the PC) represents a reputational risk factor; different brands recognized by the market as related to the bank or banking conglomerate is also a risk factor. - In terms of scope of consolidation, funds must be consolidated if there is evidence of substantial risk assumption on behalf of the fund. *Source: cr18340 - conclusions are then used by the Judiciary Branch to recover amounts from managers* ### 50.1 percent of the banking system’s total assets and is monitored with respect to liquidity ### 50.1 percent of the banking system’s total assets and is monitored with respect to liquidity ### Cross-border supervision and monitoring - Cross-border activities are monitored and communication with home/host supervisors is maintained through cross-border inspections, supervisory colleges and bilateral relationships. - Supervision of cross-border Agencies, Branches and Subsidiaries follows the guidelines “Supervision of Units Abroad – Orientation” with two approaches: - Type 1 (significant units): - On-site or off-site examination on a four or five-year cycle depending on supervision priority. - Evaluation of the main economic-financial indicators. - Contact with the host supervisor. - Meetings with the bank or banking conglomerate and requests for information on the condition of the cross-border establishment. - Internal audit conclusions on examinations required by the head office. - Type 2 (non-significant units): more discretionary; supervisor can use some or all Type 1 procedures if establishment represents a potential or material risk. - The BCB maintains detailed information and organizational charts on all conglomerates, including cross-border operations, held in the BCB’s information systems; further supervisory access improvements were being developed. ### Consolidated supervision framework (EC2) - The supervisor imposes prudential standards and collects and analyses financial and other information on a consolidated basis covering capital adequacy, liquidity, large exposures, exposures to related parties, lending limits and group structure. - Regulatory framework applied in Consolidated Supervision is set out in circulars and resolutions including (listed exactly as in source): - Circular 1,273 – Accounting Regulation; - Circular 3,547 – ICAAP Procedures; - Circular 3,678 – Disclosure of information regarding risk management; - Circular 3,701 – Financial statements concerning the Prudential Conglomerate; - Circular 3,748 – Leverage Ratio; - Resolution 2,283 – Operational Limits; - Resolution 2,827 – Credit Exposure Limits – Public Sector; - Resolution 2,844 – Credit Exposure Limits – Clients; - Resolution 3,380 – Operational Risk Management (*); - Resolution 3.464 – Market Risk Management (*); - Resolution 3,721 – Credit Risk Management (*); - Resolution 3,988 – Capital Management (*); - Resolution 4,019 – Preventive Prudential Actions; - Resolution 4,090 – Liquidity Risk Management (*); - Resolution 4122 – Requirements and Procedures for Authorizations; - Resolution 4,192 – Regulatory Capital Calculation Methodology; - Resolution 4,193 – Minimum Capital Requirements; - Resolution 4,280 – Scope of Consolidation; - Resolution 4,327 - Socio-environmental Responsibility; - Resolution 4,502 – Recovery Plan; - Resolution 4,557 – Risk Management and Capital Management Structures. - (*) Will be replaced by Resolution 4,557/2017 by the end of February 2018; for D-SIBs, by the end of August 2017. - Information captured on a consolidated basis: - Prudential Conglomerate Financial Statement (Cadocs 4060/4066 – Cosif), including domestic consolidated, foreign consolidated, financial conglomerate, prudential conglomerate, intragroup eliminations. - Foreign Consolidated Financial Statement (Cadoc 4343). - Operational Limits Statement (Cadoc 2061 – DLO currently contemplating the limits of Regulatory Capital, Fixed Assets and Leverage Ratio16). - Liquidity Risk Statement (Cadoc 2160 – DRL). - Market Risk Statement (Cadoc 2060 – DRM). - Daily Risk Statement (Cadoc 2011 – DDR). - Solo information captured: - Domestic Individual Entity Financial Statement (Cadocs 4010/4016). - Foreign Individual Financial Statement (Cadocs 4303/4313). - Credit Information System (Cadoc 3040 – SCR). - Banks subject to ICAAP (Resolution 3988 and Circular 3547) must assess overall capital sufficiency to cover all risks, including strategic, reputational and stress scenarios; ICAAP is differentiated between SIFIs and smaller banks. - BCB monitors capital adequacy on a consolidated basis using early warning indicators, alerts on significant variations, monitoring reports, and simulations (ANEF process). - Consolidated disclosure requirements (Circular 3,678) include conglomerates' composition, financial statements, regulatory framework, and credit exposure segregated by economic sector, country, geographic region, economic sectors, remaining maturity, delinquency and other, securitization, equity holdings, etc. - Exposure/concentration limits and risk diversification monitored on a consolidated basis; Resolution 2,844 limits conglomerates’ large exposures. 16 Circular 3,748 requires banks to compute, submit to the BCB, and disclose to the public their Leverage Ratio in accordance with Basel III metric. ### Supervisory focus on contagion, contagion risk analysis and remedial powers - BCB evaluates Contagion Risk in the SRC methodology by considering relationships between prudential-conglomerate entities and related parties, assessing potential impact on capital and profits, independence between entities, and pricing criteria to avoid conflicts of interest. - BCB may impose prudential actions (Resolution 4019) to limit risk exposure, including restricting opening of new branches or operations and requiring asset disposal; powers apply to domestic institutions and Brazilian subsidiaries of foreign banks. - The Commitment Letter (MSU 4.50.40) formalizes obligations of legal representatives and controllers to adopt corrective measures for serious deficiencies, including insufficient capital. ### Supervisory treatment of individual (solo) entities within conglomerates (EC7) - BCB’s current policy is not to supervise the solo bank within the consolidated group on a systematic basis. - Specific Examinations (on-site and off-site) can focus explicitly on a bank individually or on a consolidated basis (MSU 4.30.10). - BCB receives accounting information and monitors institutions on a sub-consolidated or standalone basis; supervisory action on an individual basis is taken if deemed necessary. - SRC methodology permits evaluation of individual business units/entities; other solo sources include SCR and market information from trade repositories such as B3 (BM&F, Bovespa and Cetip). ### Home-host relationships and cross-border cooperation (Principle 13) - BCB establishes and hosts supervisory colleges taking into account risk profile and systemic importance; supervisory colleges are periodically reviewed on average every two years or triggered by relevant events. - BCB conducts biennial supervisory colleges for Banco do Brasil and Itaú-Unibanco as home supervisor. - Information exchange practices: - As host supervisor: BCB requests detailed information from home supervisors during licensing and responds to information requests on demand; notifies home supervisors of material issues and actions taken. - As home supervisor: Brazilian banks require explicit authorization to establish subsidiaries or branches abroad and must pledge full and unrestricted access to information for BCB evaluation. - MoUs detail circumstances and types of information exchange, subject to bank secrecy laws; since 2016 BCB requests Confidentiality Agreements from participants when convening supervisory colleges. - Collaborative supervisory activities: joint inspections are permitted but none recent; BCB engages in collaborative work when common areas of interest are identified. - Cross-border crisis cooperation and resolution: - BCB is single supervisory and resolution authority; Department of Resolution Regimes (Deres) established in 2016 prepares resolution plans and conducts resolvability assessments. - BCB has a Cross-border Cooperation Agreement (CoAg) with EU, Spain and UK authorities concerning Santander; specific MoU with Banco de España for resolution strategies. - Resolution 4,502 requires D-SIBs to prepare recovery plans (process began December 2016 and will end July 2018) and update them annually thereafter. - BCB participates in FSB Resolution Steering Group (ReSG) and is preparing a new resolution law to align with Key Attributes of Effective Resolution Regimes. - Host supervisor treatment: all banks in Brazil are subject to same regulatory and supervisory requirements irrespective of foreign or domestic control; no differentiation in treatment. - Access for home supervisors: MoUs grant home authorities on-site access to subsidiaries in Brazil and require notification of planned activities. - Booking offices and shell banks: no legal provision for licensing booking offices; BCB’s licensing framework does not, in practice, permit incorporation of shell banks; Resolution 4122 requires inspection of any new institution prior to authorization and permits revocation for absence of evidence of essential operations. - Consultation before consequential action: BCB policy is to notify relevant supervisory authority and probe information received that could lead to supervisory actions. ### Assessment and key supervisory observations (Principles 12 & 13 summary) - Assessment of Principle 12: Largely Compliant. - BCB’s prudential-conglomerate methodology and use of Contagion Risk analysis provide continuous supervisory insight; however, BCB does not systematically assess individual banking entities within prudential conglomerates on a proactive solo basis. - The system relies on multiple monitoring tools which make extensive deterioration of a solo bank unlikely to go undetected, but current stance is reactive rather than proactive. - Assessment of Principle 13: Compliant. - BCB has established effective communication with peer authorities; banks reported positive experience with BCB’s international coordination. - Recommendations include enhanced formal feedback to banks after supervisory college meetings and consideration of annual supervisory colleges for institutions with systemic cross-border entities; recovery and resolution work not yet fully completed (graded in CP8). ### Corporate governance regime (Principle 14) - Legal and regulatory basis and expectations: - Corporate Law (Law 6404) sets general board responsibilities; some governance differences exist between listed and private institutions. - Resolution 4122 sets licensing conditions and conditions for membership of statutory or contractual bodies for banks. - Resolution 2,554 requires an annual report to the board on internal control framework performance. - Resolution 4557 requires board approval and at least annual review of risk management policies; CRO appointment and independence; boards must approve Risk Appetite Statement (RAS) and related policies. - Law 13,303 (2016) sets corporate governance framework for state-owned entities. - Guidance of Supervision Practices (GPS) was intended for release by end 2017 and was published in March 2018. - Corporate governance structures and committees: - Board and senior management responsibilities, audit committee, risk committee and remuneration committee requirements are set out in various regulations. - Audit committee required for banks meeting size or systemic criteria (e.g., equity equal to or greater than 1bn reais; or deposits and asset management equal to or greater than 5bn reais). - Risk committee requirements under Resolution 4,557: at least three members, majority independent, chaired by an independent member, coordination with audit committee; some sector segmentation exemptions apply. - Remuneration committee required under Resolution 3921 for publicly traded FIs or those required to have an audit committee; compensation rules include deferral and share-based elements and malus clauses. - Supervisory assessment and enforcement: - BCB assesses corporate governance via SRC and Special Examinations (VEs); BCB holds frequent meetings with board, senior management, audit committee, remuneration committee, internal audit and CRO with specified frequencies depending on supervisory cycle. - BCB has enforcement powers under Banking Law (Law 4,595) and can require removal of executives or deny managerial appointments (Law 9,447 and Resolution 4122). - Assessment of Principle 14: Largely Compliant. - BCB’s corporate governance emphasis is strong and reoriented supervisory approach (SRC and VEs) reflects this. - Some key components were still being implemented at the time of assessment (Resolution 4557 rollout timing; guidance publication timing); concern noted that unlisted banks may lack a formal board of directors and BCB should ensure expectation that prudential standards are met and monitored on a solo basis. ### Risk management process (Principle 15) - Regulatory foundation and segmentation: - Resolution CMN 4,557 of 2017 requires a continuous and integrated risk management structure effective from August 2017 for Segment 1 (S1) and from February 2018 for Segments 2 to 5 (S2–S5). - The risk management structure must be: - Commensurate with business model, nature of operations and complexity. - Proportional to magnitude and materiality of risk exposures according to criteria defined by the institution. - Adequate for the institution’s risk profile and systemic importance. - Capable of assessing risks arising from the macroeconomic environment and the markets. - Segmentation criteria (exact presentation as in source): - Segment 1: Universal banks, commercial banks, investment banks, foreign exchange banks and federal savings banks and other institutions whose size is equal to or greater than 10% (ten percent) of the Gross Domestic Product (GDP) of Brazil; or foreign assets (international activity) above USD 10 billion - Segment 2: whose size is less than 10% and equal to or greater than 1% of GDP; and whose size is equal to or greater than 1% of GDP - Segment 3: whose size is less than 1% and equal to or greater than 0.1% of GDP. - Segment 4: whose size is less than 0.1% of GDP. - Segment 5: whose size is less than 0.1% of GDP and that use an optional simplified methodology to calculate the minimum requirements of regulatory capital; and institutions that are not required to calculate PR (Patrimônio de Referência - PR), Tier 1 Capital and Core Capital. - Required elements of risk management (CMN 4,557 summary): - Policies, systems, procedures and routines for identification, measurement, evaluation, monitoring, reporting, control and mitigation of risks. - Integrated coverage across credit risk, market risk, IRRBB, operational risk, liquidity risk, socio-environmental risk and other material risks. - Establish risk limits consistent with the RAS and processes for tracking and timely reporting of exceptions. - Periodic assessment of adequacy of systems and procedures; stress testing; business continuity management; timely reporting to senior management, risk committee and board. - Existing sectoral regulations (S2–S5) addressing individual risks: - Resolution CMN 3,380 of 2006 – Operational risk management structure. - Resolution CMN 3,464 of 2007 – Market risk management structure. - Resolution CMN 3,721 of 2009 – Credit risk management structure. - Resolution CMN 4,090 of 2012 – Liquidity risk management structure. - Supervisory assessment tools and process: - Risks and Controls Assessment (SRC) evaluates ten risk types qualitatively: credit, market, liquidity, contagion, operational, reputational, strategic, IT, money laundering and consumer relationship. - ARC reports and SRC handbook guide supervisors; ARC on corporate governance to represent 30 percent of qualitative score with other risks representing 70 percent. - Supervision cycle (MSU 3.10.40) and Special Verifications (VEs) such as credit risk, market risk, liquidity risk, IRRBB, treasury operations, corporate governance, operational risk, IT reviews, AML procedures. - Corec committee reviews SRC outcomes; larger and more complex banks have shorter supervision cycles and deeper analysis. - Capital and liquidity adequacy and ICAAP: - Resolution CMN 4,557 requires liquidity policies to cover intraday to stress horizons, daily assessment for operations with maturity less than 90 days, and funding profiles adequate to liquidity risk. - Capital management framework must include assessment of total Regulatory Capital (PR), Tier 1 and CET1 commensurate with risks. - Resolution CMN 3,988 (2011) required capital management structure and a minimum three-year capital plan. - For banks with total assets above or equal to R$100 billion, an annual ICAAP report is mandatory and regularly reviewed by supervision teams. - Modelling and model validation (EC6): - CMN 4,557 requires periodic evaluation of risk management models’ adequacy and robustness, including backtesting when applicable; evaluation must be independent from model development or risk-taking units. - Board, risk committee, CRO and senior management must understand limitations and uncertainties of models, including when developed by third parties. - Regulations establish requisites and procedures for internal models for market, credit and operational risk for regulatory purposes and require rigorous testing and approval before use in regulatory calculations. - Supervisors monitor approved model outputs via DLO documents and managerial reports. *Source: cr18340 - 50.1 percent of the banking system’s total assets and is monitored with respect to liquidity* ### conclusion on the models used and their output is expressed through the corresponding ### conclusion on the models used and their output is expressed through the corresponding ### Model approval, validation, and governance - Models are subject to an ARC routine on risks and controls. - On model approval examinations, the roles of the board and the senior management are evaluated, including their knowledge of limitations and uncertainties. - Three years after approval, all models must be again submitted to an independent validation process. - Supervision teams evaluate this revalidation process when it is concluded. ### Information systems, reporting, and board/senior management oversight (EC7) - Regulatory requirement: Resolution CMN 4,557 of 2017 mandates risk management systems, including information systems adequate under normal circumstances and in periods of stress, to assess, measure and report on size, composition and quality of risk exposures. - Reporting requirements: - Must reflect the institution’s risk profile and liquidity needs. - Must be provided on a timely basis and in a suitable form to the board and senior management. - Must note any deficiencies or limitations in risk estimation and in the assumptions of quantitative models and scenarios. - Supervisory practice: - Supervision assesses how corporate risks are captured and reported regularly and timely to the board and senior management. - Management reports expected to provide a comprehensive view (solo and consolidated) enabling identification, prevention and timely correction of risk control and management deficiencies. - During VEs supervision teams assess clarity, quality, timing and regularity of risk reports (examples cited: market risk – MSU 4.30.10.50.02.03 –, liquidity risk – MSU 4.30.10.50.02.02 –, credit risk MSU 4.30.10.50.01.01). - Assessment also performed in SRC and via ARC routines on strategic risk control and corporate governance. ### New products, material modifications, and board approval (EC8) - Regulatory requirement: Resolution CMN 4,557 of 2017 requires board-approved policies, procedures and controls to ensure prior identification of risks inherent to: - a) New products and services; - b) Material modifications to the existing products or services; - c) Material changes in processes, systems, operations and the institution’s business model; - d) Hedge strategies and risk-taking initiatives; - e) Material corporate reorganizations; and - f) Changes in the macroeconomic perspectives. - Board responsibilities: approve relevant changes induced by these risks in risk management policies, strategies, systems, routines and procedures. - Supervisory practice: - VE examinations include review of new product approvals, dossiers and samples compared to policy; conclusions feed SRC. - New products include those developed by the bank or by a third party and purchased or distributed by the bank. ### Risk management function resourcing, independence, and reporting (EC9) - Regulatory requirement: Resolution CMN 4,557 of 2017 requires periodic submission of risk and capital management processes to internal auditing and mandates a segregated risk management unit staffed by certified expertise. - CRO independence: - Institution must establish conditions for CRO independence and CRO’s direct and exclusive access to the risk committee, CEO and board. - CRO must have access to all necessary information. - Supervisory practice: - VEs assess independence, resources and authority of risk management to challenge front office decisions (examples: credit risk MSU 4.30.10.50.01.01, market risk MSU 4.30.10.50.02.03, liquidity risk MSU 4.30.10.50.02.02, operational risk MSU 4.30.10.50.11, corporate governance MSU 4.30.10.50.06.01). - Evaluated also in SRC via ARC routines; internal audit findings are considered. ### Chief Risk Officer requirements and dismissal protocols (EC10) - Regulatory requirement: Resolution CMN 4,557 of 2017 requires appointment of a CRO responsible for the risk management unit. - CRO responsibilities (must be stated in bylaws): - a) Oversee development, implementation and performance of the risk management structure; - b) Implement policies, processes, reports, systems and models consistent with RAS and strategic goals; - c) Provide training on risk management policies, processes, reports, systems and models, including third-party models, to risk management staff; - d) Provide support and participate in strategic decision-making related to risk management and, where applicable, capital management, as an advisor to the board. - Permitted functions: Provided absence of conflicts of interest, CRO may perform other functions including capital adequacy assessment. - Appointment and dismissal: - Board must approve appointment and dismissal. - Dismissal must be timely disclosed on the institution’s website and reasons communicated to BCB, which may require additional information. - Historical context: prior resolutions (CMN 3,380 of 2006; CMN 3,464 2007; CMN 3,721 of 2009; CMN 4,090 of 2012) already prescribed senior staff responsible for risk management; many larger banks already had CROs before Resolution CMN 4,557 of 2017. - Supervisory practice: VEs and ARC routines examine roles and robustness of those in charge of risk management; supervision teams regularly meet boards and high-level committees. ### Standards covering major risk types (EC11) - Resolution CMN 4,557 of 2017 requires an integrated risk management structure covering: - Operational risk (formerly CMN 3,380 of 2006), - Market risk and interest rate risk in the banking book (formerly CMN 3,464 of 2007), - Credit risk (formerly CMN 3,721 of 2009), - Liquidity risk (formerly CMN 4,090 of 2012), - Socio-environmental risk (addressed by CMN 4,327 of 2014), - Other risks deemed material by the institution, including those not considered in RWA. - Implementation timing: - Effective from August 2017 for institutions allocated to S1, and from February 2018 for institutions allocated to S2, S3, S4 or S5. - Supervisory action: Banking Supervision Department working to make standards public in summarized SRC guidelines. ### Contingency arrangements, business continuity, and recovery plans (EC12) - Regulatory requirements (Resolution CMN 4,557 of 2017): - Risk management structure must include documented policies and strategies for business continuity management covering: - a) Business impact analysis identifying and classifying critical business processes and assessing potential effects from disruptions; - b) Strategies to ensure continuity and limit losses from disruptions; - c) Business continuity plans with procedures and deadlines for resumption and recovery, and communication actions; - d) Tests and revisions of business continuity plans with adequate frequency. - Institutions required to have liquidity and capital contingency plans that are regularly reviewed and establish responsibilities, strategies and procedures for stress conditions. - Board must approve and review, at least annually, business continuity policies, liquidity contingency plan and capital contingency plan. - Stress test program required; stress test results must be used in strategic decisions, risk appetite revisions, policy revisions, assessment of capital and liquidity, and development of contingency and recovery plans (Resolution CMN 4,502 of 2016). - Supervisory practice: - VEs assess feasibility of actions, sources, timing, governance and regular tests for contingency plans (relevant MSUs cited). - SRC evaluates these plans via ARC routines on liquidity risk control, operational risk control and strategic risk control. - Recovery plans (Resolution CMN 4,502 of 2016) required for institutions with a critical role or significant level of exposures: - Definitions: - Critical roles: activities whose discontinuity may endanger financial stability and functioning of the economy, as determined by the BCB. - Significant level of exposures: established as superior to 10 percent of the ratio Exposures/GDP. - Recovery plan minimum contents: - a) Critical roles and essential services performed by each entity; - b) Monitoring program with quantitative and qualitative information; - c) Stress test scenarios; - d) Recovery strategy and criteria for operationalization; - e) Communication plan; - f) Constraints and risks to effectiveness of recovery strategies and execution; - g) Governance mechanisms necessary to execute the recovery plan. - BCB powers: may require inclusion of additional activities, indicators, stress scenarios, and may determine total or partial execution of the recovery plan. - Implementation status: - Phased-in schedule for submitting recovery plans to BCB ended on December 31st, 2017, but supervision teams had already started evaluating drafted documents. ### Stress testing program requirements and supervisory assessment (EC13) - Regulatory requirements (Resolution CMN 4,577 of 2017): - Stress test program must: - a) Include all material risks; - b) Assess impact of significant risk concentrations; - c) Use sensitivity analysis (for institutions allocated to S1, S2, S3 and S4), scenario analysis (for institutions allocated to S1 and S2) and reverse stress test (for institutions allocated do S1); - d) Prescribe the use of assumptions and parameters that are adequately severe; - e) Be clearly documented; - f) Be performed in an integrated manner across risks and business areas (for institutions allocated to S1, S2 and S3), considering different levels of aggregation of exposures and the prudential conglomerate as a whole; - g) Consider adverse effects from interactions between risks (for institutions allocated to S1, S2 and S3) and prescribe use of a common scenario when scenario analysis is required. - Stress test results must be used in identification, measurement, evaluation, monitoring, control and mitigation of risks; strategic decisions; revision of risk appetite; revision of policies, strategies and limits; structured communication; assessment of capital and liquidity; capital adequacy assessment; and recovery plans. - Complementary use: stress test program must be used to assess adequacy and robustness of assumptions and methodologies related to models. - Senior management and board involvement: must be actively involved, indicate guidelines and approve scenarios where required; board must approve and review, at least annually, the stress test program. - Supervisory practice: - Desup performs regular evaluations of banks’ stress test processes during VEs; consideration of stress test results by senior management and board is assessed in VEs (examples cited). - Supervision findings communicated to bank staff who must design working plans to correct shortcomings. - Assessment of stress tests included in SRC via corresponding ARC routines. - ICAAP review gathers deficiencies on stress test concepts, tools, scenarios and model outputs; banks must adjust identified deficiencies until the next report. ### Internal pricing, performance measurement and new product approval (EC14) - Regulatory requirement: risk management structure must include policies, procedures and controls to ensure prior identification of risks inherent to new products, material modifications, material operational changes and hedge strategies (same list a–f as EC8). - Supervisory practice: - VE examinations verify that new products were assessed from a risk perspective by reviewing lists and dossiers of approved products and sampling for compliance with internal approval policy; lack of evidence is reported and a correction plan required. - SRC quantitative evaluation: supervisory teams analyze results vis-à-vis risk taken using ANEF (financial and economic assessment of results – specifically P&L). - Metrics used: - RORWA (return on risk weighted assets) — considers bank P&L based on amount of risk assumed, on a standardized calculation, enabling supervisors to assess extent to which risk has been priced into products and business activities. - RORWA is compared with return of the bank’s cluster for peer comparison. - Managerial figures, including RAROC, are also assessed to grant the bank an overall grade. ### Policies for other material risks (AC1) - Resolution CMN 4,557 of 2017 requires risk management structure to cover operational, market, credit, liquidity, socio-environmental and other risks deemed material by the institution, including those not considered in RWA. - ICAAP reports must include strategies and procedures to manage other risks with explicit reference to reputational, strategic and contagion risks. - Supervisory guidance: - SRC handbook provides guidance for evaluation of contagion risk, reputational risk, strategic risk, IT risk, money laundering risk and consumer relations’ risk. - SRC requires supervisors to consider interaction between different types of risk. - ANEF states that “Pilar 2 risks” should impact the evaluation on the adequacy of capital held by the bank. - ARC routine on strategic risk control assesses processes for identifying material risks. ### Assessment summary and introduction to capital adequacy (Principle 15 & Principle 16 intro) - Assessment of Principle 15: Compliant. - Comment: Regulatory and supervisory frameworks collectively promote a comprehensive risk management culture and frameworks in banks operating in Brazil. Frameworks require compliance with key elements of risk management (identify, measure, monitor and manage) and comprehensive scope to cover all material risks proportionate to materiality, risk profile and systemic relevance through the segment approach. Regulations are comprehensive with detailed expectations for credit, market, operational and liquidity risk management frameworks and related governance. Recovery and resolution planning work is progressing for large banks; stress testing and contingency planning requirements assist in assessing resilience and preparedness in other banks. - Transition to capital adequacy (Principle 16): - BCB implemented Basel II in 2007 with a minimum total regulatory capital ratio of 11 percent. - BCB introduced Basel 2.5 effective 1 January 2012. - BCB implemented Basel III effective 1 October 2013 covering revised definition of capital, capital requirements, capital buffers, CVA, exposures to CCPs, securitizations, and Pillar 3. - Regulations issued in 2015 define computation methodology of the Systemic buffer (effective 2017), the Countercyclical Basel III Buffers (currently at zero percent) and the Basel III leverage ratio (effective 2018). - The timeline was slightly later than global start date of January 1, 2013 but includes accelerated transitional arrangements such that Common Equity Tier 1 (CET1) of 4.5 percent is the minimum from 1 October 2013 (compared with Basel III phase-in arrangements that require a CET1 minimum of 3.5 percent in 2013). - There is a corresponding reduction in Brazil’s current 11% total minimum capital requirement to bring it into line with the Basel minimum of 8 percent by *Source: cr18340 - conclusion on the models used and their output is expressed through the corresponding* ### 2019. Please see Table 2 below for the minimum capital requirements established under ### Minimum Risk-Based Capital Requirements During the Implementation Period (cr18340 - 2019) ### Capital framework and regulations - Key regulatory instruments and dates: - Resolution CMN 4,192 of 2013: current definition of regulatory capital. - Resolution CMN 4,193 of 2013: minimum required amount in each category of regulatory capital (PR) per Basel III definitions; explicitly requires computation and maintenance of capital for interest rate risk in the banking book (IRRBB). - Resolution CMN 4,557 of 2017 (issue formerly addressed by Resolution CMN 3,988 of 2011): requires banks to assess and maintain capital to face all relevant risks. - Circular BCB 3,768 and Circular BCB 3,769, both of 2015: define computation methodology of the Systemic and the Countercyclical Basel III Buffers, respectively. - February 2017: BCB issued regulations on capital management applied in a graded manner to institutions in segments S1 to S5. - August 2017: capital adequacy requirements for prudential conglomerates apply at the level of the prudential conglomerate (consolidated). - Basel III compliance: - Regulations are compliant with Basel III criteria in composition requisites and loss-absorbing characteristics. - Brazil assessed under the Basel Committee RCAP in 2013; Brazilian capital framework considered “Compliant” with the Basel Committee minimum requirements. ### Segmentation, scope, and systemic buffers - Segmentation and applicability: - Graded application to segments S1 to S5; Pillar 2 ICAAP applies only to S1 institutions; a simplified ICAAP planned from 2018 for S2 institutions. - Institutions with total exposure equal to or greater than 10% (ten percent) of nominal GDP of Brazil or total consolidated foreign assets equal to or greater than USD10 billion are included in S1 segment. - The capital regime applies in its entirety (Pillars 1, 2 and 3) to S1 institutions. - Five banks in Brazil have been determined as D-SIBs and are required to establish a systemic capital buffer, which is in transition stage. - Prudential consolidation: - Scope includes financial institutions and financial-related entities and vehicles that can bring risks to the economic group (payment institutions, private equities, securitization companies, factorings and funds with material retention of risks and benefits). - Buffers and constraints: - Circular BCB 3,768 of 2015 sets methodology for D-SIB higher loss absorbance capital buffer (Resolution CMN 4,193 of 2013). - Circular BCB 3,769 of 2015 sets procedures for Countercyclical Capital Buffer (Resolution 4,193 of 2013) reflecting geographical location of exposures. - Dividend pay-out restrictions and compensation limits apply when an institution breaches the capital conservation buffer and the countercyclical buffer. ### More conservative elements relative to Basel - Regulatory features that are more conservative than Basel: - Banks’ fixed assets should be less than 50 percent of total capital; any excess must be deducted from regulatory (CET1) capital. - Mortgages with a Loan-to-Value (LTV) lower than 80 percent receive a risk weight (RW) of 35 percent or 50 percent; RW for higher LTVs is 75 percent or 100 percent. - DTAs not deducted from CET1 attract a 300 percent RW (Basel recommended 250 percent). - Holdings of Additional Tier 1 and Tier 2 capital instruments issued by other financial institutions must be deducted fully from the respective capital tier. ### Deferred Tax Assets (DTAs) and Deferred Tax Credits (DTCs) - Aggregate and composition: - Aggregate gross DTAs around R$280 billion; loan loss provisions account for about 55 percent of total DTAs. - DTAs arising from loan loss provisions amounting to R$146 billion are included in CET1 capital and constitute about 25 percent of CET1 capital. - Legal treatment and conversions: - Law No. 12,838 of July 2013 allows banks to convert DTAs arising from loan loss provisions into eligible tax credits (DTCs) when the bank’s taxable income in any year is negative (loss) or when the bank is bankrupt or subject to extra-judicial liquidation; DTAs arising from other causes are not eligible. - Banks with eligible DTCs may claim compensation in the form of cash or securities issued by the central government. - About 3 banks under resolution have claimed compensation in lieu of DTCs for about R$ 450 million and are awaiting issue of government securities; the claim of one bank (for R$ 36 million) has been recently approved by the Government. - Basel Committee view: - RCAP recognizes such DTCs as capital in cases where the law supports this treatment. ### Pillar 2, ICAAP, and capital add-ons - ICAAP implementation: - Since 2013, ten institutions met criteria to implement an ICAAP: (a) total assets over one hundred billion Reais, and (b) authorized to use internal models of market risk, credit risk or operational risk or part of a financial conglomerate with total assets over one hundred billion Reais and composed of at least one multiple bank, commercial bank, investment bank, development bank, exchange bank or savings bank. - With segmentation, 6 of these institutions are currently in Segment 1 and hence required to implement ICAAP. - ICAAP reports are reviewed annually as part of capital adequacy analysis. - Pillar 2 add-on framework (established September 2017): - Two categories of quantitative Pillar 2 capital add-on: - Reference add-on: using benchmark models to address risks not adequately captured by Pillar 1; initially operational risk, IRRBB and credit concentration risk; envisioned for ICAAP banks only, may be extended to non-ICAAP banks. - Structured add-on: focused on final grade from the supervisory process (SRC); aims to improve risk management and applies to all banks; final grade approved by BCB’s Risk and Control Assessment Committee (COREC); after COREC approval, Board of Directors notified. - Add-on notification process: two steps — notification of weaknesses (category 1 or 2), and if weaknesses persist at end of next SRC cycle, Pillar 2 capital add-on will be required. Process expected to be initiated during the second semester of 2017. - Breach of Pillar 2 add-on requirement subject to supervisory actions under Resolution CMN 4,019 of 2012, including more stringent controls, reduction of risk exposures, and limits on compensation, dividends, selected transactions, new business lines, acquisitions, and opening of branches/subsidiaries. ### Risk coverage, approaches used, and supervisor powers - Required capital coverage: - Regulations require capital for credit risk, market risk and operational risk. - On-balance sheet and off-balance sheet risks are included in prescribed capital requirements (Resolution CMN 4,193 of 2013). - BCB advises banks to maintain capital for IRRBB; not formal Pillar 1 but considered in supervisory capital adequacy assessment. - Approaches in use: - All banks currently using the ‘standardised’ approach for credit risk. - Operational risk: either Basic Indicator Approach (BIA) or Alternative Standardised Approach (ASA). - Market risk: only two institutions permitted to use internal models approach; requests from two other institutions under consideration. - Supervisor powers: - BCB can impose preventive prudential measures: reduction in degree of risk of exposures, add-on to minimum regulatory capital, or more restrictive operational limits (Resolution CMN 4,019 of 2011). - The supervisor does not see a need for additional hard-wired thresholds; prefers ability to engage before breach of formal threshold. ### Use of internal models and supervisory approval process - Regulatory allowance and current usage: - Regulations allow use, upon BCB approval, of internal models for credit, market and operational risk assessment (Resolution CMN 4,193 of 2013). - Methodologies for internal models: Circular BCB 3,646 of 2013 (market risk), Circular BCB 3,647 of 2013 (operational risk), Circular BCB 3,648 of 2013 (credit risk). - Internal guidance for model validation is conservative; standards must be followed on an ongoing basis. - As of the report: two banks adopt internal models for market risk; requests from two other banks under processing; no bank authorized to use internal models for credit risk (IRB) or operational risk (AMA); no formal applications yet received for IRB and AMA. - Four-phase supervisory approval process for internal models: 1. Pre-application: bank must have a sound market risk management process as attested by supervisory team; inspections may be required before application. 2. Assessment of documentation: mainly offsite; checks remittance of minimum information to BCB; additional information may be required before next phase. 3. Onsite examination: intermittent process with examiners from four dedicated teams responsible for continuous supervision of the bank, market risk, information technology, and quantitative analysis; this phase may take several years. 4. [Phase 4 not included in supplied content.] *Source: cr18340 - 2019* ### 4. Approval by the Internal Models Committee: when all dedicated teams are ### 4. Approval by the Internal Models Committee: when all dedicated teams are satisfied, the application is submitted to this committee, composed of the head and the four deputy heads of the Department of Banking Supervision. The committee decides upon the approval and on the amount of the qualitative add-on. ### Supervisory capacity and dedicated teams - Assessment of internal models by the BCB began in June 2010. - Assessment is performed by the team directly responsible for supervising a bank plus three specialized teams: - Market Risk: 5 members, dedicated partially (around 15–20 percent of the time) to assessment of internal models of market risk. - Information Technology: 7 members, dedicated partially (around 5–10 percent of the time) to assessment of internal models of market risk. - Quantitative Analysis: installed in 2006, mainly devoted to assessment of internal models; 5 members, dedicated partially (around 15–20 percent) to assessment of internal models of market risk (for capital purposes). Large portion of time devoted to evaluating risk models used for credit risk provisions and capital requirement of interest rate risk of the banking book. ### Internal model validation and regulatory requirements - Regulations (Circular BCB 3,646 of 2013; supervisory guideline “Internal Validation”) set clear and comprehensive validation requirements including, at minimum: - Evaluation of methodologies, assumptions and theoretical foundations; mapping of positions and pricing methods. - Accuracy and appropriateness of assumptions of volatility and correlation; inclusion of all relevant risk factors. - Comprehensiveness, consistency, integrity and reliability of input data and independence of their sources. - Consideration of characteristics of new products impacting market risk. - Adequacy of compliance tests and stress tests, suitability of reports and their use in measurement, monitoring and managing market risk. - Adequacy of internal controls related to the model. - Adequacy of technological infrastructure, operation of systems, including testing, approvals and certifications. - Compatibility of operating system calculations with logic of assumptions and methodologies. - Integrity, completeness and adequacy of model documentation, and content and scope of risk measurement reports. - Additional requirements: - Institution’s responsibility for validation process. - Validation at least once in three years. - Tests should include hypothetical portfolios. - Independence and insulation from pressures; documentation and reporting to the board. ### Internal audit requirements for models - Internal audit (as defined in Circular BCB 3,646) must include, at least: - Checks on effectiveness of validation process. - Checks on process validation after relevant changes in model or risk profile. - Review of management structure of market risk; integration of internal model into daily management including stress testing. - Review of backtests and effective use for model performance and improvement. - Compliance with risk management policies, including structural limits. - Verification of sufficient and technically qualified professionals in business, operational, risk management, information technology, and other areas involved. - Verification of integrity and adequacy of management information systems. - Involvement of senior administration in market risk management and timeliness and quality of information to the board. - Internal audit must be independent from teams responsible for development, use and validation of the risk model. ### EC6 — Supervisor powers and capital management (forward‑looking) - Supervisor powers include requiring banks to adopt a forward-looking approach to capital management, including stress testing. - Supervisor may require banks: - a) To set capital levels and manage available capital in anticipation of possible events or changes in market conditions that could have an adverse effect. - b) To have feasible contingency arrangements to maintain or strengthen capital positions in times of stress, appropriate to risk profile and systemic importance. - Regulatory requirements for capital management (Res 3988 of 2011; Res 4557 of 2017) — key minimum elements: - Mechanisms to identify and evaluate relevant risks, including risks not covered under regulations. - Clearly documented policies and strategies for capital management. - Capital plan with a minimum three-year horizon. - Stress testing and assessment of impacts on capital. - Periodic reports to senior management and the board on capital adequacy. - Internal Capital Adequacy Assessment Process (ICAAP). - Capital plan must include capital target and projections, main capital sources, and a capital contingency plan. - Revised Res 4557 of 2017 requires institutions in segments S1, S2, S3 and S4 to implement capital management structures to monitor and control capital, assess necessary capital, and plan capital targets considering strategic goals. - Revised requirements include maintaining total regulatory capital, Tier 1 and CET1 compatible with risks; systems and procedures for capital management; assessment of stress test impacts; capital contingency plan; capital adequacy assessment; timely reports to senior management, risk committee and board. ### Stress testing requirements (Resolution 4,577 of 2017) - Stress test program requisites include, among others: - (a) Encompass all material risks, including risk concentrations. - (b) Use assumptions and parameters that are adequately severe. - For institutions in S1, S2 and S3, stress testing must: - (i) Be performed in an integrated manner across risks and business areas. - (ii) Consider different levels of aggregation of exposures and the prudential conglomerate as a whole. - (iii) Consider adverse effects arising from interactions between risks. - Stress test results must be considered in: - (a) Revision of risk appetite levels. - (b) Revision of policies, strategies and limits for risk and capital management. - (c) Assessment of institution’s capital and liquidity and development of contingency plans. - (d) Capital adequacy assessment. - (e) Preparation of recovery plans. - Supervisors review capital adequacy and capital management framework during supervisory cycle via on-site visits and engagement with senior management and board; capital plans reviewed as part of SREP and ICAAP, referencing bank business plans and stress testing results and BCB stress testing outcomes. ### AC1 — Capital framework consistency (non‑internationally active banks) - Capital definition, risk coverage and methodology to calculate minimum capital requirements according to Basel recommendations apply to all institutions licensed by the BCB. - Simplified methodology for credit cooperatives (Resolution 4,194 of 2013) may be adopted if: - a) Total assets under R$100 million for central credit cooperatives. - b) Single credit cooperatives may not have exposures in gold, foreign exchange, commodities, stocks, derivatives, securitizations, repos (with a few exceptions) and investment funds (with a few exceptions). - Resolution 4,194 of 2013 is under review; scope of institutions allowed to use simplified methodology is likely to be extended. ### AC2 — Distribution of capital within group entities - Regulations and supervision do not explicitly require distribution of capital among different entities in the prudential conglomerate. - Compliance with regulatory capital requirements is verified on a consolidated basis (Resolution CMN 4,280 of 2013). - Supervisory contagion analyses assess risks to supervised institution arising from group entities, but do not necessarily focus on entity-level capital adequacy relative to entity risk exposures. ### Assessment of Principle 16 — summary and key figures - Assessment: Compliant. - Comment highlights: - Basel III implementation in Brazil; Basel Committee assessed capital rules as compliant. - Law No. 12,838 of July 2013 allows banks to convert DTAs arising from loan loss provisions into eligible tax credits (DTCs) when taxable income is negative or bank is bankrupt/subject to extra-judicial liquidation; DTAs from other causes not eligible. - DTCs can be claimed in cash or securities issued by the central government where law supports it. - DTCs arising from loan loss provisions amount to R$146 billion and constitute about 25 percent of CET1 capital. - Banks expect full transition by 1 January 2019. - Pillar 2 ICAAP applies only to S1 institutions; simplified ICAAP planned from 2018 for S2 institutions. - Prudential capital requirements currently apply only at consolidated level; BCB yet to establish thresholds to trigger supervisory action. - Areas for improvement suggested: - (a) Require individual banks within prudential conglomerate to comply with capital requirements at solo level. - (b) Require prudential conglomerates to ensure adequate distribution of capital within different entities according to allocation of risks. - (c) Establish thresholds by reference to which supervisory action might be triggered, preferably before breach of minimum requirements. ### Principle 17 — Credit risk: key regulatory framework and supervisory findings - Principle 17 assessment: Compliant. - Regulatory basis: - Banking Law (Law 4,595 of 1964). - CMN Resolutions: CMN 3,721 of 2009; CMN 4,557 of 2017; CMN 2,554 of 1998; CMN 4,122 of 2012; CMN 2,682 of 1999; CMN 4,007 of 2011; CMN 3,658 of 2008. - EC1 — bank-wide credit risk management processes: - Requirements include clearly documented policies; validation of systems/models; estimation of losses with comparisons to actual losses; debt recovery procedures; systems to identify, measure, control and mitigate credit risk at individual and aggregate levels; adequacy of regulatory capital and provisioning; evaluation taking into account market and macroeconomic conditions; limits establishment; documentation and monitoring. - EC2 — board approval and review: - Policies and strategies must be approved and reviewed at least once a year by board. - Systems, routines and procedures to identify, measure, control and mitigate credit risk must be reviewed at least once a year. - Board must ensure compensation structure does not encourage imprudent risk-taking. - Credit risk management must be performed by a unit segregated from business trading units and internal audit. - Institutions must appoint a director responsible for credit risk management. - Revised integrated risk regulations apply to S1 from August 2017 and to other banks from February 2018. - EC3 — controlled credit risk environment: - Supervisory examination procedures assess control framework; identification, evaluation and assessment; specific controls; monitoring; communication and information. - Supervisory off-site monitoring includes technical meetings, management/internal/external audit reports, and BCB Monitoring Department data. - SCR (BCB Credit Information System) provides historical loan and credit exposure data; data available per-operation for counterparties with total exposure larger than BRL200; otherwise consolidated on a per-type basis. - EC4 — monitoring total indebtedness and unhedged FX risk: - Resolutions CMN 4,557 of 2017 and CMN 3,721 of 2009 require credit limits, routines to identify/measure/monitor/mitigate credit risk, and assessment processes taking into account borrower financial capacity (implicitly including total indebtedness). - Resolution CMN 2,682 of 1999 sets minimum set of risk factors; Resolution CMN 4,007 of 2011 extends to other instruments. - Res 4,557 of 2017 explicitly includes unhedged foreign exchange risk as a credit risk factor. - EC5 — arm’s-length decisions and conflict of interest: - Resolutions CMN 4,557 of 2017, 3,721 of 2009 and CMN 2,554 of 1998 forbid CRO, risk management directors and senior risk staff from activities involving conflicts of interest (e.g., being part of credit origination). - Supervisory procedures require verification of segregation between origination and credit risk management. - EC6 — board/senior management decision on large or risky exposures: - Resolution CMN 4557 (effective for S1 in August 2017; for other banks February 2018) requires board or senior management to decide on exposures that: - a) Exceed a certain amount or percentage of the bank’s capital; - b) Are especially risky; - c) Are not in line with the mainstream of the bank’s activities. - Examination procedures (MSU 04-30-10-50-01-01, Section 3.1) previously required supervisors to verify board/senior management deliberation for exposures exceeding established quantitative limits or incompatible with risk profile/products. - EC7 — supervisor access to information: - Banking Law (Law 4,595 of 1964) grants BCB access to all data necessary for supervisory activities. - Complementary Law 105 of 2001 establishes that bank secrecy does not apply to BCB during supervisory duties. - Institutions must periodically send accounting and regulatory capital reports and data on credit risk exposures to the SCR (Resolution CMN 3,658 of 2008). - BCB has full access to settlement system data, custody and clearing systems. BCB may request information on cross-border operations (Resolution CMN 2,723 of 2000). - EC8 — integration of credit exposures into stress testing: - Resolution CMN 4,557 of 2017 and CMN 3,721 of 2009 are the regulatory framework for stress testing; supervisory procedures require review of stress testing frameworks and their use by banks (MSU 04-30-10-50-01-01, Section 3.3.4). - Supervisory approach: - Supervisors combine on-site and off-site processes, interviews with senior management and audit committees, reviews of ICAAP and SREP, and monitoring via SCR and BCB Monitoring Department to challenge bank systems and verify outputs. ### Principle 18 — Problem assets, provisioning and reserves - Principle 18 assessment: Compliant. - EC1 — identification and management of problem assets: - Regulations require institutions to estimate losses according to consistent and prudent criteria; procedures for debt recovery; adequate provisioning; evaluation of exposures considering market and macroeconomic prospects; clearly defined procedures for granting/renegotiation/periodic collateral evaluation; classification of operations on consistent and verifiable criteria; documentation and storage of loss information (Resolution CMN 3,721 of 2009). - Revised integrated risk regulations (Resolution CMN 4,557 of 2017) effective for S1 from August 2017 and for other institutions from February 2018 require: - A) Classification of exposures considering economic and financial circumstances, collateral mitigation, and period of delinquency. - B) Exposures are problem assets when at least one of: - a) Obligation more than 90 (ninety) days past due. - b) Indications obligation will not be fully paid without collateral or guarantee being triggered. - C) Instances considered as inability to fully pay include: - a) Institution considers counterparty no longer has financial capacity to pay under contracted terms. - b) Institution recognizes, for accounting purposes, significant deterioration in credit quality. - c) Exposure has been forborne. - d) Institution files for counterparty’s bankruptcy or similar measure. - e) Counterparty files plea or undergoes court order that limits/delays/precludes payment. - D) Problem assets may be reclassified as performing only when evidence exists that counterparty can meet obligations under contracted terms; criteria must be established and documented. - Resolution CMN 2,682 of 1999 requires institutions to rate exposures from “AA” to “H” according to expected credit loss, except exposures lower than BRL 50,000 classified only on number of days past-due; institutions must adopt loan classification, provisioning and write-off frameworks; periodic review of credit ratings and provisions monthly for payment delays, every 6 months for single client/group operations representing 5 percent or more of capital base, or every 12 months for other cases. - Minimum provisioning requirements (as summarized): - Arrears in Days — Credit Classification — Required Loan-Loss Provision - Under 15 — AA — 0.50% - 15–30 — B — 1% - 31–60 — C — 3% - 61–90 — D — 10% - 91–120 — E — 30% - 121–150 — F — 50% - 151–180 — G — 70% - 180–360 — H — 100% - Over 360 — Transferred to Compensation Account — 100% - Notes: - National Monetary Council Resolution n. 2,697 of 2.24.2000: until 3.31.2000 applies to borrowers with balances above R$500 thousand, and until 7.31.2000 also to borrowers with credit balances between R$50 and R$500 thousand. Exceptions apply for certain types of credits. - Credit operations classified in level H must be transferred to Compensation Account—debit in the loan-loss account—six months after being assigned this risk level. - Flexibility provisions: - Banks must classify problem assets at least at Risk level ‘E’ regardless of delinquency; supervisors may accept lower risk levels if bank proves expected credit losses are less than 30 percent. - Less strict approach for exposures with maturities exceeding 36 months: number of days in arrears doubled (Art 4, Para 2, Res 2682 of 1999). - Collateral value considered for classification and provisioning, but classification determined by days past due irrespective of collateral availability/value (Resolution CMN 4,557/2017 article 23, VI, VII, XIV and §1st; Resolution CMN 2,682/1999 articles 2nd and 6th). Banks expected to maintain minimum provisioning levels stipulated in regulations. - Treatment of renegotiation and restructuring: - Renegotiation: any modification of contractual loan terms (Resolution CMN 2,682/1999). - Restructuring/forbearance: a renegotiation that implies advantages to counterparty due to deterioration in credit quality (Resolution CMN 4,557/2017). Forborne exposures must be classified as problem assets. - Revised regulations treat restructured exposures as problem assets for S1 (effective August 2017) and will apply to S2–S5 from February 2018. *Source: cr18340 - 4. Approval by the Internal Models Committee: when all dedicated teams are satisfied, the application is submitted to this committee, composed of the head and the four deputy heads of the Department of Banking Supervision. The committee decides upon the approval and on the amount of the qualitative add-on.* ### 2018. Until then, for renegotiated exposures, which includes forborne exposures, ### cr18340 - 2018. Until then, for renegotiated exposures, which includes forborne exposures, ### EC2 — Supervisor evaluates adequacy of grading, classification and provisioning frameworks - Supervisor determines adequacy of a bank’s policies and processes for grading and classifying its assets and establishing appropriate and robust provisioning levels; reviews supporting the supervisor’s opinion may be conducted by external experts, with the supervisor reviewing the work of the external experts. - Revised regulations (4557 of 2017) require banks to have a framework for estimating expected losses that must consider: - a) The classification of the exposure; - b) The current macroeconomic environment and expected changes in the short-term; - c) The probability of the exposure becoming a problem asset; - d) The expectation of a credit recovery, including costs of collection and timelines for collection. - Expected loss estimate must be revised: - a) Semiannually or: - b) Monthly, when the exposure is past due; and - c) Immediately, when the exposure becomes a problem asset. - On-site inspections goals: - (i) compliance with regulation and assessment of adequacy and efficacy of risk management frameworks to ensure sufficient provisioning to face expected credit losses; - (ii) avoid overexposure to credit risk. - On-site inspection practices: - sample exposures selected (randomly or based on evidence in the Credit Information System (SCR)); - supervisors assess compliance with regulation, borrowers’ creditworthiness, adequacy and sufficiency of guarantees and collateral; - comparisons made with banks’ risk-management analyses and credit classification. - Supervisors assess credit risk exposure aggregates: non-performance risk, concentration risk, mitigation risk, settlement risk and counterparty credit risk. - Supervisors may require modifications to banks’ risk management frameworks, impose specific credit classification and provisioning levels for sampled exposures, extend such requirements to similar exposures (Resolutions CMN 3,721 of 2009, CMN 4,557 of 2017, CMN 2,682 of 1999 and CMN 4,019 of 2011). - External auditors provide a detailed report twice a year (June and December) reviewing criteria for credit ratings and adequacy of provision levels; these reports are an additional information source but do not substitute supervisors’ own opinions. ### Interest recognition and renegotiated/forborne exposures (regulatory constraints) - Regulations establish that renegotiated exposures, which includes forborne exposures, cannot be assigned a better risk classification until there is significant amortization or when new relevant facts are presented, such as new, liquid and sufficient collateralization (Resolution CMN 2,682/1999). - Institutions cannot recognize through Profit & Loss account interest on loans that are past-due for 60 days or longer (Resolution CMN 2,682/1999). - Banks can accrue interest on non-performing loan if they do not meet the 60-days past-due criteria; the corresponding “accrued, though unpaid” interest can enter the income statement. - Such interest shall be taken into account when estimating the expected credit losses for provisioning purposes. ### EC3 — Treatment of off-balance sheet (OBS) exposures in classification and provisioning - Law or regulations do not have a clear definition of “exposure” for management of credit risk; supervisors assert methodology for measuring credit risk for capital adequacy purposes applies for other prudential purposes. - Scope of classification system includes loans, lease operations and other operations with characteristics of credit risk; supervisors may apply same requirements to other exposures as considered appropriate. - Accounting framework (Resolutions CMN 3,823 of 2009 and 4,512 of 2016) requires provisions for certain off-balance sheet exposures such as loan commitments and financial guarantee contracts. - Regulations appear inconsistent about treatment of OBS exposures for provisioning for accounting and prudential purposes. - Technical Note 170/2017-BCB/Desup: financial guarantees generally considered at nominal value, but CCFs accepted for some specific guarantees (e.g., bid and performance bonds) as long as not classified as non-performing exposures. - Reporting practice: while reporting on non-performing exposures, banks report full transaction on-balance amount as delinquent; OBS exposures are not reported as delinquent, but supervisors expect banks to block the undrawn portion until overdue payments are made or loan is restructured. - Conclusion: absence of consistent definition of ‘exposure’ covering all on- and off-balance sheet items and lack of clarity on treatment for supervisory reporting and provisioning lead to unclear quality and consistency of verification and enforcement. ### EC4 — Timeliness and realism of provisions and write-offs - Banks must comply with IFRS for consolidated annual financial statements for listing requirements, but must comply with COSIF and BCB regulations for half-yearly financial statements and prudential reporting. - Resolution CMN 2,682/1999 requires supervised institutions to make minimum provision based on credit rating assigned as per regulations. - Two supervisory methodologies to assess sufficiency of loan provisions and classification: - Cash-Flow Analysis: - uses an algorithm with BCB´s Credit Register System (SCR) to generate sample loans where net cash inflows are lower than amounts due, suggesting “arrears”; - compares with risk rating assigned by the bank to identify incompatibility; on-site inspection checks classification and provisioning. - Massive Analysis: - set of eight standardized tests applied to entire loan portfolio to verify proper risk rating; - loans failing tests selected for on-site inspection checks; tests based on files from institutions or BCB credit registry. - Accounting regulation requires provisions only for: - • Incurred credit losses in securities exposures (Circular 3,068/2001); - • Expected credit losses in loans and lease operations (Resolution 2,682/1999); and - • Expected credit losses in financial guarantees (Resolution 4,512/2016). - Supervisors may require expected loss provisioning for any credit risk exposure (Resolution 4,557/2017). - Supervisory guidance examples: Technical Note 357/2016-BCB/Desup (ECL for securities) and Technical Note 170/2017-BCB/Desup (ECL for financial guarantees). ### EC5 — Early identification, oversight and treatment of deteriorating assets - Supervisors use BCB’s SCR to develop reports and indicators to identify credit-risk deterioration, including evergreening; warnings are reported to On-Site Supervision for evaluation. - Verification of evergreening: supervisors plan on-site inspections applying cash-flow analysis; if identified, corrective actions required (risk reclassification, increased provisioning, policy/procedure modifications) and, in some cases, sanctions. - Uniform classification approaches required by regulation: - Assess counterparty’s “unlikely to pay” to mark exposure as problem asset (Resolution CMN 4,557/2017 and Res 2623 of 1999). - Apply most adverse rating/classification to all exposures of the same counterparty when any becomes non-performing (Resolution CMN 4,557/2017, item XIV, and Resolution CMN 2,682/1999, article 3), with case-by-case exceptions for collateralized and nature-specific exposures (e.g., project finance and payroll guaranteed loans). - Supervisors check compliance (e.g., massive analysis) and use SCR to detect distinct risk ratings across exposures to same counterparty. - Banks must identify connected counterparties and regard them as a single counterparty for credit risk management (Resolution CMN 4,557/2017, article 22); banks may set own criteria but must consider minimum related-parties criteria from the regulation; supervisors review and can require banks to treat specific counterparties as connected regardless of banks’ criteria. ### EC6 — Information access, reporting and documentation requirements - No specific requirement for reporting details on non-performing exposures to BCB; banks must submit periodical reports to SCR with elaborate individual exposure details including contract number, date of granting, amounts drawn, date of repayment, days past due, cash flows, asset rating/classification, available collateral, collateral value, provisions held. - SCR granularity allows supervisors to: - perform analyses and generate reports for comprehensive reviews of asset quality; - challenge banks’ classification and provisioning where discrepancies observed; - compare classification and provisioning levels across the banking system; - review renegotiated and restructured exposures relative to classification and provisioning and prudential requirements. - Regulations require banks’ policies, processes and procedures for credit risk management to be completely and adequately documented (Resolutions CMN 4,557 of 2017, 3,721 of 2009 and CMN 2,682 of 1999), including assessment of credit risk, estimation of expected credit losses, classification and provisioning, identification of problem assets and management of forborne exposures. - On-site examination procedures expect supervisors to assess whether documentation is comprehensive, technically sound and accessible; supervisors can request additional information or require improvements. ### EC7 — Supervisory corrective powers and enforcement - Supervisors assess adequacy of classification and provisioning for prudential purposes using methodologies described under EC4–EC6. - Under regulations, supervisors have authority to: - a) Require corrections and improvements to risk management framework activities; - b) Impose ratings and provisioning levels for specific exposures; and - c) Require capital increase and impose other remedial measures. - In case of misconduct versus legal or regulatory requirements, penalties apply to both financial institution and its board or senior management (Resolutions CMN 3,721 of 2009, 4,557 of 2017, 2,682 of 1999 and 4,019 of 2011). ### EC8 — Valuation of risk mitigants and collateral - Regulations require the credit risk management framework to prescribe clearly defined and documented criteria and procedures for periodic evaluation of sufficiency of collateral (Art. 4, Res 3721 of 2009). - Regulations do not specify norms for periodic collateral valuation (frequency, net realizable value assessment, use of in-house vs independent valuers); banks adopt own methods. - Supervisory expectations: - evaluate adequacy of management reports to board on measures of expected loss, comparison with amounts provisioned and valuation of assets subject to marking to market; - evaluate report quality, comprehensiveness, periodicity and timeliness. - Supervisors expect banks to reassess value of collaterals at least annually as banks must review risk ratings at least annually. - Reporting and validation examples: - Auto loan collateral reporting includes vehicle serial number allowing validation against Sistema Nacional de Gravames (SNG) and FIPE car price indexes for realizable value estimates. - SNG began receiving new real estate financing data at beginning of 2017; BCB tracks historical real estate collateral prices reported to SCR. - Desup strategic project (ASup/Perda Esperada) uses SCR data to estimate recovery values and backtest loss-given default parameters banks use for expected credit loss provisions. ### EC9 — Criteria for identifying problem assets and reclassification as performing - Regulation 2,682 of 1999 (operating regulation for S2 to S5 segments) does not provide a definition of a problem or non-performing asset. - Regulation requires classification of all credit exposures under 9 categories from AA to H based on ‘days past due’ and ‘ability to pay’ criteria. - Regulations have not established quantitative criteria for upgrading assets (probation period or minimum amortization). - Renegotiated loans must be held in the same classification category; re-classification to a lower risk category is permitted when there is significant amortization or when new relevant facts justify risk-level change. - Banks are allowed to establish proprietary criteria based on own credit experience. - For S1 institutions, regulation 4557 issued in February 2017 became effective in August 201. *Source: cr18340 - 2018.* ### 2017. This regulation establishes the definition of a problem asset as one that is classified ### cr18340 - 2017. This regulation establishes the definition of a problem asset as one that is classified as ‘E’ or worse. ### Problem assets, classification, and provisioning (Principle 18 / EC10–EC12) - Findings: - Regulation defines a problem asset as one that is classified as ‘E’ or worse. Supervisors understand ‘problem assets’ to mean ‘non-performing’, but this interpretation is not articulated in laws or regulations. - Resolution 4557 explicitly provides that exposures identified as problem assets may only have this condition changed in face of evidences that the counterparty’s ability to meet obligations under the contracted terms is recovered. - Criteria for identifying the counterparty’s ability to pay must be established by the institution and clearly documented. - These regulations become effective for the institutions included in S2 to S5 in February 2018. - Regulations are unclear about norms guiding reclassification of borrowers among grades, allowing scope for individual practices amongst banks. - Regulations require banks’ credit risk management frameworks to regularly provide reports to senior management and the board (Resolutions CMN 4,557 of 2017 and 3,721 of 2009), but do not explicitly require boards to periodically obtain and review information on asset quality, major problem assets and provisioning trends. - Banks must subject all credit exposures to rating/classification and provisioning on an individual basis, with a simpler framework allowed for exposures below BRL 50,000; for counterparties with exposures below BRL 50,000, classification can be determined based on days past due but rating cannot be better than ‘A’ implying provisions of at least 0.5 percent for these exposures. (Art 5, (Resolution CMN 2,682 of 1999)) - BCB reviews and assesses quality of credit risk portfolios of individual banks and can compare classification of same counterparty across banks using the SCR database. - Assessment: - Assessment of Principle 18: Largely Compliant. - Areas for improvement (preserve original recommendations): - A clear definition of exposure that explicitly includes treatment of off-balance sheet exposures, investment in securities, and other amounts due from counterparties, including guidance on how each type of exposure should be treated for measuring and reporting of problem assets or non-performing exposures, and how they should be treated for provisioning purposes; (Ref. BCBS D403, April 2017) - Issue clear norms for reclassification of problem assets and restructured assets as performing and reclassification (upgrading) of assets from one level to the other; (Ref. BCBS D403, April 2017) - Explicit requirement to adopt an expected loss approach to all types of exposures while assessing provisioning requirement; - Harmonize norms for classification and provisioning irrespective of maturity period of the exposures; - Establish explicit norms for collateral eligibility and valuation, for determining provisioning for problem exposures; - Clearly articulate board responsibilities for oversight of the identification, measurement and management of problem assets; - Introduce periodical reporting on asset classification and provisioning. ### Concentration risk and large exposures (Principle 19 / EC1–EC7, AC1) - Findings: - Regulations require banks to have policies/processes to identify, measure, control and mitigate credit risk exposures, including concentration risk. (Res. 3721 of 2009; Resolution CMN 4,557 of 2017) - Revised regulation (Resolution CMN 4,557) improves identification, measurement and management of concentration risk and includes: - Explicit definition of concentration risk with categories a.–f. (see source). - Requirements for information systems to identify and aggregate exposures to single or connected counterparties. - Documentation of criteria for identification of groups of connected counterparties. - Mandatory reporting of exposures subject to concentration risk to senior management, risk committee and the board. - Requirement to establish internal limits and documented criteria for board decisions when exposures exceed limits. - Regulations do not explicitly define “exposure” for assessing compliance with prudential exposure limits from a concentration-risk perspective; capital adequacy definition allows set-offs/netting that Basel guidance suggests should be disallowed for maximum exposure to loss assessment. - Supervisory practices: on-site (Desup) and off-site (Desig) procedures verify concentration limits, internal reporting, and compliance; SCR, clearinghouses, and other databases used to monitor exposures. - BCB conducts system-wide stress tests addressing concentration in interbank market, market exposures, sectoral credit risk contagion (including “car wash” and federative units), and funding concentration scenarios. - Prudential exposure limits (exact figures preserved): - Table 4: Prudential Exposure Limits-Summary - 1 Single private sector counterparty 25 - 2 Group of connected private sector counterparties 25 - 3 Single public sector counterparty 25 - 4 Group of connected Federal public sector counterparties** 45 - 5 Group of State and state related public sector counterparties 45 - 6 Group of Municipal and municipality related public sector counterparties 45 - 7 Aggregate large exposures *** 600 - Note: * as percent of regulatory capital; ** excludes exposure to the federal government; *** A large exposure is defined as one that is equal to, or exceeds, 10% of Regulatory Capital. - Foreign currency/gold net exposure limit: 30% of Regulatory Capital (Res. CMN 3,488 of 2007). - Assessment: - Assessment of Principle 19: Largely Compliant. - Areas for improvement: - Introduce an explicit and clear definition of exposure for assessing compliance with prudential exposure limits and how exposures should be aggregated from concentration risk perspective; - Review/revise the exemptions and eligible collaterals that off-set exposure; - Review/ revise the prudential exposure limits for (a) federal public sector entities; (b) state and state public sector entities and (c) municipality and municipal public sector entities; - Revise the reference for the prudential limits from total regulatory capital to Tier 1 capital (BCBS 283, April 2014 on Large Exposures); - Apply the prudential framework and the prudential limits to the solo banks also within the prudential conglomerates; - Enhance currently available supervisory guidance and/or establish benchmark(s) for other types of concentrations (sector, geographic region, credit risk mitigant, etc.) to guide supervisors while assessing concentration risk; - Introduce explicit periodical reporting by banks on concentration risk exposures. ### Transactions with related parties (Principle 20 / EC1–EC7) - Findings: - Law and regulations have not explicitly articulated a full prudential definition/list of related parties; Article 34 of Law 4595 of 1964 provides a list including directors, their spouses, relatives up to second degree, individuals or legal entities with capital participation in excess of 10%, and legal entities where the institution participates more than 10%, with some subsequent amendments (Law 13506 of 2017) adding items f) and g). - Accounting standard COSIF - Technical Pronouncement CPC-05 defines “Related party” for disclosure purposes with broader alignment to Basel. - Prior prohibitions in Banking Law on granting loans/advances/investments to certain related parties were revoked on June 7, 2017, then CMN Resolution No. 4596 of 2017 reinstated prohibitions effective September 06, 2017, creating a temporary window of permissive activity. - Post-amendment (from 13 Nov 2017) financial institutions can extend credit to related parties provided transactions are under conditions compatible with market conditions and other safeguards (i.–vi. in source). - No explicit prudential definition of “related party transaction” for prudential supervision; limits on related party exposures are effectively the same as single counterparty/connected counterparty limits (e.g., 25 percent for private sector connected counterparties), but there is no aggregate prudential cap for related party exposures. - Supervisory tools: BCB compares SCR with Unicad to identify related-party transactions; since 2012 seven Punitive Administrative Processes (PAP) initiated for violations of the prohibition on lending to related parties. - Assessment: - Assessment of Principle 20: Materially Non-Compliant. - Key gaps and areas for improvement (verbatim recommendations): - Enhanced and explicit requirements for Board oversight of related party exposures and transactions; - An explicit definition or articulation of list of “related parties”, to include at least those mentioned in the footnote to the CP; - An explicit definition or articulation of the list of “related party transactions” for prudential purposes, to include at least those mentioned in the footnote 69 to the CP; - Introduction of prudential limit for aggregate exposures to related parties that are at least as conservative as the limits for connected counterparties; - Introduction of periodical focused reporting by the supervised institutions on the exposures, transactions, exceptions and write-offs; - Application of the prudential framework for related party exposures and related party transactions to the solo bank(s) within the prudential conglomerate; - Appropriate corresponding improvements to the supervisory manual. ### Country and transfer risks (Principle 21 / EC1–EC6) - Findings: - BCB view: banking system exposure to country and transfer risks not perceived to pose significant risk because (a) assets held abroad by the banking system are less than 15% of the total assets of the financial system; (b) most of these assets are invested in G20 countries; and (c) after considering intercompany eliminations, foreign exposures of the supervised entities reportedly account for 6% of the total portfolio. - Resolutions CMN 4,557 of 2017 and 3,721 of 2009 treat country and transfer risks as components of credit risk, but regulations do not explicitly require banks to establish standalone policies/processes for identification, measurement, monitoring and mitigation of country and transfer risks. - Regulatory descriptions (Res. 3721 of 2009; Res. 4557 of 2017) frame country and transfer risks in terms tied to non-compliance or barriers to currency conversion rather than the broader Basel “country risk” concept. - BCB supervisory procedures and practices focus on immediate/direct exposures rather than the “ultimate” or indirect exposure perspective; supervisory manuals and procedures are oriented to credit risk and do not fully address specific requirements for country and transfer risks. - Circular BCB 3,678 of 2013 requires public disclosure of credit risk exposures by countries and geographical regions when significant exposures exist. - Assessment: - Assessment of Principle 21: Materially Non Compliant. - Areas for improvement (verbatim recommendations): - Revision to the definition of country risk to fully align with the Basel definition; - Explicit adoption the 'ultimate risk' approach to these risks; - Issue of explicit regulations on identification, measurement, monitoring and management of these risks, including guidance on grading these risk exposures and provisioning therefor as a distinct risk from counterparty risk; - Extension of the ‘ultimate risk’ approach to the exposures of the banks’ branches and group entities that are abroad; - (source content truncated here; further areas for improvement continue in source). *Source: cr18340 - 2017. This regulation establishes the definition of a problem asset as one that is classified as ‘E’ or worse.* ### introduction of appropriate prudential reporting requirements to monitor the banks’ ### introduction of appropriate prudential reporting requirements to monitor the banks’ ### Prudential reporting requirements - introduction of appropriate prudential reporting requirements to monitor the banks’ exposure to these risks, ### Application to solo banks within prudential conglomerates - (f) application of the regulatory and supervisory elements pertaining to these risks to the solo banks within the prudential conglomerates and (f) *Source: cr18340 - introduction of appropriate prudential reporting requirements to monitor the banks’* ### introduction of appropriate corresponding improvements to the supervisory manual. ### introduction of appropriate corresponding improvements to the supervisory manual. ### Principle 22 — Market risk: legal/regulatory framework and market structure - Principle statement: Supervisor determines banks have adequate market risk management considering risk appetite, risk profile, market and macroeconomic conditions and the risk of a significant deterioration in market liquidity; includes policies/processes to identify, measure, evaluate, monitor, report and control or mitigate market risks on a timely basis. - Main instruments traded by banks in Brazil: government bonds, repos/reverse repos collateralized by government bonds, BRL/USD futures, interest rate (CDI) futures (DI futures), and swaps (fixed vs. CDI, CDI vs. USD + “cupom cambial”). - Typical trading-book use: managing liquidity buffer (government bonds, reverse repos) or hedging for clients. - Major sources of market risk for trading book (absolute market value of exposures, descending order, As of December 2016, for banking conglomerates): - interest rate risk: 57.8 percent - foreign exchange: 28.6 percent - credit risk and other exposures: 13.2 percent - equity price: 0.6 percent - commodities: 0.04 percent - Table 6 — Relevance of Market Risk in Supervised Institutions (Share in total risk weighted assets (%) — Number of Institutions — Market share in total assets (%)): - <1%: S1 0, S2 0, S3 9, S4 41, S5 0, Total 50, Market share 3.4 - 1 50: S1 0, S2 0, S3 1, S4 3, S5 0, Total 4, Market share 0.2 - Regulatory highlights (Resolution 3464 of 2007; Resolution CMN 4,557 of 2017; Circulars referenced): - Requirement for risk management structure compatible with nature, complexity and size of exposure. - Structure must provide: (a) policies/strategies with operating limits and procedures; (b) systems to measure/monitor/control exposures across trading and other positions; (c) assessment tests at least annually; (d) prior identification and analysis of new activities/products; (e) extreme scenario stress tests including breach of assumptions with results leading to policy/limit revisions. - Annual review/approval by board or senior management required. - Trading book definition includes all transactions with financial instruments and commodities, including derivatives; institutions must have clear policies for trading book inclusion and consistent classification procedures. - Market risk structure must identify/evaluate/monitor/control risks at prudential conglomerate and individual institution levels, and monitor risks of other companies controlled by conglomerate members. - Market risk management must be executed by a unit segregated from business and internal audit; the CRO may perform other functions if no conflict of interest. - Revised definition of market risk (Art. 25, CMN 4557 of 2017): losses from movements in market values; includes interest rates and equity prices for trading book; foreign exchange and commodities for trading or banking book. - Trading book rules (Art. 26–27, CMN 4557 of 2017): intent of trading defined (resale, benefitting from price movements, arbitrage); documentation and procedures for shifting between trading and banking books required. - Systems must consider all relevant sources of risk, use reliable internal/external market and liquidity data, and document shifts between books (Art. 29, Resolution CMN 4,557). - Regulation requires consideration of inability to trade at market price due to size or market discontinuity (Art. 37). ### Principle 22 — Supervisory processes (EC2–EC6) - Offsite monitoring and data flows: - Financial System Monitoring Department (Desig) receives monthly market risk reports (DRM) from institutions and daily inputs from exchanges, CCPs and trade repositories. - Desig performs extensive daily routines and occasional stress tests to assess impact on banks’ liquidity positions and triggers warnings to on-site supervisors for delays/errors. - On-site supervision: - Compares actual risk assumed vs. board-approved risk appetite; evaluates adequacy given capital, processes, technical skills. - Two main on-site processes: - Risks and Controls Assessments (SRC): largest banks annually, smaller banks every two or three years; market risk is one assessed risk group and can receive a grade. - Special Verifications (VEs): usually two banks per year, three examiners for 2 months; selection drivers include complexity of trading products, significance of market risk capital requirement to Total Capital, prior SRC grade, and intention to apply for internal models. - Other Special Verifications cover Trading Operations, Structured Products, Hedge Accounting, Authorization for Internal Model of Market Risk. - Supervisory checklist items (examples): adequacy of policies and strategies; clarity of risk appetite, roles, authorized factors, limits and reporting; capture of all material risk sources; senior management engagement and competence; mark-to-market process independence and documentation; limit structure and exception processing; market and macroeconomic condition assessment by market risk committee; internal audit role. ### Principle 22 — Measurement, valuation, models and capital (EC3–EC5) - Offsite measurement tools: - DRM analyzed by Desig includes metrics: VaR (parametric and historical, different confidence levels), Expected Shortfall, complementary sensitivity analysis. - BRM (Market Risk Balance Sheet) tool for durations and gap detection. - BCB-developed market risk monitoring tools use historical behavior, securities/derivatives portfolios, and daily market settlements to CCPs. - Components of standardized capital requirement (BCB circulars): - Fixed Interest Rates: Parametric VAR model standardized by BCB (Circular BCB 3,634). - Fixed Interest Coupon Over Inflation Rates: three components, methodology resembles maturity ladder (Circulars BCB 3,635, 3,636 and 3,637). - Equities: Circular BCB 3,638. - Commodities: Circular BCB 3,639. - Foreign Exchange: Circular BCB 3,641. - Internal models approach: Circular BCB 3,646. - Valuation and model governance (EC4): - Regulations require derivatives, securities and bonds to be valued via consistent/verifiable methods by independent sources (Circulars BCB 3,082 and 3,068). - Trading book exposures must be marked-to-market daily to independent references (Circular BCB 3,354). - Resolution CMN 4,277 of 2013 sets minimum standards/prudential adjustments for valuation at market value, including responsibilities, review of market information sources, guidance on unobservable inputs and independent verification. - Practically, domestic market is less sophisticated than mature markets but deeper than other emerging markets; most non-derivative trading-book instruments are government bonds (liquid, easily priced). Derivatives are largely standardized and registered at B3. - Two of the largest institutions use approved internal models for regulatory capital; two others have applied for approval (under BCB consideration). - Daily SMM full valuation of domestic portfolios allows supervisors to reprice books using BCB pricing references and independent sources. - On-site examinations check verifiable, consistent valuation processes performed by personnel independent of trading desks and evaluate reliance on models and their governance. - Capital and prudential assessment (EC5): - Detailed capital requirement methodologies established in Circulars BCB 3,634–3,641 and Circular BCB 3,646 for internal models. - RCAP assessment (BCBS, December 2013) concluded Brazilian risk-based capital standards compliant; noted a quasi-modelled approach for fixed interest rates where BCB fixes parameters; approach generally more conservative than Basel standardized approach. - Resolution CMN 3,488 restricts FX exposure to 30% of Total Capital (consolidated, prudential conglomerate concept). - Regulations require procedures for valuation adjustments for instruments that cannot be prudently valued (Resolution CMN 4,277 of 2013). - Offsite: Desig computes simplified market stress test daily for traded securities/derivatives and can run specific sensitivity scenarios. - Onsite: SRC evaluates capital strength vs. risks and can run specific examinations focused on market risk RWA. ### Principle 22 — Stress testing and supervisory use (EC6) and assessment - Regulations: CMN 4,557 of 2017 (Arts. 12–19) require stress testing programs including market risk exposures and assessment of significant concentrations; institutions must use results in controlling/mitigating exposures and in model assessment. - Supervisory review: VEs evaluate stress test methodology, scenario development, frequency, governance and use of results; supervisors require corrective plans for deficiencies. - Assessment of Principle 22: Compliant. - Supervisors can determine market risk exposures almost daily and pursue banks on market and funding liquidity perspectives. - Market risk is not significant system-wide but significant for several S3 and S4 institutions; governance challenges may be greater in unlisted institutions. - Revised regulations (Resolution 4557 of 2017) will be fully effective for all institutions from February 2018 but lack explicit norms/minimum requirements including governance elements pertaining to shifting instruments between trading and banking books. - Areas for improvement recommended: - Review market risk management frameworks in relevant S3 and S4 banks at more frequent intervals than prescribed supervisory cycle. - Issue explicit norms and guidance for shifting of exposures from and to the trading book. --- ### Principle 23 — Interest rate risk in the banking book (IRRBB): framework and findings - Principle statement: Supervisor determines banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate risk in the banking book on a timely basis; systems account for risk appetite, risk profile and market/macro conditions. - Historical/regulatory context: - Prior to 2017: risk management regulations addressed individual risks; Circular 3365 of 2007 provided regulatory basis for IRRBB under Basel II implementation with flexibility for institutions to determine key elements of risk management frameworks. - Circular 3365 minimum criteria for IRRBB measurement frameworks include: include all operations sensitive to interest rates; use widely accepted techniques; consider rates, maturities, prices, optionalities; define premises to transform positions into cash flow; measure sensitivity; integrate with daily risk practices; allow simulation of extreme conditions (stress tests); estimate capital requirements. - Revised regulations (Resolution CMN 4,557) became effective for S1 banks in August 2017 and for other banks in February 2018. - Revised regulations define IRRBB (Art. 28 of Resolution CMN 4,557) and require assessment/control of determinants (maturity, rate, index, currency mismatches) and measurement based on methodologies consistent with banking book characteristics. - For S1, S2, S3 institutions: identification/measurement/control must be based on both economic value approach (EVA) and earnings-based approach (EBA). - BCB may define methodologies/minima for S1–S4, including EVA and EBA. - IRRBB appetite levels must be documented in the RAS, considering EVA and EBA (Art. 30). - Definitions: EVA = impact of interest rate movements on current cash flows of banking-book instruments; EBA = impact on earnings (Art. 30). ### Principle 23 — Supervisory processes and findings (EC2–EC4, AC1–AC2) - Supervisory reporting and monitoring: - SRC coverage: all banks subject to SRC (largest once a year, smallest once in three years); VEs specifically for IRRBB conducted (two VEs on IRRBB in 2016 found deficiencies). - Supervisory review includes that strategies/policies are approved by senior management/board; establish IRRBB appetite; protect capital; set reporting lines; establish quantitative/qualitative targets; define methodologies, limits, responsibilities, authorized instruments and hedging. - BCB is drafting a circular to require identification/measurement/control of IRRBB, evaluation of capital availability for IRRBB, reporting to BCB and disclosure — to align with BCBS IRRBB (April 2016), intended implementation by 2018. - Measurement requirements: - Regulations require quarterly EVA evaluations using shocks compatible with the 1st and 99th percentiles of a five-year historical distribution of interest rate changes, considering a one-year holding period and five-year observation period (Circular BCB 3,365 of 2007). - Banks should estimate basis point shocks that reduce market value of banking book by 5%, 10% and 20% of Total Capital (Circular BCB 3,365). - Measurement systems must consider embedded optionalities, non-maturity deposits and prepayment risk, and be consistent/verifiable/documented/stable over time. - Validation, limits and information systems: - Supervisory procedures require independent validation covering comprehensiveness, adequacy of metrics, embedded optionality models, embedded gains/losses, control of credit spread risk, capital calculations, stress tests, back-tests and database consistency. - Limits expected for global exposure under normal and extreme conditions measured in Delta NII and Delta EVE; procedures for breaches must ensure corrective action and not exhibit permissiveness. - Reporting systems: banks must submit DLO and DRM monthly; BCB tool BRM identifies main IRRBB determinants and supports ALM approach. - ICAAP and capital assessment: - Regulations require ICAAP to assess sufficiency of capital over one-year horizon covering IRRBB (Circular BCB 3,547 of 2011); major banks must describe IRRBB measurement under EVA and EBA including embedded gains & losses (BCB Circular 3,774). - Supervisors estimate reference capital for IRRBB using earnings approach (Delta NII), economic value approach (Delta EVE), embedded losses and going/gone concern characteristics; used to challenge banks’ own measures. - Improvements observed: shift from VaR-based economic value metrics and near absence of earnings-based approaches to adoption of EVE and NII metrics, embedded gains/losses treatment and embedded options handling. - Assessment of Principle 23: Compliant. - Comments: Gaps in regulations relating to IRRBB risk management framework, governance and board/senior management oversight existed but have been addressed via Resolution 4557 of 2017 effective for S1 banks from August 2017 and for other banks by February 2018; BCB is reviewing/revising frameworks to align with BCBS IRRBB (April 2016) expected completion in early 2018. --- ### Principle 24 — Liquidity risk: framework, requirements and supervisory practice - Principle statement: Supervisor sets prudent and appropriate liquidity requirements (quantitative/qualitative) that reflect banks’ liquidity needs; banks have strategies enabling prudent liquidity risk management consistent with risk appetite, profile, market/macro conditions; for internationally active banks, liquidity requirements are not lower than applicable Basel standards. - LCR and NSFR: - LCR: Resolution CMN 4,401 of 2015 and Circular 3,749 of 2015 require prudential conglomerates and specified banks with total assets > BRL 100 billion to comply with LCR. Implementation schedule: 60% in 2015, 70% in 2016, 80% in 2017, 90% in 2018, and 100% by January 2019. LCR applied at prudential conglomerate (consolidated) level. Circular BCB 3,749 requires public disclosure of LCR per Basel template. Basel RCAP assessment found Brazilian LCR compliant. - NSFR: BCB working toward implementation; will become a minimum standard by January 2018; draft regulation and impact studies underway. - Non-LCR banks (assets < BRL 100 billion) are not subject to formal liquidity ratios but BCB can adopt preventive prudential measures (Resolutions CMN 4,019 and 4,557). - Monitoring tools and data: - Liquidity and Market Monitoring System (SMM) provides supervisors and COMEF with timely info, stress scenarios (idiosyncratic, peer, systemic), technical reports and early warnings. - New monitoring tools: LCR by currency and jurisdiction; Extended Liquidity Ratio (ELR) considering step-in support to managed funds; detailed non-LCR bank reports allowing BCB to run an LCR proxy monthly. - Liquidity risk management regulatory requirements (Res. 4090 of 2012; Res. 4557 of 2017): - Definition of liquidity risk includes inability to honor obligations without significant losses and inability to negotiate positions at market price due to size or market discontinuity. - Requirements for liquidity frameworks: identify/assess/monitor/control risks at entity and conglomerate level; consider impacts from other conglomerate members; board/senior management responsibility; documented policies/strategies with limits and procedures; processes for multiple time horizons including daily assessment of operations < 90 days; annual evaluation of such processes; diversified funding policies; periodic stress tests (short/long horizons, idiosyncratic/systemic); liquidity contingency plan (approved/updated annually); product approval to include liquidity assessment; include all market/capital operations and contingents; consider liquidity by country and currency; appointment of a director responsible for liquidity risk. - Revised regulations (Res. 4557 of 2017) require independent unit for liquidity management and systems that cover intraday and normal/stress conditions, adequate liquid assets, adequate funding profile and diversification of funding sources; require prior identification of risks inherent to new products, material modifications, changes in processes/systems, hedge strategies, reorganizations and macroeconomic changes. - Liquidity strategy, governance and reporting (EC4–EC6): - Boards must approve liquidity risk appetite, contingency funding plan and review these at least annually. - Banks’ information systems must identify and aggregate liquidity exposures and timely report deficiencies or model assumption limitations to board/senior management. - Supervisors assess adequacy via SRC, VEs and continuous monitoring; off-site tools produce stress tests and early warnings for on-site action. - Contingency Funding Plans (CFP): must include cash flow projections, funding alternatives, sequence of asset realization, legal aspects, access to reserve lines, communication framework with BCB. Supervisors verify CFP feasibility and require remediation for deficiencies. - Funding strategy and HQLA management (EC5, AC1): - Regulations require banks to analyze funding under alternative scenarios, maintain cushion of high quality unencumbered liquid assets (HQLA), diversify funding sources and tenor, maintain relationships with liability holders, and assess capacity to sell assets. - Circular BCB 3,749 (2015) clarifies HQLA must be unencumbered; institutions must monitor concentration within asset classes and ensure HQLA consistency with liquidity needs by currency; periodic monetization of sample HQLA to test market access. - Supervisors note LR proxy for non-LCR banks is often more conservative than LCR, supporting acceptable HQLA management across non-LCR banks. - Disclosure requirements: periodic disclosures on risk management frameworks and Pillar 3; LCR institutions must disclose LCR calculation and qualitative explanations quarterly per standard format. - Liquidity stress testing (EC7) and currency-specific issues (EC8): - Regulations require stress test programs to include liquidity risk and use sensitivity, scenario and reverse stress tests; stress tests must consider historical/hypothetical elements, idiosyncratic/systemic risks, risk interactions, step-in risk, non-linearities and feedback effects. - Stress test outcomes must inform RAS, policies, strategies, limits and CFPs; BCB may require adjustments and can provide specific scenarios. - BCB does not yet have fully integrated top-down stress testing for liquidity and solvency; efforts to include fire-sale feedback into solvency stress testing ongoing. - Foreign currency exposure: - Banks are not allowed to offer foreign currency deposit products to general public (Circular BCB 3.691), exceptions apply (travel agencies, embassies etc.). - Foreign currency exposures mainly relate to funding instruments issued abroad and trade finance assets. - Regulations require management of liquidity risk separately by country and currency; LCR institutions must calculate/monitor LCR by relevant currency and maintain HQLA consistent with currency needs (Circular BCB 3.749). - Since H1 2017, supervision monitors LCR by significant currency to detect mismatches and assess ability to transfer liquidity across currencies/jurisdictions. - Assessment of Principle 24: (no explicit final assessment text in supplied excerpt for overall principle; supervisory findings and regulatory implementations summarized above) *Source: cr18340 - introduction of appropriate corresponding improvements to the supervisory manual.* ### annex of Circular 3.749 of 2015. This information must be available along with the ### annex of Circular 3.749 of 2015. This information must be available along with the ### Principle 24 — Liquidity (Assessment) - Assessment: Compliant - Findings: - The regulatory requirement (LCR) set by the BCB complies with the Basel standards. - Supervisors monitor the liquidity situation in the banks on almost a daily basis, including implications of potential stress from market risk situations. - Multiple liquidity monitoring tools and methodologies provide assurance of banks’ ability to meet liquidity needs. - Supervisors complement quantitative monitoring with qualitative assessment of banks’ liquidity risk management through ongoing and continuous supervision. ### Principle 25 — Operational risk (Assessment) - Assessment: Largely Compliant - Overview: - The supervisor determines that banks have an adequate operational risk management framework covering identification, assessment, evaluation, monitoring, reporting and control/mitigation of operational risk. - Operational risk definition noted: The Committee has defined operational risk as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. The definition includes legal risk but excludes strategic and reputational risk. - Key quantitative finding: - Legal risk accounts for about 70 percent of operational risk losses. - External frauds account for about 20 percent. - All other types account for the remaining 10 percent. - Regulatory timeline and instruments: - Regulations in operation till August 2017 for S1 banks and till Feb 2018 for other banks (Res. 3380 of 2007) set core operational risk requirements. - Revised regulations (Resolution CMN 4,557 of 2017) effective for S1 banks from August 2017 and for other banks from February 2018 introduce additional requirements. - Revised requirements (high-level): - Policies for outsourcing decisions and minimum contractual conditions. - Allocation of resources to evaluate/manage/monitor operational risk from outsourced services. - Implementation of an IT governance framework consistent with the RAS. - IT systems, procedures and infrastructure that: - ensure data and systems integrity, security and availability; - are robust and adequate under normal circumstances and in periods of stress; - include mechanisms to prevent, detect and reduce digital attacks. - Consistent process to collect operational risk information, classify and aggregate material losses, and assess root causes. - Periodic scenario analysis for rare and highly severe operational risk events. - Supervisory practice: - Operational risk management framework assessed within the SRC (MSU 4.30.40.20.05) and scaled proportionately to size, complexity, risk profile and systemic importance. - Supervisors use internal control reports, internal audit reports, internal annual report to board, external audit report, ICAAP, and benchmarks such as: - Share of operational risk capital requirement in bank’s total capital requirement; - Comparison of operational risk losses with operational risk capital requirements; - Adequacy of provisions for litigation; - Disclosure on contingent liabilities. - Special verifications (VE) and thorough analyses are used where needed; focus on internal loss data collection, scenario analysis, and management/regulatory reports, especially for DSIBs. - Information systems and data: - Circular BCB 3.647 of 2013 sets minimum requirements for internal models and internal loss data collection. - BCB is working on a project for periodic reporting of internal loss events by banks. - While supervisors push improvements, periodical regulatory reporting of internal loss data by banks to the BCB is not yet established. - Outsourcing and business continuity: - Res. CMN 4,557/2017 requires outsourcing policies, business continuity policies and contingency plans that consider outsourced services and permit BCB access to IT outsourcing contracts and provider information. - Supervisors verify IT disaster recovery and business continuity plans against Cobit and international best practices; can require additional controls if inadequate. - Areas for improvement (listed in source): - Issue of clear guidance to banks for standardized compilation and periodical reporting of internal loss data, including data on operational risk events, to the BCB; - Issue of regulations focused on cybersecurity, including prompt reporting on significant cyber threats; - Require banks to report significant OR events of all types with minimum loss of time. ### Principle 26 — Internal control and audit (Assessment) - Assessment: Largely Compliant - EC1 — Internal control frameworks: - Laws and regulations: Banking Law (Law 4595 of 1964), Company Law (Law 6404 of 1976), Res 2554 of 1998 and related regulations. - Internal control systems must be effective and consistent with nature, complexity and risk of operations. - Annual report on internal controls required (Resolution CMN 4,390 of 2014) to board, senior management and external auditor; kept available to the Central Bank of Brazil for five years. - Supervisory procedures based on BIS and COSO five components: Control Environment; Risk Assessment; Control Activities; Information and Communication; Monitoring. - Supervisor can sanction institutions (Resolution CMN 4019 of 2011) and use inspection letters for less serious cases. - EC2 — Balance of skills and resources: - Evaluation of balance of skills between back office/control functions and business origination inherent in internal controls, internal audit, external audit and supervisory oversight. - MSU contains specific supervisory procedures (e.g., MSU 4.30.10.50.02.04 for treasury). - EC3 — Compliance function: - No formal universal requirement to have a segregated compliance function; compliance elements embedded in internal control regulations (Res 2554 of 1998). - In practice, majority of banks have a compliance officer/unit; large banks segregate compliance. - Resolution 4595 of 2017 (effective 31 December 2017) requires a formalized compliance policy appropriate to the institution’s nature, size, complexity, structure, risk profile and business model; board responsibilities include approving and overseeing compliance policy and providing necessary means and suitably qualified staff. - EC4 & EC5 — Internal audit: - Regulations require an internal audit function as part of internal controls (Res 2554 of 1998; Res 3056 of 2002). - Resolution 4588 of 2017 (effective 31 Dec 2017) establishes detailed requirements for internal audit including resources, reporting to board/audit committee, timely notification of material changes, full access to information, risk-based audit plans, and authority to assess outsourced functions. - Comments and supervisory concern: - Unlisted banks are not required to establish a non-executive board; of 116 unlisted banks, 41 have Boards of Directors. Of the remaining 75 banks (about R$540 billion in total assets, 6.8% market share), 46 are foreign owned (5.8% market share). - Regulational permissibility for internal audit to be part of internal control and non-mandatory compliance function, and less sophisticated internal audit requirements historically, can undermine effectiveness in some banks. - BCB should devote greater attention to internal control, compliance and internal audit functions in unlisted banks and take corrective measures where warranted. ### Principle 27 — Financial reporting and external audit (Assessment) - Assessment: Compliant - EC1 — Responsibility for financial statements: - Board and/or senior management responsible; specific responsibilities depend on governance structure. - Resolution CMN 3,786 of 2009 requires IFRS financial statements and auditor opinion for specified institutions. - Circular BCB 1,273 of 1987 (Cosif) sets local accounting standard and requires publication of financial statements with external auditor’s opinion. - About 58 banks prepare and publish financial statements that comply with IFRS; all banks comply with Cosif. - EC2 — External audit and publication: - Financial institutions must disclose semi-annual financial statements under Cosif; parent institution responsible for consolidated disclosures (Resolution CMN 4,280). - External auditors must be registered at CVM and approved in periodical certification by CFC; auditing practices follow NBC (translations of ISA). - EC3 — Valuation practices: - Cosif prescribes accounting standards; CMN issued standards aligned with IFRS since 2008. - Specific rules cited: Resolution CMN 3,566 of 2008 (impairment), Circulars 3,068/2001 and 3,082/2002 (securities/derivatives), Resolution CMN 4,277 of 2013 (pricing controls), Resolution CMN 3,533 of 2008 (derecognition), Resolution CMN 4,512 of 2016 (expected loss allowances for guarantees), Resolution CMN 4,524 of 2016 (IAS 21 alignment), Resolution CMN 4,534 of 2016 (IAS 38), Resolution CMN 4,535 of 2016 (IAS 16), Resolution CMN 3,565 of 2008 (prohibits revaluation of fixed assets in use). - Supervision evaluates mark-to-market procedures on-site and off-site. - EC4–EC8 — External audit scope, powers and interaction: - External auditors follow IAASB standards as endorsed by CFC. - BCB has powers to require complementary examinations, review audit work, and initiate Punitive Administrative Processes (PAP) which may include replacement of audit firms. - Rotation: law does not require audit firm rotation but requires rotation of in-charge audit team members after five complete annual reports (Resolution CMN 3,198 of 2004 as amended). - Supervisor meets with external auditors at least once a year and has a group (GT1 Ibracon + BCB) meeting about every two months. - External auditors must report certain material operational events to BCB within three working days (Resolution CMN 3,198/2004). - BCB can access external auditors’ working papers per contract clauses required by regulation. - Conclusion: - Financial statements prepared and published comply with Cosif and IFRS; audited and published at least semi-annually; governance arrangements for external audit oversight in place. ### Principle 28 — Disclosure and transparency (Assessment) - Assessment: Compliant - EC1 — Periodic public disclosures: - Financial statements required on solo and consolidated basis at least semi-annually; Cosif or IFRS as applicable. - Key disclosure requirements include: - Semi-annual solo statements (Cosif) for all banks (Large circulation newspaper; Twice a year). - Prudential consolidated statements (Cosif) for all banks leading prudential conglomerates (Website; Twice a year). - Consolidated IFRS statements for listed banks and those required to implement an audit committee (Website; Annually). - Circular BCB 3,678 of 2013 mandates Pillar 3 disclosures in a single, easily accessible section of the institution’s website: - Quantitative information updated quarterly; qualitative information updated annually. - Resolution CMN 4401 requires LCR disclosure in standardized format. - Circular BCB 3748 of 2015 requires leverage ratio disclosure quarterly and semi-annually. - Circular BCB 3,751 of 2015 requires disclosure related to global systemic importance on a four-month and annual basis. - EC2 — Scope and content: - Pillar 3 (Circular CMN 3,678 of 2013) disclosures include both qualitative and quantitative information on: financial performance; financial position; risk management strategies; governance; risk exposures; related-party exposures; accounting policies; and detailed risk metrics (capital, market, credit, operational exposures). - Qualitative information minimum update: annual (or upon relevant alteration). Quantitative information minimum update: quarterly (March 31, June 30, September 30, December 31). - Resolution CMN 4.557 (effective Aug 2017 for S1) requires public reporting of risk management and capital management structures at least annually, board responsibility for information, semi-annual qualitative risk disclosures, and timely disclosure of CRO dismissal on the institution’s website. - EC3 — Group entity disclosure: - Cosif requires disclosure of entities in consolidated financial statements. - Circular CMN 3,678/2013 requires listing of institutions in prudential consolidation and disclosure of assets, net worth and activity area of relevant entities. - EC4 — Enforcement: - BCB enforces compliance with Cosif and Pillar 3 disclosures; can require amendment and re-publication of irregular financial statements. - EC5 — Aggregate system information: - BCB releases quarterly analytical accounting information aggregated by type of institution and publishes a half-yearly Financial Stability Report. - BCB also publishes individual institution financial statements and prudential/consolidated information (total assets, total deposits, risk weighted capital ratio, net profits, tier I capital, net worth). - AC1 — Flow/movement disclosures: - Circular BCB 3,678/2013 requires disclosure of flow-related items such as average exposures during quarter, loans written off in the quarter, securitization flows over 12 months segmented by quarter, and other period-flow metrics. ### Principle 29 — Abuse of financial services / AML-CFT (Assessment) - EC1 — Legal duties and supervisory powers: - AML/CFT addressed under Law 9613; BCB is competent authority to supervise AML/CFT internal controls and apply administrative sanctions (Article 12). - Circular 3461 sets BCB requirements for policies and internal controls and requires nomination of a senior manager for implementation and suspicious transaction reporting to COAF. - COAF is the Financial Intelligence Unit receiving and analysing suspicious transaction reports and producing Financial Intelligence Reports to competent authorities. - Whistleblower protection: communications made in good faith to COAF will not result in civil or administrative liability (Law 9613, Article 11, paragraph 2). - Complementary Law 105 requires BCB to notify competent authorities of signs of crimes or irregularities from supervisory activities. - BCB has a seat on COAF’s Council and access to suspicious transaction reports. - EC2 — Bank policies, processes and supervisory methodology: - BCB separates banks into tiers for AML/CFT supervision: more relevant banks receive Continuous Conduct Monitoring (ACC); 28 institutions monitored under ACC, including all systemic banks. - For less risky banks, remote monitoring via SisCom with: - Remote Compliance Inspection (ICR): document-based assessment; tailored questionnaire (around 300 questions, typically ~100 sent); leads to action plans and supervisory monitoring. - Remote Direct Inspection (IDR): detailed analysis when atypical situations detected or unsatisfactory ICR responses. - ICR/IDR processes lead to inspection letters and remedial plans; DECON planning to amend processes to avoid action-plan approval delays. - BCB monitors foreign exchange transactions and external lines of credit registered in BCB to detect AML/CFT concerns (MSU references). - Note: the source content continues into prevention, detection and reporting procedures banks must meet (text truncated in supplied excerpt). *annex of Circular 3.749 of 2015. This information must be available along with the* ### 2554. This resolution imposes an obligation on senior management to foster high ethical ### 2554. This resolution imposes an obligation on senior management to foster high ethical standards and to promote an organizational culture that demonstrates and emphasizes, to all staff, the importance of internal controls and the role of each member in the process. ### Duties and legal basis - Duties imposed on banks regarding customer identification, data maintenance and report of suspicious transactions to the financial intelligence unit (COAF) are established in the law on AML (Law 9613). - In performing these duties, the banks must follow instructions of the BCB (see Articles 9 to 11). - Circular 3461 requires financial institutions to implement policies, procedures and internal controls to prevent the use of the financial system for criminal activities described by Law 9,613 (money laundering or concealment of assets, rights and values). ### Circular 3461 — main aspects - Financial institutions must implement policies, procedures and internal controls to prevent abuses set out in Law 9613. - The procedures must include explicit measures that determine customer due diligence, validate customers’ information, identify final beneficiaries of transactions and rules for the definition of politically exposed persons (PEPs). ### I) Implementation of policies and internal control procedures - Policies must: - Document the responsibilities of members at each hierarchical level of the institution; - Encompass timely collection and registration of information about customers, enabling identification of risks associated to such persons; - Define criteria and procedures for selection, training, and monitoring of employees’ financial situation; - Include preliminary analysis of new products and services, to prevent the financial institution of being used for criminal purposes; - Be approved by the board of directors; and - Have appropriate internal disclosure. ### II) Identification and record-keeping - Identification of all customers: individuals, legal entities and their representatives, including final beneficiaries. - Customers files must be kept updated and records of transactions held for at least 5 years. ### III) Monitoring of transactions - Monitoring of transactions to identify unusual situations. - Special attention to situations that pose higher risk and detection of suspicious situations. ### IV) Reporting to the COAF - Mandatory reporting of cash transactions exceeding R$ 50,000.00. - Mandatory reporting of suspicious transactions related to predicate offenses as specified in Law 9,613. *Source: cr18340 - 2554.* ### 9613. Complementary Law 105 provides that the reporting of suspicious criminal ### cr18340 - 9613. Complementary Law 105 provides that the reporting of suspicious criminal ### Regulatory requirements and bank obligations (Circulars/Resolutions referenced) - Complementary Law 105: reporting of suspicious criminal transactions to the relevant competent authorities does not constitute a breach of professional secrecy. - Nomination requirement: banks must nominate a senior manager responsible for implementation and compliance with established measures, and for reporting suspicious transactions to COAF. - Strengthened due diligence for relationships with foreign financial institutions, representatives, or correspondent banks, and for customers contacted via electronic means, banking agents, or other indirect means. Particular attention required for transactions with customers from countries not compliant with FATF recommendations. - In cross-border correspondent relationships banks should: - Gather information on the correspondent institution, including reputation and quality of supervision, and whether subject to investigation or AML/CFT action; - Assess controls adopted by the correspondent institution with respect to AML/CFT; - Obtain approval from the senior manager responsible for transactions in the foreign exchange market before establishing a new correspondent relationship; - Document responsibilities of each institution regarding AML/CFT. - Circular 3461, Circular 3691, Resolution 2554, Resolution 3198, Resolution 4019, Resolution 4567, Resolution 4577: establish KYC, internal controls, supervisory access to files, FX market CDD, internal audit requirements, channels for anonymous stakeholder reporting, and continuous/integrated risk management framework. - Customer due diligence (CDD) essentials include: - Customer acceptance policy; - Customer identification, verification, and ongoing due diligence including beneficial ownership as necessary; - Monitoring and recognition of unusual or potentially suspicious transactions; - Enhanced due diligence on high-risk accounts and PEPs with escalation to senior management; - Recordkeeping with at least a five year retention period. ### Areas requiring special attention by financial institutions - Transactions or proposals that give cause to suspect crimes described in Law 9613. - Opening of accounts and/or transactions with PEPs from Brazil and from countries with high levels of financial/commercial transactions, common borders, or ethnic/linguistic/political proximity. - Evidence of fraud in identification and registration procedures set out in Circular BCB 3461. - Customers and transactions where final beneficiary cannot be identified. - Transactions coming from or heading for countries/territories which unsatisfactorily apply FATF recommendations, as disclosed by the BCB. - Situations where it is not possible to keep customers’ information files updated. - Branches and subsidiaries abroad: Items II–VII of Circular 3461 apply when no legal impediment in the host country; attention should be paid to CPs 5, 6 and 7 regarding BCB powers over group structure approval/rejection. ### Reporting and quality assessment statistics - Table 9. Total of Reports To COAF (banks and banking conglomerates included) - 2014: Number of banks (*) 92 — Total 32,009 - 2015: Number of banks (*) 97 — Total 43,217 - 2016: Number of banks (*) 99 — Total 53,002 - 2017 (1): Number of banks (*) 81 — Total 26,473 - Aggregate total presented: 154,701 - (*) Includes reports from banks and banking conglomerates - (1) As of June 28th - Table 10. Average Grade of Reports To COAF (each selected report graded 1 to 6) - 2014: Number of FIs (*) 40 — Average grade 3,7 - 2015: Number of FIs (*) 37 — Average grade 3,7 - 2016: Number of FIs (*) 28 — Average grade 3,8 - 2017 (1): Number of FIs (*) 12 — Average grade 4,5 - (*) Includes reports from banks and banking conglomerates - (1) As of June 28. - Table 11. Notification to Competent Authorities—Banking Sector (number of notifications) - Reports 2015 / 2016 / 2017 (*) - COAF: 1 / 0 / 3 - MPF: 1 / 0 / 1 - RFB: 1 / 0 / 3 - (*) as of June 28, 2017. - Table 12. ML Administrative Process—Fines and Ineligibility Sanctions—Banking Sector - 2016: Process FI Stakeholders Number 1 — Fines (R$) 58.255.873,77; Number 2 — Fines (R$) 8.823.381,07; Ineligibility 4 and 8 years - 2017(*) 3 3 5 - (*) as of June 28, 2017. - Table 13. Decon—Human Resources—As of June 28th, 2017 - DSUP2: Number of HR 19 - DSUP3: Number of HR 15 - DSUP4: Number of HR 12 - TOTAL 46 - Table 14. Supervision Actions—Modalities of Inspection—Banking Sector (totals) - Modalities 2014 / 2015 / 2016 / 2017(*) - AE: 1 / 3 / 1 - ACC: 8 / 17 / 27 - VE(***): 29 / 11 / 9 - SRC: 49 / 43 / 38 / 17 - ICR: 5 / 6 / 21 / 31(**) - IDR: 1 / 1 (**) - Total: 83 / 69 / 89 / 77 - (*) As of June 28th, 2017 - (**) ICR – 5 ongoing and 18 scheduled / IDR – 1 ongoing - (***) Special Verifications—being discontinued due to adoption of ACC methodology. - Table 15. ACC and VE—Number of Inspection Letters (PAS FIs) - 2014: 16 / 10 - 2015: 19 / 5 - 2016: 25 / 10 - 2017: 29 / 1 - Table 16. IC—Regularization Plans—Actions Proposed and Approved - 2014: Insp. Letters 5 — Findings 56 — Reg. Plans Proposed 5 — Approved 56 56 - 2015: Insp. Letters 6 — Findings 66 — Reg. Plans Proposed 6 — Approved 66 33 - 2016: Insp. Letters 21 — Findings 294 — Reg. Plans Proposed 21 — Approved 294 6 - 2017: Insp. Letters 8 (*) — Findings 84 — Reg. Plans Proposed 4 — Approved 41 - (*) 8 finished, 5 as of June 28, 2017, and 18 scheduled - Table 17. IDR—Regularization Plans—Actions Proposed and Approved - 2016: Insp. Letters 1 — Findings 7 — Reg. Plans Proposed 1 — Approved 7 - - 2017: Insp. Letters 1(*) - (*) As of June 28th, 2017 ### Supervisory findings by Effectiveness Component (EC3–EC13) - EC3 (reporting to banking supervisor): BCB has access to information but does not receive standard reports from banks on suspicious activities and incidents of fraud that are material to safety, soundness, or reputation. BCB maintains frequent communication with banks and external auditors must report incidents of fraud to the BCB (Resolution 3198). BCB has access to STRs to COAF through SisPLD. - EC4 (supervisor informs FIU): Complementary Law 105 requires BCB to notify COAF, MPF and RFB of signs of crimes against public order and of evidence of irregularities or illegal administrative offenses identified in supervision; such reporting does not constitute breach of professional secrecy. MSU (4-30-30-10-02) requires reporting crimes or abuses defined in Law 9613 to the Public Ministry/District Attorney’s Office. - EC5 (CDD policies & integration into risk management): Circular 3461 and Resolution 2554 set internal control and AML/CFT procedural requirements; Circular 3461 requires dissemination, timely registration of customer information, identification of final beneficiaries, PEP rules, and retention. Circular 3691 targets FX market operations with customer due diligence and immediate BCB access to files (Article 139). Resolution 4577 requires continuous and integrated risk management framework (implementation not yet fully in place). - EC6 (correspondent banking controls): Circular 3461 heightens controls for foreign relationships; Circular 3691 sets registration and use rules for BRL deposit accounts for banks headquartered abroad and requires registration in Sisbacen/COSIF for respondent banks carrying international BRL transfers. Cross-border correspondent relationship requirements (Circular 3691, article 170) mirror earlier bullets. Documentary procedures and verifications required for international BRL transfers equal to or more than R$ 10,000.00 (BRL ten thousand) (Articles 173 and 174). - EC7 (controls and systems to prevent abuse): Circular 3461 mandates policies, procedures and internal controls; BCB analyses FI systems per supervisory manual MSU references assessing detection, analysis processes, reporting criteria, cash/value card reporting, and UNSC restrictive lists. - EC8 (sanctioning powers): BCB has corrective and sanctioning powers (MSU 4-50-20) and may apply preventive measures, Commitment Letters, and Punitive Administrative Processes. Resolution 4019 empowers limitations or suspensions for stability/soundness risks. Decon creation in December 2012 intensified sanctions and reduced time between detection and legal action. Table 12 summarizes ML administrative processes and fines. - EC9 (independent audit, compliance officers, screening, training): Internal audit requirement (Resolution 2554); internal audit scope (Resolution 4588); nomination of senior manager for COAF reporting (Circular 3461); AML policies must set selection, training and monitoring criteria for employees (Circular 3461). BCB evaluates through SRC, ACC and ICR inspections. - EC10 (reporting channels & MIS): ACC assesses managerial AML/FT reports, disclosure levels, records of conclusions/actions and senior management monitoring. Resolution 4567 requires banks to provide an anonymous reporting channel for stakeholders; reports must be available to the BCB. Remote inspections apply where ACC not used. - EC11 (protections for reporters): Law 9613 protects staff reporting suspicious activity in good faith from administrative and civil liability. Complementary Law 105 confirms communication of administrative and criminal offenses to competent authorities does not breach secrecy. - EC12 (cooperation with domestic/foreign supervisors): Complementary Law 105 obliges BCB to notify competent authorities of crimes/irregularities. BCB maintains agreements enabling joint supervisory work and mutual cooperation. BCB has 25 MoUs with 29 foreign supervisory authorities from 24 countries and answers about 100 surveys/requests per year (average five or six related to AML/CFT). BCB signed MoUs with named countries (listed in source). - EC13 (in-house AML/CFT resources & guidance): Decon established December 2012 with three Divisions (DSUP2, DSUP3, DSUP4) exclusively dealing with AML/CFT; total HR 46 as of June 28th, 2017. ACC targets 28 largest banks via DSUP2; others under remote supervision by DSUP3/DSUP4. Decon provides feedback through moral suasion meetings, ACC routine meetings and group meetings; no regular written report on ML/FT risks is issued to FIs, but guidance to be released on BCB website by end-2017. ### Assessment, supervisory approach, and recommendations - Assessment of Principle 29: Largely Compliant. - Supervisory approach: “Twin peaks” split between prudential and conduct supervision facilitates coordination; the most relevant banks are subject to continuous supervision (ACC) and others to remote supervision. - Recent enhancements: increased staffing for AML/CFT; creation of COPAC in 2015 reduced time between detection and issuance of subpoenas; ACC methodology adopted replacing some Special Verifications. - Identified gaps and recommendations from assessors: - Move supervisory focus from documentation/process adequacy to deeper examinations of KYC effectiveness and suspicious transaction detection/monitoring tools. - Improve reporting requirements to the BCB and supplement remote procedures for banks not subject to ACC (additional inspections, random sampling). - Ensure BCB access to RFB database to cross-check beneficial owner information (BCB confirmed access recently obtained subject to operational arrangements). - Improve timeliness of remedial and enforcement actions; consider more disciplinarian approaches (automatic fines, rapid escalation to severe measures) to deter AML/CFT failures. - Increase supervisory outreach in the form of published guidance and more systematic dissemination of ML/FT risk information to FIs (BCB to release guidance to banks and banking groups and disclose AML/CFT information on BCB’s website by end-2017). *Source: cr18340 - 9613. Complementary Law 105 provides that the reporting of suspicious criminal transactions to the relevant competent authorities does not constitute a breach of professional secrecy.* ### 1. Responsibilities, objectives and powers C The Banking law clearly establishes the BCB as ### cr18340 - 1. Responsibilities, objectives and powers C The Banking law clearly establishes the BCB as ### 1. Responsibilities, objectives and powers - The Banking law clearly establishes the BCB as the supervisory responsibility with a suite of tasks and powers. - The BCB’s corrective powers are triggered (Resolution 4019) with the aim of ensuring the solidity, stability and regular operation of the National Financial System. - All laws and regulations are published in the Federal Official Gazette of Brazil; updated Federal legislation is accessible through the site of the Presidency of the Republic of Brazil: www.planalto.gov.br. - Regulations issued by the CMN and the BCB are accessible through the BCB site: www.bcb.gov.br. - The BCB does not have the power to issue regulations independently, but it sits on the CMN, has the right of initiative for new regulation in its sphere, and no practical impediment to regulatory development was identified. ### 2. Independence, accountability, resourcing and legal protection for supervisors - Grade: MNC - The BCB does not have full, de jure independence from the government. - Legal protection for BCB staff is lacking. - There is no fixed mandate for the term of the Governor or for Board members. - The Governor can be dismissed at the will of the President with no formal reasons required and no requirement for public disclosure of reasons. - The BCB appears to enjoy de facto operational independence, but this is not backed by law. - Ancillary points that should fall within BCB discretion include budget and personnel decisions. ### 3. Cooperation and collaboration - Grade: C - The BCB has clear powers to exchange information domestically and abroad. - Relevant MoUs are in place or in the process of being agreed to adapt to new elements of recovery and resolution. - The BCB emphasizes proactive and timely information sharing and assistance when requested. ### 4. Permissible activities - Grade: C - Identity and permitted activities of entities operating under a banking authorization are clearly available on the BCB website. - No institution may accept deposits without authorization from the BCB. - No direct prohibition on use of the word “bank” except in particular cases (e.g., credit cooperatives); trade boards register corporate entities and assess name veracity. - No authority actively monitors institutions presenting themselves as banks without necessary authorisations. ### 5. Licensing criteria - Grade: C - The BCB operates a comprehensive and careful licensing process. - Scrutiny extends to new board members or senior executives joining an institution even after initial license grant. ### 6. Transfer of significant ownership - Grade: C - The BCB’s powers for initial authorisation and change of control are very similar. - Practices are careful with attention to determination of ultimate control of a banking entity or group. ### 7. Major acquisitions - Grade: C - The BCB must authorize all acquisitions made by financial institutions (with trading activities exempted). - The BCB is subject to an excessive number of filings, not all relevant to safety and soundness, creating a workload issue. ### 8. Supervisory approach - Grade: LC - The BCB developed a high quality SRC methodology and introduced a twin peak model integrating prudential and conduct supervision. - Central emphasis placed on corporate governance execution. - Banking sector formally segmented into categories from DSIBs (segment 1) to micro credits and cooperatives (segment 5) to enable proportionate supervisory action. - No formal distinction in process between publicly owned and privately owned banks. - Work on recovery and resolvability in progress; affects CPs 3, 8 and 13 and is not yet complete. - Recommendation: design a clear decision-making process to avoid undue delay in recovery or resolution. ### 9. Supervisory techniques and tools - Grade: C - The BCB has pioneering trade reporting and use in systemic risk monitoring (FSB April 2017). - Large primary transaction data mobilized (credit register, trade repositories) to support on- and offsite supervisors, especially for contagion risk. - Supervisory strategy allows targeted planning informed by conglomerate idiosyncrasies and macro concerns (COMEF, COREMEC). - A supervisory manual guides quantitative and qualitative tasks. ### 10. Supervisory reporting - Grade: C - BCB obtains a very wide range of data; DESUP (on-site) and DESIG (offsite) use analytical tools to scrutinize data. - Gap: BCB does not require a full range of prudential information on a solo basis for every bank; CP12 covers consolidated supervision specifics. - BCB can cross check and recreate prudential returns (e.g., large exposures for conglomerates) using registries and repositories. - Strong recommendation: require all banks to submit solo prudential returns covering standard prudential data such as large exposures, related party exposure, problem assets. ### 11. Corrective and sanctioning powers of supervisors - Grade: LC - BCB has a wide range of corrective and remedial powers. - Provisional Measure 784 lapsed and was replaced by Ordinary Law 13,506; between lapse and new law enforcement, BCB retained core powers but lacked important flexibility. - BCB attentive to deterioration in condition and governance and ready to act early and escalate. - Concern: overall timescales observed are lengthy; lack of graduated escalation instruments was a possible cause, remedied by Ordinary Law 13,506. ### 12. Consolidated supervision - Grade: LC - BCB methodology for prudential conglomerate includes relevant entities and uses Contagion Risk analysis to yield group risk insights. - BCB does not systematically obtain or assess individual banking entities within a conglomerate against prudential standards (solo assessment gap). - This approach is reactive rather than proactive; expectation or requirement that individual banks continue to meet prudential standards on a solo basis is not communicated or established. - For resolvability and planning, BCB needs to understand obstacles to liquidity and capital transfers across group entities and may require structural changes. - Emphasis: banks must provide BCB with information rather than rely on BCB to gather it. ### 13. Home-host relationships - Grade: C - BCB has made efforts to establish effective communication with peer authorities for home and host supervision. - Banks reported positive international coordination experience with BCB. - Areas for enhancement: formal communication with supervised banks and frequency of cross-border supervisory college meetings for Brazilian banks with systemic subsidiaries abroad. - Recovery and resolution planning work with banks not yet fully completed (see CP8). ### 14. Corporate governance - Grade: LC - BCB reoriented supervisory approach (SRC and targeted on-site inspections) to emphasize sound corporate governance. - Internal documents and bank discussions consistent with this emphasis. - Corporate governance work still in progress; critical Resolution on risk management and governance (Resolution 4557) had been in force for 6 months for systemic banks and will be in force for the rest of the sector in February 2018. ### 15. Risk management process - Grade: C - Regulatory and supervisory frameworks promote comprehensive risk management culture covering identify, measure, monitor and manage. - Frameworks required to be proportionate to materiality, risk profile, and systemic relevance; segment approach supports this. - Regulations explicitly establish expectations for credit, market, operational and liquidity risk management and related governance. - Recovery and resolution planning progressing for large banks; stress testing and contingency planning requirements apply across banks. ### 16. Capital adequacy - Grade: C - Banks in Brazil implementing Basel III capital requirements; capital rules assessed as compliant by the Basel Committee. - Basel III allows DTAs from temporary differences to be included in CET1 up to 10% of bank’s common equity. - Law No. 12,838 of July 2013 allows banks to convert DTAs arising from loan loss provisions into eligible tax credits (DTCs) when taxable income in any year is negative (loss) or when the bank is bankrupt or subject to extra-judicial liquidation; DTAs from other causes are not eligible. - Law allows banks with eligible tax credits to claim compensation in cash or securities issued by the central government. - DTCs arising from loan loss provisions amount to R$146 billion and are included in CET1 capital and constitute about 25 percent of CET1 capital. - Banks expect to fully implement Basel III by 1 January 2019. - Pillar 2 ICAAP applies only to S1 institutions; simplified ICAAP planned from 2018 for S2 institutions. - All banks required to maintain capital for interest rate risk in the banking book, but not as a binding requirement. - Prudential capital requirements currently apply only at the consolidated level (prudential conglomerate). - BCB is yet to establish thresholds that might trigger supervisory action. ### 17. Credit risk - Grade: C - Regulatory and supervisory requirements ensure adequate credit risk management frameworks. - Periodical monitoring and analysis equip supervisors to challenge bank systems and verify outputs. - A few areas for improvement are identified and specified in relevant credit risk-related CPs. ### 18. Problem assets, provisions, and reserves - Grade: LC - Supervisory framework for early identification and management of problem assets and adequate provisions is largely in place. - In absence of explicit reporting by banks, BCB estimates NPLs from exposure perspective and from 'renegotiation' perspective. - Absence of explicit requirement to adopt expected loss approach for all exposure types and absence of explicit guidance on eligible collateral and valuation pose challenges for assessing provisioning adequacy. - The regulatory framework for identification, measurement and provisioning is in transition and needs stabilization. - Resolution 4557 of 2017 addresses some gaps. - Need for: comprehensive definition of exposure for classification and provisioning; clear norms for reclassification to lower risk categories; explicit adoption of expected loss approach for all exposures; harmonization of norms irrespective of maturity; norms for collateral eligibility and valuation for provisioning. ### 19. Concentration risk and large exposure limits - Grade: LC - Operating regulations for concentration risk for most banks (S2 to S5) have gaps that can introduce bank-level discretion. - Key gaps addressed in Resolution 4557 of 2017: effective for S1 banks from August 2017 and for other banks from February 2018. - Remaining issues: lack of explicit definition of exposure for prudential exposure limits and aggregation rules; lack of explicit reporting from banks on exposures to single or connected counterparties; absence of comprehensive database of connected parties by control or economic interconnectedness. - Without explicit reporting on exposures to economic sectors, geographic regions, and credit risk mitigants, and without guidance or database on inter-sector or inter-region correlations, supervisors cannot fully challenge banks’ concentration risk assessments. *Source: cr18340 - 1. Responsibilities, objectives and powers C The Banking law clearly establishes the BCB as* ### 20. Transactions with related parties MNC The key variances from the Basel norms are ### 20. Transactions with related parties MNC — The key variances from the Basel norms ### Major findings on related party framework and supervision - Non-inclusion of all types of related parties within the prudential purview. - Absence of an explicit and complete definition of related party transactions for prudential purposes. - Absence of a prudential limit on banks’ aggregate exposure to related parties. - Gaps in governance requirements. - Absence of explicit requirement for policies and processes for related party transactions. - Absence of explicit and focused supervisory (prudential) reporting requirement for transactions with and exposure to related parties. - Application of prudential requirements at the level of the prudential conglomerates and not at the level of the solo bank(s) within the conglomerates. - These features collectively result in significant gaps in the prudential regime for transactions with related parties. ### Supervisory monitoring practices and data gaps - The BCB monitors related party transactions by reviewing: - periodical accounting information received from supervised entities, - SCR database, - database on market transactions received from the TRs, - Unicad database. - Given gaps in the definition of related party and related party transactions, and absence of a dedicated off-site supervisory (prudential) report on related party exposures, it is unclear that the universe of the database reviewed by the BCB is complete. - Examples of transactions potentially not reflected in reviewed databases: - transactions with related parties outside the list specified in law or regulations; - sale and purchase of assets outside the scope of the TRs; - service contracts with related parties. - The supervisory routines in the supervisory manual, referencing assessment of inherent risks and control risks pertaining to credit risk, do not explicitly articulate a focus on related party exposures, related party transactions, and governance requirements relevant for such exposures and transactions. --- ### 21. Country and transfer risks MNC ### Major findings on country and transfer risk framework - Requirements under laws and regulations on management of country and transfer risks by financial institutions are not explicit; they are subsumed under general risk management and credit risk management regulations. - The description of country risk in regulations is at variance from the Basel definition, which is wider than the default of the counterparty. - The current description and supervisory approach adopt an “immediate risk” perspective (direct exposures) and do not take into consideration the “ultimate” risk perspective (direct and indirect exposures). - Banks are not explicitly required to establish policies and procedures for identifying, measuring, monitoring and managing country and transfer risks. - The BCB has not issued specific guidance or established specific requirements for: - measurement and grading of exposures to country and transfer risks; - periodical reporting of these exposures to the BCB. - There are no explicit requirements for establishing provisions for country and transfer risk exposures, and for stress testing those exposures. ### Supervisory information and monitoring gaps - Absence of a supervisory information system that tracks and monitors exposures from an ultimate risk perspective, the risk grading of these exposures, and the provisions held by banks for these risks. --- ### 22. Market risk C ### Key findings - Supervisors can determine market risk exposures of banks on almost daily basis from off-site inputs and pursue issues as required, including market risk and funding liquidity interplay. - Market risk is not significant at a system level but is significant for several S3 and S4 institutions. - Challenges exist in establishing a robust governance framework in some institutions, particularly when they are unlisted. - Resolution 4557 of 2017 improves the regulatory framework; it will become fully effective for all institutions from February 2018. - Existing norms lack explicit and clear articulation of minimum requirements, including governance elements, pertaining to shifting of instruments from and to the trading book. --- ### 23. Interest rate risk in the banking book C ### Key findings and reforms - Gaps exist in regulations relating to risk management framework for IRRBB, including governance and board or senior management oversight requirements. - Adequate addressing of IRRBB has been achieved through: - clear articulation of the framework for measuring and reviewing banks’ exposures to IRRBB and introduction of conservative requirements for such measurement considering the Brazilian interest rate environment; - requirement for all banks to hold capital for IRRBB exposures; - issuance of Resolution 4557 of 2017, effective for S1 banks from August 2017 and for other banks by February 2018. - The BCB is reviewing and revising regulatory and supervisory frameworks for IRRBB to align closer to BCBS IRRBB (April 2016). This is expected to be completed in early 2018. --- ### 24. Liquidity risk C ### Key findings - The regulatory requirement (LCR) set by the BCB complies with the Basel standards. - Supervisors monitor the liquidity situation on almost a daily basis, including potential stress from market risk. - Multiple liquidity monitoring tools and methodologies provide assurance of banks’ ability to meet liquidity needs. - Supervisors supplement quantitative monitoring with qualitative assessments of liquidity risk management frameworks through continuous supervision. --- ### 25. Operational risk LC ### Key findings and ongoing gaps - Operational risk management framework initially established in 2007 to support Basel II qualitative requirements; made more prescriptive through Res. CMN 4557. - Res. CMN 4557 is effective for S1 banks from Aug 2017 and will be effective for other banks from Feb 2018. - Main improvements through CMN 4557 include IT risk, outsourcing, business continuity planning and compilation of operational risk loss data. - Supervisory focus has evolved to operational risk models in DSIBs and key elements such as internal loss data collection, scenario analysis, and regulatory reports. - BCB is pursuing improvements to banks’ operational risk loss information systems and databases but has yet to establish periodical regulatory reporting by banks on their internal loss data and operational risk events. --- ### 26. Internal control and audit LC ### Key findings on governance and supervisory expectations - Prior to Resolutions CMN 4595 and CMN 4588, regulation focused on internal controls; responsibility rests with board of directors and senior management; part responsibility on audit committee. - In Brazil: - unlisted banks are not required to establish a board of directors (non-executive); - small unlisted banks need not establish an audit committee; - shareholders can constitute senior management. - Of the 116 unlisted banks, 41 have established Board of Directors. - Of the remaining 75 banks accounting for about R$540 billion in total assets (6.8% market share), 46 are foreign owned banks (5.8% market share). - Regulations permit internal audit to be part of internal control with internal audit reporting to senior management. - Compliance function is not a requirement and internal audit requirements are less sophisticated. - Collectively, these features can undermine effectiveness of internal control and internal audit in these banks. - Resolutions CMN 4595 and CMN 4588 become effective on 31 December 2017; full benefits may take time to materialize. - BCB supervises financial institutions’ “internal controls system” (internal controls, compliance, internal audit) drawing on Resolution 2,554 of 1998, and evaluates effectiveness of compliance and internal audit functions observing the supervisory cycle for each institution. --- ### 27. Financial reporting and external audit C ### Key findings - Financial statements prepared and published by financial institutions comply with Cosif (Brazil GAAP) and IFRS. - Statements are audited by independent external auditors required to perform audits in compliance with international auditing standards. - Audited financial statements with explanatory notes and auditors’ opinion are published at least at half-yearly intervals, both at solo and consolidated levels. - Laws, regulations and the supervisor ensure appropriate governance arrangements are in place for overseeing the external audit function. --- ### 28. Disclosure and transparency C ### Key findings - Supervised institutions regularly publish consolidated and, where appropriate, solo information that is accessible and reflects financial condition, performance, risk exposures, risk management strategies and corporate governance. - Publications mainly comprise audited financial statements with notes (IFRS and BR-GAAP) and Pillar 3 disclosures placed on institutions' websites in accessible locations. --- ### 29. Abuse of financial services LC ### Key findings and supervisory enhancements - BCB has introduced changes and enhancements in AML/CFT oversight since last FSAP, including: - “twin peaks” approach facilitating coordination between prudential and conduct supervision; - creation of a new committee on punitive administrative processes; - increased staffing levels for AML/CFT. - BCB differentiates between banks subject to continuous oversight and those perceived as less risky, applying a remote inspection process to the latter. - Enhancements to supervisory processes are not yet complete; more effort required to reduce time between detection of deficiencies and punitive action. - Next cycle of onsite inspections will move beyond adequacy of documentation and processes into effectiveness of KYC and monitoring, analysis, selection and reporting procedures and tools. - Supervisory guidance on AML/CFT expected to be issued by end 2018. --- ### Recommended actions (selected, by Principle) ### Principle 20 (related parties) — Recommended actions - Introduce enhanced and explicit requirements for Board oversight of related party exposures and transactions. - Provide an explicit definition or articulation of list of “related parties”, to include at least those mentioned in the footnote to the CP. - Provide an explicit definition or articulation of “related party transactions” for prudential purposes, to include at least those mentioned in footnote 69 to the CP. - Introduce a prudential limit for aggregate exposures to related parties that are at least as conservative as the limits for connected counterparties. - Introduce periodical focused reporting by supervised institutions on exposures, transactions, exceptions and write-offs. - Apply the prudential framework for related party exposures and related party transactions to the solo bank(s) within the prudential conglomerate. - Make appropriate corresponding improvements to the supervisory manual. ### Principle 21 (country and transfer risk) — Recommended actions - Revise the definition of country risk to fully align with the Basel definition and explicitly adopt the "ultimate risk" approach. - Consider issuing explicit regulations on identification, measurement, monitoring and management of these risks, including guidance on grading these exposures and provisioning distinct from counterparty risk. - Extend the ultimate risk approach to risk exposures of the bank’s branches and group entities abroad. - Introduce appropriate prudential reporting requirements to monitor banks’ exposures to these risks. - Make corresponding improvements to the supervisory manual and apply regulatory and supervisory elements pertaining to these risks to solo banks within prudential conglomerates. ### Other selected recommended actions (by Principle) - Principle 22: Review market risk management frameworks in relevant S3 and S4 banks more frequently; issue explicit norms and guidance for shifting of exposures from and to trading book. - Principle 25: Issue clear guidance for standardized compilation of internal loss database and periodical reporting; issue regulations focused on cybersecurity and prompt reporting of significant cyber threats; advise banks to report significant operational risk events with minimum delay. - Principle 26: Devote greater attention to internal control, compliance and internal audit functions in unlisted banks, review effectiveness and take corrective measures where warranted. - Principle 29: Consider proactive measures such as additional inspections in non-priority bank segment; consider more disciplinarian corrective actions and faster escalation; complete operational processes to ensure BCB access to Brazilian Federal Revenue Office database for beneficial owner verification (access granted after assessment mission; some operational arrangements remain). *Source: cr18340 - 20. Transactions with related parties MNC The key variances from the Basel norms are* ### 43. The Brazilian authorities wish to express their support for the Financial Sector ### The Brazilian authorities wish to express their support for the Financial Sector Assessment Program (FSAP) ### Overall position and engagement - The Brazilian authorities express support for the FSAP as a valuable contribution to the enhancement of supervisory practices. - Brazil appreciates the effort of FSAP staff and the insights gained during discussions. - The authorities express entire agreement with the staff’s views on the necessity of improvements in the Brazilian framework, and full commitment to adopt necessary steps in directions suggested by the FSAP (examples cited: CP 2 and recommendations concerning resolution practices and regulation in CP 8). ### General commitment and points of divergence - Authorities acknowledge the quality of assessors’ inputs and commit to adopting most recommendations, while providing differing views on some comments and grades. - The authorities are committed to further improve policies and practices of supervision and provide specific comments on FSAP recommendations. ### CP 10 — Onus and responsibility for risk management - FSAP noted a need to put onus and responsibility for monitoring and managing prudential and risk dimensions squarely on financial institutions. - Authorities state that the onus and responsibility are already fully on banks, as established by extensive CMN and BCB regulation. - Supervisory framework elements cited: - Continuous supervision cycle to identify vulnerabilities in risk management. - Supervisory actions and sanctions where institutions fail regulatory requirements. - Risk and Controls Assessment System (SRC) conducts extensive on-site analyses of inherent risks and controls. - Off-site monitoring tools and significant information allow BCB to keep close watch and provide an independent view. - Authorities reference positive findings in the last FSB Peer Review of Brazil (FSB Review Report, April 19, 2017), praising “pioneering work carried out on trade reporting and its use in systemic risk monitoring”. ### Corrective and sanctioning powers and Abuse of financial services (CPs 11 and 29) - Points where authorities differ from FSAP staff: - Staff recommendation: BCB should implement additional inspections to improve supervision of smaller banks. - Authorities’ response: - BCB’s remote inspection methodology is designed to address all steps of a full inspection, including evidence collection on functioning of systems and controls; examiners can request additional reports/databases. - Remote inspections have enabled BCB to liquidate some FX brokers based solely on remote inspection information where serious violations and sufficient evidence were detected. - The overall design (continuous supervision for higher risk; remote inspections for lower risk) aligns with FATF/GAFI’s risk based approach. - Staff suggestion: BCB should consider a more disciplinarian approach than moral suasion. - Authorities’ response: - Moral suasion is used as a complementary measure and does not prevent corrective and/or sanctioning measures when appropriate. - Recent legislation (Law 13,506, passed on November 13, 2017) introduced changes in procedures for sanctioning administrative processes that will contribute to improving timeliness of sanctioning procedures. - Timelines are being reduced, but corrective actions are already taken in a reasonable timeframe, often before initiation of sanctioning processes. Priority on corrective action is considered appropriate due to proven efficiency in ceasing irregular conduct. ### Consolidated supervision (CP 12) - Reason for non-compliant judgment: prudential regulations do not reflect expectation that individual institutions within a Prudential Conglomerate should also individually observe prudential requirements. - Staff concluded it is unlikely a solo bank would deteriorate extensively before BCB monitoring tools detect a problem; BCB monitors significant sub-consolidated and standalone information and acts if necessary. - BCB supervisory work includes analysis of each group’s structure, business models, and relevant functional activities/business lines; individual areas are examined under a risk-based approach. - BCB will review application of its prudential regulatory framework and make changes as necessary, based on risk-based and cost-effective approach, taking proportionality criteria into account. ### Corporate governance (CP 14) - Authorities generally agree with FSAP assessment but note recent improvements not fully taken into account by FSAP staff. - Examples of regulatory developments: - Resolution 4,557 of 2017 established risk management requirements following a proportionality approach (segmentation introduced by Resolution 4,553 of 2017). - Compliance required for internationally active and systemic banks since August 2017; for other institutions since February 2018. - Resolution 4,557 consolidated and improved requirements from prior regulations: operational risk (Resolution 3,380 of 2006), market risk (Resolution 3,464 of 2007), credit risk (Resolution 3,721 of 2009), liquidity risk (Resolution 3,988 of 2011). - Audit committee requirements established in Resolution 3,198 of 2004; remuneration policy and requirement of a Remuneration Committee introduced by Resolution 3,921 of 2010. - Many features of Resolution 4,557 were already part of supervision manuals and were required by supervisors before regulation came into force. - Supervisory process incorporates local standards and international best practices; supervisory guidelines published March 2018 and supervisory expectations were communicated through the supervision cycle before guideline publication. - Board of directors context: - Brazilian corporate law (Law 6,404 of 1976) requires boards only for publicly held companies. - 41 non-listed banks constituted boards of directors responding to supervisory recommendations. - In absence of a board, senior management must assume board responsibilities for risk management and capital management as established by Resolution 4,557. - Listed and unlisted banks that have a board hold 93 percent of the total assets and 95 percent of total deposits of the Brazilian financial system as of September 2017. - Of the 75 banks without a board: - 46 are foreign-owned institutions holding 6 percent of system assets and 4 percent of system deposits; governance monitored by parent companies. - The remainder represent 1 percent of system assets and 1 percent of system deposits, consisting of very small institutions (largest being a cooperative bank). ### Problem assets, provisions and reserves (CP 18) - Authorities share most FSAP staff views but provide clarifications. - Brazilian regulations require financial institutions to adopt an expected loss approach for assessing provisions. - Resolution 2,682 of 1999: - Establishes minimum provisioning levels according to number of days past-due. - Provisions shall be sufficient to cover expected credit losses in any situation, including when days past-due is used as sole criterion for loans below fifty thousand of Brazilian reais. - The Brazilian provisioning framework differs from IAS39 (which requires provisions only for defaulted or almost-defaulted exposures), being closer to IFRS9. - Regulatory evolution: - Resolution 3,721 of 2011 required credit risk management structure to ensure provisioning levels compatible with incurred credit risk; supervision can require provisioning for all on- and off-balance sheet credit risk exposures. - Resolution 4,557 establishes that integrated risk management must guarantee provisions sufficient to cover all expected credit losses. - Draft regulations to replace Resolution 2,682 of 1999 have been submitted to public consultation; proposed rules aim to reduce asymmetries between local accounting regulation and IFRS9. Final rules expected in 2018 and will clarify harmonization of Resolution 4,557 and IFRS9. FSAP recommendations on collateral eligibility/valuation and reclassification of problem assets will be considered. - Resolution 4,557 adopts a comprehensive approach to definition of exposure: management requirements for credit risk (including assessment of provisions) apply to any exposure meeting the risk definition, irrespective of legal form or accounting denomination. - Gaps in explicit definition of credit risk exposure and explicit command for provisioning exposures other than those in Resolutions 2,682 and 4,512 will be addressed by IFRS9-implementing regulation. - Credit risk governance: board responsibilities addressed in Resolution 3,721 of 2009 and Resolution 4,557 — boards must approve/review risk management policies and ensure prompt correction of deficiencies; boards receive periodic management reports on asset performance, classification, provisions, and material problem assets. - FSAP recommendation on periodical reporting on asset classification and provisioning: - Authorities state reporting requirements have been addressed. - Credit bureau instructions require each operation’s record to inform adoption of restructuring practices as defined in Resolution 4,557 and Circular Letter 3,819 of 2018. - This information has been received from systemically important institutions since April 2018 and will be received for others starting in September 2018. ### Concentration risk and large exposure limits (CP 19) - Authorities generally agree with assessment but note supervisory monitoring of large exposures is comprehensive and effective. - Supervisor receives monthly reports from largest banks, taking into account connected counterparties; BCB can monitor large exposures through wide-range supervisory tools and procedures. - Authorities agree definitions and aggregation methods for exposures and connected counterparties should be improved. - New regulation replacing Resolution 2,844 of 2001 will address gaps to comply with BCBS 283 (“Supervisory framework for measuring and controlling large exposures”); for large exposures limit, all exposures used in capital requirement calculation will be considered. Regulation expected to be implemented according to Basel timeline. - Consultative process: - Consultative document published on Central Bank of Brazil website on February 9, 2018; proposal available for comments by March 20, 2018. - Financial System Monitoring Department conducted detailed impact study; concluded data already gathered by BCB does not significantly differ from data to be collected under the new approach. - Supervisors have enough information to challenge banks on concentration risk and large exposures; banks are improving systems to prepare for BCB scrutiny and enhance capacity to measure concentration risk and adopt remedial action for breaches. - Compliance with regulatory limits is monitored monthly by the Financial System Monitoring Department. - BCB is updating the Report on Operational Limits (DLO) to follow latest BCBS recommendations for large exposures, including additional requirements for financial institutions; this will meet FSAP recommendation for explicit periodical reporting by banks on concentration risk exposures. - BCB committed to continuously improving supervisory guidance and databases; information on correlations among economic sectors or geographic regions will be broadened and produced regularly via automatic procedures. - Authorities state sufficient data exists on credit risk mitigants and a comprehensive database of almost all connected parties; upcoming regulatory enhancements expected to address FSAP-identified gaps. ### Transactions with related parties (CP 20) - Authorities generally concur with CP 20 assessment but highlight points moderating the judgment. - Historical prohibition and legislative change: - Granting of loans to related parties was prohibited until Law 13,506 of 2017 came into force. - Law 13,506 of 2017 amended legislation permitting loans to related parties provided they are carried out under market conditions; law’s definition of “related party” includes significant portion of parties listed in CP 20. - Prior supervisory mechanisms to assess exposures/risks from related-party transactions: - Regular information gathering of detailed accounting information for monitoring purposes, enabling identification of significant changes and atypical transactions (including related-party transactions). - On-site examinations to verify formal segregation of duties and assess potential conflicts of interest involving related parties. - New supervisory procedures under implementation: - Requirement for Board of Directors to ensure transactions with related parties are properly reviewed regarding risks and restrictions. - Evaluation of contagion risk from transactions with related parties outside the prudential conglomerate and assessment of policies to control these transactions. - Disclosure and definitions: - Resolution 4,636 of 2018 (and Resolution 3,750 of 2009) establish procedures for disclosing information about transactions with related parties using a definition closely aligned with CP 20. - Authorities recognize need for regulatory and supervisory adjustments to comply with FSAP recommendations: - Planned improvements will encompass prudential limits applied to a broader range of transactions with a wider set of counterparties. - Requirements will focus on prudential conglomerates and relevant individual entities. *Source: cr18340 - 43. The Brazilian authorities wish to express their support for the Financial Sector Assessment Program (FSAP).* ### 80. With respect to the introduction of periodical focused reporting by supervised ### 80. With respect to the introduction of periodical focused reporting by supervised institutions on the exposures, transactions, exceptions and write-offs, Brazil intends to follow the recommendation. ### Country and transfer risks (CP 21) - Authorities concur with some assessment points but strongly disagree with the relevance staff assigned to country and transfer risks. - Brazil FX exposure is very low in the financial institutions’ balance sheets; authorities view FSAP concerns as overstated. - Since 2009, Brazilian laws and regulations include country and transfer risks as elements of credit risk, requiring financial institutions to establish policies and procedures for identifying, measuring, monitoring and managing them accordingly. - These risks must be considered in the risk framework and, when relevant, in the stress testing process. - The majority of financial institutions exhibit very low levels of exposure to country and transfer risks; regulatory choice was to define them formally as components of credit risk and to establish broad risk management requirements applicable to all financial institutions. - Supervisors assess the sufficiency and adequacy of risk management in the Risk and Controls Assessment System (SRC), which includes a specific evaluation of elements for country and transfer risks. - Resolution 4,557 establishes country and transfer risks as components of credit risk and subjects them to all applicable requirements, including the ECL framework and stress testing process. - Authorities concur with the recommendation to introduce more explicit requirements despite the low exposure; these issues will be addressed in the regulation that will replace Resolution 2,682 and implement IFRS9 requirements for Brazilian banks. - The BCB supervisory process includes indirect exposures in default risk by considering that a local debtor may face financial difficulties due to events abroad; the BCB intends to review Resolution 4,557 of 2017 to make it clearer. - Authorities agree with the recommendation of introducing prudential reporting requirements to monitor banks’ exposure to these risks and will adopt necessary measures to implement these requirements. ### Operational risk (CP 25) - Authorities consider current supervisory practices to be in line with the guidelines of BCP 25. - Supervisory requirements on operational risk management in Brazil are constantly evolving and frequently incorporate items not explicitly required in regulations. - The BCB has had IT expert supervisory teams since 1996 and has required banks’ compliance with features of the ISACÁ’s COBIT framework since 2000. - Supervisors closely monitor risk exposure of banks, especially those systemically important; operational risk management requirements are commensurate with the nature and complexity of institutions’ products, services, activities, processes and systems. - Supervision has focused on internal loss databases of operational risk events and has demanded banks, mainly the D-SIBs and ASA banks, to collect data and adequately react to it. - The BCB is currently working, along with the industry, on a project imposing periodical regulatory reporting by banks on their internal loss data and operational risk events. - Resolution 4,557, of February 23, 2017, consolidated risk management requirements in place since 2006 and updated operational risk management requirements for banks in Brazil; the regulation takes into account post-crisis principles and many supervisory practices already in place. - From authorities’ perspective, Resolution 4,557 complemented by supervisory practices adequately covers the Core Principle criteria, including operational risk data and reporting mechanisms to supervisors. - National Monetary Council Resolution 4,658, issued on April 26, 2018, establishes requirements for cybersecurity policy, including minimum requirements on outsourcing storage and data processing and on outsourcing cloud computing, covering recommended improvements related to cyber risks and prompt reporting of cyber threats. ### Internal control and audit (CP 26) - Assessment notes not all banks are required to establish a board of directors or an audit committee. - As of November 2017, from a total of 135 banks, 107 either have a board of directors or are foreign-owned banks. - The remaining 28 banks comprise only 1 percent of the market share, as measured by assets. - Assessment states regulations permit internal audit to be part of the internal control function, compliance function is not a requirement, and requirements for the internal audit framework are not sophisticated enough. - Resolutions 4,588 and 4,595, which updated requirements for the internal audit function and regulated the compliance function, came into force on December 31, 2017. - These Resolutions introduced more prescriptive requirements, in line with BCBS documents “Compliance and the Compliance Function in Banks” (2005) and “The Internal Audit Function in Banks” (2012). - Many features of these regulations were already part of supervision manuals and required by supervisors; the Resolutions represent a consolidation of rules and practices already in place. *Source: cr18340 - 80. With respect to the introduction of periodical focused reporting by supervised institutions on the exposures, transactions, exceptions and write-offs, Brazil intends to follow the recommendation.* --- _Source: https://www.imf.org/-/media/files/publications/cr/2018/cr18340.pdf_