## EXECUTIVE SUMMARY ## Source details **Canonical URL:** [EXECUTIVE SUMMARY](https://www.imf.org/-/media/files/publications/pp/2024/english/ppea2024037.pdf) ## Other formats - [Markdown version](/-/media/files/publications/pp/2024/english/ppea2024037.pdf.md) - [Structured JSON version](/-/media/files/publications/pp/2024/english/ppea2024037.pdf.json) --- ### INTRODUCTION - The BCBS published the revised Basel Core Principles for Effective Banking Supervision (BCP) in April 2024; the new BCP document combines the Core Principles and the assessment methodology and is available both as a single comprehensive document and as an integrated module within the Basel Framework. - The BCP are the standard used in assessing banking regulatory and supervisory regimes under the Financial Sector Assessment Program (FSAP) and for preparing stand-alone Reports on Observance of Standards and Codes (ROSCs). - Purpose of the paper: inform the Executive Boards of the IMF and WB of the main changes in the revised Principles and methodology and seek IMF Board endorsement for use in future assessments. - Date on document: July 12, 2024. ### SUMMARY OF KEY CHANGES - First comprehensive update since 2012 reflecting: - lessons from countries’ implementation of the 2012 Core Principles; - impacts of and policy responses to the COVID-19 pandemic; - FSAP assessments completed since 2013; - thematic topics: (i) financial risks; (ii) operational resilience, including cyber security risks; (iii) systemic risk and macroprudential supervision; (iv) risks from climate change and digitalization; (v) growth of nonbank financial intermediation; (vi) evolving risk management practices. - Lessons from the March 2023 banking turmoil incorporated, including supervisory expectations on capacity for timely, consistent, and conclusive supervisory actions; adequacy of liquidity arrangements; interface between daily supervisory practices and crisis management measures; heightened focus on understanding the viability of banks’ business models. - The revised standard: - strengthens requirements for supervisors, supervisory approaches, and supervisors’ expectations of banks; - reinforces proportionality to accommodate the global diversity of banks and banking systems while maintaining stringency of approach; - makes explicit reference to the High-Level Considerations on Proportionality. - Several criteria formerly classified as “additional” under the 2012 BCP have been reclassified as “essential” criteria. - IMF and WB staff participated in the review process and support the revisions as strengthening prudential regulation and effective supervision. ### USE OF THE PRINCIPLES IN ASSESSMENTS - The revised Core Principles and methodology are available for immediate use by the IMF and the WB; the BCBS has not provided a transitional period. - Assessments of compliance with the new BCP in the context of the FSAP or as stand-alone ROSCs will start immediately after IMF Board endorsement. - Many countries are likely to need time to achieve compliance because the BCP: - expanded to cover new areas; - are more comprehensive; and - have sharpened compliance criteria—effectively raising the bar for supervisors and banks. - Assessment workload and demand: - coverage and complexity mean assessments remain resource intensive for staff; - BCBS members (all subject to mandatory FSAP assessments) are likely to request a graded assessment in their next FSAP as part of implementation commitments; - a change in standard or methodology is a key criterion for determining whether a graded assessment (Detailed Assessment Report) or focused review (Technical Note) will be conducted in the FSAP. - Staff expects to be able to respond to renewed interest in BCP detailed assessments within the existing resource envelope. ### TECHNICAL ASSISTANCE - Outreach during the consultation period included eight webinars with the ten IMF Regional Capacity Development Centers, reaching over 1600 participants from authorities of over a hundred jurisdictions; the outreach sessions were delivered in English, French, Spanish and Portuguese. - The BCBS also hosted an outreach program, in collaboration with IMF and WB staff, targeted at advanced and emerging market economies’ authorities and industry representatives. - The revised BCP are likely to generate additional requests for technical assistance (TA) because: - the principles acknowledge emerging risks such as climate and digitalization and counterparty risk from nonbank financial intermediation; - the principles have become more demanding in scope and depth of regulatory requirements and supervisory practices; - jurisdictions will likely seek assistance to enhance capacity to identify and monitor emerging risks, understand cross-sector linkages, and ensure effective, risk-based supervision incorporating systemic and macroprudential dimensions. ### PROPOSED DECISION - Proposed IMF Executive Board decision (may be adopted by a majority of votes cast): - The Executive Board takes note of the February 2024 revisions to the BCBS Core Principles for Effective Banking Supervision endorsed by the International Conference of Banking Supervisors in April 2024 and endorses them as the standards under which assessments initiated after the date of this decision will be conducted. - For assessments initiated before that date, the revised principles may be used at the request of a member. ### APPENDIX I — SUMMARY OF THE MAIN REVISIONS TO THE BCBS CORE PRINCIPLES - Financial Risks - A non-risk-based measure to constrain the buildup of leverage in the banking sector (CP16 – Capital Adequacy) was introduced; the previous methodology broadly required capital to constrain leverage and this has now been made more explicit. - Credit Risk Management (CP17) strengthened to emphasize securitization exposures, counterparty risk margining, and clarify the broad scope of credit risk. - Problem Assets, Provisions and Reserves (CP18) updated to include expected credit loss provisioning and align definitions with BCBS guidance. - Operational Resilience and Digitalization of Finance - CP25 revised to encompass operational risk and operational resilience, enhancing focus on governance, operational risk management, business continuity, interconnections and interdependencies, third party dependence management, cybersecurity, and information and communication technology. - Systemic Risk and Macroprudential Supervision - Existing requirements in various CPs strengthened to incorporate macroprudential policy and supervision and a broad financial system perspective. - Amendments to Cooperation and Collaboration (CP3) and Home-Host Relationships (CP13) emphasize close cooperation between banking supervision authorities and macroprudential/financial stability authorities. - Supervisory Approach (CP8) and Supervisory Techniques and Tools (CP9) amended to clarify the supervisor’s role in assessing and mitigating risks to banks and the banking system and to require a process to assess and identify systemically important banks in a domestic context. - Risk Management Practices - Corporate Governance (CP14) changes: greater emphasis on corporate culture and values, board independence, and processes to identify and assign responsibility and accountability. - Risk Management Process (CP15) changes: reinforced risk culture and risk appetite frameworks; introduced specific requirements on risk data aggregation; explicit reference to business model sustainability and explanation of key components. - Transactions with Related Parties (CP20) strengthened: definition of related parties and approval/management/reporting requirements reinforced; provisions on exemptions for certain intragroup transactions introduced. - Pillar 3 disclosure requirements introduced for internationally active banks (CP28 – Disclosure and Transparency). - Amendments to maintain consistency with FATF standards (CP29 – Abuse of Financial Services). - New Risks — Climate Change and Digitalization - Explicit references to climate-related financial risks introduced and a principles-based approach promoted for supervisory practices and banks’ risk management. - Amendments to Supervisory approach (CP8) and Supervisory Reporting (CP10) introduce a definition of climate-related financial risks, require supervisors to consider climate-related financial risks in their methodologies and have the power to require banks to submit information to assess materiality. - Adjustments to CP15 require banks to have comprehensive risk management policies and processes for all material risks (including climate-related financial risks), recognize varying time horizons for materialization, and implement appropriate measures where risks are assessed as material. - Adjustments to Internal Control and Audit (CP26) require banks to consider climate-related financial risks as part of their internal control framework. - Banks and supervisors may consider climate-related financial risks in a flexible manner given heterogeneity and evolving practices. ### 8. Changes resulting from technology driven innovation and the digitalization of finance - Technology-driven innovation and digitalization: revisions to supervisory responsibilities and operational resilience - Amendments to Responsibilities, Objectives and Powers (CP1) were made to ensure that supervisors can continue to access relevant information (irrespective of where it is stored) and review the overall activities of the banking group, including those undertaken by service providers. - The importance of Operational Resilience (CP25) was also highlighted. - Nonbank Financial Intermediation: group-wide supervision and specific risk emphases - The rapid proliferation of nonbank financial intermediation and its potential impact on financial stability were acknowledged. - Amendments reinforce the need for a group-wide approach to supervision (CP1). - Amendments to CP15 highlight step-in risk more explicitly. - Adjustments to CP17 give greater emphasis to the management of counterparty credit risk. ### High-level supervisory framework (selected principles and core expectations) - Principle 1 – Responsibilities, Objectives, and Powers: An effective system of banking supervision has clear responsibilities and objectives for each authority involved in the supervision of banks and banking groups. A suitable legal framework for banking supervision is in place to provide each responsible authority with the necessary legal powers to authorize banks, conduct ongoing supervision, address compliance with laws and undertake timely corrective actions to address safety and soundness concerns. - Principle 2 – Independence, Accountability, Resourcing, and Legal Protection for Supervisors: The supervisor possesses operational independence, transparent processes, sound governance, budgetary processes that do not undermine autonomy, and adequate resources, and is accountable for the discharge of its duties and use of its resources. The legal framework for banking supervision includes legal protection for the supervisor. - Principle 3 – Cooperation and Collaboration: Laws, regulations, or other arrangements provide a framework for cooperation and collaboration with relevant domestic authorities and foreign supervisors. These arrangements reflect the need to protect confidential information. - Principle 4 – Permissible Activities: The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined, and the use of the word “bank” in names is controlled. - Principle 5 – Licensing Criteria: The licensing authority has the power to set criteria for licensing banks and to reject applications where the criteria are not met. At a minimum, the licensing process consists of an assessment of the ownership structure and governance (including the fitness and propriety of board members and senior management) of the bank and its wider group, its strategic and operating plan, internal controls, risk management and projected financial condition (including capital base). Where the proposed owner or parent organisation is a foreign bank, the prior consent of its home supervisor is obtained. - Principle 6 – Transfer of Significant Ownership: The supervisor has the power to review, reject and impose prudential conditions on any proposals to transfer significant ownership or controlling interests held directly or indirectly in existing banks to other parties. - Principle 7 – Major Acquisitions: The supervisor has the power to: (i) approve or reject (or recommend to the responsible authority the approval or rejection of) and impose prudential conditions on major acquisitions or investments by a bank (including the establishment of cross-border operations), against prescribed criteria; and (ii) determine that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision. - Principle 8 – Supervisory Approach: An effective system of banking supervision requires the supervisor to develop and maintain a forward-looking assessment of the risk profile of individual banks, proportionate to their systemic importance; identify, assess and address risks emanating from banks and the banking system as a whole; have a framework in place for early intervention; and have plans in place, in partnership with other relevant authorities, to take action to resolve banks in an orderly manner if they become non-viable. - Principle 9 – Supervisory Techniques and Tools: The supervisor uses an appropriate range of techniques and tools to implement the supervisory approach and deploys supervisory resources on a proportionate basis, considering the risk profile and systemic importance of banks. - Principle 10 – Supervisory Reporting: The supervisor collects, reviews and analyses prudential reports and statistical returns from banks on both a solo and a consolidated basis, and independently verifies these reports through either on-site examinations or use of external experts. - Principle 11 – Corrective and Sanctioning Powers of Supervisors: The supervisor acts at an early stage to address unsafe and unsound practices or activities that could pose risks to banks or to the banking system. The supervisor has at its disposal an adequate range of supervisory tools, that it can apply at its discretion, to bring about timely corrective actions. This includes the ability to revoke the banking license or to recommend its revocation. - Principle 12 – Consolidated Supervision: The supervisor supervises the banking group on a consolidated basis, adequately monitoring and, as appropriate, applying prudential standards to all aspects of the business conducted by the banking group worldwide. - Principle 13 – Home-host relationships: Home and host supervisors of cross-border banking groups share information and cooperate for effective supervision of the group and group entities, and effective handling of crisis situations. Supervisors require the local operations of foreign banks to be conducted to the same standards as those required of domestic banks. ### Prudential regulations and risk management (selected principles) - Principle 14 – Corporate Governance: The supervisor determines that banks have robust corporate governance policies and processes covering, for example, corporate culture and values, strategic direction and oversight, group and organizational structure, the control environment, the suitability assessment process, the responsibilities of the banks’ boards and senior management, and compensation practices. These policies and processes are commensurate with the risk profile and systemic importance of the bank. - Principle 15 – Risk Management Process: The supervisor determines that banks have a comprehensive risk management process (including effective board and senior management oversight) to identify, measure, evaluate, monitor, report and control or mitigate all material risks (which can include risks related to digitalization, climate-related financial risks and emerging risks) on a timely basis and to assess the adequacy of their capital, their liquidity and the sustainability of their business models in relation to their risk profile and market and macroeconomic conditions. This extends to the development and review of contingency arrangements (including robust and credible recovery plans where warranted) that consider the specific circumstances of the bank. The risk management process is commensurate with the risk profile and systemic importance of the bank. - Principle 16 – Capital Adequacy: The supervisor sets prudent and appropriate capital adequacy requirements for banks that reflect the risks undertaken and presented by a bank in the context of the markets and macroeconomic conditions in which it operates. The supervisor defines the components of capital, bearing in mind their ability to absorb losses. At least for internationally active banks, capital requirements are not less stringent than the applicable Basel standards. - Principle 17 – Credit Risk: The supervisor determines that banks have an adequate credit risk management process that considers their risk appetite, risk profile, market conditions, macroeconomic factors and forward-looking information. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate credit risk (including counterparty credit risk) on a timely basis. The full credit life cycle is covered, including credit underwriting, credit evaluation and the ongoing management of the bank’s loan and investment portfolios. - Principle 18 – Problem Assets, Provisions, and Reserves: The supervisor determines that banks have adequate policies and processes for the early identification and management of problem exposures and the maintenance of adequate provisions reserves. - Principle 19 – Concentration Risk and Large Exposure Limits: The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or mitigate concentrations of risk on a timely basis. Supervisors set prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties. At least for internationally active banks, large exposure requirements are not less stringent than the applicable Basel standard. - Principle 20 – Transactions with Related Parties: To prevent abuses arising in transactions with related parties and to address the risk of conflicts of interest, the supervisor requires banks to: enter into any transactions with related parties on an arm’s length basis; monitor these transactions; take appropriate steps to control or mitigate the risks; and write off exposures to related parties in accordance with standard policies and processes. - Principle 21 – Country and Transfer Risks: The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or mitigate country risk and transfer risk in their international lending and investment activities on a timely basis. - Principle 22 – Market Risk: The supervisor determines that banks have an adequate market risk management process that considers risk appetite, risk profile, market and macroeconomic conditions, and the risk of a significant deterioration in market liquidity. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate market risks on a timely basis. - Principle 23 – Interest Rate Risk in the Banking Book: The supervisor determines that banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate risk in the banking book on a timely basis. These systems consider the bank’s risk appetite, risk profile and market and macroeconomic conditions. - Principle 24 – Liquidity Risk: The supervisor sets prudent and appropriate liquidity requirements (which can include either quantitative or qualitative requirements or both) that reflect the liquidity needs of banks. The supervisor determines that banks have a strategy that enables prudent management of liquidity risk and compliance with liquidity requirements. The strategy considers the bank’s risk profile, market and macroeconomic conditions, and includes prudent policies and processes, consistent with the bank’s risk appetite, to identify, measure, evaluate, monitor, report and control or mitigate liquidity risk over an appropriate set of time horizons. At least for internationally active banks, liquidity (including funding) requirements are not lower than the applicable Basel standards. - Principle 25 – Operational Risk and Operational resilience: The supervisor determines that banks have an adequate operational risk management framework and operational resilience approach that considers their risk profile, risk appetite, business environment, tolerance for disruption to their critical operations, and emerging risks. This includes prudent policies and processes to: (i) identify, assess, evaluate, monitor, report and control or mitigate operational risk on a timely basis; and (ii) identify and protect themselves from threats and potential failures, respond and adapt to, as well as recover and learn from, disruptive events to minimize their impact on delivering critical operations through disruption. - Principle 26 – Internal Control and Audit: The supervisor determines that banks have adequate internal control frameworks to establish and maintain an effectively controlled and tested operating environment for the conduct of their business, considering their risk profile. These include clear arrangements for delegating authority and responsibility; separation of the functions that involve committing the bank, paying away its funds, and accounting for its assets and liabilities; reconciliation of these processes; safeguarding the bank’s assets; and appropriate independent internal audit (including those that are outsourced or co-sourced), compliance and other control functions to test adherence to and effectiveness of these controls as well as applicable laws and regulations. - Principle 27– Financial Reporting and External Audit: The supervisor determines that banks and banking groups maintain adequate and reliable records, prepare financial statements in accordance with accounting policies and practices that are widely accepted internationally and annually publish information that fairly reflects their financial condition and performance and bears an independent external auditor’s opinion. The supervisor also determines that banks and parent companies of banking groups have adequate governance and oversight of the external audit function. - Principle 28 – Disclosure and Transparency: The supervisor determines that banks and banking groups regularly publish information on a consolidated and, where appropriate, solo basis that is easily accessible and fairly reflects their financial condition, performance, risk exposures, risk management strategies and corporate governance policies and processes (including compensation practices). At least for internationally active banks, disclosure requirements are not less stringent than the applicable Basel standards. - Principle 29 – Abuse of Financial Services: The supervisor determines that banks have adequate policies and processes, including robust and risk-based customer due diligence (CDD) rules and effective compliance functions to promote high ethical and professional standards in the financial sector and prevent the bank from being used intentionally or unintentionally for criminal activities. *Source: 2024 REVISED BASEL CORE PRINCIPLES FOR EFFECTIVE BANKING SUPERVISION (excerpt).* ### EXECUTIVE SUMMARY ### EXECUTIVE SUMMARY ### INTRODUCTION - The BCBS published the revised Basel Core Principles for Effective Banking Supervision (BCP) in April 2024; the new BCP document combines the Core Principles and the assessment methodology and is available both as a single comprehensive document and as an integrated module within the Basel Framework. - The BCP are the standard used in assessing banking regulatory and supervisory regimes under the Financial Sector Assessment Program (FSAP) and for preparing stand-alone Reports on Observance of Standards and Codes (ROSCs). - Purpose of the paper: inform the Executive Boards of the IMF and WB of the main changes in the revised Principles and methodology and seek IMF Board endorsement for use in future assessments. - Date on document: July 12, 2024. ### SUMMARY OF KEY CHANGES - The revision is the first comprehensive update since 2012 and reflects: - lessons from countries’ implementation of the 2012 Core Principles; - impacts of and policy responses to the COVID-19 pandemic; - FSAP assessments completed since 2013; - thematic topics: (i) financial risks; (ii) operational resilience, including cyber security risks; (iii) systemic risk and macroprudential supervision; (iv) risks from climate change and digitalization; (v) growth of nonbank financial intermediation; (vi) evolving risk management practices. - Lessons from the March 2023 banking turmoil were incorporated, including: - supervisory expectations on capacity for timely, consistent, and conclusive supervisory actions; - adequacy of liquidity arrangements; - interface between daily supervisory practices and crisis management measures; - heightened focus on understanding the viability of banks’ business models. - The revised standard: - strengthens requirements for supervisors, supervisory approaches, and supervisors’ expectations of banks; - reinforces proportionality to accommodate the global diversity of banks and banking systems while maintaining stringency of approach; - makes explicit reference to the High-Level Considerations on Proportionality. - Several criteria formerly classified as “additional” under the 2012 BCP have been reclassified as “essential” criteria. - IMF and WB staff participated in the review process and support the revisions as strengthening prudential regulation and effective supervision. ### USE OF THE PRINCIPLES IN ASSESSMENTS - The revised Core Principles and methodology are available for immediate use by the IMF and the WB; the BCBS has not provided a transitional period. - Assessments of compliance with the new BCP in the context of the FSAP or as stand-alone ROSCs will start immediately after IMF Board endorsement. - Many countries are likely to need time to achieve compliance because the BCP: - expanded to cover new areas; - are more comprehensive; and - have sharpened compliance criteria—effectively raising the bar for supervisors and banks. - Assessment workload and demand: - coverage and complexity mean assessments remain resource intensive for staff; - BCBS members (all subject to mandatory FSAP assessments) are likely to request a graded assessment in their next FSAP as part of implementation commitments; - a change in standard or methodology is a key criterion for determining whether a graded assessment (Detailed Assessment Report) or focused review (Technical Note) will be conducted in the FSAP. - Staff expects to be able to respond to renewed interest in BCP detailed assessments within the existing resource envelope. ### TECHNICAL ASSISTANCE - Outreach during the consultation period included eight webinars with the ten IMF Regional Capacity Development Centers, reaching over 1600 participants from authorities of over a hundred jurisdictions; the outreach sessions were delivered in English, French, Spanish and Portuguese. - The BCBS also hosted an outreach program, in collaboration with IMF and WB staff, targeted at advanced and emerging market economies’ authorities and industry representatives. - The revised BCP are likely to generate additional requests for technical assistance (TA) because: - the principles acknowledge emerging risks such as climate and digitalization and counterparty risk from nonbank financial intermediation; - the principles have become more demanding in scope and depth of regulatory requirements and supervisory practices; - jurisdictions will likely seek assistance to enhance capacity to identify and monitor emerging risks, understand cross-sector linkages, and ensure effective, risk-based supervision incorporating systemic and macroprudential dimensions. ### PROPOSED DECISION - Proposed IMF Executive Board decision (may be adopted by a majority of votes cast): - The Executive Board takes note of the February 2024 revisions to the BCBS Core Principles for Effective Banking Supervision endorsed by the International Conference of Banking Supervisors in April 2024 and endorses them as the standards under which assessments initiated after the date of this decision will be conducted. - For assessments initiated before that date, the revised principles may be used at the request of a member. ### APPENDIX I — SUMMARY OF THE MAIN REVISIONS TO THE BCBS CORE PRINCIPLES - Financial Risks - A non-risk-based measure to constrain the buildup of leverage in the banking sector (CP16 – Capital Adequacy) was introduced; the previous methodology broadly required capital to constrain leverage and this has now been made more explicit. - Credit Risk Management (CP17) strengthened to emphasize securitization exposures, counterparty risk margining, and clarify the broad scope of credit risk. - Problem Assets, Provisions and Reserves (CP18) updated to include expected credit loss provisioning and align definitions with BCBS guidance. - Operational Resilience and Digitalization of Finance - CP25 revised to encompass operational risk and operational resilience, enhancing focus on governance, operational risk management, business continuity, interconnections and interdependencies, third party dependence management, cybersecurity, and information and communication technology. - Systemic Risk and Macroprudential Supervision - Existing requirements in various CPs strengthened to incorporate macroprudential policy and supervision and a broad financial system perspective. - Amendments to Cooperation and Collaboration (CP3) and Home-Host Relationships (CP13) emphasize close cooperation between banking supervision authorities and macroprudential/financial stability authorities. - Supervisory Approach (CP8) and Supervisory Techniques and Tools (CP9) amended to clarify the supervisor’s role in assessing and mitigating risks to banks and the banking system and to require a process to assess and identify systemically important banks in a domestic context. - Risk Management Practices - Corporate Governance (CP14) changes: greater emphasis on corporate culture and values, board independence, and processes to identify and assign responsibility and accountability. - Risk Management Process (CP15) changes: reinforced risk culture and risk appetite frameworks; introduced specific requirements on risk data aggregation; explicit reference to business model sustainability and explanation of key components. - Transactions with Related Parties (CP20) strengthened: definition of related parties and approval/management/reporting requirements reinforced; provisions on exemptions for certain intragroup transactions introduced. - Pillar 3 disclosure requirements introduced for internationally active banks (CP28 – Disclosure and Transparency). - Amendments to maintain consistency with FATF standards (CP29 – Abuse of Financial Services). - New Risks — Climate Change and Digitalization - Explicit references to climate-related financial risks introduced and a principles-based approach promoted for supervisory practices and banks’ risk management. - Amendments to Supervisory approach (CP8) and Supervisory Reporting (CP10) introduce a definition of climate-related financial risks, require supervisors to consider climate-related financial risks in their methodologies and have the power to require banks to submit information to assess materiality. - Adjustments to CP15 require banks to have comprehensive risk management policies and processes for all material risks (including climate-related financial risks), recognize varying time horizons for materialization, and implement appropriate measures where risks are assessed as material. - Adjustments to Internal Control and Audit (CP26) require banks to consider climate-related financial risks as part of their internal control framework. - Banks and supervisors may consider climate-related financial risks in a flexible manner given heterogeneity and evolving practices. *International Monetary Fund — Executive Summary, July 12, 2024.* ### 8. Changes resulting from technology driven innovation and the digitalization of finance ### 8. Changes resulting from technology driven innovation and the digitalization of finance ### Technology-driven innovation and digitalization: revisions to supervisory responsibilities and operational resilience - Amendments to Responsibilities, Objectives and Powers (CP1) were made to ensure that supervisors can continue to access relevant information (irrespective of where it is stored) and review the overall activities of the banking group, including those undertaken by service providers. - The importance of Operational Resilience (CP25) was also highlighted. ### Nonbank Financial Intermediation: group-wide supervision and specific risk emphases - The rapid proliferation of nonbank financial intermediation and its potential impact on financial stability were acknowledged. - Amendments reinforce the need for a group-wide approach to supervision (CP1). - Amendments to CP15 highlight step-in risk more explicitly. - Adjustments to CP17 give greater emphasis to the management of counterparty credit risk. ### High-level supervisory framework (selected principles and core expectations) - Principle 1 – Responsibilities, Objectives, and Powers: An effective system of banking supervision has clear responsibilities and objectives for each authority involved in the supervision of banks and banking groups. A suitable legal framework for banking supervision is in place to provide each responsible authority with the necessary legal powers to authorize banks, conduct ongoing supervision, address compliance with laws and undertake timely corrective actions to address safety and soundness concerns. - Principle 2 – Independence, Accountability, Resourcing, and Legal Protection for Supervisors: The supervisor possesses operational independence, transparent processes, sound governance, budgetary processes that do not undermine autonomy, and adequate resources, and is accountable for the discharge of its duties and use of its resources. The legal framework for banking supervision includes legal protection for the supervisor. - Principle 3 – Cooperation and Collaboration: Laws, regulations, or other arrangements provide a framework for cooperation and collaboration with relevant domestic authorities and foreign supervisors. These arrangements reflect the need to protect confidential information. - Principle 4 – Permissible Activities: The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined, and the use of the word “bank” in names is controlled. - Principle 5 – Licensing Criteria: The licensing authority has the power to set criteria for licensing banks and to reject applications where the criteria are not met. At a minimum, the licensing process consists of an assessment of the ownership structure and governance (including the fitness and propriety of board members and senior management) of the bank and its wider group, its strategic and operating plan, internal controls, risk management and projected financial condition (including capital base). Where the proposed owner or parent organisation is a foreign bank, the prior consent of its home supervisor is obtained. - Principle 6 – Transfer of Significant Ownership: The supervisor has the power to review, reject and impose prudential conditions on any proposals to transfer significant ownership or controlling interests held directly or indirectly in existing banks to other parties. - Principle 7 – Major Acquisitions: The supervisor has the power to: (i) approve or reject (or recommend to the responsible authority the approval or rejection of) and impose prudential conditions on major acquisitions or investments by a bank (including the establishment of cross-border operations), against prescribed criteria; and (ii) determine that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision. - Principle 8 – Supervisory Approach: An effective system of banking supervision requires the supervisor to develop and maintain a forward-looking assessment of the risk profile of individual banks, proportionate to their systemic importance; identify, assess and address risks emanating from banks and the banking system as a whole; have a framework in place for early intervention; and have plans in place, in partnership with other relevant authorities, to take action to resolve banks in an orderly manner if they become non-viable. - Principle 9 – Supervisory Techniques and Tools: The supervisor uses an appropriate range of techniques and tools to implement the supervisory approach and deploys supervisory resources on a proportionate basis, considering the risk profile and systemic importance of banks. - Principle 10 – Supervisory Reporting: The supervisor collects, reviews and analyses prudential reports and statistical returns from banks on both a solo and a consolidated basis, and independently verifies these reports through either on-site examinations or use of external experts. - Principle 11 – Corrective and Sanctioning Powers of Supervisors: The supervisor acts at an early stage to address unsafe and unsound practices or activities that could pose risks to banks or to the banking system. The supervisor has at its disposal an adequate range of supervisory tools, that it can apply at its discretion, to bring about timely corrective actions. This includes the ability to revoke the banking license or to recommend its revocation. - Principle 12 – Consolidated Supervision: The supervisor supervises the banking group on a consolidated basis, adequately monitoring and, as appropriate, applying prudential standards to all aspects of the business conducted by the banking group worldwide. - Principle 13 – Home-host relationships: Home and host supervisors of cross-border banking groups share information and cooperate for effective supervision of the group and group entities, and effective handling of crisis situations. Supervisors require the local operations of foreign banks to be conducted to the same standards as those required of domestic banks. ### Prudential regulations and risk management (selected principles) - Principle 14 – Corporate Governance: The supervisor determines that banks have robust corporate governance policies and processes covering, for example, corporate culture and values, strategic direction and oversight, group and organizational structure, the control environment, the suitability assessment process, the responsibilities of the banks’ boards and senior management, and compensation practices. These policies and processes are commensurate with the risk profile and systemic importance of the bank. - Principle 15 – Risk Management Process: The supervisor determines that banks have a comprehensive risk management process (including effective board and senior management oversight) to identify, measure, evaluate, monitor, report and control or mitigate all material risks (which can include risks related to digitalization, climate-related financial risks and emerging risks) on a timely basis and to assess the adequacy of their capital, their liquidity and the sustainability of their business models in relation to their risk profile and market and macroeconomic conditions. This extends to the development and review of contingency arrangements (including robust and credible recovery plans where warranted) that consider the specific circumstances of the bank. The risk management process is commensurate with the risk profile and systemic importance of the bank. - Principle 16 – Capital Adequacy: The supervisor sets prudent and appropriate capital adequacy requirements for banks that reflect the risks undertaken and presented by a bank in the context of the markets and macroeconomic conditions in which it operates. The supervisor defines the components of capital, bearing in mind their ability to absorb losses. At least for internationally active banks, capital requirements are not less stringent than the applicable Basel standards. - Principle 17 – Credit Risk: The supervisor determines that banks have an adequate credit risk management process that considers their risk appetite, risk profile, market conditions, macroeconomic factors and forward-looking information. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate credit risk (including counterparty credit risk) on a timely basis. The full credit life cycle is covered, including credit underwriting, credit evaluation and the ongoing management of the bank’s loan and investment portfolios. - Principle 18 – Problem Assets, Provisions, and Reserves: The supervisor determines that banks have adequate policies and processes for the early identification and management of problem exposures and the maintenance of adequate provisions reserves. - Principle 19 – Concentration Risk and Large Exposure Limits: The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or mitigate concentrations of risk on a timely basis. Supervisors set prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties. At least for internationally active banks, large exposure requirements are not less stringent than the applicable Basel standard. - Principle 20 – Transactions with Related Parties: To prevent abuses arising in transactions with related parties and to address the risk of conflicts of interest, the supervisor requires banks to: enter into any transactions with related parties on an arm’s length basis; monitor these transactions; take appropriate steps to control or mitigate the risks; and write off exposures to related parties in accordance with standard policies and processes. - Principle 21 – Country and Transfer Risks: The supervisor determines that banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or mitigate country risk and transfer risk in their international lending and investment activities on a timely basis. - Principle 22 – Market Risk: The supervisor determines that banks have an adequate market risk management process that considers risk appetite, risk profile, market and macroeconomic conditions, and the risk of a significant deterioration in market liquidity. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate market risks on a timely basis. - Principle 23 – Interest Rate Risk in the Banking Book: The supervisor determines that banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate risk in the banking book on a timely basis. These systems consider the bank’s risk appetite, risk profile and market and macroeconomic conditions. - Principle 24 – Liquidity Risk: The supervisor sets prudent and appropriate liquidity requirements (which can include either quantitative or qualitative requirements or both) that reflect the liquidity needs of banks. The supervisor determines that banks have a strategy that enables prudent management of liquidity risk and compliance with liquidity requirements. The strategy considers the bank’s risk profile, market and macroeconomic conditions, and includes prudent policies and processes, consistent with the bank’s risk appetite, to identify, measure, evaluate, monitor, report and control or mitigate liquidity risk over an appropriate set of time horizons. At least for internationally active banks, liquidity (including funding) requirements are not lower than the applicable Basel standards. - Principle 25 – Operational Risk and Operational resilience: The supervisor determines that banks have an adequate operational risk management framework and operational resilience approach that considers their risk profile, risk appetite, business environment, tolerance for disruption to their critical operations, and emerging risks. This includes prudent policies and processes to: (i) identify, assess, evaluate, monitor, report and control or mitigate operational risk on a timely basis; and (ii) identify and protect themselves from threats and potential failures, respond and adapt to, as well as recover and learn from, disruptive events to minimize their impact on delivering critical operations through disruption. - Principle 26 – Internal Control and Audit: The supervisor determines that banks have adequate internal control frameworks to establish and maintain an effectively controlled and tested operating environment for the conduct of their business, considering their risk profile. These include clear arrangements for delegating authority and responsibility; separation of the functions that involve committing the bank, paying away its funds, and accounting for its assets and liabilities; reconciliation of these processes; safeguarding the bank’s assets; and appropriate independent internal audit (including those that are outsourced or co-sourced), compliance and other control functions to test adherence to and effectiveness of these controls as well as applicable laws and regulations. - Principle 27– Financial Reporting and External Audit: The supervisor determines that banks and banking groups maintain adequate and reliable records, prepare financial statements in accordance with accounting policies and practices that are widely accepted internationally and annually publish information that fairly reflects their financial condition and performance and bears an independent external auditor’s opinion. The supervisor also determines that banks and parent companies of banking groups have adequate governance and oversight of the external audit function. - Principle 28 – Disclosure and Transparency: The supervisor determines that banks and banking groups regularly publish information on a consolidated and, where appropriate, solo basis that is easily accessible and fairly reflects their financial condition, performance, risk exposures, risk management strategies and corporate governance policies and processes (including compensation practices). At least for internationally active banks, disclosure requirements are not less stringent than the applicable Basel standards. - Principle 29 – Abuse of Financial Services: The supervisor determines that banks have adequate policies and processes, including robust and risk-based customer due diligence (CDD) rules and effective compliance functions to promote high ethical and professional standards in the financial sector and prevent the bank from being used intentionally or unintentionally for criminal activities. *Source: 2024 REVISED BASEL CORE PRINCIPLES FOR EFFECTIVE BANKING SUPERVISION (excerpt).* --- _Source: https://www.imf.org/-/media/files/publications/pp/2024/english/ppea2024037.pdf_