## Detailed Assessment of Compliance of the Basel Core Principles

## Source details

**Canonical URL:** [Detailed Assessment of Compliance of the Basel Core Principles](https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2007/_cr07155.pdf)

## Other formats

- [Markdown version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2007/_cr07155.pdf.md)
- [Structured JSON version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2007/_cr07155.pdf.json)

---

### Assessment scope, methodology, and participants
- Assessment carried out in March 2006 by Peter Hayward (consultant) and Jorge Mogrovejo (consultant) as part of a Module 2 assessment of Gibraltar’s financial sector at the request of the Gibraltar government.
- Primary legal/documentary bases: Financial Services Commission Ordinance (FSCO), 1992; Banking Ordinance, 1992 (BO); Administrative Notices; Guidance Notes; Newsletters; statutory review (January 2005); FSC self-assessment.
- Methodology: Qualitative assessment using the Core Principles Methodology Document of October 1999; observance judged against essential and additional criteria; compliance categories: Compliant; Largely compliant; Materially non-compliant; Non-compliant; Not applicable.
- Related assessment: Separate MFD/LEG team assessed FATF AML/CFT recommendations, amplifying CP 15.

### Institutional and market structure — key facts and figures
- Banking sector composition and scale:
  - 18 banks with total assets of £6.7 billion ($11.7 billion) as of end-2005.
  - Most banks are subsidiaries or branches of banks from other European countries; the United Kingdom accounts for eight subsidiaries/branches.
  - Only one bank is not foreign bank owned.
- Business model and cross-border activity:
  - No licensing distinction between banks conducting cross-border and local business.
  - Majority of local market business concentrated in two banking groups.
  - Major cross-border activities: private banking (asset management) to Swiss-based customers and expatriates in Spain and Portugal; residential mortgages to regional property purchasers.
  - Services to nonresident trusts and companies benefit from exemption from Gibraltar corporate tax rate of 35 percent (tax exemption due to be phased out to comply with EU state aid rules; business could survive if unified corporate tax rate is not more than 10-15 percent).
- Risk profile:
  - Principal risks: reputational risk (large off-balance-sheet assets; investment risk borne by clients), credit risk concentrated in residential mortgage lending.
  - Reported loan/value ratios: typically 60-70 percent for mortgages to Spanish property purchasers; Gibraltar loan-to-value ratios approaching 100 percent in some instances.
  - Market and liquidity risks reported as low: no recognized trading book in Gibraltar; treasury and liquidity management largely at head office.
- Legal, accounting, and supervisory preconditions:
  - EU directives adopted and implemented; Gibraltar member of EU since 1973.
  - IFRS adopted for all EU listed companies effective January 2005; some subsidiaries still use older accounting standards.
  - Limited liability companies required to submit audited financial statements to the Registrar of Companies; filings publicly available.
  - Law enforcement and credit culture generally good; incidence of default reported as exceptionally low.

### Governance, mandate, powers, and operational independence of the FSC
- Structure and appointment:
  - FSC established by FSCO; consists of the Commissioner (Chairman and chief executive) and seven independent part-time members.
  - Members appointed by the Governor of Gibraltar with approval of the U.K. Secretary of State for Foreign and Commonwealth Affairs; independent members appointed after consultation with the Commissioner. (FSCO Section 3)
  - Commissioner’s statutory responsibilities include supervision of institutions licensed to provide financial services and ensuring compliance with EU obligations and standards matching those required in the United Kingdom. (FSCO Section 8)
- Statutory powers and instruments:
  - BO empowers Commissioner to license and supervise banks (BO Section 24) and to withdraw licenses (BO Section 65); powers to issue conditions (BO Section 62) and to enter premises and inspect records (BO Sections 62 and 63).
  - Administrative Notices set out supervisory criteria and prudential requirements; BO Sections 22 and 23 set licensing requirements to be met continuously.
  - Commissioner may apply to the Supreme Court for winding-up (BO Section 78); Companies Ordinance governs winding-up procedures.
- Operational independence and resources:
  - FSC operationally independent of the Government of Gibraltar in practice; financing partly by Government subvention (now minor); fees payable by supervised institutions are determined by Government.
  - FSC has reserves sufficient to enable continuation of activities in a crisis without external support.
  - Staffing: professional staff with finance sector backgrounds; training emphasized; low turnover; power to hire external expertise.
  - IT systems in place; FSC achieved ISO recognition under ISO 9001:2000.
- Corporate governance and transparency:
  - FSC published line-by-line assessment of compliance with the U.K.’s Combined Code on Corporate Governance.
  - FSC publishes statistical information on banking industry performance; locally incorporated banks must file annual financial statements with the Registrar of Companies.
- Terms of office and removal:
  - No statutory fixed term of office for members or the Commissioner, though in practice appointments made for fixed terms published in the Gibraltar Gazette.
  - Grounds for removal not exhaustively specified in law; FSCO Section 3 contains grounds for dismissal but not exclusively; no statutory requirement that reasons be specified upon dismissal.

### Supervisory legal framework and enforcement powers (selected findings)
- Licensing and ongoing supervision:
  - Banks required by BO Section 25(2) to continuously observe licensing criteria in BO Sections 22 and 23.
  - Commissioner may impose conditions on or revoke a license where criteria are not met or where actions likely to damage depositors’ interests or Gibraltar’s reputation (BO Sections 29–31, 62, 65).
  - Formal powers to impose directions and enter premises exist but have never needed to be used.
  - Proposed “approved persons” regime would give Commissioner direct powers against individuals and provide affected individuals with rights of redress.
- Legal protection for supervisors:
  - FSCO Section 18 and BO Section 14 provide protection against civil liability for the Commissioner or authorized persons unless acting in bad faith.
  - No statutory indemnification requirement for costs defending suits though FSC has proposed an addition to FSCO Section 18 to require indemnification.
- Information sharing and confidentiality:
  - Commissioner may share information with other supervisors where necessary and confidentiality assured (BO Section 82 (10) (i)); detailed exchange rules from the EU Banking Consolidation Directive included in Schedule 3 to the BO.
  - FSC has MOUs with several foreign supervisory authorities and shares information in practice; internal disclosure processes improved following a 2003 Court of Appeal case.
  - Proposed Financial Services (Information and Co-operation: Powers and Confidentiality) Ordinance to consolidate and clarify existing powers.

### Key prudential standards and supervisory practice (selected principles)
- Permissible activities and control of the term “bank” (CP 2): Compliant.
  - Definitions and restrictions via BO Sections 2, 4, 5, 7, Schedule 1, and BO Section 74.
- Licensing criteria and process (CP 3):
  - Main criteria in BO Sections 22 and 23; initial capital requirement for a newly licensed bank: at least €5 million.
  - BO Section 23 (3) (e): “fit and proper” requirement for shareholders controlling more than 10 percent.
  - Applications require financial projections, business plans, staffing and governance arrangements; Commissioner may require additional information and cancel licenses for misleading information.
- Ownership and control (CP 4): Compliant.
  - Notification and no-objection regime for controllers (BO Section 53); thresholds at 10 percent (and similar requirements at 20, 33, 50 percent); objection powers (BO Sections 54, 56); remedies include depriving voting rights and court-ordered sale.
- Investment criteria (CP 5): Compliant.
  - BO Section 40: limit on bank ownership of financial interests to 15 percent of the bank’s capital in aggregate; investments reported in quarterly prudential returns.
- Capital adequacy (CP 6): Compliant.
  - Minimum capital ratio of 8 percent required by law; requirements set out in AN 1 and AN 2.
  - Commissioner may apply capital adequacy on a consolidated basis; banks must report capital ratios quarterly.
  - Banks set “target” and “trigger” ratios above 8 percent; absolute minimum capital of €5 million required at all times.
- Credit policies (CP 7): Compliant.
  - Board-approved policies required; implementation tested on-site; quarterly reporting of large exposures (exposures in excess of 10 percent of capital) and ten largest exposures.
  - All credit decisions must be taken in Gibraltar even if policies originate at head office.
  - Lending profile dominated by residential mortgages and security-based lending.
- Loan evaluation and provisioning (CP 8): Compliant.
  - BO Section 23(3)(d) requires adequate provisioning; GN 4 and GN 6 set expectations based on U.K. practices.
  - No standardized classification/provisioning scheme; provisioning based on estimated recoverability; supervisory review via on-site and audited financial statements.
- Large exposure limits (CP 9): Compliant.
  - Large exposure defined as exposure in excess of 10 percent of capital (AN 3 Annex 1).
  - Aggregate cap on large exposures: 800 percent of capital; individual cap: 25 percent of capital.
  - Exemptions mirror EU directive; large exposures reported quarterly.
- Connected lending (CP 10): Compliant.
  - Comprehensive definition of “connected” exposures (AN 3 Annex 1 paragraph 15); aggregate limit on loans to connected parties: 25 percent of capital.
  - Arm’s-length requirement and board policies required; Commissioner may deduct connected lending from capital in certain cases.
- Country risk (CP 11): Compliant.
  - Supplementary Quarterly Return from Q4 2005 requires assets/liabilities breakdown by country; GN 4 addresses country/transfer risk.
- Market risk (CP 12): Compliant.
  - Limited trading books; AN 7 aligns with EU directives; head offices manage substantial market-risk products.
- Other risks (liquidity, interest rate, operational) (CP 13): Largely compliant.
  - Quarterly Returns include maturity schedules; no across-the-board liquidity ratio norms; specific mismatch ratios monitored case by case.
  - FSC recommendation: require banks with high potential liquidity risk to meet their liquidity mismatch ratio or provide daily liquidity information and report breaches.
- Internal control and audit (CP 14):
  - Internal audit functions typically provided by head office; GN 6 addresses internal audit; Section 23 (3) (h) requires adequate accounting records and control systems.
  - “Four eyes” principle required by Section 23 (3) (f); Approved Persons Regime ordinance prepared.
- Anti-Money Laundering (CP 15): Compliant.
  - EEC Directive (91/308/EEC) transposed via Drug Trafficking Offences Ordinance and Criminal Justice Ordinance (CJO); AML Guidance Notes set KYC, record retention, suspicious transaction reporting, and Money Laundering Reporting Officer requirements.
  - Section 20 of the CJO obliges the FSC to make disclosures to GFIU of suspicious transactions.
- On-site and off-site supervision (CP 16–19):
  - Revised risk-based supervision framework implemented in 2003 with four phases: pre-assessment, assessment, formal feedback, risk mitigation.
  - Grading methodology uses six evaluation factors with grades 1–5; results determine supervisory intensity.
  - On-site visits follow Self Assessment Questionnaire; FSC may rely on reporting accountants (BO Section 60) for focused exams.
  - Off-site: quarterly reports, annual financial reports, management letters, internal audit reports; Banking Supervisory Returns submitted quarterly within 14 days of period end.
  - Validation: FSC can require reporting accountants’ examinations; appointment of external auditors subject to Commissioner approval (BO Section 60).
- Consolidated supervision and supervision over foreign establishments (CP 20, 23–25): Compliant.
  - FSC has legal authority to supervise on a consolidated basis (AN 4 implements Directive 2000/12/EC; AN 8 implements Post-BCCI directive).
  - As host supervisor, BO Section 18 requires consultation with relevant home supervisors; for non-EEA head offices Commissioner must be satisfied with home supervision.
  - In practice, FSC has developed extensive contacts with home supervisory authorities.
- Accounting standards (CP 21): Compliant.
  - Quarterly returns, published abstracts of key banking statistics; EU-listed companies required to report using IFRS; BO provisions support auditor communication with FSC and permit Commissioner to appoint/retain an auditor (BO Section 62 (2)).
- Remedial measures (CP 22): Compliant.
  - Remedial powers include oral/formal requests, orders to refrain from action (BO Section 62 (1)), varying licenses by imposing/amending/revoking conditions (BO Sections 29 and 30), and canceling licenses (BO Section 64).
  - No penalties regime for individuals currently, but Government drafted an Approved Persons Regime to approve/remove key individuals and provide sanction powers.

### Summary compliance and key statistics
- Many principles assessed as Compliant; selected items (e.g., operational independence and legal protection) assessed as Largely compliant in places.
- Specific quantitative requirements and thresholds preserved in law and supervisory guidance:
  - Sector size: 18 banks; total assets £6.7 billion ($11.7 billion) as of end-2005.
  - Initial capital for new bank: at least €5 million.
  - Minimum capital ratio: 8 percent by law.
  - Large exposure definition: exposures >10 percent of capital; aggregate cap 800 percent of capital; individual cap 25 percent of capital.
  - Investment ownership cap: 15 percent of bank’s capital in aggregate.
  - Corporate tax rate exemption: 35 percent (being phased out); tolerant unified rate estimated support threshold: not more than 10-15 percent.
  - Mortgage loan-to-value examples: 60-70 percent (Spanish purchasers); approaching 100 percent in some Gibraltar-originated lending.

### Recommended action plan (excerpt) and authorities’ response
- Recommended actions (selected):
  - CP 1 (Objectives, autonomy, powers and resources):
    - Enshrine FSC’s objectives and responsibilities in law by amendment to the FSCO.
    - Give FSC responsibility to fix fees payable to the FSC.
    - Establish term of office of the Commissioner and members of the Commission in the FSCO.
    - Introduce proposed amendment to FSCO Section 18 requiring FSC to indemnify staff for costs in defending legal action.
  - CP 13 (Other risks — liquidity):
    - Require banks assessed as having a high potential liquidity risk to meet their liquidity mismatch ratio or provide information about liquidity positions on a daily basis and report breaches.
- Authorities’ response:
  - FSC welcomes the IMF assessment and emphasizes validation of its supervisory work, particularly the Risk Assessment Framework methodology designed and implemented by its staff and deployed across supervisory functions.

*Source: Detailed Assessment of Compliance of the Basel Core Principles (IMF staff assessment, March 2006).*

### 1. Detailed Assessment of Compliance of the Basel Core Principles........................................7

### 1. Detailed Assessment of Compliance of the Basel Core Principles

### Assessment scope, methodology, and participants
- Assessment carried out in March 2006 by Peter Hayward (consultant, formerly Bank of England and IMF) and Jorge Mogrovejo (consultant, Superintendency of Banks and Insurance, Peru) as part of a Module 2 assessment of Gibraltar’s financial sector at the request of the Gibraltar government.
- Primary legal and documentary bases:
  - Financial Services Commission Ordinance (FSCO), 1992
  - Banking Ordinance, 1992 (BO)
  - Administrative Notices, Guidance Notes, Newsletters, statutory review (January 2005), and FSC self-assessment.
- Methodology:
  - Qualitative assessment based on the Core Principles Methodology Document of October 1999.
  - Observance judged against each principle’s essential criteria and, where necessary, additional criteria.
  - Compliance categories used: Compliant; Largely compliant; Materially non-compliant; Non-compliant; Not applicable.
- Other assessments:
  - Separate MFD/LEG team assessed FATF AML/CFT recommendations; that assessment amplifies CP 15 (1999 methodology).

### Institutional and market structure — key facts and figures
- Banking sector composition and scale:
  - 18 banks with total assets of £6.7 billion ($11.7 billion) as of end-2005.
  - Most banks are subsidiaries or branches of banks from other European countries; the United Kingdom accounts for eight subsidiaries/branches.
  - Only one bank is not foreign bank owned; its shareholders operate in the investment business in a major European financial centre.
- Business model and cross-border activity:
  - No licensing distinction between banks conducting cross-border and local business.
  - Majority of local market business concentrated in two banking groups.
  - Major cross-border activities: private banking (asset management) to Swiss-based customers and expatriates in Spain and Portugal; provision of residential mortgages to clients purchasing regional property.
  - Services to nonresident trusts and companies benefit from exemption from Gibraltar corporate tax rate of 35 percent.
- Market features and competitive position:
  - Banks benefit from EU “passport” arrangements to provide services throughout the EU.
  - Local banks handle money transmission and general banking; local banks do not significantly compete in asset management/private banking.
  - Profitability and expansion of private banking business is highlighted.
  - Tax exemption is due to be phased out to comply with EU state aid rules; business could survive if unified corporate tax rate is not more than 10-15 percent.
- Risk profile:
  - Principal risks: reputational risk (large off-balance-sheet assets; investment risk borne by clients), credit risk concentrated in residential mortgage lending.
  - Reported loan/value ratios: typically 60-70 percent for mortgages to Spanish property purchasers.
  - Market and liquidity risks reported as low: no recognized trading book in Gibraltar; most treasury and liquidity management performed at head office.
  - Investment advice normally based on head office analysis or specialist investment firms.
- Legal, accounting, and supervisory preconditions:
  - EU directives adopted and implemented in Gibraltar legislation; Gibraltar has been a member of the EU since 1973.
  - IFRS adopted for all EU listed companies effective January 2005; some subsidiaries of listed companies still use older accounting standards.
  - Limited liability companies required to submit audited financial statements to the Registrar of Companies; filings are publicly available.
  - Company law, accounting, and auditing arrangements generally based on EU requirements and U.K. law and practice.
  - Law enforcement and credit culture described as generally good; incidence of default reported as exceptionally low.

### Governance, mandate, powers, and operational independence of the FSC
- Structure and appointment:
  - FSC established by FSCO. The FSC consists of the Commissioner (Chairman and chief executive) and seven independent part-time members.
  - Members appointed by the Governor of Gibraltar with approval of the U.K. Secretary of State for Foreign and Commonwealth Affairs; independent members appointed after consultation with the Commissioner. (FSCO Section 3)
  - Commissioner’s statutory responsibilities include supervision of institutions licensed to provide financial services and ensuring compliance with EU obligations and standards matching those required in the United Kingdom. (FSCO Section 8)
- Statutory functions and instruments:
  - BO empowers Commissioner to license and supervise banks (BO Section 24) and to withdraw licenses (BO Section 65).
  - Existing Administrative Notices set out supervisory criteria and basic prudential requirements; BO Sections 22 and 23 set out licensing requirements required to be met continuously by licensed banks.
  - Commissioner has powers under BO Sections 64–66 to cancel a license or issue directions; may apply to the Supreme Court for winding-up (BO Section 78). Companies Ordinance governs winding-up procedures.
  - Government may implement EU requirements by regulation; FSC supplements by Guidance Notes.
  - FSC has statutory obligation to monitor developments (FSCO Section 8) and has published regulatory objectives and principles guiding supervision.
- Operational independence and resources:
  - FSC is operationally independent of the Government of Gibraltar and independent of the U.K. government in practice (legislation passed by Gibraltar House of Assembly; U.K. authorities have no supervisory authority over Gibraltar).
  - Financing: activities financed in part by Government subvention (now minor); fees payable by supervised institutions are determined by Government.
  - FSC has built reserves sufficient to enable continuation of activities in a crisis without external support.
  - Staffing and capacity: professional staff with finance sector backgrounds; emphasis on training and personal professional qualifications; low turnover; powers to hire external expertise where needed.
  - IT systems established to discharge responsibilities and publicize operations.
  - FSC achieved ISO recognition under ISO 9001:2000.
- Corporate governance and transparency:
  - FSC has published a line-by-line assessment of its compliance with the U.K.’s Combined Code on Corporate Governance.
  - FSC publishes statistical information on banking industry performance; locally incorporated banks must file annual financial statements with the Registrar of Companies.
- Terms of office and removal:
  - No statutory fixed term of office for members or the Commissioner, although in practice appointments are made for fixed terms published in the Gibraltar Gazette.
  - Grounds for removal are not exhaustively specified in law; FSCO Section 3 contains grounds for dismissal but not exclusively; no requirement that reasons be specified upon dismissal.

### Principle 1: Objectives, Autonomy, Powers, and Resources — assessments and recommendations
- Principle 1(1) — Clear responsibilities and objectives:
  - Assessment: Compliant
  - Key points:
    - FSC empowered and structured under FSCO and BO; Commissioner responsible for ensuring compliance with EU obligations and matching U.K. standards where applicable.
    - FSC functions include provision of resources to the Commissioner and review of supervisory effectiveness and Gibraltar legislation relating to financial services.
    - FSC publishes regulatory objectives and supervision-related material; ISO 9001:2000 recognition supports consistent achievement of objectives.
- Principle 1(2) — Operational independence and adequate resources:
  - Assessment: Largely compliant
  - Observations and findings:
    - Operational independence achieved in practice; government does not formally appoint FSC members and appears not to interfere in supervisory activities.
    - FSC cannot set fees payable by supervised institutions; fees are determined by Government.
    - FSC has reserves and financing arrangements that provide crisis resilience.
    - Staffing, remuneration, training, and ability to hire external expertise support effective supervision.
    - Lack of statutory fixed terms of office and lack of exhaustive legal grounds and requirement to specify reasons for dismissal noted.
  - Policy observations / implied recommendations:
    - FSC should have responsibility for its own finances, including powers to fix fees payable by authorized institutions to the FSC, to strengthen autonomy.
    - Specifying term of office and reasons for dismissal in law would align with modern corporate governance practice, though assessors note low risk of politically motivated dismissal given current appointment practices.
- Principle 1(3) — Suitable legal framework for licensing and ongoing supervision:
  - Description (excerpt): BO governs authorization and supervision; Commissioner empowered by BO Section 24 to issue licenses and BO Section 65 to withdraw them; detailed prudential requirements are contained in Administrative Notices issued under BO.
  - (Assessment and further commentary continue in original text beyond provided excerpt.)

*Source: Detailed Assessment of Compliance of the Basel Core Principles (IMF staff assessment, March 2006).*

### Section 16. These are “admissible in evidence in any action commenced in exercise of the

### _cr07155 - Section 16. These are “admissible in evidence in any action commenced in exercise of the

### Principle 1(4) — Legal framework for banking supervision, powers to address compliance and safety-and-soundness
- Description:
  - Banks are required by BO Section 25(2) to observe continuously the essential licensing criteria in BO Sections 22 and 23.
  - If it “appears to” the Commissioner that the criteria are not being observed or if the bank is engaged in actions likely to damage the interests of depositors or the reputation of Gibraltar he may impose conditions on the license or revoke it. (BO Sections 29 to 31).
  - He may also issue conditions under BO Section 62.
  - BO Sections 62 and 63 give the Commissioner and those authorized by him the right to enter premises and inspect such records as may be necessary.
  - Where remedial action is necessary the Commissioner may issue directions under BO Section 29, and in cases of urgency, impose conditions under BO Section 30.
  - BO Section 65 gives the Commissioner powers to revoke a license where a bank had failed to meet the licensing criteria.
  - These formal powers have never needed to be used but reference has been made to their existence.
- Assessment:
  - Compliant
- Comments:
  - There are proposals for an “approved persons” regime which would give the Commissioner powers to act directly against an individual as well as a bank as an institution.
  - Such persons would also have rights of redress not currently available to them if the FSC acts against an institution as a corporate entity.
  - The Commissioner has no powers to impose civil financial penalties on banks or individuals but the absence of such powers has not so far proved a constraint on his ability to ensure compliance with supervisory requirements.

### Principle 1(5) — Legal protection for supervisors
- Description:
  - FSCO Section 18 and BO Section 14 provide protection against civil liability for the Commissioner or any person authorized by him in the discharge or purported discharge of his functions under law unless it can be shown he acted in bad faith.
  - There is no provision requiring indemnification against the costs of such a person defending himself against suit (see additional criterion 3), although in practice no such cases have arisen.
- Assessment:
  - Largely compliant
- Comments:
  - The FSC has proposed an addition to FSCO Section 18 which would require the FSC to indemnify any existing or former member of the FSC’s staff against such costs.

### Principle 1(6) — Arrangements for sharing information and confidentiality protections
- Description:
  - The Commissioner is the sole regulator and supervisor of financial entities so there is no need for powers to share information domestically.
  - Under BO Section 82 (10) (i), the Commissioner may share information with another supervisor where the latter has a need for the information for supervisory purposes and where the Commissioner is satisfied that the information will continue to be subject to confidentiality requirements.
  - The FSC has concluded memoranda of understanding (MOUs) with several foreign supervisory authorities and has shared information with other authorities with which it has no formal agreement.
  - It has done so with a number of the authorities that have supervisory responsibility over banks or parents or affiliates of banks authorized in Gibraltar.
  - Where a request for information is not covered by one of the “gateways” in the BO the Commissioner cannot accede to such a request.
  - Detailed rules on the exchange of information in paragraph 30 of the EU Banking Consolidation Directive (BCD) are included in Schedule 3 to the BO.
- Assessment:
  - Compliant
- Comments:
  - A Court of Appeal case in 2003 criticized internal processes used regarding disclosure in a particular instance. However, the Court confirmed the FSC’s powers of cooperation.
  - The internal processes have now been improved.
  - The FSC has proposed a new Financial Services (Information and Co-operation: Powers and Confidentiality) Ordinance which would consolidate and clarify existing powers in various ordinances.

### Principle 2 — Permissible activities and control of the term “bank”
- Description:
  - The term “credit institution” is defined in BO Section 2 by reference to the definition in the BCD.
  - BO Section 4 defines “deposit”.
  - BO Section 5 defines a “deposit-taking business” and BO Section 7 restricts the business of taking deposits to licensed institutions.
  - Schedule 1 lists the permissible activities of institutions authorized under the BO by reference to the activities listed in the BCD.
  - Activities other than those authorized under the BO require separate authorization under other laws.
  - BO Section 74 also restricts the use of the term “bank” etc. to institutions authorized under the BO or EU institutions authorized as such by other EU member states.
  - BO Section 7 prohibits others not authorized from using the term “bank.”
  - The Gibraltar Savings Bank, an institution regulated by the Government of Gibraltar under a separate law, is specifically exempted.
- Assessment:
  - Compliant
- Comments:
  - (No additional comments provided in source.)

### Principle 3 — Licensing criteria and process
- Description:
  - Part IV of the BO deals with the licensing of banks. BO Sections 22 and 23 contain the main criteria which an applicant must satisfy.
  - These criteria must continue to be satisfied so long as the license is retained. (BO Section 25(2))
  - Failure to satisfy the Commissioner on any of the criteria is grounds for rejecting the application.
  - BO Section 2A incorporates requirements that the legal and management structures are not such as to hinder effective supervision.
  - BO Section 23 (3) (e) requires that all shareholders that control more than 10 percent of the voting shares are judged ‘fit and proper’ to exercise such control.
  - The provisions of AN 8 implement the so-called ‘Post BCCI’ directive of the EU and empower the Commissioner to reject an application where “the existence of a close link between a credit institution and another undertaking or individual prevents the effective exercise of his or the Banking Supervisor’s supervisory functions in relation to the institution.”
  - Although the BO does not require it, the Commissioner satisfies himself as to the source of the proposed capital of the applicant.
  - A newly licensed bank is required to have an initial capital of at least €5 million.
  - Banks also have to maintain a minimum ratio of their capital to their risk assets. (See CP 6.)
  - Under BO Section 23 (3) (e) controllers, shareholders, directors, and managers are required to be ‘fit and proper’ for their respective positions.
  - BO Section 23 (5) requires the Commissioner to have regard to the relevant person’s competence, probity, diligence, and soundness of judgment, as well as the interests of depositors generally in concluding whether a person is “fit and proper” to exercise the relevant role.
  - “Probity” is further defined with reference to criminal record as well as evidence of unsound business practices and judgment, incompetence, and malpractice.
  - The FSC issued a newsletter in 2002 with further guidance on the FSC’s fit and proper tests.
  - Applications are required to be accompanied by financial projections and business plans, as well as the proposed staffing and governance arrangements.
  - The FSC’s ongoing supervisory requirements require banks to have appropriate internal controls and operating policies and procedures; these are therefore also required of new applicants.
  - Although no new banks have recently been licensed, there have been changes of control and applications from new shareholders and the licensing requirements have been enforced on these occasions.
  - BO allows the Commissioner to require additional information at any stage if he feels that necessary to assess the application fully.
  - A licence can be cancelled if it is found that information provided in connection with an application proves to be misleading or untrue.
- Assessment:
  - (No separate overall assessment line provided in source content.)

*Content extracted from the provided IMF document section.*

### Section 64(1)). It is the practice of the Commissioner to request letters of comfort from

### _cr07155 - Section 64(1)). It is the practice of the Commissioner to request letters of comfort from

### Authorization, Fit-and-Proper, and Supervision of Foreign Banks
- Practice: Commissioner requests letters of comfort from shareholders indicating willingness to provide additional capital support if necessary.
- EU banks: Under BCD enacted in Gibraltar by the BO, EU banks have the right to establish in Gibraltar without additional FSC authorization; home supervisory authority must notify the FSC when an EU bank wishes to establish in Gibraltar.
- Non-EU banks: BO Section 18(4) requires the Commissioner to assure himself that the home supervisor is content and that the home supervisor exercises effective supervision over the applicant.
- Practice: Commissioner seeks consent of home supervisor of subsidiaries of non-EU banks despite BO Section 18 not explicitly requiring it.
- Governance requirement: BO Section 23 (3) (f) requires at least two persons direct the business of a bank (“four eyes” requirement).
- Supervision: All banks are subject to continuous supervision; new entrants are particularly closely monitored.
- Assessment: Compliant
- Comment: Proposal for a more extensive “approved persons” regime would apply the “fit and proper” tests to a wider range of individuals; allowing appeal by affected persons would make the Commissioner’s judgment more readily defensible.

### Principle 4 — Ownership
- Requirement: BO Section 53 — no person may become a “controller” (BO Section 2) unless he has notified the Commissioner and the Commissioner has indicated he has no objection.
- Thresholds: Applies to control of more than 10 percent of voting power; similar requirements at 20, 33, and 50 percent thresholds.
- Powers: BO Section 54 empowers Commissioner to object to a potential shareholder controller; BO Section 56 empowers Commissioner to object to an existing controller if no longer fit and proper.
- Remedies: If a person becomes controller despite objection, he may be deprived of voting rights; Commissioner may seek a court order requiring sale of the shareholding.
- Reporting: BO Section 36 (3) requires licensed institutions to notify the Commissioner at least once a year of names of each controller and any close links as defined in AN 8.
- Assessment: Compliant

### Principle 5 — Investment Criteria
- Limit: BO Section 40 prevents a bank from owning financial interests in any business in excess of 15 percent of the bank’s capital in aggregate.
- Approval: No requirement for approval for acquisitions within this 15 percent limit.
- Close links: AN 8 prevents a bank from forming close links that would prevent effective supervision.
- Reporting: Investments reported in bank’s quarterly prudential returns.
- Assessment: Compliant
- Comment: Commissioner lacks power to vet acquisitions within the 15 percent limit; the 15 percent cap and tight limits on non-banking business reduce inappropriate investment risk.

### Principle 6 — Capital Adequacy
- Implementation: Gibraltar implemented minimum capital adequacy requirements set out in EU law in BCD, following Basel standards.
- Minimum ratio: A minimum capital ratio of 8 percent is required by law.
- Legal sources: Requirements set out in AN 1 and AN 2.
- Consolidation: Commissioner can apply capital adequacy ratios on a consolidated basis though no Gibraltar incorporated banks have significant subsidiaries requiring consolidation.
- Enforcement: Commissioner may impose conditions under BO Section 29 or 30; may revoke license under BO Section 64 in severe cases.
- Reporting: Banks must report capital ratios quarterly.
- Supervisory practice: Banks are set “target” and “trigger” ratios above 8 percent which vary by bank; banks must maintain capital above the trigger at all times and aim to exceed the target; breach of the trigger prompts regulatory action.
- Absolute minimum: Banks are required to exceed a minimum capital of €5 million at all times.
- Assessment: Compliant
- Comment: Gibraltar banks often have ratios substantially in excess of those required; regulatory action is rare.

### Principle 7 — Credit Policies
- FSC framework: Risk assessment process leads to supervisory strategy including on-site assessment of principal risks such as credit.
- Requirements: FSC requires board-approved policy documents for all major risk areas including credit; implementation tested on-site (examination of exposures, security, classification, provisions).
- Head office role: Most Gibraltar banks are foreign-controlled; credit policies and monitoring often originate from head office/parent credit departments; internal audit functions review controls.
- Lending profile: Main lending types — residential mortgages and lending related to security transactions; generally secured by mortgage or charge over marketable securities.
- Powers: FSC can commission reporting accountants; Commissioner can require production of all relevant documentation.
- Local decision-making: All credit decisions must be taken in Gibraltar even if policies set by head office/parent.
- Reporting: Banks must report quarterly large exposures (exposures in excess of 10 percent of capital) and the ten largest exposures.
- Assessment: Compliant
- Comment: Credit risk modest overall due to wealth management focus; some banks have exposures to Southern Spain and Portugal real estate and to Gibraltar; Spain loan-to-value ratios reportedly low (60-70 percent) while Gibraltar loan-to-value ratios approaching 100 percent are not uncommon; main lending banks are well capitalized and exposures small relative to group capital.

### Principle 8 — Loan Evaluation and Loan-Loss Provisioning
- Legal duty: BO Section 23(3) (d) requires banks to make adequate provision for bad and doubtful debts.
- Supervisory guidance: FSC does not prescribe classification/provisioning rules; banks must have board-approved policies; GN 4 sets expectations based on U.K. practices.
- External audit: Loan valuations subject to external audit under IFRS or U.K. statements of standard accounting practice; provisioning policies should include off-balance sheet exposures.
- Remedial powers: Commissioner can require policy improvements and impose directions (e.g., limit ability to extend credit).
- Standardization: No standardized classification/provisioning scheme; no requirement that loans in arrears by specified days be treated in specified ways; provisioning determined by estimated recoverability.
- Supervision: Commissioner reviews audited financial statements and on-site implementation; loan quality rarely an issue in Gibraltar.
- Assessment: Compliant
- Comment: Directives adopting Basel II expected to require more extensive reporting of loan quality; Gibraltar follows U.K. practice regarding arrears-based mandatory classification.

### Principle 9 — Large Exposure Limits
- Definition: AN 3 Annex 1 defines large exposure as exposure in excess of 10 percent of the bank’s capital.
- Aggregation: Exposures to “closely related” borrowers treated as single exposure (AN 3, paragraph 13); “closely related” includes cases where financial soundness of one affects the other or common factors affect both.
- Aggregate cap: Aggregate of all large exposures must not exceed 800 percent of capital.
- Individual cap: Amount of any exposure limited to 25 percent of capital.
- Exemptions: Exemptions mirror EU directive and include exposures to other banks and exposures collateralized by cash or securities issued by OECD governments.
- Reporting: All large exposures reported quarterly to the FSC.
- Consolidation: AN 3 requires limits on a consolidated basis though no Gibraltar banks have subsidiaries significant enough to require consolidation in practice.
- Additional reporting: Banks now report exposures to individual countries and provide broad sectoral breakdowns.
- Waiver power: Commissioner may allow limits to be waived; this power has never been used.
- Assessment: Compliant

### Principle 10 — Connected Lending
- Definition: AN 3 Annex 1 paragraph 15 provides a comprehensive definition of a “connected” exposure (affiliates, shareholders, directors, management, staff, close family members, and other connections).
- Commissioner discretion: BO Section 2 defines “associate” widely; GN 2 indicates Commissioner may deem a connection to exist even if not formally defined.
- Arm’s-length requirement: AN 3 paragraph 16 requires lending to connected parties be at arm’s length and not on more favorable terms.
- Board policies: GN 2 requires banks to have policies on lending to connected borrowers; compliance tested on-site.
- Board approval: No specific requirement that connected loans above a threshold be approved by the board.
- Capital deduction: AN 3 paragraph 18 allows Commissioner to deduct connected lending from capital if loan is for capital purposes or not at arm’s length.
- Aggregate limit: Loans to connected parties must be reported quarterly and in aggregate must not exceed 25 percent of the bank’s capital.
- Assessment: Compliant
- Comment: Definition of connected party is wide; no specific prohibition on potential beneficiaries participating in loan approval but bank policies are expected to address conflict management.

### Principle 11 — Country Risk
- Reporting enhancement: From last quarter of 2005, FSC established a Supplementary Quarterly Return requiring banks to submit assets and liabilities breakdown by countries, differentiating exposures to banks and nonbanks.
- Guidance: GN 4 (December 2001) includes country or transfer risk as an issue to consider.
- Supervision: FSC risk-based framework explicitly addresses country and transfer risk.
- Assessment: Compliant
- Comment: Gibraltar banks’ exposures are mainly to countries with low transfer and country risk.

### Principle 12 — Market Risks
- Market activity: Gibraltar banks generally do not have active treasuries or sophisticated products; trading books are minimal or nonexistent.
- Head office support: For substantial market-risk products, head offices provide services.
- Supervisory framework: Risk-based framework treats market risk as an element under the risk group environment; risk management element covers identification, measurement, monitoring and control.
- FX monitoring: Framework includes assessment of foreign exchange positions and bank-set limits.
- Legal alignment: AN 7 introduced EEC Directive 93/6/EEC requirements (as amended by 98/31/EC and 98/33EC) into Gibraltar law for market and other risks associated with trading activities.
- Assessment: Compliant

### Principle 13 — Other Risks (Liquidity, Interest Rate, Operational)
- Risk framework: FSC risk-based framework assesses risk management, quality management, and corporate governance.
- Liquidity reporting: Quarterly Returns include maturity schedule tables with accumulated net positions by time period.
- Liquidity supervision: No across-the-board liquidity ratio norms; specific mismatch ratios monitored case by case. FSC can impose license conditions under BO Sections 29 and 30 for persistent excessive mismatches (powers never used).
- Daily reporting: Many Gibraltar banks lack daily liquidity reporting; FSC should verify that banks with high potential liquidity risk meet agreed limits or provide daily liquidity information.
- Interest rate risk: AN 7 deals with interest rate risk in the trading book; FSC framework includes interest rate risk in the banking book under market risk.
- Operational risk: Addressed as a risk element covering process/system exposures, change, firm structure, management and employees, risk appetite, and mitigation.
- Assessment: Largely compliant
- Comment: FSC should ensure banks with high potential liquidity risk meet agreed limits or provide daily liquidity position information verifiable by the Commissioner.

### Principle 14 — Internal Control and Audit
- Group structure: All banks but one are branches or subsidiaries of major banking organizations with recognized corporate governance and internal controls.
- Internal audit: In most cases internal auditors come from head office; external audit firm commonly the same for the group.
- Back office: Back office functions are often performed in head offices.
- Legal duties: Companies Ordinance and common law establish director responsibilities.
- Assessment: (Assessment label not repeated in provided excerpt) 

*Source: _cr07155 - Section 64(1)). It is the practice of the Commissioner to request letters of comfort from*

### Section 23 (3) (h) of the BO  requires a bank to maintain at all times adequate accounting

### _cr07155 - Section 23 (3) (h) of the BO  requires a bank to maintain at all times adequate accounting records and adequate systems of control of the business and records. GN 6 deals with the internal audit function in banks and communications between the internal audit function, the external auditors, and the FSC.

### Internal audit, governance, and four-eyes principle
- Section 23 (3) (h) of the BO requires a bank to maintain at all times adequate accounting records and adequate systems of control of the business and records.
- GN 6 addresses the internal audit function in banks and communications between internal audit, external auditors, and the FSC.
- The FSC risk-based framework includes internal audit and quality of management as risk elements in pre-assessment and post-on-site assessments.
- The Risk Based Self Assessment Questionnaire includes questions about internal control systems, management, and organization.
- Section 23 (3) (f) of the BO 1992 introduces the four eyes principle, requiring that the business will be effectively directed by no fewer than 2 individuals.
- An ordinance for an Approved Persons Regime dealing with approval and removal of key individuals (i.e., directors and managers) has been prepared.
- FSC has used Reporting Accountants to conduct focused reports on High Level Controls for several banks.
- Assessment: Compliant
- Comments:
  - Boards typically include local executive members and non-resident head office members, providing a certain level of independence.
  - Internal audit is normally based in head office/parent with an internal audit committee overseeing group operations including Gibraltar.

### Anti-Money Laundering (Principle 15)
- Banks must comply with the EEC Directive (91/308/EEC) and AML Guidance Notes (AMLGN) part II on prevention of use of the financial system for criminal purposes.
- Directive transposed into Gibraltar law via the Drug Trafficking Offences Ordinance and the Criminal Justice Ordinance (CJO).
- FSC risk-based framework treats Anti-Money Laundering Controls as a risk element assessed off-site and on-site; FSC may appoint reporting accountants for focused exams.
- AMLGN part IV: requirements on KYC and record retention.
- AMLGN part VI: recognition and reporting of suspicious transactions.
- Banks must appoint a Money Laundering Reporting Officer; role described in AMLGN part VI.
- Bank management must inform FSC of material failings that could threaten depositors (including fraud or misfeasance).
- Section 2(3) and 3(5) of the CJO exempt disclosers of suspicious transactions from liability.
- CJO and AMLGN require institutions to have staff training programs; FSC verifies existence during on-site visits and via the self assessment questionnaire.
- Section 20 of the CJO obliges the FSC to make disclosures to GFIU of suspicious transactions.
- Assessment: Compliant
- Comments: Compliance with the FATF 40 plus 9 was assessed by a specialist team.

### On-site and off-site supervision (Principle 16)
- FSC implemented a revised risk based supervision framework in 2003 with four phases: pre-assessment, assessment, formal feedback, and risk mitigation.
- Grading methodology uses six evaluation factors ("Risk Groups"): Financial Soundness and Capital, Environment, Business Plan, Controls, Organization and Management. Each risk group graded from 1 to 5; grades multiplied by fixed weights and by the impact score to obtain final risk profile determining supervisory intensity.
- On-site visits occur during assessment after Self Assessment Questionnaire and preliminary assessment; visits include meetings with senior management and heads of significant units, discussions on controls, strategy, organization, risk management; sample testing if not covered by internal audit.
- FSC may rely on reporting accountants (BO Section 60), normally external auditors, for on-site examinations (money laundering, credit risk, IT, private banking, high level controls); trilateral meeting held among bank management, reporting accountants, and FSC to discuss findings.
- Off-site supervision uses quarterly reports, annual financial reports, management letters, internal audit reports; off-site reports include trend analysis and peer group reviews.
- FSC holds ISO 9001:2000 certification for its quality management process.
- BO 1992 Section 60: FSC access to all types of records and information within a bank including board reports by internal/external auditors.
- BO 1992 Section 86A: confidentiality provisions on obtained information with suitable gateways for disclosure.
- Assessment: Compliant

### Bank management contact (Principle 17)
- Regular “prudential” visits discuss organization, management, strategic planning, budgets, financial performance, product and market developments.
- Frequency: about every nine months with licensed institutions and once a year for EU branches.
- FSC risk-based framework assesses management quality and corporate governance.
- Assessment: Compliant

### Off-site supervision mechanics (Principle 18)
- Banking (Accounts Directive) Regulation 1997 specifies accounting on solo and consolidated basis in line with EU directives.
- Banking Supervisory Returns submitted quarterly to FSC within 14 days of period end; required signature by a Senior Manager and another authorized official.
- FSC can commission reporting accountants’ reports on control systems or impose license conditions if pattern of reporting errors detected.
- Quarterly returns include balance sheet, income statements, non performing loans, provisions, and supervisory ratios.
- BO Section 59 (b) and AN 7 (Post BCCI Directive: Close Links) enable FSC to seek information about related companies and subsidiaries.
- FSC analytical system processes quarterly returns data; data has same reporting date and is in GBP enabling cross-referencing across the banking system.
- Assessment: Compliant

### Validation of supervisory information (Principle 19)
- FSC risk-based framework explicitly includes on-site visits focused on significant assessed areas.
- FSC can require examinations by reporting accountants (typically external auditors).
- Appointment of external auditors for financial statements is subject to approval by the Commissioner.
- BO Section 60: power to obtain information and require production of documents.
- FSC engages with Gibraltar Society of Chartered and Certified Accountancy Bodies (GSCCAB) on auditing and bank supervision issues.
- Assessment: Compliant

### Consolidated supervision (Principle 20)
- None of Gibraltar-licensed banks have overseas operations or subsidiaries; FSC is not Home Supervisor of any banking group.
- FSC has legal authority to supervise on a consolidated basis; AN 4 implements Banking Consolidated Directive (2000/12/EC); AN8 implements Post-BCCI directive (95/26/EC).
- AN 4 section 24: where consolidation deemed inappropriate (e.g., preponderance of industrial and insurance business), Commissioner may require parent and subsidiaries to supply relevant supervisory data.
- BO Section 59 extends FSC powers to subsidiaries, parents or other undertakings/persons under Article 56 of Directive 2000/12/EC.
- Assessment: Compliant

### Accounting standards (Principle 21)
- BO Section 23 (3) (g) and (h) require as licensing and ongoing criteria that each bank maintains proper accounts and adequate systems of controls over business and records.
- Quarterly returns due within 14 days of period end; FSC has no capacity to apply penalties for late returns.
- EU-listed companies required to report using IFRS; this applies to most Gibraltar banks, though some Gibraltar subsidiaries may still use earlier U.K. accounting standards.
- Banking (Accounts Directive) Regulations 1997, section 13: banks must publish audited financial statements.
- BO Sections 46, 46A and 47 establish auditors’ immunity from civil liability, enabling auditors to communicate freely with FSC.
- Banking (Accounts Directive) Regulations 1997 Schedule 1, Chapter 1, Part III: valuation rules for banks’ financial statements follow EU directives.
- BO Section 62 (2): power for the Commissioner to appoint and retain an auditor.
- FSC publishes an abstract of key banking statistics from quarterly returns.
- Assessment: Compliant

### Remedial measures (Principle 22)
- Commissioner’s remedial powers include: oral request; formal written request; order to refrain from action (BO Section 62 (1)); varying a license by imposing, amending, or revoking any condition (BO Sections 29 and 30); canceling the license (BO Section 64).
- Absence of a penalties regime (e.g., fines on banking officers) has not constrained FSC’s ability to ensure compliance to date.
- Assessment: Compliant
- Comments: Government of Gibraltar prepared a draft ordinance for an Approved Persons Regime to approve/remove key individuals and give the Commissioner power to apply sanctions to individuals.

### Globally consolidated and host country supervision (Principles 23–24) 
- Principle 23 (Globally Consolidated Supervision): None of Gibraltar banks have overseas operations; FSC has legal authority to supervise on a consolidated basis if needed. Assessment: Compliant
- Principle 24 (Host Country Supervision): FSC has not needed to act as home supervisor to establish contact with other supervisors, but is legally prepared to be a home supervisor including powers to refuse or cancel licenses where close links impede supervision. AN 4 and AN8 implement consolidation and Post-BCCI directives. Assessment: Compliant

### Supervision over foreign banks’ establishments (Principle 25)
- BO Section 18: Commissioner must consult relevant supervisory authority of a European institution for applications by subsidiaries/controlled entities of a European institution.
- For applicants with head office outside EEA, Commissioner must be satisfied about the nature and scope of supervision exercised by that authority; that authority must inform the Commissioner it is satisfied about prudent management and financial soundness of the applicant.
- FSC, as host supervisor, allows EEA supervisory authorities to exercise powers similar to those of the Commissioner for prudential supervision of Gibraltar banks in EEA-supervised conglomerates.
- In practice, FSC has developed extensive contacts with home supervisory authorities responsible for banking groups operating in Gibraltar.
- Assessment: Compliant

### Summary compliance (Table 2 highlights)
- Overall classification across Basel Core Principles shows:
  - Many principles assessed as Compliant (C).
  - Independence and legal protection items marked LC (Largely compliant) in the table context displayed.
- Specific principles listed as Compliant include: 1.1 Objectives; 1.3 Legal framework; 1.4 Enforcement powers; 1.6 Information sharing; 2–14; 15–25 as presented in the table.
- Table footnotes define: C: Compliant; LC: Largely compliant; MNC: Materially non-compliant; NC: Non-compliant; NA: Not applicable.

### Recommended action plan and authorities’ response
- Recommended actions excerpted:
  - Objectives, autonomy, powers and resources (CP 1):
    - FSC’s objectives and responsibilities should be enshrined in law by amendment to the FSCO.
    - The level of fees payable to the FSC should be fixed by the FSC.
    - The term of office of the Commissioner and members of the Commission should be established in the FSCO.
    - Proposed amendment to FSCO Section 18 requiring FSC to indemnify staff for costs in defending legal action should be introduced.
  - Other risks (CP 13):
    - FSC should require banks assessed as having a high potential liquidity risk to meet their liquidity mismatch ratio or provide information about liquidity positions on a daily basis and duly report whenever a breach occurs.
- Authorities’ response highlights:
  - The FSC welcomes the IMF's assessment and thanks the IMF team.
  - The FSC emphasizes validation of its supervisory work, particularly the Risk Assessment Framework methodology designed and implemented by its staff and deployed across supervisory functions.

*Source: _cr07155 - Section 23 (3) (h) of the BO  requires a bank to maintain at all times adequate accounting records and adequate systems of control of the business and records.*

---


_Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2007/_cr07155.pdf_