## 1.  A detailed assessment of observance of the Basel Core Principles for Effective Banking Supervision (BCP)

## Source details

**Canonical URL:** [1.  A detailed assessment of observance of the Basel Core Principles for Effective Banking Supervision (BCP)](https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2008/_cr08205.pdf)

## Other formats

- [Markdown version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2008/_cr08205.pdf.md)
- [Structured JSON version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2008/_cr08205.pdf.json)

---

### Overview
- A detailed BCP assessment was undertaken in October 2003 as part of Austria’s Financial Sector Assessment Program (FSAP); that assessment found that the regulatory framework and its implementation were generally of high standard and effective.
- This note provides a factual update and analysis of the regulatory and supervisory regime for banks in Austria in force in December 2007, focusing on innovations since 2003: recent legal and regulatory changes and innovations in supervisory practice.
- Main information sources: the Banking Law (BWG), as amended; material provided by the Financial Market Authority (FMA) and the Oesterreichische Nationalbank (OeNB), including a self-assessment of observance of the BCP; discussions with FMA and OeNB staff, bank representatives, and the Rechnungshof (government Court of Accounts, report published July 2007).
- A law was adopted by the Austrian National Assembly during the FSAP Update mission affecting FMA and OeNB tasks and responsibilities for banking supervision; the timing of the update does not allow a full operational assessment of the new system, so the report provides a preliminary assessment with caveats and implementation considerations.

### Institutional roles, cooperation and capacity
- FMA and OeNB are jointly in charge of supervision of credit institutions; roles and responsibilities are more clearly defined under the new regime than before.
- Scope of supervision broadened in 2004 by transposition of the EU conglomerates directive and creation of an FMA department for coordinated supervision over financial conglomerates, cooperating closely with FMA departments for banks, investment firms, and insurance companies.
- Within the CRD framework and CEBS guidelines, the FMA has taken initiatives to enhance cooperation with other EU banking supervisors and to elaborate cooperation arrangements with non-EU supervisors where Austrian banks operate (notably in the Balkans and some members of the CIS).
- Authorities have worked to enhance supervision quality by improving organizational systems and structures, upgrading staff expertise, and intensifying on-site supervision; these responses address recommendations of the 2003 FSAP and the 2007 Rechnungshof review.
- Priority implementation challenges:
  - ensure adequate resources (staff numbers and qualifications) for both institutions; and
  - enhance structures, mutual agreements, and cooperation atmosphere between FMA and OeNB.

### Independence, Accountability and Transparency (BCP 1.2)
- FMA instituted an internal audit function with a charter making it answerable to the management board and with a direct reporting line to the supervisory board; internal audit is conducted according to an approved annual audit plan.
- At the time of the update, no longer-term planning framework for internal audit had been finalized; the Rechnungshof recommended enhancing scope and coverage of internal audit actions.

### Legal Framework and Legal Protection (BCP 1.3; BCP 1.5)
- Austria has transposed EU directives and supporting regulations in a timely and comprehensive fashion; implementation of the CRD and complementary regulations proceeded on schedule, establishing an advanced legal framework for banking supervision.
- The FMA has been entrusted with adequate regulatory powers, including close consultation with OeNB prior to issuance of regulations, involving both institutions in monitoring and supervision.
- Main legal change since 2003: clarification that individual staff members cannot be held personally liable for actions taken in execution of duties, and suits for improper supervisory action should be directed against the Republic of Austria rather than government institutions such as the FMA.
- 2005 legislation amended liability for statutory external auditors: government liable only insofar as auditors acted in fulfillment of an order of the authorities.
- Since the amendment, several suits have been brought against the federal government claiming negligence in financial sector regulation and supervision; cases appear to have involved at most slight negligence and charges have been filed against FMA staff (not brought to court). These cases could involve possible large compensation claims and have occupied significant supervisory resources.
- Conclusion: legal protection with respect to institutional liability (“Amtshaftung”) is weak.

### Cooperation (BCP 1.6)
- FMA actively contributed to CEBS guidance on home/host cooperation and committed to integrate principles into operational cooperation with foreign supervisors.
- Memoranda of Understanding (MoU) on supervisory cooperation have been signed or cooperation arrangements under the EU Directive are in place with EU supervisors for all countries where Austrian banks operate or where foreign banks operate in Austria.
- For non-EU supervisors, equivalent cooperation arrangements have been effected except where legal issues (notably bank secrecy) impede MoUs; practical arrangements have been worked out in such cases.
- FMA coordinated model approval (IRB and AMA) processes under the CRD with host supervisors in Central Eastern and Southern European (CESE) countries.
- FMA and OeNB have implemented and tested simultaneous on-site inspections across whole banking groups for large Austrian institutions with subsidiaries in CESE countries to make integrated global assessments.
- Authorities and banks agree that cross-border cooperation needs further enhancement. Priorities include:
  - group-wide risk assessments;
  - coordinated stress testing;
  - aligned supervisory planning; and
  - joint crisis-preparedness exercises.

### Permissible Activities and Licensing (BCP 2; BCP 3)
- FMA established a publicly accessible database of licenses granted to allow the general public to verify the licit or illicit character of offerings or solicitations regarding regulated financial services.
- BWG modified: for establishment of branches or subsidiaries by credit institutions incorporated in non-EU countries, the country of origin must have consolidated supervision equivalent to EU regulation; if the credit institution has pre-existing establishments within the EU, FMA requires sub-consolidated supervision at least on an EU-level.
- Under the transposed CRD, any credit institution applying for a license must have integrated within its organization and systems an Internal Capital Adequacy Assessment Process (ICAAP), with implicit reference to CEBS guidance requirements.

### Major Acquisitions (BCP 5)
- Legislative changes to implement relevant EU directives will be made in the near future; notwithstanding absence of a formal legal requirement, FMA firmly encourages pre-notification of significant acquisitions and investments by credit institutions and this recommendation is observed in practice.
- Recommendations:
  - Make pre-notification a legal obligation.
  - Fully empower FMA, based on clear criteria (e.g., financial or risk impact, institution’s capacity to manage and control the acquired entity, transparency of group structures), to review and possibly object to large investments.
  - Enable FMA to intervene when a financial institution plans to acquire (or be acquired by) financial or nonfinancial affiliates that impair the effectiveness of supervision.
  - Grant FMA enhanced powers to force institutions to unwind structures that impair effective supervision, with special concern for structures that obscure ownership, ultimate beneficiaries, and large exposures (e.g., complex holding companies and trusts).

### Capital Adequacy and Pillar II (BCP 6)
- Austria has fully transposed the CRD into national legislation: capital requirements are imposed on the basis of the new approaches (opening for IRB- and AMA-models; requirement to calculate capital needs for operational risk).
- Introduction of powers under Pillar II allows FMA to require additional capital coverage for other risks (interest rate in the banking book, concentration risk, country risk, etc.), a fundamental change from the previous more rigid regime.
- The possibility to require capital add-ons under Pillar II, as laid down in BWG amendments, is subject to very precise criteria for progressively more severe measures; it is suggested that FMA could be enabled to use capital requirements more flexibly as a signal or incentive for improved systems and risk management.

### Risk Management Processes (BCP 7)
- Transposed CRD extends, deepens, and makes explicit qualitative requirements for risk management, including more precise requirements for overall risk management systems, strong recommendations for ICAAP, and clearer due diligence obligations.
- FMA, jointly with OeNB, issued minimum standards and guidelines for risk management processes within credit institutions, based on CEBS guidance.
- FMA and OeNB appear to have adequate capacity to assess banks’ risk management processes; they are certifying major commercial banks’ IRB models and are regarded by commercial bank staff as knowledgeable, thorough, and insightful.
- Complication: parameterizing models for banks with extensive CESE operations is limited by data availability, which covers a period of unusually strong macroeconomic performance, financial sector expansion, and structural change.
- Practical experience with the new regime across bank types is limited; prima facie assessment points to adequate observation of proportionality principles allowing complexity to match operations.
- Recent legal changes extend supervisory responsibility: FMA shall assess (based on OeNB supervisory reports) adequacy of internal risk measurement and management systems and overall compliance with Pillar II and Pillar III (disclosure) requirements of the CRD.
- CEBS guidance on Pillar II sets standards and guidance for supervisory review; FMA and OeNB are building on this to enhance supervisory effectiveness and provide a consistent group-wide assessment process.
- New provisions enhance the role of banks’ internal audit and scope of external auditors’ review regarding institutions’ risk management processes.
- It is too early to assess the full effectiveness of the new provisions and their implementation; however, all elements appear to be in place to meet Basel Committee, CEBS, and Austrian authority objectives.

### Types of Risks and Risk Reporting (BCP 8–16)
- In implementing CRD, FMA and OeNB comprehensively overhauled regulations, standards, and guidance for major bank risk categories; a key instrument is guidelines on bank-wide risk management and ICAAP.
- Credit risk: complementary requirements set out in FMA’s “Minimum standards for the credit business and other transactions entailing counterparty risk” and in FMA/OeNB credit risk guidelines.
- Impaired assets and provisioning: a definition of default referencing a 90 days payment arrears standard has been introduced, clarifying impairment and setting a uniform benchmark.
- Large exposure limits amended by implementation of the CRD and Directive 2006/49/EC; explicit limits do not negate the CRD obligation to provide for comprehensive assessment of all risk concentration features for each bank or group.
- Country and transfer risk measurement is based on the Bank for International Settlements Risk Statistics, relevant for banks with non-EU exposures.
- Operational risk and IRBB: CRD transposition and Directive 2006/49/EC established adequate measures regarding operational risk and enhanced provisions on interest rate risk in the banking book.
  - Operational risk: opens use of advanced approaches for capital assessment and imposes a formal requirement to include operational risk in each institution’s overall risk profile and to cover it with adequate capital.
  - Liquidity risk: FMA and OeNB follow recent international practice with a principles-based approach complemented by “broad brush” reporting of balance sheet mismatches. Banks must have liquidity management systems and conduct stress tests assessing shocks over 30, 60, and 90 days. Authorities conduct “top down” tests of aggregate and bank-specific liquidity.
  - Recommendation: review liquidity reporting in due time in light of recent market tensions.
- OeNB and FMA are implementing CEBS guidance and have enhanced reporting requirements via COREP and FINREP; they are well advanced in developing a common proprietary risk assessment system to ensure full coverage of each institution’s and group’s risk profile.

### Corporate governance, internal control, and internal audit
- Requirements for internal control and guidance on internal audit with credit institutions have been explicitly enhanced with the transposition of the CRD.
- CEBS’s standards and guidance papers regarding advanced risk management approaches and Pillar II have been fully taken on board; they constitute a significant enhancement in line with standards and practices promoted throughout the international supervisory community.

### Abuse of the Financial Services (BCP 18) / AML/CFT
- Legislation implementing the third EU Anti-Money Laundering Directive was passed by the National Assembly in the course of the mission.
- In 2008 a full review of all issues on AML/CFT based on the Financial Sector Action Task Force 40+9 Methodology will be conducted in collaboration with the IMF.
- It was agreed not to review this principle as part of the FSAP Update.

### Supervisory Process: framework changes and coordination (BCP 19–21)
Findings
- The supervisory framework is currently being overhauled; assessing the old framework is of little relevance, and it is premature to assess definitively the practical effectiveness of the new framework.
- The new framework centralizes operational functions: OeNB entrusted with all operational aspects of banking supervision in financial analysis and onsite inspection; FMA retains ultimate responsibility.
- Risks identified:
  - FMA staff could become disconnected from “hands on” supervision while retaining final responsibility for supervisory action.
  - Supervision is further separated from enforcement, potentially complicating rapid information sharing and decision making in stress situations.
  - Complexity and degree of change require caveats; final results will only become clear over time.
- Cooperation and institutionalization:
  - FMA and OeNB need to support one another fully and coordinate closely.
  - Cooperation should be institutionalized through mechanisms and procedures (FMA and OeNB already plan to maintain a joint database).
  - FMA must retain powers and means to effectively steer the process and consult closely with OeNB.

Recommendations for FMA and OeNB cooperation
- Both institutions should not only jointly express commitment but also explicitly take joint moral responsibility for the regime’s effectiveness.
- Creation of joint teams of experts and generalists requires sustained management effort to maintain a cooperative culture beyond minimum standards.
- Adequate and sufficient staffing of both institutions is a joint key responsibility; review number and profile of required staff (in particular within the FMA), preserve career perspectives, consider joint training and cross-cutting career opportunities.
- CRD and risk-based supervision will require OeNB to enhance frequency and scope of on-site inspections; off-site monitoring and analysis must evolve in parallel.
- Since 2003 authorities have increased frequency of both general and targeted on-site inspections.

### Role of state commissioners and external auditors
State commissioners
- Decision to retain state commissioners only in larger banks as observers on the supervisory board charged with ensuring compliance with laws/regulations.
- Risks:
  - Presence of government official may hamper openness of board discussions.
  - May create impression that government is responsible for any wrongdoing by a bank.
- Recommendation: assess cost-benefit contribution of state commissioners to supervisory effectiveness.

External auditors
Findings
- Heavy reliance continues to be placed on external auditors in verifying compliance, subject to review by authorities.
- Audit reports must conform to certain guidelines; FMA increasingly requests clarifications and regularly meets with external auditors.
- External auditors do not normally carry any legal responsibility in the supervisory field; authorities do not bear general liability for auditors’ actions.
- Incentives and constraints differ between auditors and supervisors; activities are not perfect substitutes.

Recommendations regarding auditors
- FMA and OeNB should undertake regular consultations with the audit profession to maintain clear understanding of auditors’ nature, scope, and report formats; guidelines may need to allow reports to differ based on bank complexity and degree of supervisory oversight.
- FMA should remain vigilant in ensuring high quality of external auditors chosen by banks.
- Auditors’ independence should be enhanced by providing for a regime of mandatory or encouraged periodic rotation of audit firms, not just individual auditors.
- When a bank changes its external auditors (especially before normal contract end), authorities may wish to assess auditors’ relationship with the bank and quality of their work.

### Risk-oriented reporting and data integration
- By implementing the core section of the COREP framework, FMA and OeNB have instituted a risk-oriented reporting system, integrated into the supervisory approach under CRD, tailored to needs of both institutions, and coordinated with OeNB’s macro-prudential requirements.
- Intention to establish a common database of information from all sources is commendable.

### Accounting and Disclosure (BCP 22)
- Austria is implementing an adequate framework by imposing broadly IFRS-based accounting and disclosure throughout the financial sector and transposing CEBS’s guidance on FINREP and disclosure.
- The move replaces a complex situation with exemptions and divergences by a transparent, straightforward, state-of-the-art regime for the banking sector.

### Corrective and Remedial Powers (BCP 23)
Findings
- FMA retains exclusive sanctioning powers and full responsibility.
- The “middle section” of sanctions between symbolic fines and hard enforcement actions seems somewhat weak.

Recommendations
- Authorities need a balanced and flexible toolkit for early remedial action, with adequate principles for use.
- FMA encouraged to design (with OeNB input) procedures to integrate early remedial action into ongoing supervisory processes.
- Recommend that FMA and OeNB elaborate quantitative and qualitative triggers for remedial actions, set out guidelines for prompt remedial action, and balance flexibility with consistency.
- Recommend review of FMA’s sanctioning powers to enable prompt, flexible, and adequate responses and provide broad scale of remedial actions and discretionary powers.
- Recommend elaboration of practical provisions and procedures for orderly exit in failures and stress situations; periodically refine contingency planning (mechanisms for prompt information gathering, consultation and decision procedures, and clear allocation of responsibilities).
- In international cooperation, agree with foreign supervisors on procedures for handling cross-border incidents and test such agreements through crisis management exercises.

### Consolidated Supervision and Home-Host Relationships (BCP 24–25)
- FMA and OeNB are enhancing consolidated supervision and cooperation with foreign supervisors given growing cross-border involvement of Austrian banks.
- Domestically, FMA created a department in charge of coordinated supervision over financial conglomerates.
- Recommendation: ensure supervisory assessments take full account of nonbank activities and ownership structures, at home and abroad, of banks and banking groups.

### Selected recommendations (high-level)
- Legal protection: clarify that financial sector regulation and supervision is conducted in the general public interest, and that losses in an investment or financial institution are not ipso facto evidence of supervisory negligence (owners, managers and creditors bear the risks they create).
- Cooperation: intensify cooperation with counterparts in countries where Austrian banks operate and aim at joint global assessments and joint planning of supervisory work.
- Licensing criteria: apply fit and proper criteria for supervisory board members more broadly than just the chairperson; avoid excessive proportionality exemptions for small institutions.
- Licensing and major acquisitions: empower FMA to halt or unwind group structures that could impede adequate supervision.
- Supervisory process: publicly acknowledge FMA–OeNB common commitment to cooperate closely and accept joint responsibility beyond legal responsibilities.
- On-site inspection: focus on on-site inspection coordinated with off-site monitoring for all institutions, taking proportionality into account.
- Joint teams: consider creating joint teams for supervision of each institution to combine centralized expertise with comprehensive assessment vision.
- Review roles of state commissioners and external auditors; recognize limits of their contributions, especially regarding promptness of supervisory action.
- Encourage periodic rotation of external audit firms’ mandates to enhance independence.

### Authorities’ reactions
General
- Austrian MoF, FMA, and OeNB consider the recommendations valuable and broadly in line with their assessments and priorities.
- Authorities particularly agree on need for effective and efficient implementation of new supervisory regime with close cooperation and joint moral responsibility (referenced recommendations nos. 37–40 and 54).
- Authorities agree on need for adequate staffing and further intensification of on-site inspections, intending a risk-based and proportionate allocation of resources.
- FMA and OeNB committed to enhancing cross-border cooperation (nos. 13–15 and 51).

Specific comments
- Para. 50 (Legal Protection): authorities appreciate recommendation to clarify public interest and are discussing narrowing public liability to align with international practice; must consider within Austrian legal context.
- Paras. 35 and 53 (Corporate Governance): several provisions to enhance corporate governance have been introduced; broader application of fit and proper criteria must be assessed in light of proportionality and cost/benefit.
- Paras. 41 and 57 (State Commissioner): state commissioners have been further integrated into supervisory process; FMA initiatives include regular contacts, reporting requirements, training, manuals, and secured company-specific information; costs and benefits to be carefully assessed before further modification.
- Paras. 47 and 59 (Early remedial action): authorities have developed an elaborated toolkit for risk-based supervision including on-site supervision, off-site analyses, meetings with CI management, stress-testing; auditors and deposit guarantee schemes required to provide timely information; remedial measures include orders to re-establish lawful conditions and cease and desist orders; authorities consider they can take early remedial actions under Austrian legal framework and constitutional rights and request clarification if IMF applies a different concept of “Early remedial action.”
- Paras. 58 (External Auditors: periodic rotation of firms’ mandates): authorities agree on importance of auditor independence; note relevant provisions under review and to be amended in accordance with EU law (8th EU-Directive on Auditing), which does not require external rotation of the auditor; legally binding external rotation is rarely implemented at EU/global levels and would require careful analysis of effects; in Austria, external rotation would currently be limited to 3 to 4 companies having the expertise in auditing banks.

*Prepared by Fernand Naert (IMF consultant on banking supervision); update based on regulatory and supervisory regime in force in December 2007.*

### 1.  A detailed assessment of observance of the Basel Core Principles for Effective

### 1.  A detailed assessment of observance of the Basel Core Principles for Effective Banking Supervision (BCP)

### Overview
- A detailed BCP assessment was undertaken in October 2003 as part of Austria’s Financial Sector Assessment Program (FSAP); that assessment found that the regulatory framework and its implementation were generally of high standard and effective.
- This note provides a factual update and analysis of the regulatory and supervisory regime for banks in Austria in force in December 2007, focusing on innovations since 2003: recent legal and regulatory changes and innovations in supervisory practice.
- Main information sources: the Banking Law (BWG), as amended; material provided by the Financial Market Authority (FMA) and the Oesterreichische Nationalbank (OeNB), including a self-assessment of observance of the BCP; discussions with FMA and OeNB staff, bank representatives, and the Rechnungshof (government Court of Accounts, report published July 2007).
- A law was adopted by the Austrian National Assembly during the FSAP Update mission affecting FMA and OeNB tasks and responsibilities for banking supervision; the timing of the update does not allow a full operational assessment of the new system, so the report provides a preliminary assessment with caveats and implementation considerations.

### Institutional roles, cooperation and capacity
- The FMA and the OeNB are jointly in charge of supervision of credit institutions; roles and responsibilities are more clearly defined under the new regime than before.
- Scope of supervision broadened in 2004 by transposition of the EU conglomerates directive and creation of an FMA department for coordinated supervision over financial conglomerates, cooperating closely with FMA departments for banks, investment firms, and insurance companies.
- Within the CRD framework and CEBS guidelines, the FMA has taken initiatives to enhance cooperation with other EU banking supervisors and to elaborate cooperation arrangements with non-EU supervisors where Austrian banks operate (notably in the Balkans and some members of the CIS).
- Authorities have worked to enhance supervision quality by improving organizational systems and structures, upgrading staff expertise, and intensifying on-site supervision; these responses address recommendations of the 2003 FSAP and the 2007 Rechnungshof review.
- Priority implementation challenges: ensure adequate resources (staff numbers and qualifications) for both institutions and enhance structures, mutual agreements, and cooperation atmosphere between FMA and OeNB.

### BCP update — Independence, Accountability and Transparency (BCP 1.2)
- FMA instituted an internal audit function with a charter making it answerable to the management board and with a direct reporting line to the supervisory board; internal audit is conducted according to an approved annual audit plan.
- At the time of the update, no longer-term planning framework for internal audit had been finalized; the Rechnungshof recommended enhancing scope and coverage of internal audit actions.

### Legal Framework (BCP 1.3)
- Austria has transposed EU directives and supporting regulations in a timely and comprehensive fashion; implementation of the CRD and complementary regulations proceeded on schedule, establishing an advanced legal framework for banking supervision.
- The FMA has been entrusted with adequate regulatory powers, including close consultation with OeNB prior to issuance of regulations, involving both institutions in monitoring and supervision.

### Legal Protection (BCP 1.5)
- Main legal change since 2003: clarification that individual staff members cannot be held personally liable for actions taken in execution of duties, and suits for improper supervisory action should be directed against the Republic of Austria rather than government institutions such as the FMA.
- 2005 legislation amended liability for statutory external auditors: government liable only insofar as auditors acted in fulfillment of an order of the authorities.
- Since the amendment, several suits have been brought against the federal government claiming negligence in financial sector regulation and supervision; cases appear to have involved at most slight negligence and charges have been filed against FMA staff (not brought to court). These cases could involve possible large compensation claims and have occupied significant supervisory resources.
- Conclusion: legal protection with respect to institutional liability (“Amtshaftung”) is weak.

### Cooperation (BCP 1.6)
- FMA actively contributed to CEBS guidance on home/host cooperation and committed to integrate principles into operational cooperation with foreign supervisors.
- Memoranda of Understanding (MoU) on supervisory cooperation have been signed or cooperation arrangements under the EU Directive are in place with EU supervisors for all countries where Austrian banks operate or where foreign banks operate in Austria.
- For non-EU supervisors, equivalent cooperation arrangements have been effected except where legal issues (notably bank secrecy) impede MoUs; practical arrangements have been worked out in such cases.
- FMA coordinated model approval (IRB and AMA) processes under the CRD with host supervisors in Central Eastern and Southern European (CESE) countries.
- FMA and OeNB have implemented and tested simultaneous on-site inspections across whole banking groups for large Austrian institutions with subsidiaries in CESE countries to make integrated global assessments.
- Authorities and banks agree that cross-border cooperation needs further enhancement, especially given CESE subsidiaries’ potential impact on Austrian banks and foreign-owned banks’ role in Austria. Priorities include group-wide risk assessments, coordinated stress testing, aligned supervisory planning, and joint crisis-preparedness exercises.

### Permissible Activities (BCP 2)
- FMA established a publicly accessible database of licenses granted to allow the general public to verify the licit or illicit character of offerings or solicitations regarding regulated financial services.

### Licensing Criteria (BCP 3)
- BWG modified: for establishment of branches or subsidiaries by credit institutions incorporated in non-EU countries, the country of origin must have consolidated supervision equivalent to EU regulation; if the credit institution has pre-existing establishments within the EU, FMA requires sub-consolidated supervision at least on an EU-level.
- Under the transposed CRD, any credit institution applying for a license must have integrated within its organization and systems an Internal Capital Adequacy Assessment Process (ICAAP), with implicit reference to CEBS guidance requirements.

### Major Acquisitions (BCP 5)
- Legislative changes to implement relevant EU directives will be made in the near future; notwithstanding absence of a formal legal requirement, FMA firmly encourages pre-notification of significant acquisitions and investments by credit institutions and this recommendation is observed in practice.
- Recommendations:
  - Make pre-notification a legal obligation.
  - Fully empower FMA, based on clear criteria (e.g., financial or risk impact, institution’s capacity to manage and control the acquired entity, transparency of group structures), to review and possibly object to large investments.
  - Enable FMA to intervene when a financial institution plans to acquire (or be acquired by) financial or nonfinancial affiliates that impair the effectiveness of supervision.
  - Grant FMA enhanced powers to force institutions to unwind structures that impair effective supervision, with special concern for structures that obscure ownership, ultimate beneficiaries, and large exposures (e.g., complex holding companies and trusts).

### Capital Adequacy (BCP 6)
- Austria has fully transposed the CRD into national legislation: capital requirements are imposed on the basis of the new approaches (opening for IRB- and AMA-models; requirement to calculate capital needs for operational risk).
- Introduction of powers under Pillar II allows FMA to require additional capital coverage for other risks (interest rate in the banking book, concentration risk, country risk, etc.), a fundamental change from the previous more rigid regime.
- The possibility to require capital add-ons under Pillar II, as laid down in BWG amendments, is subject to very precise criteria for progressively more severe measures; it is suggested that FMA could be enabled to use capital requirements more flexibly as a signal or incentive for improved systems and risk management.

### Risk Management Processes (BCP 7)
- Transposed CRD extends, deepens, and makes explicit qualitative requirements for risk management, including more precise requirements for overall risk management systems, strong recommendations for ICAAP, and clearer due diligence obligations.
- FMA, jointly with OeNB, issued minimum standards and guidelines for risk management processes within credit institutions, based on CEBS guidance, enhancing requirements and promoting EU convergence to facilitate group-wide requirement implementation.
- FMA and OeNB appear to have adequate capacity to assess banks’ risk management processes; they are certifying major commercial banks’ IRB models and are regarded by commercial bank staff as knowledgeable, thorough, and insightful.
- Complication: parameterizing models for banks with extensive CESE operations is limited by data availability, which covers a period of unusually strong macroeconomic performance, financial sector expansion, and structural change.
- Practical experience with the new regime across bank types (large banks, small banks in groups, independent banks) is limited; prima facie assessment points to adequate observation of proportionality principles allowing complexity to match operations.
- Recent legal changes extend supervisory responsibility: FMA shall assess (based on OeNB supervisory reports) adequacy of internal risk measurement and management systems and overall compliance with Pillar II and Pillar III (disclosure) requirements of the CRD.
- CEBS guidance on Pillar II sets standards and guidance for supervisory review; FMA and OeNB are building on this to enhance supervisory effectiveness and provide a consistent group-wide assessment process.
- The possibility of imposing capital add-ons implicitly enhances FMA’s powers, though such measures must be duly justified toward the credit institution or group.
- New provisions enhance the role of banks’ internal audit and scope of external auditors’ review regarding institutions’ risk management processes.
- It is too early to assess the full effectiveness of the new provisions and their implementation; however, all elements appear to be in place to meet Basel Committee, CEBS, and Austrian authority objectives.

### Types of Risks (BCP 8 to 16)
- In implementing CRD, FMA and OeNB comprehensively overhauled regulations, standards, and guidance for major bank risk categories; a key instrument is guidelines on bank-wide risk management and ICAAP.
- Credit risk: complementary requirements set out in FMA’s “Minimum standards for the credit business and other transactions entailing counterparty risk” and in FMA/OeNB credit risk guidelines.
- Impaired assets and provisioning: a definition of default referencing a 90 days payment arrears standard has been introduced, clarifying impairment and setting a uniform benchmark.
- Large exposure limits amended by implementation of the CRD and Directive 2006/49/EC; explicit limits do not negate the CRD obligation to provide for comprehensive assessment of all risk concentration features for each bank or group.
- Country and transfer risk measurement is based on the Bank for International Settlements Risk Statistics, relevant for banks with non-EU exposures.
- Operational risk and IRBB: CRD transposition and Directive 2006/49/EC established adequate measures regarding operational risk and enhanced provisions on interest rate risk in the banking book.
  - Operational risk: opens use of advanced approaches for capital assessment and imposes a formal requirement to include operational risk in each institution’s overall risk profile and to cover it with adequate capital.
  - Liquidity risk: FMA and OeNB follow recent international practice with a principles-based approach complemented by “broad brush” reporting of balance sheet mismatches. Banks must have liquidity management systems and conduct stress tests assessing shocks over 30, 60, and 90 days. Authorities conduct “top down” tests of aggregate and bank-specific liquidity.
  - Recommendation: review liquidity reporting in due time in light of recent market tensions.
- OeNB and FMA are implementing CEBS guidance and have enhanced reporting requirements via COREP and FINREP; they are well advanced in developing a common proprietary risk assessment system to ensure full coverage of each institution’s and group’s risk profile.

*Prepared by Fernand Naert (IMF consultant on banking supervision); update based on regulatory and supervisory regime in force in December 2007.*

### 35.  Austrian corporate law has been amended to bring it more in line with

### _cr08205 - 35.  Austrian corporate law has been amended to bring it more in line with

### Corporate governance, internal control, and internal audit
- Requirements for internal control and guidance on internal audit with credit institutions have been explicitly enhanced with the transposition of the CRD.
- CEBS’s standards and guidance papers regarding advanced risk management approaches and Pillar II have been fully taken on board; they constitute a significant enhancement in line with standards and practices promoted throughout the international supervisory community.

### Abuse of the Financial Services (BCP 18) / AML/CFT
- Legislation implementing the third EU Anti-Money Laundering Directive was passed by the National Assembly in the course of the mission.
- In 2008 a full review of all issues on AML/CFT based on the Financial Sector Action Task Force 40+9 Methodology will be conducted in collaboration with the IMF.
- It was agreed not to review this principle as part of the FSAP Update.

### Supervisory Process (BCP 19–21): framework changes and coordination
Findings
- The supervisory framework is currently being overhauled; assessing the old framework is of little relevance, and it is premature to assess definitively the practical effectiveness of the new framework.
- The new framework centralizes operational functions: OeNB entrusted with all operational aspects of banking supervision in financial analysis and onsite inspection; FMA retains ultimate responsibility.
- Risks identified:
  - FMA staff could become disconnected from “hands on” supervision while retaining final responsibility for supervisory action.
  - Supervision is further separated from enforcement, potentially complicating rapid information sharing and decision making in stress situations.
  - Complexity and degree of change require caveats; final results will only become clear over time.
- Cooperation and institutionalization:
  - FMA and OeNB need to support one another fully and coordinate closely.
  - Cooperation should be institutionalized through mechanisms and procedures (FMA and OeNB already plan to maintain a joint database).
  - FMA must retain powers and means to effectively steer the process and consult closely with OeNB.

Recommendations for FMA and OeNB cooperation (explicit considerations)
- Both institutions should not only jointly express commitment but also explicitly take joint moral responsibility for the regime’s effectiveness.
- Creation of joint teams of experts and generalists requires sustained management effort to maintain a cooperative culture beyond minimum standards.
- Adequate and sufficient staffing of both institutions is a joint key responsibility; review number and profile of required staff (in particular within the FMA), preserve career perspectives, consider joint training and cross-cutting career opportunities.
- CRD and risk-based supervision will require OeNB to enhance frequency and scope of on-site inspections; off-site monitoring and analysis must evolve in parallel.
- Since 2003 authorities have increased frequency of both general and targeted on-site inspections.

### Role of state commissioners and external auditors
State commissioners
- Decision to retain state commissioners only in larger banks as observers on the supervisory board charged with ensuring compliance with laws/regulations.
- Risks:
  - Presence of government official may hamper openness of board discussions.
  - May create impression that government is responsible for any wrongdoing by a bank.
- Recommendation: assess cost-benefit contribution of state commissioners to supervisory effectiveness.

External auditors
Findings
- Heavy reliance continues to be placed on external auditors in verifying compliance, subject to review by authorities.
- Audit reports must conform to certain guidelines; FMA increasingly requests clarifications and regularly meets with external auditors.
- External auditors do not normally carry any legal responsibility in the supervisory field; authorities do not bear general liability for auditors’ actions.
- Incentives and constraints differ between auditors and supervisors; activities are not perfect substitutes.

Recommendations regarding auditors
- FMA and OeNB should undertake regular consultations with the audit profession to maintain clear understanding of auditors’ nature, scope, and report formats; guidelines may need to allow reports to differ based on bank complexity and degree of supervisory oversight.
- FMA should remain vigilant in ensuring high quality of external auditors chosen by banks.
- Auditors’ independence should be enhanced by providing for a regime of mandatory or encouraged periodic rotation of audit firms, not just individual auditors.
- When a bank changes its external auditors (especially before normal contract end), authorities may wish to assess auditors’ relationship with the bank and quality of their work.

### Risk-oriented reporting and data integration
- By implementing the core section of the COREP framework, FMA and OeNB have instituted a risk-oriented reporting system, integrated into the supervisory approach under CRD, tailored to needs of both institutions, and coordinated with OeNB’s macro-prudential requirements.
- Intention to establish a common database of information from all sources is commendable.

### Accounting and Disclosure (BCP 22)
- Austria is implementing an adequate framework by imposing broadly IFRS-based accounting and disclosure throughout the financial sector and transposing CEBS’s guidance on FINREP and disclosure.
- The move replaces a complex situation with exemptions and divergences by a transparent, straightforward, state-of-the-art regime for the banking sector.

### Corrective and Remedial Powers (BCP 23)
Findings
- FMA retains exclusive sanctioning powers and full responsibility.
- The “middle section” of sanctions between symbolic fines and hard enforcement actions seems somewhat weak.

Recommendations
- Authorities need a balanced and flexible toolkit for early remedial action, with adequate principles for use.
- FMA encouraged to design (with OeNB input) procedures to integrate early remedial action into ongoing supervisory processes.
- Recommend that FMA and OeNB elaborate quantitative and qualitative triggers for remedial actions, set out guidelines for prompt remedial action, and balance flexibility with consistency.
- Recommend review of FMA’s sanctioning powers to enable prompt, flexible, and adequate responses and provide broad scale of remedial actions and discretionary powers.
- Recommend elaboration of practical provisions and procedures for orderly exit in failures and stress situations; periodically refine contingency planning (mechanisms for prompt information gathering, consultation and decision procedures, and clear allocation of responsibilities).
- In international cooperation, agree with foreign supervisors on procedures for handling cross-border incidents and test such agreements through crisis management exercises.

### Consolidated Supervision and Home-Host Relationships (BCP 24–25)
- FMA and OeNB are enhancing consolidated supervision and cooperation with foreign supervisors given growing cross-border involvement of Austrian banks.
- Domestically, FMA created a department in charge of coordinated supervision over financial conglomerates.
- Recommendation: ensure supervisory assessments take full account of nonbank activities and ownership structures, at home and abroad, of banks and banking groups.

### Recommendations (selected highlights)
- Legal protection: clarify that financial sector regulation and supervision is conducted in the general public interest, and that losses in an investment or financial institution are not ipso facto evidence of supervisory negligence (owners, managers and creditors bear the risks they create).
- Cooperation: intensify cooperation with counterparts in countries where Austrian banks operate and aim at joint global assessments and joint planning of supervisory work.
- Licensing criteria: apply fit and proper criteria for supervisory board members more broadly than just the chairperson; avoid excessive proportionality exemptions for small institutions.
- Licensing and major acquisitions: empower FMA to halt or unwind group structures that could impede adequate supervision.
- Supervisory process: publicly acknowledge FMA–OeNB common commitment to cooperate closely and accept joint responsibility beyond legal responsibilities.
- On-site inspection: focus on on-site inspection coordinated with off-site monitoring for all institutions, taking proportionality into account.
- Joint teams: consider creating joint teams for supervision of each institution to combine centralized expertise with comprehensive assessment vision.
- Review roles of state commissioners and external auditors; recognize limits of their contributions, especially regarding promptness of supervisory action.
- Encourage periodic rotation of external audit firms’ mandates to enhance independence.

### Authorities’ reactions
General
- Austrian MoF, FMA, and OeNB consider the recommendations valuable and broadly in line with their assessments and priorities.
- Authorities particularly agree on need for effective and efficient implementation of new supervisory regime with close cooperation and joint moral responsibility (referenced recommendations nos. 37–40 and 54).
- Authorities agree on need for adequate staffing and further intensification of on-site inspections, intending a risk-based and proportionate allocation of resources.
- FMA and OeNB committed to enhancing cross-border cooperation (nos. 13–15 and 51).

Specific comments
- Para. 50 (Legal Protection): authorities appreciate recommendation to clarify public interest and are discussing narrowing public liability to align with international practice; must consider within Austrian legal context.
- Paras. 35 and 53 (Corporate Governance): several provisions to enhance corporate governance have been introduced; broader application of fit and proper criteria must be assessed in light of proportionality and cost/benefit.
- Paras. 41 and 57 (State Commissioner): state commissioners have been further integrated into supervisory process; FMA initiatives include regular contacts, reporting requirements, training, manuals, and secured company-specific information; costs and benefits to be carefully assessed before further modification.
- Paras. 47 and 59 (Early remedial action): authorities have developed an elaborated toolkit for risk-based supervision including on-site supervision, off-site analyses, meetings with CI management, stress-testing; auditors and deposit guarantee schemes required to provide timely information; remedial measures include orders to re-establish lawful conditions and cease and desist orders; authorities consider they can take early remedial actions under Austrian legal framework and constitutional rights and request clarification if IMF applies a different concept of “Early remedial action.”
- Paras. 58 (External Auditors: periodic rotation of firms’ mandates): authorities agree on importance of auditor independence; note relevant provisions under review and to be amended in accordance with EU law (8th EU-Directive on Auditing), which does not require external rotation of the auditor; legally binding external rotation is rarely implemented at EU/global levels and would require careful analysis of effects; in Austria, external rotation would currently be limited to 3 to 4 companies having the expertise in auditing banks.

*Source: IMF staff report content provided in the supplied PDF chapter/section.*

---


_Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2008/_cr08205.pdf_