## _cr1413

## Source details

**Canonical URL:** [_cr1413](https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr1413.pdf)

## Other formats

- [Markdown version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr1413.pdf.md)
- [Structured JSON version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr1413.pdf.json)

---

### INTRODUCTION — mission, scope and grading
- Assessment completed under the Financial Sector Assessment Program (FSAP) by the IMF.
- Scope: legal framework and detailed examination of policies and practices of institutions responsible for banking supervision.
- Assessment periods: February 18–25 and April 3–18 April, 2013.
- Assessors: Arnoud Vossen (Central Bank of the Netherlands), Michael Deasy (Consultant) and Diane Marie Mendoza (IMF).
- Grading scale: compliant; largely compliant; materially noncompliant; noncompliant; not applicable. Grading based on Essential Criteria (EC).

### INSTITUTIONAL AND MARKET STRUCTURE — overview
- Supervisory architecture:
  - Dual supervisory system: Financial Market Authority (FMA) and Austrian Central Bank (OeNB).
  - FMA: independent integrated financial supervisory authority; decision-making and regulatory authority.
  - OeNB: executes all on-site inspections (under FMA inspection orders), performs off-site analysis using CI reporting, solely responsible for payment systems oversight.
  - Joint database and Financial Market Committee (FMK) to strengthen cooperation.
- Market scale and structure:
  - Consolidated total assets of banking sector: EUR 1,189 billion (June 2012).
  - Banking sector size: nearly 400 percent of GDP.
  - CIs account for approximately 80 percent of financial market intermediation.
  - Nonbank intermediation: less than EUR 240 billion (end-2011).
  - Number of registered CIs: 822 (mid-2012).
  - Four financial conglomerates declared in Austria (mid-2012).
- Ownership, capital and profitability:
  - Public ownership: more than 10 percent of total unconsolidated assets (June 2012).
  - Foreign-owned CIs: over 20 percent of total assets (June 2012).
  - Estimated additional capital required for Basel III: EUR 8–13 billion.
- Asset quality and funding:
  - Consolidated NPL ratio: 9.1 percent (mid-2012).
  - Unconsolidated NPL ratio (domestic Austria): approximately 4.6 percent (June 2012).
  - NPL ratio of Austrian subsidiaries in CESEE: 15.8 percent (mid-2012).
  - NPL ratio for foreign-currency loans (CESEE): 19.7 percent (mid-2012 reference).
  - Deposit growth in Austria: 5.3 percent (2012).
  - Retail and corporate deposits are major funding sources.

### PRECONDITIONS, MACROPRUDENTIAL FRAMEWORK, AND PAYMENT SYSTEMS
- Legal and economic environment: well-developed business law, high rental housing share reduces price volatility.
- Macroprudential framework:
  - OeNB’s Financial Markets Analysis and Surveillance Division responsible for systemic risk identification and stress testing.
  - Tasks/objectives for macroprudential supervision under legislative discussion; in practice FMA and OeNB undertake systemic risk monitoring.
- Payment systems oversight: OeNB responsibility.
- Recovery, resolution and deposit insurance:
  - Bank Reorganisation Act to enter into force 1st January 2014 requiring CIs to set up recovery and resolution plans and providing FMA with early intervention tools.
  - Deposit guarantee: five sectoral schemes; guarantee up to EUR 100,000 per deposit/group of related deposits.

### POLICY RESPONSES TO THE 2008 CRISIS — selected measures
- October 2008 “Austrian banking package”:
  - “Financial Market Stabilization Act”: envelope of EUR 15 billion for recapitalization.
  - “Interbank Market Reinforcement Act”: up to EUR 75 billion for funding guarantees; established “Clearing Bank for Interbank Operations”.
  - Unlimited deposit insurance for non-legal entities until end-2009 (overall envelope EUR 10 billion).
- Status:
  - As of 2013, only “Financial Market Stabilization Act” remains legally available; overall envelope almost used up.
  - Guarantees under Interbank Market Reinforcement Act fell from an end-year peak of 22 billion in 2010 to below 10 billion at end-March 2012; will expire in 2014.
- Foreign-currency lending controls and liquidity monitoring:
  - Measures introduced (most recently early 2013) to contain foreign currency lending domestically and in CESEE/CIS.
  - New OeNB reporting system (late 2008) to monitor liquidity/funding risk; weekly liquidity template for major banks.

### DETAILED ASSESSMENT FRAMEWORK — template guidance
- Principle-by-Principle self-assessment template must include: (1) description of system; (2) grading option; (3) comments.
- Description to cite laws/regulations, structured around banking laws, prudential regulations, supervisory tools, institutional capacity and evidence of implementation.

---

### PRINCIPLE HIGHLIGHTS — selected principles, findings and statistics

H3: Principle 1 — Responsibilities, objectives and powers (Assessment: Compliant)
- Legal basis and division:
  - FMA established under Article 1 para. 1 FMABG; operates since April 1, 2002; “shall not be bound by any instructions.”
  - OeNB responsibilities in National Bank Act and Banking Act; OeNB “shall not be bound by any instructions” (Article 79 para. 5 Banking Act).
  - Post-2008 reform: FMA as decision-maker; OeNB as fact-finder (on-site/off-site).
- Selected EC findings:
  - EC1: Responsibilities/objectives defined in legislation; FMA is the competent authority for regulatory supervision.
  - EC2: FMA’s objectives (Article 69 Banking Act) include considering “the national economic interest in maintaining an efficient banking system and financial market stability”; assessors flagged potential tension with primary safety/soundness objective.
  - EC6: Corrective powers include Article 70 para. 2 measures (prohibit withdrawals/distributions; appoint expert supervisor; prohibit directors), administrative penalties up to EUR 60,000 (Article 96), and license revocation as ultima ratio.
  - Noted gaps: only natural persons can be penalized (not CIs); FMA lacks some early intrusive powers and specific resolution-triggering powers.
- Practical statistics:
  - OeNB on-site inspections (Article 70 para. 1 no. 3): 2009: 49; 2010: 39; 2011: 43; 2012: 48.
  - Instances of information sought/documentation inspected in 2012 (Jan.–Oct.): 331.
  - Measures in case of danger to creditors pursuant to Article 70 para. 2 Banking Act (’07–’12 totals): total 4 (year split: 0,0,3,0,1,0).
  - Measures to establish compliance pursuant to Article 70 para. 4 nos. 1–3 Banking Act (’07–’12 totals): total 49 (year split: 4,2,27,3,5,8).
  - Charging of interest pursuant to Article 97 Banking Act (’07–’12 totals): total 224 (year split: 34,46,51,37,32,24).

H3: Principle 2 — Independence, accountability, resourcing and legal protection (Assessment: Largely compliant)
- Governance and independence:
  - Supervisory Board composition involves MoF and OeNB appointments; Executive Board two members appointed by Federal President upon Government proposal; terms five years.
  - Funding: supervised entities mainly fund FMA; Federal Government fixed contribution EUR 3.5 million per year (Article 19 FMABG).
- Resourcing:
  - FTE evolution (selected years):
    - 2002: 136.8
    - 2003: 164.7
    - 2004: 195.1
    - 2005: 196.2
    - 2006: 199.98
    - 2007: 216,65
    - 2008: 219,20
    - 2009: 275,25
    - 2010: 282,25
    - 2011: 308,38
    - 2012: 326,85
- Legal protection and weaknesses:
  - Insurance arrangements: liability insurance maximum EUR 7.5 million yearly; defense/recovery insurance maximum EUR 225,000 yearly.
  - Weaknesses identified by assessors: no cap on liability; no safeguards against self-incrimination when assisting Bundes Finanzprokuratur; potential liability where courts find supervised entities non-compliant.
- Accountability:
  - FMA reports annually to Finance Committee within four months after year-end; annual reports published in German and English.
- Key assessor recommendations: clarify MoF ex ante use of Article 16 para.4; consider staggered Supervisory Board terms; introduce legal obligation to disclose reasons for Executive Board dismissal; enhance legal protections.

H3: Principle 3 — Cooperation and collaboration (Assessment: Compliant)
- Domestic cooperation: codified cooperation between FMA and OeNB (Article 79 Banking Act); FMK established under Article 13 FMABG; SPOC system.
- Foreign cooperation: legal bases Articles 77 and 77a Banking Act and Article 21a FMABG; participation in EBA/ESAs, ESRB, supervisory colleges (7 sessions in 2012 until 30 November 2012).
- Confidentiality limits: inability to exchange confidential information with a limited number of non-EEA supervisors (e.g., Bosnia Herzegovina, Albania, Ukraine, Montenegro, Kosovo, Belarus); FMA may rely on public information or intra-group flows.

H3: Principle 4 — Permissible activities (Assessment: Compliant)
- Definition: Kreditinstitut (CI) defined in Article 1 (1) Banking Act with 23 enumerated banking activities; financial institution defined in Article 1 (2).
- Protected designations: Article 94 Banking Act; FMA enforces against unauthorized use.
- Deposit-taking: requires license (Article 1 (1) no.1, Article 4); unauthorized deposit-taking punishable by fine up to EUR 50,000 (Article 98 (1)).

H3: Principle 5 — Licensing criteria (Assessment: Materially non-compliant)
- Licensing authority: FMA (Article 4 (1), Article 69 (1) Banking Act).
- Minimum initial capital: EUR 5 million (Article 5 para. 1 no. 5 Banking Act); lower minima for certain specialized CIs.
- Fit & proper testing: applied to management board members; supervisory board chairman tested only for CIs with total assets exceeding EUR 750 million (Article 28a para. 3). Assessors recommend extending fit & proper to all supervisory board members and granting FMA power to require changes.
- New entrants: no specific post-licensing hands-on regime; assessors recommend intensified supervision of new entrants.
- Key deficiency: FMA lacks specific legal powers to set its own licensing criteria and has limited fit & proper coverage.

H3: Principle 6 — Transfer of significant ownership (Assessment: Compliant)
- Qualifying participation: 10 percent threshold (Article 2 para.1 no.3 Banking Act).
- Notification/assessment: notifications at 20 percent, 30 percent, 50 percent thresholds (Article 20); FMA assessment period 60 working days (extendable).
- Statistics (2008–2012 approvals/denials/approved under conditions):
  - 2008: 25 approved, 1 denied, 0 approved under conditions
  - 2009: 31 approved, 0 denied, 0 approved under conditions
  - 2010: 13 approved, 0 denied, 0 approved under conditions
  - 2011: 4 approved, 1 denied, 15 approved under conditions
  - 2012 (to Oct.): 5 approved, 1 denied, 1 approved under conditions
- Enforcement for failure to notify (§ 98 Abs. 2 Z 3 Banking Act) case counts:
  - 2009: 3; 2010: 2; 2011: 14; 2012: 4; 2013: 13; cumulative: 36.
- Noted gap: no explicit statutory duty for CIs to notify supervisor “as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder.”

H3: Principle 7 — Major acquisitions (Assessment: Materially non-compliant)
- Prior approval required for qualifying participations in CIs (Articles 20–21 and EKV).
- Identified gaps:
  - No prior approval process for CIs’ investments in non-bank financial institutions outside the EEA or non-bank non-financial institutions inside or outside the EEA.
  - No pre-approval required for greenfield operations when setting up a credit institution in a third country.
- Prudential holding limits in non-banks:
  - Article 29: single participation limit 15% of eligible capital; total participations not exceed 60% of eligible capital; excesses must be covered by own funds.

H3: Principle 8 — Supervisory approach (Assessment: Compliant)
- Risk-based supervision: ABBA-system scoring 1 to 6; SREP and ICAAP frameworks used; uniform risk modules for on-site and off-site.
- On-site planning: joint annual audit plan per Article 70 para. 1b; some smaller banks not inspected within last five years due to resources; recommendation to develop multi-year planning.
- Resolvability/recovery planning:
  - Recovery plans required initially for 3 large groups (Erste, RZB, UniCredit Bank Austria); Bank Reorganisation Act obliges all institutions to draft plans with staggered deadlines:
    - Restructuring plans due: 1st July 2015 (general); 1st July 2014 (institutions with balance sheet total exceeding 30 billion euros and those receiving funds directly from ESFS or ESM).
    - Resolution plans due: 31st December 2015 (general); 31st December 2014 (institutions above).
  - FMA to be given early intervention tools.

H3: Principle 9 — Supervisory techniques and tools (Assessment: Compliant)
- OeNB handles fact-finding; FMA is decision-maker.
- On-site system: BOSS modules; last major update 2012.
- Information systems: central credit register threshold EUR 350,000 for individual borrower reporting (Article 75 Banking Act).
- No specific unit for supervisory approach development or quality control; assessors recommend creation.

H3: Principle 10 — Supervisory reporting and data quality (Assessment: Compliant)
- Reporting frameworks: COREP, FINREP, national reporting; reporting frequency varies (monthly/quarterly/annual).
- Liquidity reporting: weekly reporting for 29 CIs, covering major consolidated groups.
- Data quality: automated validation routines, plausibility checks, Java-based visualization tools, periodic verification.

H3: Principle 11 — Corrective and sanctioning powers (Assessment: Largely compliant)
- Range of measures: Article 70 para. 4 (orders to re-establish lawful conditions), Article 70 para. 2 (temporary measures up to 18 months), administrative fines (post May 1, 2012 increases), extra capital add-on up to 150 percent of minimum capital requirement (Article 70 para. 4a).
- Penalty examples and statistics:
  - Administrative penal proceedings in banking supervision:
    - 2008: 132
    - 2009: 248
    - 2010: 386
    - 2011: 396
    - 2012: 397
  - Administrative penalties by FMA (total FMA figures):
    - 2010: # 542 (banking supervision 327); Amount: EUR 1.4 (mln)
    - 2011: # 492 (banking supervision 307); Amount: EUR 1.2 (mln)
    - 2012: # 375 (banking supervision 210); Amount: EUR 1.3 (mln)
- Limitations noted:
  - EC3: FMA lacks explicit powers to directly order remedial actions on risk management systems or to prohibit/limit specific business activities (reliance on capital add-ons).
  - EC5: Only natural persons currently subject to penalties (legal change expected with CRD IV/CRR as of 1st January 2014).
  - Recommendation: provide FMA powers to apply penalties to legal persons and to directly take measures against persons not fit & proper.

H3: Principle 15–19 and other risk areas (selected findings)
- Risk management (Principle 15): overall assessment Largely compliant; no explicit legal requirement for CRO though planned introduction in 2013; planned mandatory risk committee as supervisory board subcommittee.
- Capital adequacy (Principle 16): Tier 1 capital end June 2012 about 10.5 percent; minimum 8 percent ratio applied >8 percent in 6 out of 677 banks on consolidated basis covering 56 percent of consolidated assets end 2012; additional Basel III capital needed estimated EUR 8 billion to EUR 13 billion (composition of EUR 13 billion: EUR 4 billion CET1; EUR 4 billion additional Tier 1; maximum EUR 5 billion Tier 2).
- Credit risk and problem assets (Principles 17–18): SREP/JRAD, Annex to the Audit Report, and CCR used; reporting threshold EUR 350,000; consolidated NPLs over 9 percent; domestic NPLs approx. 4.6 percent (June 2012); CESEE NPLs about 15.8 percent (mid-2012); FX loan NPLs 19.7 percent (CESEE, mid-2012).
- Concentration limits (Principle 19): large exposure defined as ≥10 percent of capital; limit for single private counterparty or connected group 25 percent of capital; monthly reporting to OeNB.
- Related-party transactions (Principle 20): Materially non-compliant — key deficiencies include no explicit arm’s length requirement, no routine specific listing of related-party lending to supervisor, no explicit prior board approval requirement for write-offs over thresholds.
- Market, interest rate and liquidity risk (Principles 22–24): market risk and interest rate risk frameworks codified; prescribed standard interest rate shock: 200 bps; liquidity ratios under Article 25: first degree liquidity > 1.0 percent; second degree liquidity > 20 percent; weekly liquidity reporting covers approx. 30 banks representing >80 percent of consolidated assets.
- Operational risk and internal controls (Principles 25–26): operational risk approaches BIA/STA/AMA permitted; AMA/STA cover approximately 70 percent of total capital requirements as of June 2012; FMA Minimum Standards for Internal Auditing in place; compliance function requirement narrow (MiFID-related); assessors recommend broader compliance function requirement.

### KEY STATISTICS (selected, preserved)
- Consolidated banking sector total assets: EUR 1,189 billion (June 2012).
- Banking sector size: nearly 400 percent of GDP.
- Nonbank intermediation: less than EUR 240 billion (end-2011).
- Registered CIs: 822 (mid-2012).
- Public ownership share: more than 10 percent of total unconsolidated assets (June 2012).
- Foreign-owned CIs share: over 20 percent of total assets (June 2012).
- Estimated additional capital for Basel III: EUR 8–13 billion.
- Consolidated NPL ratio: 9.1 percent (mid-2012).
- Unconsolidated domestic NPL ratio: approximately 4.6 percent (June 2012).
- CESEE subsidiaries NPL ratio: 15.8 percent (mid-2012).
- FX loan NPL ratio (CESEE): 19.7 percent (mid-2012).
- Deposit growth in Austria: 5.3 percent (2012).
- Minimum initial capital for license: EUR 5 million (Article 5 para. 1 no. 5 Banking Act).
- CCR reporting threshold: loans above EUR 350,000 (Article 75 Banking Act).
- FMA annual fixed government contribution: EUR 3.5 million per year (Article 19 FMABG).
- FMA FTEs (selected): 2002: 136.8; 2012: 326,85.

### RECOMMENDED ACTIONS (ASSESSORS’ SUMMARY)
- Independence and governance:
  - Clarify ex ante criteria for MoF use of Article 16 para.4; consider restricting MoF oversight powers and frequency of information requests.
  - Discontinue industry presence on Supervisory Board or create separate industry forum; consider staggered Supervisory Board terms.
  - Provide internal audit direct access to Supervisory Board.
  - Introduce legal obligation to publicly disclose reasons for Executive Board dismissals.
- Resourcing and supervisory quality:
  - Develop multi-year supervisory/audit planning.
  - Establish a supervisory methodology development and quality control unit/function.
- Licensing and fit & proper:
  - Extend fit & proper criteria to all supervisory board members and key senior employees; grant FMA power to require changes in supervisory board composition.
  - Implement a hands-on regime for new entrants (intensified reporting, early on-site work).
- Ownership and acquisitions:
  - Introduce explicit notification duty for material information affecting shareholder suitability.
  - Provide FMA powers to pre-approve investments/acquisitions in non-bank financial and non-financial institutions and require pre-approval for greenfield subsidiaries abroad.
- Corrective powers and sanctions:
  - Provide FMA explicit powers to directly order remediation of risk management deficiencies, to prohibit/limit business activities or exposures, and to impose penalties on legal persons (CIs) as well as natural persons.
  - Grant FMA powers to take direct measures against unfit persons (direct relief/removal).
- Related-party lending:
  - Re-examine related-party regulation; consider introducing more restrictive limits and require routine listings to FMA.
- Internal controls, compliance and auditors:
  - Introduce explicit requirement for a business-wide compliance function.
  - Consider lowering audit committee threshold from EUR 1 billion to EUR 500 million (suggested).
  - Consider granting FMA power to access external auditors’ working papers where necessary.
- Recovery/resolution:
  - Ensure FMA has clear legal framework and powers for recovery/resolution, timely intervention, and assessment of bank resolvability (Bank Reorganisation Act timelines and early intervention tools noted).

---

*Source: _cr1413 - INTRODUCTION (IMF assessment document).*

### INTRODUCTION __________________________________________________________________________________  4

### INTRODUCTION

### Mission and scope
- Assessment completed as part of the Financial Sector Assessment Program (FSAP) by the International Monetary Fund (IMF).
- Review covers legal framework and detailed examination of policies and practices of institutions responsible for banking supervision.
- Assessment periods: February 18–25 and April 3–18 April, 2013.
- Assessors: Arnoud Vossen (Central Bank of the Netherlands), Michael Deasy (Consultant) and Diane Marie Mendoza (IMF).

### Grading approach
- Grading for each Principle is based on the essential criteria (EC). Additional criteria are commented upon but are not reflected in the grading.
- Assessment grades: compliant; largely compliant; materially noncompliant; noncompliant; not applicable.
- Definitions:
  - Compliant: all essential criteria applicable for this country are met without any significant deficiencies.
  - Largely compliant: only minor shortcomings that do not raise concerns about achieving full compliance within a prescribed period.
  - Materially non-compliant: severe shortcomings despite formal rules; practical implementation weak; supervision ineffective.
  - Non-compliant: no substantive implementation; several essential criteria not complied with; supervision manifestly ineffective.
  - Not applicable: Principle does not apply given structural, legal, and institutional features of the country.

### Assessment options
- Compliance assessed and graded only with reference to the essential criteria unless the country opts otherwise.
- A country may volunteer to be assessed against additional criteria for commentary but grading remains with reference to essential criteria.

### Institutional glossary (selected entries from source)
- AML/CFT: Anti-Money Laundering/Combating the Financing of Terrorism
- BCP: Basel Core Principles
- FMA: Financial Market Authority
- OeNB/ONB: Austrian Central Bank
- CI: Credit Institution
- NPL: Non-Performing Loans
- SREP: Supervisory Review and Evaluation Process

---

### INSTITUTIONAL AND MARKET STRUCTURE—OVERVIEW

### Supervisory architecture
- Dual supervisory system: responsibilities shared by the Financial Market Authority (FMA) and the Central Bank of Austria (OeNB) for the banking sector.
- FMA is Austria’s independent, integrated financial supervisory authority; solely responsible for insurance and securities markets supervision.
- Federal Ministry of Finance (BMF) develops and defines the legislative framework adopted by the Austrian parliament.
- Relevant laws include: Financial Market Authority Act, National Bank Act, Banking Act, Insurance Supervision Act, Pension Funds Act, Stock Exchange Act, Investment Fund Act, Provision of Payment Act and Capital Market Act.

### Division of responsibilities between FMA and OeNB
- FMA: issues rulings, considers legal questions, supervises all significant providers of financial services and functions (CIs, financial institutions, insurance undertakings, pension companies, corporate provision funds, investment firms and service providers, investment funds, financial conglomerates, stock exchanges).
- OeNB: executes all on-site inspections on the basis of inspection orders issued by the FMA; can request audits or expansion of inspection orders; responsible for off-site analysis using CI reporting; solely responsible for oversight of payment systems.
- A single database is used to share supervisory-related data held by both institutions.
- Financial Market Committee (FMK) strengthens cooperation and clarifies division of responsibilities between FMA and OeNB.

### Market structure and scale
- Banking sector dominates financial intermediation: CIs cover approximately 80 percent of financial market intermediation.
- Consolidated total assets of the Austrian banking sector: EUR 1,189 billion (June 2012).
- Size relative to GDP: nearly 400 percent of GDP.
- Nonbank financial intermediation (insurance companies, pension funds, etc.): less than EUR 240 billion (end-2011).
- Four financial conglomerates subject to declaration in Austria (mid-2012), mainly dominated by CIs.
- Number of registered CIs: 822 (mid-2012), largely due to decentralized sectors (local cooperative banks).

### Ownership, capital and profitability
- Public ownership increased to more than 10 percent of total unconsolidated assets (June 2012) following nationalizations during the financial crisis.
- Foreign-owned CIs represented over 20 percent of total assets (June 2012).
- Austrian CIs expanded activities in Central Eastern and South Eastern Europe (CESEE).
- Authorities’ estimate for additional capital required in relation to Basel III: EUR 8–13 billion.
- Bank profits affected by low net interest income and higher provisioning; CESEE business supports overall profitability.

### Asset quality and funding
- Consolidated non-performing loans (NPL) ratio: 9.1 percent (mid-2012).
- Unconsolidated NPL ratio (domestic business in Austria): approximately 4.6 percent (June 2012).
- NPL ratio of Austrian subsidiaries in CESEE: 15.8 percent (mid-2012).
- NPL ratio for foreign-currency loans: 19.7 percent (CESEE, mid-2012 reference).
- Retail and corporate deposits are major funding sources.
- Deposit growth in Austria: 5.3 percent (2012).

---

### PRECONDITIONS FOR EFFECTIVE BANKING SUPERVISION

### Economic and legal environment
- Sustainability of public finances and growth-promoting policy mix contributed to generally healthy banking industry.
- High share of rented accommodation in housing market reduces price volatility.
- Highly developed system of business laws: corporate, bankruptcy, contract, consumer protection, private property laws; legal and accounting regime consistent with a developed economy.

### Financial stability and macroprudential framework
- OeNB’s Financial Markets Analysis and Surveillance Division (within Financial Stability and Bank Inspections Department) responsible for identifying, monitoring and assessing systemic risk, including stress testing.
- FMA and OeNB participate in European System of Financial Supervision bodies.
- Tasks, objectives and responsibilities for macroprudential supervision are still under discussion in legislation, taking into account the ESRB Recommendation of December 22, 2011.
- In practice, both FMA and OeNB undertake macroprudential activities focused on systemic risk monitoring.

### Payment systems oversight
- OeNB oversees the functioning of payment systems.

### Recovery, resolution and deposit insurance
- In anticipation of EU adoption of the Commission’s proposals for recovery and resolution, Austria started discussion on national measures and instruments on early intervention and bank resolution.
- As of 1st January 2014, legislation will come into force requiring credit institutions to set up recovery and resolution plans and providing the FMA with a set of early intervention tools.
- Deposit guarantee scheme mirrors sectoral structure: each of five banking sectors operates a separate scheme; each deposit/group of related deposits guaranteed up to EUR 100,000.

---

### POLICY RESPONSES TO THE FINANCIAL CRISIS (SELECTED MEASURES)

### Support measures and guarantees
- October 2008 “Austrian banking package” main components:
  - “Financial Market Stabilization Act”: envelope of EUR 15 billion for bank recapitalization measures.
  - “Interbank Market Reinforcement Act”: initially providing up to EUR 75 billion for bank funding guarantees and establishing the “Clearing Bank for Interbank Operations” (vested with a federal guarantee).
  - Introduction of an unlimited deposit insurance for non-legal entities until end-2009 (overall envelope of EUR 10 billion).
- A special federal holding entity was created to monitor government participations and support conditions.
- As of 2013, the only legal basis for bank crisis support still in place is the “Financial Market Stabilization Act”, whose overall envelope is almost used up.
- Note: The “Interbank Market Reinforcement Act” expired at end-2010. Guarantees extended on this basis fell from an end-year peak of 22 billion in 2010 to below 10 billion at end-March 2012 and will expire completely in 2014. The “Clearing Bank for Interbank-Operations” stopped new business at end-2010 and its activities ran off shortly thereafter.

### Foreign currency and liquidity risk management
- Measures introduced, most recently in early 2013, to contain foreign currency lending (FCL) domestically and in CESEE/CIS.
- New reporting system by OeNB (late 2008) to monitor individual banks’ liquidity and funding risk; aimed at encouraging better foreign currency risk management practices (lengthened funding maturities, counterparty and instrument diversification, increased liquidity buffers).

### Supervisory reforms and cross-border cooperation
- Early 2012 supervisory guidance for three largest internationally-active Austrian banks:
  - Requires early implementation of Basel III capital requirements.
  - Requires submission of group recovery and resolution plans.
  - Encourages stable local funding for foreign subsidiaries.
- Strengthened cooperation between FMA and OeNB via clearer division of responsibilities and the Financial Market Committee (FMK).
- Active participation in the Vienna Initiative to coordinate sales of bank assets, accelerate NPL resolution in host countries, create new lending capacity, and enhance home-host information sharing.

---

### DETAILED ASSESSMENT FRAMEWORK

- Assessment of compliance will use the four-grade scale: compliant; largely compliant; materially noncompliant; noncompliant. A “not applicable” grading can be used under certain circumstances.
- Self-assessments may be informative but assessors will make independent judgments.
- For the purpose of grading, references to “essential criteria” include additional criteria if the country volunteered to be assessed and graded against them.

*Source: _cr1413 - INTRODUCTION (IMF assessment document).*

### 28.      The detailed Principle-by-Principle self-assessment should provide a “description” of

### _cr1413 - 28.      The detailed Principle-by-Principle self-assessment should provide a “description” of

### Template guidance for Principle-by-Principle self-assessment
- The template must include:
  - a “description” of the system with regard to a particular Principle;
  - spaces for a grading or “assessment” (optional for the country);
  - a “comments” section (optional if country includes a grade).
- The “description” should:
  - cite and summarize the main elements of the relevant laws and regulations and provide means to locate them (URLs, official gazettes, etc.);
  - be structured, insofar as possible and relevant, around: (1) banking laws and supporting regulations; (2) prudential regulations, including prudential reports and public disclosure; (3) supervisory tools and instruments; (4) institutional capacity of the supervisory authority; and (5) evidence of implementation and/or enforcement or the lack of it.
- The “assessment” section (if included) should contain only one line: “compliant”, “largely compliant”, “materially non-compliant”, “non-compliant” or “not applicable”.
- The “comments” section is for assessors to explain gradings, structured as: (i) reasons related to laws/regulations and implementation; (ii) state of supervisory tools/instruments; (iii) quality of practical implementation; (iv) institutional capacity of the supervisory authority; (v) enforcement practices. For less-than-“compliant” gradings, highlight measures needed to achieve full compliance or reasons for lower grading despite apparently adequate laws.

### A. Supervisory Powers, Responsibilities and Functions — Principle 1 (Responsibilities, objectives and powers)
- Legal framework and institutions:
  - Financial Market Authority (FMA) established under Article 1 para. 1 FMABG; autonomous, “In performing its duties, it shall not be bound by any instructions.” FMA operating since April 1, 2002.
  - Banking Act (Bankwesengesetz—BWG, Federal Law Gazette No. 532/1993, Article I) and multiple sectoral statutes define the FMA’s remit and the scope of “banking supervision” (Article 2 para. 1 FMABG lists numerous laws).
  - Two-thirds majority in the Austrian Parliament required to amend Article 1 para. 1 FMABG.
  - OeNB (Austrian central bank) responsibilities defined in National Bank Act (NBG) and Banking Act (notably Article 79 Banking Act, effective 1-1-2010); OeNB “shall not be bound by any instructions” (Article 79 para. 5 Banking Act).
  - MoF organized under Federal Ministries Act 1986 (BMG); charged with drafting legislation in banking supervision.
- Division of responsibilities after supervisory reform (effective 1 January 2008):
  - FMA: integrated financial supervisor and decision-making authority for official decisions.
  - OeNB: conducts all on-site inspections (except KAGs, BVKs, and AML/CFT—special FMA unit), performs all off-site analyses of credit institutions (CIs), prepares expert opinions for model approvals, assesses viability of business models, and is consulted before mergers/splits approvals.
  - Joint database and single point of contact (SPOC) for each CI in FMA and OeNB to ensure high flow of information.
  - OeNB’s financial stability mandate explicitly in Article 44b NBG (monitoring circumstances affecting financial stability and informing BMF and FMA).
- Findings and practice:
  - Reform improved links between micro- and macroprudential supervision; day-to-day supervision experienced as a single integrated process by CIs.
  - ESRB Recommendation (22 December 2011; published 16 January 2012) on national macroprudential mandates under discussion in Austria; in practice both FMA and OeNB undertake systemic risk monitoring.
- Essential Criteria (selected):
  - EC1: Responsibilities/objectives clearly defined in legislation and publicly disclosed. Description cites Article 1 FMABG and lists statutes that confer FMA powers. Finding: FMA is the only competent authority for regulatory supervision; tasks conferred only by federal laws (Article 18 B-VG).  
  - EC2: Primary objective is to promote safety and soundness of banks. FMA’s objectives (Article 69 Banking Act) include monitoring compliance and “must consider the national economic interest in maintaining an efficient banking system and financial market stability.” Finding: assessors saw potential risk that “national economic interest” could conflict with primary objective, but no practical instances identified.
  - EC3: Laws provide framework for supervisor to set/enforce minimum prudential standards and to increase requirements based on risk profile and systemic importance. Listing of Banking Act provisions with detailed capital, credit risk, operational risk, trading book, liquidity (Article 25 Banking Act), disclosure (Articles 26 and 26a), large exposures (Article 27), related-party transactions (Article 28), holdings limits (Article 29), group provisions (Article 30), supervisory measures (Article 70), reporting duties (Article 74), and more. Finding: FMA has powers to increase prudential requirements (e.g., capital add-on up to 150 percent of minimum capital requirement—see EC6 discussion), especially used in practice for capital increases.
  - EC4: Laws/regulations updated as necessary; EU directives drive many changes. Finding: FMA issues regulations when authorized; consent of MoF sometimes required; consultation processes in place.
  - EC5: FMA has full access to CIs’ boards, management, staff and records (Article 70 para. 1 Banking Act); OeNB conducts on-site inspections under FMA mandate; OeNB may conduct on-site inspections abroad in subsidiaries/branches on FMA request. Data: 331 instances of information sought/documentation inspected in 2012 (Jan.–Oct.); OeNB on-site inspections pursuant to Article 70 para. 1 no. 3 Banking Act: 2009: 49; 2010: 39; 2011: 43; 2012: 48.
- EC6 (timely corrective action, sanctions, license revocation, resolution):
  - Powers (Article 70 para. 4 Banking Act): instruct CI to restore legal compliance under threat of penalty; repeated violations can lead to prohibition of directors from managing the CI; ultima ratio: revoke banking license.
  - Administrative penalties: up to EUR 60,000 (Article 96 Banking Act); fines for various administrative offences up to EUR 30,000 (Article 98 para. 1).
  - Corrective instruments (Article 70 para. 2): prohibit withdrawals/distributions; appoint an expert supervisor; prohibit directors from managing; prohibit continuation of business operations. Administrative rulings effective up to 18 months.
  - Additional powers: impose a minimum capital requirement higher than normal (Article 70 para. 4a)—extra capital add-on can be up to 150 percent of the minimum capital requirement.
  - Limits/gaps identified by assessors:
    - Only natural persons can be penalized for administrative and criminal offences (not CIs themselves).
    - FMA lacks powers for certain early intrusive interventions (e.g., prohibiting or limiting specific business activities or exposures directly, beyond capital add-ons).
    - FMA lacks specific resolution-triggering powers and no tailored cooperation powers for orderly resolution (see CP 11 EC7 cross-reference).
  - Practical application examples:
    - One administrative ruling under Article 70 para. 2 in 2011 where CI was in danger of fulfilling obligations to creditors.
    - One license revoked in 2012 (Article 6 para. 2 no. 3 in conjunction with Article 70 para. 4 Banking Act).
    - Five orders in 2011 to CI to establish compliance under threat of coercive penalty.
    - No measures under Articles 81 to 91 (receivership/insolvency) had been necessary since FMA establishment.
  - Official measures statistics (2007–2012):
    - Measures in case of danger to creditors pursuant to Article 70 para. 2 Banking Act: total 4 (’07–’12 split: 0,0,3,0,1,0).
    - Measures to establish compliance pursuant to Article 70 para. 4 nos. 1–3 Banking Act: total 49 (’07–’12 split: 4,2,27,3,5,8).
    - Charging of interest pursuant to Article 97 Banking Act: total 224 (’07–’12 split: 34,46,51,37,32,24).
- EC7: Supervisor has power to review parent companies and affiliated companies’ activities on safety/soundness and can apply consolidated supervision (Articles 30 and 30a Banking Act). FMA organizes supervisory colleges for cross-border groups (7 supervisory college sessions in 2012 until 30 November 2012).

- Principle 1 assessment: Compliant.
  - Comments highlighted:
    - EC2: potential tension due to FMA’s mandate to consider national economic interest.
    - EC6: assessors view several powers lacking for timely corrective action, sanctions to CIs, direct action against directors, and triggering resolution (further considered under CP 11).

### Principle 2 Independence, accountability, resourcing and legal protection for supervisors
- Operational independence and governance:
  - Article 1 para. 1 FMABG: FMA “shall not be bound by any instructions.”
  - Supervisory Board composition: chairperson, deputy chairperson, four additional members and two co-opted members. Chair, deputy and additional voting members appointed by the Federal Minister of Finance; OeNB names deputy chairperson and two additional voting members; Supervisory Board co-opts two members named by Austrian Federal Economic Chamber without voting rights.
  - Current Supervisory Board (delegations listed in source). Voting membership composition implies 50% from MoF and 50% from OeNB; MoF supplies chair, OeNB vice chair.
  - Supervisory Board tasks: organizational/business oversight (confirm annual accounts, yearly finance plan, investment plan, HR plan, confirm new investments exceeding EUR 75.000).
  - Executive Board: two members, appointed by Federal President upon Federal Government proposal; term of office five years (Articles 5 and 7 FMABG). Appointment process: call for job tenders, Staffing Act 1998 applied.
  - Article 16 FMABG: oversight by Federal Minister of Finance (MoF) to ensure legal compliance; Article 16 para.4 allows MoF to commission FMA on on-site inspections (used once in 2006).
  - Funding: Article 19 FMABG—FMA mainly funded by supervised entities; Federal Government contributes a fixed amount of EUR 3.5 million per year.
- Accountability and internal control:
  - FMA reports annually to Finance Committee of National Assembly within four months after end of each calendar year (Article 16 para. 3 FMABG); annual reports published in German and English.
  - Internal Audit division (S2/Internal Audit) directly subordinated to the Executive Board; Internal Auditor in place since 1 March 2004; reports regularly to Supervisory Board. Recommendations to ensure Internal Audit direct access to Supervisory Board were made.
  - Audits by Austrian Court of Audit and potential extraordinary parliamentary investigations possible (parlamentarischer Untersuchungsausschuss—UA).
- Conflicts of interest, integrity and staff professionalism:
  - Compliance Code required for all employees, published on FMA website; Compliance Officer subordinate to Executive Board.
  - Staff recruitment and integrity checks: extract from register of convictions (“Strafregisterauszug”) required.
- Resourcing and staffing:
  - Staffing authority: Executive Board authorized to hire personnel (Article 14 para. 1 FMABG); financial and staff plan required annually (Article 17 para. 1 FMABG).
  - FTE evolution:
    - 2002: 136.8
    - 2003: 164.7
    - 2004: 195.1
    - 2005: 196.2
    - 2006: 199.98
    - 2007: 216,65
    - 2008: 219,20
    - 2009: 275,25
    - 2010: 282,25
    - 2011: 308,38
    - 2012: 326,85
  - New FMA Salary Scheme (2009): four salary levels (A, B, C, D), market value allowance, management and professional career paths, performance-linked progress, aim to attract/retain qualified staff.
  - Training and career development pillars:
    - University Programme in Financial Market Supervision (with OeNB), Management Curriculum, FMA Academy, international seminars and third-party seminars.
  - IT and supervisory tools: modern hardware/software, central credit register, joint database with OeNB; state-of-the-art infrastructure claimed.
- Protections and legal liability:
  - Public liability framework based on Article 23 B-VG and liability statutes; Article 3 FMABG explicitly governs liability. Federal Government liable under AHG for damage caused by FMA bodies/employees enforcing specified federal acts; FMA and its employees not liable towards injured party (Article 3 para. 1 FMABG).
  - Insurance arrangements:
    - Liability insurance (Haftpflichtversicherung) covering FMA, Executive Board, staff and bodies; insured amount maximum EUR 7.5 million yearly; excludes knowing violations of law where final judgment exists.
    - Defense and recovery insurance (Rechtsschutzversicherung) maximum EUR 225,000 yearly; covers legal defense costs; excludes final condemnations for intentional crime.
  - Legal weaknesses identified (assessors):
    - no cap on liability of FMA/OeNB bodies and staff;
    - no safeguards to protect FMA/OeNB bodies and staff against self-incrimination while assisting Bundes Finanzprokuratur;
    - FMA/OeNB bodies and staff held liable in cases where courts have found supervised institutions or managers non-compliant.
  - Recommendation to remedy those weaknesses, particularly if FMA is to receive resolution powers.
- Assessments of Essential Criteria (selected)
  - EC1: Operational independence, accountability and governance prescribed in legislation and publicly disclosed; assessors noted potential independence risks:
    - industry representatives on Supervisory Board (non-voting) but present;
    - Supervisory Board confirms second-level staff appointments;
    - synchronized Supervisory Board terms may align with political cycle;
    - MoF’s right to commission inspections (Article 16 para.4) could influence priorities (used once in 2006);
    - FMA must obtain MoF consent for some regulations (MoF review may assess mandate conformity);
    - MoF entitlement to receive information from FMA could be excessive if frequent.
    - recommendation: clarify ex ante criteria for MoF use of Article 16 para.4; consider separate industry forum (not Supervisory Board); clarify that consideration of national economic interest must never impede supervisory considerations.
  - EC2: Appointment/removal of Executive Board transparent; five-year terms; dismissal reasons listed; no legal obligation to publicly disclose reasons for dismissal—assessors recommend introducing such legal obligation.
  - EC6/EC7/EC8 (resourcing and HR planning): generally adequate resources and structured HR planning; training budgets and programmes in place; FMA and OeNB undertake multi-year planning; assessors recommend a function for supervisory approach development and quality control.
  - EC9 (legal protection): current insurance and liability framework provides some protection but weaknesses remain (see above).
- Principle 2 overall assessment: Largely compliant.
  - Comments summarizing main concerns: operational independence risks (Supervisory Board composition/role, MoF powers, national economic interest clause), lack of legal obligation to disclose dismissal reasons for Executive Board, legal protection/liability weaknesses.

### Principle 3 Cooperation and collaboration
- Domestic cooperation:
  - Cooperation between FMA and OeNB structured and codified (Article 79 Banking Act); joint database, mandate mechanisms, reliance on OeNB analyses in FMA decisions.
  - Internal cross-sector collaboration within FMA in place; Financial Markets Committee (FMK) established under Article 13 FMABG at BMF to foster cooperation among FMA, OeNB and BMF, meet at least quarterly, includes contingency planning and coordination roles in crises (Cross-border Stability Group—CBSG).
- Foreign cooperation:
  - Legal bases: Articles 77 and 77a Banking Act for information sharing; Article 21a FMABG for cooperation within ESFS and with EBA/ESAs.
  - FMA participates in multilateral and bilateral cooperation: EBA/ESAs, ESRB, Group of Banking Supervisors from Central and Eastern European Countries (BSCEE), ICBS, bilateral MoUs with many countries (list provided in source), active engagement with CESEE region via colleges and Article 131 CRD Agreements (college/college agreements).
  - Practical arrangements: supervisory colleges; supervisory college sessions (7 in 2012 until 30 November 2012).
- Confidentiality safeguards:
  - Banking secrecy: Article 38 Banking Act; Article 14 para. 2 FMABG extends to FMA staff; Article 45 NBG applies to OeNB staff.
  - Cross-border exchange permitted with EEA authorities and third countries where confidentiality/professional secrecy is equivalent (equivalence assessments by EBA).
  - Practically, FMA cannot exchange confidential supervisory information with a limited number of non-EEA supervisors where safeguards are absent (e.g., Bosnia Herzegovina, Republic Srpska, Albania, Ukraine, Montenegro, Kosovo, Belarus). In such cases, only publicly available information is exchanged; FMA may rely on intra-group information flows where feasible or take measures (including ordering closure of operations) if consolidated supervision is not feasible.
  - Article 77 para. 5 Banking Act: FMA will disclose information received from a competent authority only with prior consent of that authority.
  - Exceptions to secrecy: obligations to report suspected criminal offenses, AML suspicions to FIU, reporting to public prosecutors where criminal prosecution required.
- Resolution cooperation:
  - No specific resolution authority exists in Austria at the time of this assessment; no specific processes exist for the supervisor to support a resolution authority.
- Principle 3 assessment: Compliant.
  - Comment: effective frameworks exist; limited number of non-EEA home-host confidentiality arrangements absent, constraining exchange of confidential information in specific jurisdictions.

### Principle 4 Permissible activities
- Definitions and permissible activities:
  - Term used: Kreditinstitut (CI) aligning with EU definition. Article 1 (1) Banking Act defines CI and enumerates 23 banking activities (acceptance of funds, current account business, lending, custody, FX, mortgage bonds, covered bank bonds, building savings, investment fund management, e-money, etc.).
  - Article 1 (2) Banking Act defines “financial institution” for related activities (leasing, advisory on capital structure, credit reporting services, safe deposit services).
  - Banking Act distinguishes branches, representative offices, foreign CIs, non-banks, etc. (Article 2 definitions).
- Control of “bank” and related designations:
  - Article 94 Banking Act: protected designations (e.g., "Bank", "Kreditinstitut", "Sparkasse", "Volksbank", "Raiffeisen") limited to authorized/supervised institutions; misuse addressed by FMA’s Division of Combat against Unauthorized Business.
  - Commercial Register entry safeguard: name containing protected designation requires original/certified FMA administrative ruling.
- Deposit-taking:
  - Acceptance of funds from other parties is a banking activity requiring a license (Article 1 (1) no.1, Article 4). Acceptance of funds from professional parties also requires license.
  - Unauthorized deposit-taking punished by fine up to EUR 50,000 (Article 98 (1) Banking Act) or criminal prosecution where applicable.
  - FMA obligated to inform public about unauthorized institutions (Article 4 (7) Banking Act).
  - FMA had about 150 proceedings outstanding under Article 98 (1) at assessment time, mostly unauthorized deposit-taking.
- Public list of licensed banks:
  - FMA compiles database of licenses and enables queries via website (Article 4 (8) Banking Act). Database online since 2004.
- Principle 4 assessment: Compliant.

### Principle 5 Licensing criteria (selected findings)
- Licensing authority:
  - FMA is licensing and supervisory authority (Article 4 (1) and Article 69 (1) Banking Act; Articles 1–2 FMABG).
- Licensing criteria:
  - Criteria are statutory (Article 5 para. 1 nos. 1–14 Banking Act). Key requirements include legal form, safe articles of association, suitability/reliability of qualifying shareholders, initial capital or endowment at least EUR 5 million freely available in Austria, directors’ fitness/professional qualifications, at least two directors, no main profession outside banking, language and residency requirements for at least one director.
  - Supporting documents required with application: place of establishment, articles of association, business plan with budgets for first three years, amount of initial capital, identity of owners and contribution, names/qualifications of designated directors, identity/address of agents for remittance services (Article 4 para. 3 Banking Act).
  - OeNB consulted for expert analysis under Article 79 para. 4 Banking Act; MoF notified and may raise concerns. For deposit-authorized CIs FMA must consult 5 protection schemes before issuing license (Article 4 para. 6).
  - For non-EEA branches, additional documents required: last three annual financial statements, transactions and locations, initial endowment in euros, decision-making powers of branch, written declaration of no objection from home country supervisor (Article 4 para. 4).
- Fit and proper tests:
  - FMA conducts fit & proper tests for management board members (directors) as defined in Article 2 no.1 and Article 5 para.1 nos. 6–13 Banking Act.
  - Fit & proper testing for supervisory board members is limited: chairman of supervisory board must meet fit & proper requirements only for CIs with total assets exceeding EUR 750 million (Article 28a para. 3 Banking Act).
  - Assessors recommend extending fit & proper requirements to all supervisory board members and providing FMA power to require changes in supervisory board composition; source notes planned legislative changes as of 1 January 2014 and FMA starting fit & proper testing on new supervisory board members from 22 May 2013 in line with EBA Guidelines.
- Minimum initial capital:
  - Minimum initial capital or endowment EUR 5 million (Article 5 para. 1 no. 5 Banking Act). Lower minima for certain specialized CIs (investment fund managers, real estate investment fund managers, etc.).
- Monitoring new entrants:
  - No specific supervisory regime for new entrants beyond standard reporting and inclusion in yearly audit/on-site inspection planning; assessors recommended a more hands-on regime for new entrants (e.g., full-scope on-site in first year, intensified reporting, higher frequency of contacts).
- Principle 5 assessment: Materially non-compliant.
  - Key deficiencies noted:
    - EC2: FMA has no specific powers to set its own licensing criteria (statutory criteria suffice in practice).
    - EC7: Fit & proper testing not applied to all supervisory board members and no explicit legal power to require changes in supervisory board composition; limited fit & proper coverage for senior employees other than directors.

### Principle 6 Transfer of significant ownership
- Definitions and legal framework:
  - “Qualifying participation” = direct/indirect holding representing 10 percent or more of capital or voting rights or enabling significant influence (Article 2 para.1 no.3 Banking Act). “Control” assessed per Article 30 criteria.
  - Notification/approval regime in Articles 20, 20a, 20b Banking Act and FMA Regulation on Owner Control (EKV).
- Notification and assessment:
  - Parties must notify FMA if decision to hold or increase qualifying participation reaches/exceeds 20 percent, 30 percent, 50 percent thresholds or CI becomes subsidiary (Article 20 para.1).
  - FMA assessment period: 60 working days after complete information; can be extended to 80 or 90 working days in specified circumstances (Article 20a).
  - Assessment criteria (Article 20b): reputation of proposed acquirer; reputation/experience of persons who will direct CI’s business; financial soundness; ability of CI to continue complying with prudential requirements (incl. group structure enabling effective supervision); reasonable grounds to suspect money laundering or terrorist financing.
  - EKV details documentation requirements (business plan, strategic objectives, ownership disclosure, economic beneficiaries, acquisition funding, agreements).
- Powers and sanctions:
  - FMA can prohibit proposed acquisition if assessment yields reasonable objections or information incomplete (Article 20a para.2).
  - If acquisition occurs without prior notification/approval, voting rights of the shares are suspended ex lege (Article 20 para.4); FMA must take suitable measures (Article 20 para.5), including requesting court appointment of trustee to exercise voting rights.
  - Statistics (2008–2012): notifications processed and outcomes:
    - Approvals/denials/approved under conditions by year:
      - 2008: 25 approved, 1 denied, 0 approved under conditions
      - 2009: 31 approved, 0 denied, 0 approved under conditions
      - 2010: 13 approved, 0 denied, 0 approved under conditions
      - 2011: 4 approved, 1 denied, 15 approved under conditions
      - 2012 (to Oct.): 5 approved, 1 denied, 1 approved under conditions
  - Actions based on Article 98 para.2 Banking Act (failure to notify acquisitions):
    - § 98 Abs. 2 Z 3 Banking Act actions: 2009: 3; 2010: 2; 2011: 14; 2012: 4; 2013: 13; cumulative: 36.
- Ongoing monitoring and notifications:
  - CIs must notify FMA of acquisitions/disposals of qualifying participations immediately when they become aware and annually provide names/addresses of qualifying participation holders (Article 73 para.1, Article 74 etc., and Article 20 provisions).
  - Assessors note absence of an explicit statutory requirement for CIs to notify supervisor “as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest”; recommended to introduce such explicit notification duty.
- Principle 6 assessment: Compliant.
  - Comment: EC6 gap noted (no explicit CI notification duty for material information affecting suitability of major shareholders).

### Principle 7 Major acquisitions
- Scope of approvals:
  - Prior supervisory approval required for CIs investing in/acquiring shares of CIs in Austria and in EEA/third-country contexts where qualifying participation thresholds are reached (Articles 20–21 and EKV). For acquisitions within the EEA, assessment primarily performed by the host/home Member State under EU framework (Directive 2007/44/EC and 3L3 Guidelines).
  - No cases for mere post-acquisition notification described; prior approval generally required where thresholds met.
- Gaps identified by assessors:
  - No prior approval process for CIs’ investments in non-bank financial institutions outside the EEA or for non-bank non-financial institutions inside or outside the EEA.
  - No prior approval required for greenfield operations when setting up a credit institution in a third country (no pre-approval for greenfield subsidiaries).
  - Recommendation: provide FMA powers to pre-approve investments/acquisitions in non-bank financial institutions and clarify/revise law so greenfield subsidiaries abroad require pre-approval.
- Prudential limits on holdings in non-banks:
  - Article 29 Banking Act: CI must not hold qualifying participation in non-bank undertakings where book value exceeds 15% of CI’s eligible capital; total book value of qualifying participations in other undertakings must not exceed 60% of eligible capital. Excess amounts must be covered by own funds; bank auditor notified of excesses.
- Process and criteria for assessment:
  - For acquisitions, FMA uses EKV checklist and Article 20b assessment criteria (reputation, expertise, financial soundness, group structure enabling supervision, ML/TF risk).
  - Timeframes: acknowledgement within two working days; 60 working days to decide after receipt of complete information; ability to request further information up to 50th working day.
- Practical supervisory remedies:
  - Article 29 enforcement via bank auditor reporting and FMA follow-up under Article 70 para.4.
  - Ex post corrective powers include Article 70 para.2 measures (prohibitions, appointment of supervisors).
- Principle 7 assessment: Materially non-compliant.
  - Comment: EC1 gap—no prior approval for investments in non-bank financial institutions outside the EEA and non-bank non-financial institutions inside/outside EEA; no pre-approval for greenfield operations abroad.

### Principle 8 Supervisory approach (selected highlights)
- Risk-based supervision:
  - Off-site and on-site processes operate continuously. Frequency and intensity of supervision depend on systemic relevance and risk profile.
  - Risk classification tiers: top 8 systemically relevant CIs, next 9–40, and smaller institutions (no specific formalized process to determine systemic relevance; granularity described).
  - Early warning system: ABBA-system scores CIs on scale 1 to 6 to identify riskiest CIs.
  - Uniform risk modules for on-site and off-site examinations covering ICAAP, risk coverage potential, liquidity risk, credit risk, market risk, operational risk, model issues and special topics.
  - ICAAP and SREP frameworks used; EBA guidelines on SREP referenced.
- Supervisory tools and information sources:
  - Regular reporting by CIs (monthly/quarterly/annual); involvement of bank auditors; duties of state commissioners (for CIs > EUR 1 bn total assets—Article 76 Banking Act); ongoing dialogue and management meetings; supervisory colleges and foreign authority coordination.
  - On-site inspections planned annually jointly by FMA and OeNB per Article 70 para.1b; OeNB authorized to perform macroeconomic inspections without FMA engagement under certain conditions.
- Resolvability and recovery planning:
  - Supervisor has recently begun assessments of recovery and resolution plans—initially for 3 large CIs.
  - No dedicated resolution authority or complete resolution toolkit available at time of assessment (see CP 11 cross-reference).
- Quality assurance and methodology development:
  - No dedicated unit identified for further development of supervisory approach or for quality control of supervisory processes; assessors recommended creation of such a function.
- Principle 8 assessment: (assessment text continues in source beyond provided excerpt).
- Selected operational statistics and data points cited earlier:
  - OeNB on-site inspections: 2009: 49; 2010: 39; 2011: 43; 2012: 48.
  - Instances of information sought/documentation inspected in 2012 (Jan.–Oct.): 331.
  - FMA staffing and FTE growth: see FTE time-series under Principle 2.

*Source: IMF assessment text provided in the supplied content unit.*

### Annex to the Audit Report on the Annual Financial Statements (AP-VO)). Special attention

### Annex to the Audit Report on the Annual Financial Statements (AP-VO)). Special attention

### Compliance checks and supervisory scope
- Special attention is given to compliance of the CI with the regulatory provisions: solvency, own funds, consolidated own funds, liquidity, open positions, large exposures, transactions with affiliated parties, participations, and to the directors’ duty of diligence.
- The areas (solvency, own funds, consolidated own funds, liquidity, open positions, large exposures) are also checked off-site on a monthly basis (consolidated and unconsolidated) by validation routines and plausibility checks in the data management system.
- OeNB’s off-site supervision departments analyse reports received on compliance. FMA departments focus on specific areas such as financial conglomerates or customer due diligence.

### Macroprudential integration in risk assessment (EC4)
- Legal and institutional framework:
  - The 2008 reform explicitly regulated the financial stability mandate of the OeNB (Article 44b NBG): OeNB shall monitor “all circumstances that may have an impact on safeguarding financial stability in Austria.”
  - Financial Markets Analysis and Surveillance Division (OeNB) is responsible for identifying, monitoring and assessing systemic risks and drafting policy measures addressing systemic risks.
  - Since 2004, FMA’s "Integrated Financial Markets" Division addresses cross-sectoral issues, supplementary supervision of financial conglomerates, advancement of accounting relevant to supervision, and records economic significance and consequences of risk transfer between financial intermediaries.
- Data and analysis:
  - OeNB has access to data of non-bank financial intermediaries for comprehensive financial stability analyses covering all relevant components and segments of the Austrian financial system.
  - Off-Site Banking Analysis and Strategy Division and Off-Site Banking Analysis Division incorporate macroprudential analyses into CI and banking group assessments.
  - Risk exposures and system-wide developments are monitored using extensive supervisory reporting data.
- Inter-agency information exchange:
  - FMA periodically provides OeNB with data on business situation, financial results and financial assets of insurance companies and pension funds.
  - Semi-annual meetings between supervised institutions and the FMA occur for insurance companies, pension funds and mutual funds; for investment firms, meetings are held annually.
  - Internal FMA colleges established for each conglomerate comprise persons responsible for conglomerate, group and solo supervision.

### Identifying and addressing system-wide risks (EC5)
- Integration of macro- and micro-prudential supervision:
  - Macro- and micro-prudential supervision are closely interconnected; identification of macroprudential risks and relevance for micro-prudential supervision is done via expert teams.
  - OeNB’s macroprudential mandate is currently limited to systemic risk monitoring.
- Tools and outputs:
  - Risk assessment tools: stress tests, early warning indicators, standardized factsheets (e.g., CESEE & CIS exposures, market developments, non-bank financial intermediaries), targeted surveys (repayment vehicle loans, foreign-currency lending in CESEE & CIS), biannual OeNB expert survey (Risk Assessment Process), analysis of regulatory reporting (weekly template on liquidity conditions of major Austrian CIs).
  - Examples of measures addressing financial stability risks: measures on foreign-currency loans (domestically and in CESEE) and the Austrian ‘Sustainability Package’. Current action on these topics relies on moral suasion and publication of risk assessments as there is no fully fledged macroprudential framework at present in Austria.
- Coordination forums and processes:
  - Risk Workshop: brings together micro- and macroprudential supervisors and macro-economic analysts from FMA and OeNB to discuss macro-economic risks for individual CIs and emerging systemic risks; since 2012 includes semi-annual “Risk Assessment Process” results and external views from international institutions and rating agencies.
  - Forum of Heads of Division (Abteilungsleiterforum—ALF) and Coordination Forum of Senior Management (Koordinationsforum—KOFO): assess need to change supervisory planning given new risks.
  - Financial Market Committee (Finanzmarktkomitee—FMK): senior management and board members from FMA, BMF and OeNB discuss need for policy or regulatory action.
  - These forums ensure FMA is regularly and timely informed about OeNB-identified sectoral risks for incorporation into on-site planning.
- Organizational integration:
  - OeNB combines macro- and microprudential functions within the Financial Stability and Banking Inspections Department; weekly senior staff meetings facilitate timely information sharing.
  - High collaboration between Financial Markets Analysis and Surveillance Division and Off-site Banking Analysis Division for Large Banks, including shared analyses and joint policy preparation (e.g., Sustainability Package).

### Resolvability and crisis-management plans (EC6 & EC7)
- Recovery and resolution planning:
  - FMA and OeNB conceived a template for recovery and resolution plans reflecting existing good practices and early indications of the European Commission’s planned framework.
  - Obligation to draw up plans currently exists for 3 large internationally active Austrian banking groups: Erste Bank Group, Raiffeisen Zentralbank, UniCredit Bank Austria (process started December 2011; draft plans provided end 2012 and are being assessed).
- Bank Reorganisation Act and timelines:
  - Austrian Council of Ministers passed a resolution on bank intervention and recovery; public consultation took place early 2013.
  - Bank Reorganisation Act passed by Parliament before the parliamentary summer recess 2013; will enter into force on 1st January 2014.
  - The Act will oblige all institutions to draft recovery and resolution plans assessed by the FMA.
  - Restructuring plans due by 1st July 2015, except:
    - credit institutions with a balance sheet total exceeding 30 billion euros and credit institutions that receive funds directly from the ESFS or the ESM must submit restructuring plans by 1st July 2014.
  - Resolution plans due by 31st December 2015, except:
    - the credit institutions mentioned above must submit resolution plans by 31st December 2014.
  - Obligation subject to the proportionality principle; FMA will be given a set of early intervention tools.
- FMA powers for early intervention and corrective action:
  - Article 70 para. 2 Banking Act: FMA may issue an administrative ruling for a limited period of time (18 month or less) ordering measures such as prohibiting withdrawals of capital, prohibiting directors from managing the CI, or completely or partly prohibiting continuation of business operations.
- Assessors’ view:
  - It is important that FMA can require CIs to set up recovery and resolution plans, assess bank resolvability, and require banks to adopt appropriate measures where barriers to orderly resolution are identified.
  - Legislative changes making recovery and resolution plans compulsory and providing FMA with additional powers are noted positively.

### Supervisory perimeter and unauthorized activity (EC8)
- Assessment of restructurings:
  - Restructurings of existing CIs are intensively assessed by FMA, including whether effective supervision can take place after restructuring; group structures must provide necessary information for effective consolidated supervision or FMA will take appropriate steps.
  - In practice, Austrian CI business models are straightforward and typically fall within the regulatory perimeter; Austria’s banking supervision perimeter is very wide.
- Combatting unauthorized business:
  - Division for Combat against Unauthorized Business (FMA) identifies and deals with undertakings offering financial services without required license.
  - FMA powers: obtain and process data, on-site examination of suspected unauthorized business (Articles 22b, 22c and 22d FMABG), issue procedural orders to restore lawfulness, administrative decisions to restore lawfulness, and as last resort order closure of business parts or entire company; initiate administrative penal proceedings; file report to public prosecution in cases of suspected criminal offence.
  - FMA may inform and warn the public of unlicensed companies providing services requiring a license; measures and sanctions may be made public as an effective prevention tool.
  - Business models or products potentially bypassing legal provisions (e.g., detected via consumer complaint or media) are reviewed thoroughly; legal breaches detected are addressed.

### Assessment of supervisory practice and gaps (Principle 8 comments)
- Assessment of Principle 8: Compliant.
- Noted deficiencies and comments:
  - EC 1: No specific unit or functionary responsible for further development of the supervisory approach and methods; no quality control unit or quality manager for monitoring supervisory processes.
  - EC 6: Obligation to draw up recovery and resolution plans currently exists only for the 3 largest internationally active Austrian banking groups (Erste Bank Group, Raiffeisen Zentralbank, UniCredit Bank Austria), which cover almost half of the total bank assets, as part of the Austrian Sustainability Package. Process started December 2011; draft plans provided end 2012 and are being assessed. Bank Reorganisation Act will extend obligations and provide early intervention tools (see timelines above).

### Supervisory techniques and tools — mix of on-site and off-site (Principle 9, EC1)
- Institutional roles:
  - Since 2008 reform, OeNB acts as fact-finding body (on-site inspection, off-site analysis and reporting, overall economic risk assessment); FMA is the decision-making body (official decisions and administrative procedures).
- OeNB organization and analysis concept:
  - Micro-prudential supervision handled primarily by Off-Site Banking Analysis Division and On-Site Banking Inspections Division.
  - Units organized by banking sectors with distinctions between major CIs, other major and regional CIs, joint stock CIs, cooperative and savings CIs.
  - Analysis concept based on three pillars: economic analysis, continuous model supervision and on-site findings.
- Off-site supervision approach:
  - Economic analysis captures a CI’s economic risk and is subdivided into:
    - automated basic analysis of all banking data (risk-based ABBA-report—Austrian Banking Business Analysis),
    - detailed economic analysis.
  - Two-stage risk-based process for efficiency:
    - Step 1: automated basic analysis for all CIs.
    - Step 2: detailed economic analysis for CIs identified as high-risk in basic analysis and generally all major and joint stock CIs.
  - Detailed economic analysis of major CIs starts from group analysis (consolidated top-down approach).
- On-site and qualitative inputs:
  - Off-site models rely on reported quantitative data; detailed economic analysis uses additional qualitative information including reports by bank auditors, supervisory reports, structured dialogue with CIs, market information, and on-site findings.

_Annex to the Audit Report on the Annual Financial Statements (AP-VO)). Special attention — IMF staff compilation from the source document._

### Annex to the Audit Report (prudential report) and the reports of the state commissioners

### Annex to the Audit Report (prudential report) and the reports of the state commissioners

### On-site and off-site integration, scoring and supervisory process
- Detailed economic analysis relies on expert judgment of a CI’s coverage and risk potential (credit, market, operational and other risks), distinct from the basic model-driven analysis.
- A scoring metric examines specific areas: credit risk, market risk, operational risk, liquidity risk, money laundering; each risk category is scored by off-site or on-site experts using a uniform metric yielding an aggregated and final risk score.
- On-site examinations follow the annual audit plan jointly determined by FMA and OeNB.
- OeNB’s on-site examination standards are implemented as modules in the IT system BOSS; specific modules are updated regularly to reflect legal and international developments (e.g., EBA guidelines). The last major update of all BOSS modules was performed in 2012.
- On-site inspection reports and expert opinions on models must be related to other analysis results and the CI’s comments to evaluate legal violations and the need for official measures (decisions and administrative procedures taken by the FMA).
- Ongoing model supervision covers models subject to pillar I requirements including:
  - Internal Rating Based (IRB) Approach for credit risk,
  - Value at Risk (VaR) model for market risk,
  - Advanced Measurement Approach (AMA) for operational risk.
- Approval and ongoing supervision of internal models are incorporated in the On-Site Banking Inspections Division and involve assessing functionality and adequacy using data reports, CI validation reports, and compliance with approval procedures.
- Supervisory Review and Evaluation Process (SREP): OeNB evaluates risks and risk bearing capacity annually, closely in line with EBA Guideline 39, using a scoring approach with scores from 1 to 4. Detailed off-site analysis and on-site inspections produce assessments in terms of these scores.

### Planning, coordination and single points of contact (SPOC)
- Audit plan is jointly defined by OeNB and FMA (article 70 para. 1b Banking Act) taking into account: audits of systemically relevant CIs, frequency for non-systemic CIs, resources for ad hoc audits, thematic focuses, and follow-up audits.
- No overall multi-year planning process established, although specific multi-year cycles exist for CI’s not examined each year:
  - For smaller banks: a 5 year cycle exists for joint-stock CI’s and a longer cycle for even smaller CI’s (in total 3 will be examined each year).
- Recommendation: develop a multi-year planning process and plan.
- Given the high number of smaller banks, some have not been inspected for the last five years; selection of small institutions for inspection considers representation for groups of similar small institutions.
- OeNB and FMA implemented a single point of contact (SPOC) system for every CI and every banking sector to exchange information frequently and coordinate prudential issues.
- Where necessary, OeNB may request FMA to extend or initiate inspections; FMA must decide on such requests without delay, at the latest, within one week. OeNB may carry out on-site inspections on its own initiative for “macroeconomic reasons” (e.g., systemically relevant CIs).
- For on-site inspections under the audit plan, FMA issues an inspection mandate specifying areas to be inspected; OeNB provides audit reports to both CI and FMA and the CI has the right to comment. FMA is informed immediately via ad hoc report under Article 79 Banking Act of facts triggering immediate official measures.

### Information sources, reporting framework and reliability (EC3 and related)
- OeNB’s ongoing supervision uses:
  - Supervisory statistics,
  - Supervisory reporting requirements, facts in notifications and ad-hoc surveys,
  - Structured dialogue with CIs and auditors,
  - CI disclosure and publicly available data (financial statements, investor presentations, press releases, rating agency reports, external analyst reports).
- Reporting frameworks used: COREP, FINREP, loss data collection, and national reporting schemes on consolidated and unconsolidated levels. Reporting for material foreign subsidiaries on stand-alone basis was added in recent years.
- Articles 44 and 74 Banking Act require extensive monthly, quarterly and annual reports to FMA and OeNB. OeNB renders expert opinions based on monthly and quarterly reports (Article 74 para. 3 Banking Act).
- Data handling: data is checked for consistency, standardized and stored in a database; data management systems perform recording, storing, validating and filtering; validation routines and plausibility checks are in place.
- Reporting timelines: Article 44 para. 1 Banking Act requires audited annual financial statements, annual reports, consolidated financial statements and consolidated annual reports, including the Annex to the Audit Report (prudential report) indicated in Article 63 para. 5 Banking Act, to be submitted to FMA and OeNB at the latest within six months after the close of the business year.
- Bank auditor reports under Article 63 para. 3 Banking Act (ad-hoc reporting obligation) are an important supervisory source; primary responsibility for these reports lies with FMA.
- Central Credit Register (CCR): exposures reported under Article 75 Banking Act; OeNB uses CCR information in overall analysis. Threshold specified: loans above EUR 350,000 are reported on an individual borrower-basis.
- Annual and case-related reports by state commissioners and deputy state commissioners (Article 76 para. 8 Banking Act) and reports of auditing associations and deposit guarantee schemes are additional information sources; these are forwarded to the FMA for evaluation.
- Supervisory powers: FMA can demand ad-hoc information and inspect bookkeeping, documents and data media (Article 70 para. 1 no. 1 Banking Act and Article 73 Banking Act).
- Reliability checks: automated checks, plausibility controls by statistics department and off-site department, comparisons with prior periods or peers, ad-hoc questionnaire checks by supervisory departments. CI internal audit and decentralized bank auditors are required to review accuracy and completeness of notifications and reports.

### Tools and analytical models (EC4)
- IT-assisted systems (e.g., ABBA) filter CIs with increased risk; resources concentrated on riskier CIs for in-depth monitoring.
- Important automated instruments include:
  - A logit model producing probabilities of defined problem events (insolvency, government bail-out, support by owner, establishing a bad bank, and others); model includes indicators from business development, credit risk, capital structure, profitability, market risk, liquidity risk, operational risk.
  - A structural model using systems of VaR models for major risk factors (credit, market, operational) relating to CIs’ capacities to cover losses. Credit risk approach based on CreditRisk+ (Credit Suisse Financial Products, 1997). Market VaR module uses RiskMetrics for interest rate, foreign exchange and equity position risk. Operational VaR model uses a workaround with the Basic Indicator Approach (Basel II) due to lack of operational loss reporting historically.
  - Flagging of CIs via developments in various ratios compared to peer groups to allocate off-site-analysis resources.
- Annual detailed economic expert analysis covers:
  - Analysis of coverage potentials under Pillar I and Pillar II,
  - Business model and strategy,
  - Balance sheet developments,
  - Profitability,
  - Budget planning,
  - Corporate and internal governance,
  - Credit risk (asset quality, concentration risk, structured credit and CDS-exposures),
  - Market risk in trading and banking book,
  - Operational risk,
  - Liquidity risk,
  - Other risk such as money laundering.
- Final outputs: summarizing assessment, assigned scoring, and regulatory actions.
- Peer and sector analyses are performed regularly due to prevalence of savings banks and credit cooperatives; OeNB provides FMA with comprehensive analyses for domestic and international use. Benchmark scoring via scoring workshops is applied.
- Stress test outcomes undertaken by banks are reviewed and fed into CI risk assessments.

### Stress testing and systemic monitoring (EC5)
- OeNB employs three stress testing tools:
  - Systemic Risk Monitor (SRM): model-based, quantitative software for quarterly analysis of systemic stability; used for stress testing market, credit and contagion risk; Monte Carlo simulation environment; results calculated quarterly for a quarterly horizon; outputs include “contagiousness” and “vulnerability” on a bank-by-bank basis for all unconsolidated Austrian banks available via OeNB intranet.
  - Macro stress testing tool: Matlab-based solvency stress testing framework for multi-period point forecasts assessing macro scenarios’ impacts on CIs’ capitalization (ratios). Core scope: credit risk (incl. RWA impact), profitability and balance sheet/P&L simulation. Allows sensitivity analyses (indirect credit risk from FX lending, sovereign exposures, securitization portfolios, market risk, cost of funding shocks linked to liquidity framework). Results for baseline and adverse scenarios for all consolidated Austrian CIs are available biannually on a bank-by-bank basis. Process includes at least three coordination meetings (“stress testing cockpits”) for (senior) managers from OeNB and FMA.
  - Liquidity risk framework: cash-flow based liquidity risk assessment based on weekly liquidity reporting; tests conducted ad-hoc and coordinated with macro stress tests to calculate impacts on funding costs. Results available bank-by-bank for large consolidated Austrian banking groups and communicated immediately via weekly liquidity risk debriefing emails.
- Typical stress testing approach: two stress tests per year:
  - “Joint Bottom-up Exercise”: top CIs perform own calculations using OeNB scenarios and common assumptions.
  - “Constrained Bottom-up Exercise”: CIs receive top-down results with scenarios and assumptions and may run their own checks but are not obliged.
- Stress test results are incorporated into detailed economic CI assessments by off-site experts.

### Internal audit reliance and standards (EC6)
- External bank auditors assess the quality of internal audit annually; this assessment is integrated into the Annex to the Audit Report (prudential report) which is subsequently assessed by the supervisor.
- FMA published Minimum Standards for Internal Auditing of CIs. Evaluation of internal audit work plays an important role during on-site inspections and expert opinion compilations.
- During on-site examinations, internal audit work is used as an input; OeNB assesses adequacy of internal audit at intake and concluding meeting. No special FMA mandate needed to assess internal audit in a risk area.
- Internal audit often involved in follow-up activities to assess whether supervisory findings in one area apply elsewhere within a CI or group.

### Contacts, escalation, communication and follow-up (EC7–EC10)
- Continuous contacts with CI management are maintained under Article 70 para. 1 no. 1 Banking Act.
- Meeting frequency/intensity based on size and systemic risk:
  - Meetings with management board of all major and medium-sized CIs take place at least on an annual basis.
  - Smaller CIs: meetings on a needs-basis; emphasis on bank auditors through 3 sectoral auditor talks per year; agenda includes risk profiles identified by ABBA and auditor concerns.
  - For the largest CIs (top 8), regular meetings at 3 levels:
    - Annual meeting with the (full) management board,
    - Periodic meetings with the CRO (e.g., discussion of JRAD results, updates/follow-ups),
    - Regular meetings with senior and middle management on various issues (ICAAP/Pillar II, ALM, CESEE, liquidity, stress testing, etc.).
- On-site inspection process: preliminary inspection results presented at concluding meeting; final audit report sent to CI for official response; response and on-site reply sent to FMA.
- Types of findings: breach of an Article of the Banking Act or other relevant Act; severe substantive finding; minor finding; recommendation. Round-of-three coordination (OeNB off-site, OeNB on-site, FMA) determines finding type; FMA decides and sends the decision to CI management board; supervisory board informed in case of severe findings; CI comment required for administrative actions.
- Follow-up: FMA may impose follow-up reporting requirements (Article 70 para 1). Measures and their implementation are registered in supervisor’s IT system enabling systemic monitoring. Follow-up meetings with CI senior/middle management are arranged; in severe cases FMA may impose follow-up on-site examination.
- Notification requirements (Article 73 Banking Act) mandate immediate reporting of circumstances endangering CI’s obligations, failures to comply with regulatory standards, insolvency or overindebtedness, opening/relocation/closure/temporary discontinuation of operations, changes in articles of association or resolutions to dissolve. Additional notification requirements under Article 20 (qualifying holdings) and Article 63 para. 3 (bank auditor immediate reporting of material findings). State commissioners must report immediately under Article 76 Banking Act when CI’s ability to meet obligations is no longer ensured.
- In practice, CIs normally inform FMA/OeNB before substantial changes; SPOCs are informed immediately in cases like fraud or system failure. OeNB assesses viability of business models before approvals to merge or split (Article 21 Banking Act).

### Use of third parties and mandates (EC11)
- FMA may engage bank auditors, other auditors, auditing associations and experts to conduct necessary audits for supervision (Article 70 para. 1 no. 2a Banking Act) and may provide information to engaged auditors. In practice, use of such external engagements happens very rarely.
- FMA duties and competencies are detailed in the FMABG.

### Information systems and supervisory IT (EC12)
- Joint information system (BASS) supports micro-prudential supervisory process: stores reporting data, FMA supervisory information, OeNB analysis results; entries signed digitally by competent experts and management; all official follow-up actions documented.
- BASS capabilities include: qualitative analyses, risk assessments, integrated workflow, complete supervisory history, individual analyses, multiple business models, scoring model for risk categories, overview of previous risk scores, granular scoring for systemically important vs other CIs, facilities for global/sector/special analyses, electronic document database, electronic handbooks with internal guidance.
- A separate IT system is used for on-site examinations with comparable facilities but tailored to on-site work.

### Additional criteria, independent review and assessments (AC1)
- Structure and separation of responsibilities and tools are reviewed and revised as part of normal supervisory processes; Austrian Court of Audit periodically examines efficiency and effectiveness.
- No specific framework exists for periodic independent review of supervisory processes undertaken by FMA and OeNB. Authorities might consider implementing such a function.
- Assessment of Principle 9: Compliant.
  - Comments: EC 2 — No overall multi-year planning process established, although specific multi-year cycles exist for CIs not examined each year. AC 1 — No specific framework exists for periodic independent review on supervisory processes undertaken by FMA and OeNB.

*Source: Annex to the Audit Report (prudential report) and the reports of the state commissioners — _cr1413*

### references are indicated for balance sheet and income statement items and comprise

### _cr1413 - references are indicated for balance sheet and income statement items and comprise

### Valuation and accounting treatment
- Local GAAP is mostly used for the Standardized Method.  
- Under Local GAAP, the following asset classes are valued at the lower of amortized cost and market method:
  - Loans
  - Securities with an investment horizon of less than 12 months which are not listed on a public exchange
  - Securities with an investment horizon of more than 12 months
  - Participations
- The following asset classes are valued based upon full fair value method or the lower of amortized cost or market value:
  - Financial instruments held in the trading book
  - Securities listed on a public exchange with an investment horizon of less than 12 months
- Most large CIs make use of internal credit risk and/or VAR models for capital adequacy; these models use market values in calculations and are assessed during on-site examinations. Internal audit may undertake independent verifications of valuations.

### Reporting frequency, scope and comparability (EC4, EC5)
- The supervisor collects and analyses information at a frequency commensurate with the information’s nature and the bank’s risk profile/systemic importance.
- Regular CI reports submitted to FMA and OeNB include standardized prudential and statistical reports, detailed balance sheets, income and risk statements, and detailed on- and off-balance-sheet information.
- Reporting frequencies (consolidated / unconsolidated, as presented):
  - On-balance Sheet: Quarterly / Quarterly
  - Off-balance Sheet: Quarterly / Quarterly
  - Profit and Loss: Quarterly / Quarterly
  - Capital Adequacy (summary info): Monthly / Monthly
  - Capital Adequacy (details): Quarterly / Quarterly
  - Liquidity: 29 CIs: weekly/ monthly / Monthly
  - Large Exposure: Monthly / Monthly
  - Assets Concentrations: quarterly1 / quarterly2
  - Asset Quality: Quarterly / Monthly
  - Loan Loss Provisioning: Quarterly / Quarterly
  - Related Party Transaction: Quarterly / monthly3
  - Interest Rate Risk: Quarterly / Quarterly
  - Market Risks: Quarterly / Quarterly
  - Operational Risk: Annually
  - Payment Institutions: monthly/quarterly/annually
  - Remuneration Policy: Annually
- The reporting scheme is based upon the COREP reporting framework used within the EEA. Only CIs with total assets below EUR 250 million submit less detailed risk information.
- The supervisor collects comparable stock (monthly/quarterly) and flow (quarterly) data on solo and consolidated bases; FMA has online access to data.

### Powers to request information, on-site access and supervisory use of data (EC6, EC7, EC8)
- Legal power: Article 70 para. 1 Banking Act grants the supervisor power to request and receive any relevant information from CIs and related companies at any time, including internal management information and bookkeeping records, documents and data media.
- Ad-hoc requests: CIs may be subject to ad-hoc information requests (examples include additional information for recovery and resolution plans and consumer loans in foreign exchange rates).
- On-site powers:
  - The supervisor can inspect bookkeeping records, documents and data media (Article 70 para. 1).
  - Meetings and direct questioning of senior executives and board members are practiced; for CIs with total assets greater than EUR 1 billion, the supervisor is directly represented in the supervisory board via state commissioners (Article 76 Banking Act).
- Enforcement for timely and accurate submission:
  - Fines up to EUR 60,000 (Article 98 para. 2 Banking Act) for non-compliance with information requirements.
  - Bank auditor (Article 63 para. 5 Banking Act) must review reporting system and report results to FMA.
  - CRO formally signs off prudential returns; during on-site examinations two board members must sign off completeness and correctness of provided documents/data.

### Data quality, validation, external experts and periodic review (EC9, EC10, EC11, EC12)
- Data-quality controls and validation:
  - OeNB implemented in 2006 a comprehensive system for checking data quality, with automatic plausibility parameter adjustments based on historical data and priority grouping of reporting entities (large/medium/small).
  - A Java-based application provides visual presentation of unusual developments in CI data.
  - Periodic verification of supervisory returns is carried out by experienced staff.
- External experts:
  - FMA and OeNB hold regular meetings with auditing associations and bank auditors; other external experts are rarely used.
  - Legal possibilities for external experts:
    - Appointment of an expert supervisor (government commissioner) under Article 70 para. 2 no. 2 Banking Act.
    - Nomination of a bank auditor or another expert to conduct an on-site examination under Article 70 para. 1 no. 2a Banking Act.
  - Use is limited because FMA bears costs for such experts; adequacy assessed case-by-case considering conflicts of interest.
- Auditor reporting obligations:
  - Bank auditors must examine annual and consolidated accounts, report on write-offs/value adjustments/provisions and compliance with Banking Act (Articles 43 to 65 Banking Act), and include results in an Annex to the Audit Report (prudential report).
  - CIs must submit audited annual accounts and related reports no later than six months after financial year-end (Article 44 Banking Act).
  - Article 63 para. 3 Banking Act requires bank auditors to inform supervisor without delay of any material shortcomings identified.
- Periodic review of information collected:
  - OeNB obliged to perform regular comprehensive analyses of data reports and other relevant information to verify they meet supervisory needs.
  - Ad-hoc surveys and additional data requests used when regular reporting lacks granularity (e.g., non-performing loans, liquidity, foreign currency loans).
  - A specific ICAAP questionnaire introduced July 2009 and sent annually; inputs used for Pillar II and JRAD group assessments.

### Assessment of Principle 10
- Overall assessment: Compliant
- Commentary highlights:
  - EC2: In practice most CIs report based on national GAAP; only a few use IAS/IFRS for prudential reports though most large CIs publish IFRS. Basel III implementation in the EEA (expected as of 2014) will require CI’s prudential reporting to align with IFRS where applicable (Article 4 No.53 of proposed CRR reference to ‘applicable accounting framework’).

### Corrective and sanctioning powers (Principle 11: EC1–EC6, EC8 additional criteria)
- Early engagement and remedial action:
  - FMA raises supervisory concerns early via ongoing dialogue, periodic meetings, and on-site inspections; remedial actions required and followed up.
  - Article 70 para. 4 no. 1 Banking Act: FMA must order a CI to reestablish lawful conditions within an appropriate period; administrative rulings can be written or oral (Article 62 para. 1 AVG); CIs must notify the chairman of their supervisory body of such rulings without delay.
  - Progress reporting may be imposed (Article 70 para. 1 no. 1 Banking Act).
- Range of supervisory tools (Article 70 para. 4 and related):
  - FMA may instruct CI to restore legal compliance, impose initial penalties, prohibit directors from managing the CI (repeated/continued violations), and as ultima ratio revoke the banking license.
  - FMA can enforce provisions on solvency (Article 22), consolidated own funds (Articles 23 and 24), liquidity (Article 25), disclosure obligations (Articles 26 and 26a), large exposures (Article 27), related-party transactions (Articles 28 and 29), duty of diligence (Article 39), internal audit provisions (Article 42), accounting and bank auditing (Articles 43 to 65), reporting/notification (Articles 20, 73–75), and duties under Articles 70–71 Banking Act.
- Fines and penalty ranges (post May 1, 2012 doubling of some amounts):
  - Severe breaches relating to anti-money laundering and terrorist financing: From six weeks of imprisonment to EUR 150,000
  - Unlicensed activities: To EUR 100,000
  - Other violations (e.g., reporting) of the Banking Act: To EUR 60,000
- Administrative penal proceedings and penalties statistics:
  - Number of administrative penal proceedings in banking supervision:
    - 2008: 132
    - 2009: 248
    - 2010: 386
    - 2011: 396
    - 2012: 397
  - Number of administrative penalties imposed by FMA (total FMA figures; banking supervision subset shown):
    - 2010: # 542 (of which banking supervision 327); Amount in mln EUR: EUR 1.4
    - 2011: # 492 (of which banking supervision 307); Amount in mln EUR: EUR 1.2
    - 2012: # 375 (of which banking supervision 210); Amount in mln EUR: EUR 1.3
- Additional corrective measures:
  - FMA may prescribe default charges repeatedly until payment (Article 22a FMABG).
  - Where solvency endangered, FMA can stop repayment of hybrid capital, limit variable remuneration, and/or impose using net profits to build capital (Article 70 para. 4c Banking Act).
  - FMA may charge interest as penalty when regulatory requirements are not met (Article 97 para. 1 Banking Act); interest must be remitted to Republic of Austria (Article 97 para. 2).
  - For securitizations, additional risk weights may be imposed (Article 70 para. 4b).
  - FMA can impose restrictions or bans on short selling under Regulation (EU) No 236/2012.
  - Extra capital add-on under Article 70 para. 4a: FMA can impose a minimum capital requirement higher than normal minimum, up to 150% of the minimum capital requirement.
- Limitations and recommendations:
  - EC3: FMA lacks explicit powers to directly order remediation of deficiencies in risk management systems or to directly prohibit/limit specific business activities or exposures when risks build up; instead it relies on capital add-ons. Recommendation: provide FMA such direct intervention powers.
  - EC5: Only natural persons (not legal persons) can be penalized under current regime; recommendation: introduce possibility for FMA to apply penalties to the CI (noted that CRD IV will introduce powers to impose pecuniary administrative sanctions against natural and legal persons for specified infringements).
  - EC5: FMA cannot directly relieve or replace a director or supervisory board chairman—must address the CI to effect removal. Recommendation: introduce power for FMA to take such direct action.

### Resolution, ring-fencing and cooperation in crisis (EC4–EC7 under Principle 11 and Principles 12–13 excerpts)
- Ring-fencing and temporary measures:
  - Article 70 para. 2 Banking Act enables FMA to order temporary measures (max period 18 months) including prohibition of withdrawals/distributions, appointment of an expert supervisor, prohibition of directors from managing, and prohibition of continuation of business operations.
- Receivership and insolvency:
  - Insolvency provisions adapt Austrian Bankruptcy Code (Articles 81 to 91 Banking Act). Over-indebted CI may apply for receivership with court; FMA may also apply. FMA has standing as a party in receivership (Article 82 para. 2). Temporary measures are suspended during receivership (Article 70 para. 5).
  - FMA must revoke license in cases of fraudulently obtained license or failure to fulfill obligations to creditors (Article 6 para. 2 Banking Act).
- Participation, acquisition, and control measures:
  - Notification and approval required for qualifying participations thresholds (10%, 20%, 33%, 50%) with special permit required for acquisitions in third country CIs (Article 21 para. 1 no. 2).
  - If current owners of qualifying participations may exercise influence endangering sound management, FMA shall take measures to avoid or end that situation (Article 20 para. 5).
- Interaction with deposit guarantee schemes and crisis cooperation:
  - Five deposit guarantee schemes exist; deposit guarantee facilities have early-warning and corrective roles (Article 93a paras. 4 and 7 Banking Act).
  - In systemic crises, Federal State will bail out depositors as last resort.
  - Cross-border cooperation: FMA coordinates in colleges of supervisors, has MoUs with 23 countries, and participates in regional Cross Border Stability Group for CESEE; Cross Border Agreement signed January 2012 with Bulgaria, Czech Republic, Hungary, Slovenia and Slovakia.
- Assessment of Principle 11: Largely Compliant
  - Comments reiterate limitations noted (EC3 and EC5) and planned/legal developments (CRD IV, Bank Reorganisation Act).

*Source: _cr1413 - references are indicated for balance sheet and income statement items and comprise*

### 1. Legal Framework

### _cr1413 - 1. Legal Framework

### Legal framework — statutory requirements
- Article 39 para. 1 Banking Act: directors of a CI must exercise the diligence of a prudent and conscientious director as defined in Article 84 para. 1 of the Stock Corporation Act; must obtain information on and control, monitor and limit the risks of banking transactions and banking operations using appropriate strategies and mechanisms; must have in place plans and procedures pursuant to Article 39a (ICAAP); must consider the overall earnings situation of the CI.
- Article 39 para. 2 Banking Act: CIs must have administrative, accounting and control mechanisms for the capture, assessment, management and monitoring of risks arising from banking transactions and banking operations; mechanisms must be appropriate to the type, scope and complexity of the banking transactions conducted; procedures must capture risks stemming from remuneration policies and practices where possible; organizational structure must prevent conflicts of interest and of competences; internal audit must review adequacy and enforcement at least once per year.
- Article 39a Banking Act: CIs must have effective plans and procedures to determine on a regular basis the amount, composition and distribution of capital available for quantitative and qualitative coverage of all material risks and to hold capital in the amount necessary; plans and procedures must be based on the nature, scope and complexity of banking transactions; CIs must review suitability and enforcement at least on an annual basis; superordinate CIs fulfill obligation exclusively on a consolidated basis.
- Article 42 para. 4 nos. 1 to 6: internal audit must review risk management procedures and report to directors and—under certain conditions—to the chairperson of the supervisory board.
- Article 25 Banking Act and the Liquidity Risk Management Regulation (LRMV): liquidity requirements and national implementation of CRD II; Article 25 mandates that CIs must ensure they can honor payment obligations at all times and must:
  - 1. establish company-specific financial and liquidity planning based on banking experience;
  - 2. sufficiently ensure ability to compensate for future imbalances by constantly maintaining sufficient liquid funds;
  - 3. have systems for monitoring and controlling the interest rate risk of all transactions;
  - 4. structure interest rate reset and call privileges according to maturity structure of assets and liabilities to account for potential market changes;
  - 5. have documentation allowing CI’s financial situation to be calculated with reasonable accuracy at all times; documents to be presented to the FMA with appropriate comments on request.
- Article 25 para. 2: FMA shall issue a regulation specifying minimum requirements consistent with Annex V, Numbers 14 to 22 of Directive 2006/48/EC.
- Article 63 paras. 3 and 4 Banking Act: bank auditor must review compliance with Articles 39 and 39a on an annual basis; Article 63 para. 4 in conjunction with the Regulation on the Annex to the Audit Report requires yearly auditor confirmation of compliance with liquidity regulations.

### Specified risk types required in procedures (Article 39 para. 2b)
Procedures pursuant to para. 2 must include in particular the following:
- 1. credit risk (Article 2 no. 57),
- 2. concentration risk (Article 2 no. 57b),
- 3. risk types in the trading book (Article 22o para. 2),
- 4. commodities risk and foreign exchange risk, including the risk arising from gold positions,
  - 1. where these are not covered by no. 3,
- 2. operational risk (Article 2 no. 57d),
- 3. securitization risk (Article 2 no. 57c),
- 4. liquidity risk (Article 25),
- 5. interest rate risk arising from any transactions not already covered by no. 3,
- 6. the residual risk from credit risk mitigation techniques (Article 2 no. 57a),
- 7. risks arising from the macroeconomic environment and
- 8. the risk arising from money laundering and terrorist financing.

### Joint risk classification organizations (Article 39 para. 2a)
- CIs may use joint risk classification organizations as service providers for development and maintenance of rating methods if reported to the FMA in advance.
- Participating CIs may convey necessary information to the joint organization for exclusive purpose of developing and maintaining risk assessment and mitigation methods; joint organization may only transfer personal data to the CI which originally provided the underlying borrower data.
- The joint risk classification organization and its personnel are subject to banking secrecy per Article 38.
- FMA has information, presentation and auditing powers under Article 70 para. 1; Article 71 applies.

### FMA-issued minimum standards and guidance
- Binding minimum standards / documents issued by FMA:
  - FMA-Mindeststandards für das Kreditgeschäft und andere Geschäfte mit Adressenausfallsrisiken (FMA-MS-K), April 2005
  - FMA-Mindeststandards für die Vergabe und Gestionierung von Fremdwährungskrediten (FMA-FX-MS), October 2003
  - FMA—Mindeststandards für die Vergabe und Gestionierung von Krediten mit Tilgungsträgern (FMA-TT-MS), October 2003
  - Ergänzung zu den FMA Mindeststandards zur Vergabe und Gestionierung von Fremdwährungskrediten und Krediten mit Tilgungsträgern vom 16. Oktober 2003 (amended March 2010) — new encompassing minimum standards on foreign currency loans (FCL) and loans with repayment vehicles (LRV); currently being updated.
- Guidelines on Credit Risk, Market Risk, Interest Rate Risk in the Banking Book, Operational Risk and Bank-Wide Risk Management published by FMA/OeNB contain recommendations on management duties, procedures, reporting mechanisms, limit controls, risk analysis for new products, risk management handbooks and internal auditing procedures.

### Supervisory responsibilities
- Supervisory responsibilities specified in Article 69 and Article 70 para. 4 nos. 1, 2 and 4a Banking Act.
- Bank auditor must review compliance with Articles 39 and 39a annually (Article 63 paras. 3 and 4 Banking Act).

### Practical application — supervisory processes
- On-site inspections and off-site analysis of periodic reports are used to review legal provisions.
- Supervisory Review and Evaluation Process (SREP): OeNB/FMA evaluates risks and risk bearing capacity on a yearly basis, assessing CI’s risk profile, financial situation, methodologies used in ICAAP and risk bearing capacity; scoring approach uses scores in the range from 1 to 4, taking account of method reliability and figures for Pillar I or Pillar II risks.
- SREP scoring:
  - Scores applied via particular surcharges leading to supervisor’s SREP capital estimate on a risk by risk basis.
  - Supervisory expectations (e.g., holding period) checked before setting SREP capital; if not met, CI’s figures are scaled or a proxy capital is calculated.
  - Sum of SREP capital estimates compared to risk bearing capacity (own funds and possibly other capital instruments in exceptional cases); reconciliation results in deemed adequacy or a capital add on by FMA (Joint Risk Assessment Decision—JRAD).

### Supervisory tools, standards and implementation
- FMA/OeNB guidelines and OeNB internal examination standards incorporate BCBS and EBA (formerly CEBS) guidance; OeNB’s standards implemented as modules in IT system BOSS (Banking On-Site Supervision System).
- Last major update of all BOSS modules performed in 2012; an English translation is being compiled.
- Examination standards form the basis for on-site inspections and mirror off-site analysis focal points; ensure coverage of essential criteria EC1.a – EC1.e.

### Supervisory findings and application against ECM criteria (EC2–EC5)

EC2 — bank-wide risk management processes
- Supervisor requires banks to have comprehensive risk management policies/processes to identify, measure, evaluate, monitor, report and control or mitigate all material risks; supervisor determines adequacy:
  - (a) to provide comprehensive “bank-wide” view across all material risk types;
  - (b) for the risk profile and systemic importance of the bank;
  - (c) to assess macroeconomic environment risks and incorporate assessments into risk management.
- Practical application:
  - Bank-wide risk management policies/processes are central in off-site analyses and on-site inspections, predominantly in ICAAP inspections and individual risk category assessments.
  - Annual JRAD centrally features assessment of bank-wide risk measurement methods.
  - Supervisory “double risk-oriented” approach: more resources on riskier/systemically important CIs and focus on dominant risk categories within each CI.
  - Article 39 para. 2b no. 10 requires CIs to consider macroeconomic risks in their risk management; OeNB/FMA address macroeconomic risks via in-depth analyses and selection of group subsidiaries in potentially riskier CESEE countries for on-site visits.
- On-site actions have been taken in the following countries in past years:
  - 2010: Croatia, Germany, Hungary, Italy, Liechtenstein, Romania, Singapore, Slovakia, United Kingdom, United States of America
  - 2011: Croatia, the Czech Republic, Germany, Hungary, Italy, Romania, and the Russian Federation
  - 2012: Croatia, Hungary, Italy, Romania and the Russian Federation

EC3 — documentation, review, communication, and exceptions
- Supervisor determines risk management strategies, policies, processes and limits are:
  - (a) properly documented;
  - (b) regularly reviewed and appropriately adjusted to reflect changing risk appetites, risk profiles and market and macroeconomic conditions; and
  - (c) communicated within the bank;
  - Supervisor determines exceptions receive prompt attention and authorization by appropriate management level and Board where necessary.
- Practical application:
  - Compliance with EC3 predominantly assessed during on-site inspections and via document requests for off-site analyses.
  - Awareness of senior directors and board members regarding documentation, dissemination and regular revisiting is assessed during high-level meetings in on-site inspections and via regular high-level meetings by responsible off-site analysts.

EC4 — Board and senior management understanding of risk
- Supervisor determines Board and senior management obtain sufficient information on, and understand, nature and level of risk and how it relates to capital and liquidity; Board and senior management regularly review and understand implications and limitations (including measurement uncertainties) of risk information received.
- Legal framework: Article 39 paras. 1 and 2 and Article 39a paras. 1 and 2 of the Banking Act; Article 5 para. 1 no. 8: licensing requirement that directors possess necessary professional qualification and experience.
- Practical application:
  - Requirements reviewed during on-site inspections and meetings with board and directors responsible for risk management.
  - Assumptions and deficiencies in risk models and awareness of board members and senior management addressed in model approval processes, ongoing off-site model supervision and examination of material model changes.

EC5 — internal process for assessing capital and liquidity adequacy
- Supervisor determines banks have appropriate internal process for assessing overall capital and liquidity adequacy relative to risk appetite and profile; supervisor reviews and evaluates these assessments and strategies.
- Legal framework:
  - Article 39a para. 1: CIs must determine on a regular basis amount, composition and distribution of capital available for coverage of all material risks and hold necessary capital.
  - Directors must exercise diligence per Article 39 para. 1; must obtain information on and control, monitor and limit risks; consider overall earnings situation.
  - CIs must have administrative, accounting and control mechanisms appropriate to type, scope and complexity of transactions.
- Guidelines and implementation:
  - FMA and OeNB issued guidelines during Basel II implementation to assist CIs redesigning methods and processes; EBA expected to develop a single supervisory handbook under Basel III implementation.
  - FMA/OeNB will decide whether to replace Austrian guidelines with new EBA guidelines or update existing national guidance on a case by case basis.
  - For Pillar II and ICAAPs, FMA and OeNB adjusted practices without waiting for EBA; latest supervisory expectations to be published on the OeNB website.
  - ICAAP: Guidelines on Bank-wide Risk Management—Internal Capital Adequacy Assessment Process (February 2006).
- Liquidity oversight tools:
  - FMA oversees liquidity management via on-site/off-site surveillance and compliance with its two liquidity stock ratios.
  - Main tool is the weekly reporting template covering all currencies and 14 time periods.

*Source: _cr1413 - 1. Legal Framework (IMF staff report PDF).*

### 2. Practical Application

### 2. Practical Application

### Supervisory Review and Evaluation Process (SREP) — overview
- OeNB/FMA review overall risk of the CI using a set of questions answered by the CI in a self-assessment process (see CP15 EC1).
- Questions are chosen depending on the size, complexity and business strategy of the CI (principle of proportionality).
- Assessment of capital and liquidity adequacy is a prime concern of FMA and OeNB; CIs’ internal processes for ensuring capital and liquidity adequacy are key elements in on-site inspections and subject to regular supervisory scrutiny.

### EC6 — Model use, limitations, validation and supervisor review
- Supervisory determinations:
  - (a) banks comply with supervisory standards on their use;
  - (b) the banks’ Boards and senior management understand the limitations and uncertainties relating to the output of the models and the risk inherent in their use; and
  - (c) banks perform regular and independent validation and testing of the models.
- Supervisor assesses whether model outputs appear reasonable as a reflection of the risks assumed.
- Legal framework — periodic validation/testing requirements (exact citations preserved):
  - Internal Ratings Based Approach: Article 21a para. 1 no. 7 of the Banking Act in conjunction with Article 59 and Article 64 of the Solvency Regulation with Article 42 para. 4 no. 6 of the Banking Act.
  - Own Volatility Estimates (Comprehensive Method) for Credit Risk Mitigation Techniques: Article 21c para. 1 of the Banking Act in conjunction with Article 22g para. 9 no. 2a bb of the Banking Act; Article 128 para. 4 nos. 8 and 9 of the Solvency Regulation.
  - Advanced Measurement Approach for Operational Risk: Article 21d para. 2 no. 5 of the Banking Act.
  - Internal Market Risk Models for the Trading Book: Article 21e para. 1 of the Banking Act in conjunction with 22p para. 5 of the Banking Act and Articles 225 and 227 of the Solvency Regulation. Article 22p para. 5 no. 1 lit. b of the Banking Act requires VaR CIs to perform stress testing and send results to the OeNB and the FMA quarterly. Article 228 para. 1 to 2 of the Solvency Regulation requires daily back testing of model results and reporting of any exemptions to the FMA and the OeNB.
  - Internal Models for Calculating Exposure Values for Derivative Contracts, Repurchase Agreements, Securities or Commodities Lending or Borrowing Transactions, Margin Lending Transactions and Long Settlement Transactions: Article 21f para. 1 of the Banking Act in particular in conjunction with Article 21f para. 4 no. 1d and no. 2d of the Banking Act.
- Practical application:
  - Supervisor approval is required before using an internal model for own funds calculation (Articles 21a to 21f).
  - Approval process for initial admission and every material change comprises an on-site inspection of compliance with legal requirements.
  - Ongoing model supervision is conducted off-site via validation analyses and reports on back testing and stress testing.
  - Pursuant to Article 70 para. 1 of the Banking Act, already approved models are periodically reviewed during on-site inspections by OeNB commissioned by FMA.
  - Internal audit unit must review at least once per year the CI's rating systems and their functioning (Article 42 para. 4 no. 6 of the Banking Act).
  - Supervisor reviews EC6 requirements during on-site inspections (including board minutes) and meetings with board and risk management directors; assumptions, deficiencies, and board/senior management awareness are explicitly addressed in model approval processes, off-site supervision and examination of material model changes.

### EC7 — Information systems and reporting
- Supervisor determines adequacy of information systems under normal and stress conditions for measuring, assessing and reporting exposures across all risk types, products and counterparties; reports must reflect risk profile and capital/liquidity needs and be timely and suitable for Board and senior management use.
- Practical application:
  - Evaluation of reporting lines and reports is part of ongoing off-site analyses.
  - Risk reporting and information used for internal steering are assessed in detail during on-site inspections.
  - Availability of comprehensive business data, quality of internal information systems and adequacy of IT infrastructure are major concerns in on-site inspections.
  - Detected deficiencies in information and reporting systems may trigger further supervisory measures, including on-site inspections in IT infrastructure and data quality.

### EC8 — New products, material modifications, major initiatives
- Supervisor determines banks have policies/processes to ensure Boards and senior management understand risks in new products, material modifications and major initiatives; approvals by Board or specific committee required.
- Legal framework:
  - Article 39 para. 2c of the Banking Act requires due consideration for security of third-party funds and preservation of CI's own funds for transactions with which CI has no experience; procedures must capture and assess risks and concentration risks.
  - Article 225 para. 8 no. 1 of the Solvency Regulation requires detailed risk analyses when introducing a new product for CIs using internal models for market risk in the Trading Book.
  - Article 39 provides a binding legal framework for product approval in all areas.
- Practical application:
  - Compliance assessed during on-site inspections; product approval process and introduction of new lines of business are central topics in examination of all risk categories.
  - Steps taken before starting a new line of business are subject to detailed scrutiny.

### EC9 — Risk management function, resources, independence, internal audit review
- Supervisor determines risk management functions cover all material risks with sufficient resources, independence, authority and Board access; duties segregated from risk-taking functions; reporting directly to Board and senior management; subject to regular internal audit review.
- Legal framework and guidance:
  - See EC1 and Article 39 para. 2 of the Banking Act.
  - FMA Minimum Standards for the Credit Business and other Transactions entailing Credit Risks (13 April 2005) set key objectives and require clear functional separation between front office ("Markt") and back office ("Marktfolge") and prescribe tasks to be performed outside the front office (clauses and tasks listed verbatim in the source).
  - In trading transactions, front office vote may be exercised by traders for counterparty limits, with proper review of counterparty risks; same applies to issuer limits.
- Practical application:
  - CIs’ compliance with FMA Minimum Standards is evaluated by the CIs’ bank auditor and must be reported to OeNB/FMA annually; also reviewed during on-site inspections.
  - Supervisory expectations for segregation of duties in other lines of business follow standards set for credit risk.
  - Resources, responsibilities and decision powers of risk management units are monitored in depth in on-site inspections.
  - Internal audit must perform regular reviews of risk management functions, processes and models as mandated by Article 42 of the Banking Act; internal audit activities, report quality and tracking of remedial actions are evaluated in on-site inspections.

### EC10 — Dedicated CRO and oversight
- Supervisor requires larger and more complex banks to have a dedicated risk management unit overseen by a Chief Risk Officer (CRO) or equivalent; removal of CRO should be approved by the Board, disclosed publicly, and discussed with supervisor.
- Practical application:
  - No explicit legal requirement for a CRO; FMA and OeNB expect a dedicated risk manager at board level (CRO) and a clearly cut structure of risk management units.
  - Discussions with larger banks led assessors to form the opinion that they had a dedicated risk management unit overseen by a CRO.
  - Compliance assessed during on-site inspections and high-level meetings with off-site analysts.
  - Directors’ requirements are laid down in Articles 5 and 39 of the Banking Act; license may be revoked if deficiencies are discovered, making removal of non-compliant persons a matter of substantial talk between CI and supervisor.

### EC11 — Supervisory standards for risk types
- Supervisor issues standards related to credit risk, market risk, liquidity risk, interest rate risk in the banking book and operational risk.
- Legal framework and practical application:
  - FMA and OeNB have issued guidelines concerning credit risk, market risk, interest rate risk in the banking book, operational risk and bank-wide risk management.
  - Minimum Standards published by the FMA (titles and dates preserved):
    - FMA Minimum Standards for Granting and Managing Foreign Currency Loans (October 2003)
    - FMA Minimum Standards for Granting and Managing Loans with Repayment Vehicles (October 2003)
    - FMA Minimum Standards for Internal Auditing (February 2005)
    - FMA Minimum Standards for the Credit Business and other Transactions entailing Counterparty Risks (April 2005)
  - Guidelines published by FMA and OeNB in the course of implementing Basel II and Basel III; EBA expected to develop a single supervisory handbook per EC communication of 12 September 2012.
  - FMA and OeNB will decide case by case whether to replace Austrian guidelines with EBA guidelines or update Austrian guidelines themselves; for Pillar II and ICAAP, FMA and OeNB adjusted requirements without waiting for EBA.
  - Credit risk guidance (titles and dates preserved): Best Practices in Risk Management for Securitized Products (December 2004); Rating Models and Validation (November 2004); Credit Approval Process and Credit Risk Management (December 2004); Credit Risk Mitigation Techniques (December 2004) and country-specific variants (December 2004).
  - Operational Risks: Guidelines on Operational Risk Management (August 2006).
  - Interest Rate Risk: Guidelines on the Management of Interest Rate Risk in the Banking Book (published in 2008).
  - ICAAP: Guidelines on Bank-wide Risk Management—Internal Capital Adequacy Assessment Process (February 2006).
  - Liquidity risk: regulated in Article 25 of the Banking Act and the Liquidity Risk Management Regulation (LRMV); Articles 39 and 39a apply; reporting standards for weekly liquidity monitoring documented in the Guideline “Erläuterung zur Liquiditätsmeldung” (published in 2008 and updated in 2009).

### EC12 — Contingency arrangements and recovery planning
- Supervisor requires contingency arrangements as part of risk management, including recovery plans for systemically important banks; supervisor assesses adequacy and feasibility and seeks improvements where deficiencies exist.
- Findings:
  - Following consultations with the three largest internationally active Austrian CIs, OeNB and FMA devised principle-based measures to make those CIs’ business models more sustainable, including preparation of recovery plans by end 2012.
  - There is no legal basis for recovery planning in Austria yet (and probably not until the implementation of the European directive); issue discussed under Principle 11—Corrective and Sanctioning Powers of Supervisors.
  - First drafts of recovery plans were received from all three CIs; drafting and evaluation treated as a pilot project for 2012 to gain experience and common understanding to improve plan quality.
  - Bank-specific contingency plans are assessed for capital (ICAAP) and liquidity within the scope of respective on-site inspections; see internal examination standards for details.

### EC13 — Stress testing programs
- Supervisor requires forward-looking stress testing programs commensurate with risk profile and systemic importance; supervisor regularly assesses that programs capture material sources of risk, adopt plausible adverse scenarios, and integrate results into decision-making, risk management (including contingency arrangements) and assessment of capital and liquidity levels.
- Supervisor also assesses that stress testing:
  - (a) promotes risk identification and control on a bank-wide basis;
  - (b) adopts suitably severe assumptions and addresses feedback effects and system-wide interaction between risks;
  - (c) benefits from active involvement of the Board and senior management; and
  - (d) is appropriately documented and regularly maintained and updated.
- Supervisor requires corrective action if material deficiencies are identified or results are not adequately considered in decision-making.
- (Description and findings re EC13 are indicated in the source but not included in the supplied excerpt.)

*Source: _cr1413 - 2. Practical Application, INTERNATIONAL MONETARY FUND*

### 1. Legal Framework

### _cr1413 - 1. Legal Framework

### Legal Framework (general)
- References to earlier sections: "See above EC 1."
- Key statutory bases: Articles 22 to 24, Article 39, Article 39a, Article 70, Article 69, and Articles 21a/21c/21d/21e/21f of the Banking Act are cited as the principal legal provisions governing capital, risk management, and supervisory measures.

### Practical Application — Stress Testing, Pricing, Product Approval
- Stress testing infrastructure:
  - Predominantly assessed during on-site inspections and within the scope of the SREP/JRAD (see CP15 EC 1).
  - Principles as set forward in EC13 (a-d) are central aspects of on-site inspections in any risk category.
  - Internal examination standards are laid down in the modules of OeNB’s BOSS-system.
  - Results of market risk stress tests by CIs using an internal model for minimum capital requirements for market risk in the Trading Book are analyzed on a quarterly basis.
- EC14 (pricing and product approval):
  - Supervisor assesses whether banks appropriately account for risks (including liquidity impacts) in internal pricing, performance measurement and new product approval processes for all significant business activities.
  - General aspects of risk adjusted pricing and performance measurement are usually discussed in on-site inspections across risk categories.
  - Commensurability of internal pricing is assessed during on-site inspections in liquidity risk, incorporating CEBS (EBA) standards on liquidity cost benefit allocation (Cf. CEBS Guidelines on Liquidity Cost Benefit Allocation, 27 October 2010).
  - Product approval process assessment referenced to EC 8.

### Additional Criteria — AC1 (other material risks)
- Requirement:
  - Supervisor requires banks to have appropriate policies and processes for assessing other material risks not directly addressed in the subsequent Principles, such as reputational and strategic risks.
- Description and findings:
  - Article 39 para. 2 and Article 39a para. 1 of the Banking Act comprise all material risks.
  - Qualitative risk assessments for various subtypes of other risks must be performed autonomously by the CI and documented appropriately.
  - Issue is addressed in the annual ICAAP questionnaire and ensuing SREP / JRAD (see CP15 EC1).

### Assessment of Principle 15 (risk management)
- Overall assessment: Largely compliant.
- Comments and findings:
  - Austrian law provides for a comprehensive risk management process in credit institutions, and supervisors demonstrate competence in oversight and implementation.
  - Shortcoming identified: no explicit legal requirement for larger and more complex banks to have a dedicated risk management unit overseen by a Chief Risk Officer or equivalent function.
  - FMA and OeNB expect such functions to exist in practice.
- Planned regulatory change (as of source):
  - It is planned to introduce an explicit requirement for CIs to have a dedicated risk management function in the course of the year 2013.
  - Main tasks of the risk management function: independent from operational functions; ensure identification, measurement and proper reporting of all material risks.
  - Obligation proposed for CIs to establish a "risk committee" as a subcommittee of the supervisory board to advise the executive board on overall risk strategy and assist the supervisory board in overseeing implementation.

### Principle 16 — Capital adequacy (overview)
- Statement: Supervisor sets prudent and appropriate capital adequacy requirements that reflect risks undertaken by, and presented by, a bank in its markets and macroeconomic context. Supervisor defines capital components with emphasis on loss-absorbing elements. At least for internationally active banks, capital requirements are not less than applicable Basel standards.
- Note: The Core Principles do not require jurisdictions to comply with Basel I/II/III; compliance with a Basel regime is only required where the jurisdiction has declared voluntary implementation.

### EC1 — Laws/regulations require calculation and observance of prescribed capital requirements
- Legal basis and scope:
  - Minimum capital adequacy provisions laid down particularly in Articles 22 to 24 of the Banking Act (transposition of the CRD into Austrian law).
  - Calculation of minimum capital adequacy ratio: Article 22 Banking Act corresponds to Article 75 of the CRD.
  - Each CI and each group required to calculate and maintain at all times minimum own funds covering:
    1. credit risk,
    2. trading book risk and
    3. operational risk,
    4. commodities and foreign-exchange risk, including the risk arising from gold positions, each for positions outside the trading book;
    5. (additional capital requirements as necessary in accordance with Article 29 para. 4 (qualifying participations) and
    6. Article 70 para. 4a (capital add-on) or
    7. requirements due to exceed of large exposure limits (in accordance with Article 27 para. 16a Banking Act).
- Supervisory powers and remedial measures:
  - Article 70 para. 4: FMA authority to take measures if a CI falls below the minimum capital ratio.
  - FMA requires a CI violating Banking Act provisions (e.g., falling below the minimum capital ratio of 8%) under threat of penalty to re-establish lawful conditions within an appropriate period.
  - For repetition or continuation, FMA may prohibit directors from conducting business and ultimately revoke the license if other measures cannot secure functionality.
  - For each negative difference between own funds and own funds requirement, FMA must charge the CI with penalty interest, absent more severe measures.
  - Deteriorating capital levels near the minimum capital level of 8% prompt supervisors to engage the board and examine the CI in more detail.
  - Article 70 para. 2: FMA may order temporary measures (e.g., prohibition of withdrawal of capital or profits, appointment of a competent supervisor, prohibition of directors from managing the business, prohibition of continuation of the business) which expire no later than 18 months after taking effect.

### EC2 — Alignment with Basel standards for internationally active banks
- Description and findings:
  - In line with the CRD, which requires all CI within the EU to apply Basel II and Basel 2.5, all Austrian CIs are subject to the same definition of own funds, method of calculation and required ratio.
  - Implementation of Basel III in the EU via CRR and CRD IV is under discussion and, once implemented, will apply to all CIs in Austria.
  - Note: holdings in insurance companies, re-insurance companies and insurance holding companies are deducted half from Tier 1 and half from Tier 11, in keeping with requirements of Basel 11.

### EC3 — Supervisor power to impose specific capital charges/limits and capture inadequately transferred risks
- Description and findings:
  - FMA must assess appropriateness of capital requirement of a group of CIs annually in cooperation with other competent authorities supervising subordinate credit institutions in other Member States.
  - FMA must decide, in cooperation with these authorities, on measures at the consolidated level pursuant to Article 69 paras. 2 and 3 and pursuant to Article 70 para. 4a of the Banking Act.
  - Risks not adequately transferred or mitigated through transactions are captured by Article 39 para. 2b no. 6 of the Banking Act; a capital charge can be derived via Article 70 para. 4a.
  - Article 22 para. 2: on-balance sheet and off-balance sheet exposures must be taken into account when calculating capital requirements.

### EC4 — Capital requirements reflect risk profile and systemic importance; constrain leverage
- Description and findings:
  - Article 39a para. 1: CIs must have effective plans and procedures to determine regularly the amount, composition and distribution of capital necessary for quantitative and qualitative coverage of all material risks and to hold necessary capital. Plans must be based on nature, scope and complexity of banking transactions.
  - March 2012 supervisory guidance (FMA and OeNB) to strengthen sustainability of business models of large internationally active Austrian CIs. The "sustainability package" aims to:
    1. Increase capitalisation:
       - "The Basel III rules in respect of Common Equity Tier 1 (CET1) shall be fully implemented from the 1st of January 2013 without making use of any related transitional provisions - with the exception that private and state participation capital subscribed under the CI support package will be included in the capital base."
       - "Furthermore, the Austrian supervisors will apply an additional capital surcharge of up to 3 percentage points of CET1 from the 1st of January 2016, taking into account specificities of the CIs’ risk profile."
    2. Rebalance refinancing structures:
       - FMA and OeNB will monitor the ratio of net new lending to the local stable funding ratio (110%).
    3. Recovery and resolution plans:
       - Parent institutions must establish recovery and resolution plans by end 2012.
  - Three banking groups currently subject to this guidance: Erste Group Bank, Raiffeisen Zentralbank, Unicredit Bank Austria.

### EC5 — Use of banks' internal assessments for regulatory capital (IRB, AMA, internal models)
- Description and findings:
  - Use of internal assessments as inputs to regulatory capital calculation is subject to FMA approval.
  - Conditions of approval are laid down in Articles 21a (credit risk), 21c (volatility of financial collateral), 21d (operational risk), 21e (trading book risk), 21f (counterparty risk).
  - Example: criteria for approval of IRB systems (Article 21a para. 1) require that:
    1. systems to control and assess credit risks and parameter estimates are sound, integrated, and play an essential role in risk management, decision-making, credit approval, ICAAP, internal control systems and reporting;
    2. rating systems deliver meaningful results for assessment of obligor and transaction characteristics and enable meaningful differentiation of risk and accurate quantitative estimates;
    3. rating systems have been in use for at least three years and sufficiently fulfill requirements at time of application;
    4. where own estimates of loss given default and conversion factors are used, the estimates have been in use for at least three years and sufficiently fulfill requirements for use of own estimates;
    5. CI has an appropriately independent organizational unit responsible for internal rating systems;
    6. required data for proper credit risk measurement and management are collected;
    7. rating systems, design and validation are documented properly;
    8. requirements of Article 22b para. 11 Banking Act are fulfilled; and
    9. fulfillment of disclosure requirements is ensured and maintained on an ongoing basis.
  - In the approval procedure the FMA must obtain an expert opinion from the OeNB on fulfillment of requirements pursuant to nos. 1 to 8.
  - Notification obligations (Article 21 para. 3): CIs and superordinate CIs acting on behalf of a group must notify FMA and OeNB in writing immediately if:
    1. CI no longer fulfills one or more of requirements indicated in nos. 1 to 9 above,
    2. it does not comply with requirements and conditions imposed by administrative ruling, and present a plan for return to compliance within a reasonable period or demonstrate that the effect of non-compliance is immaterial.

*Source: _cr1413 - 1. Legal Framework (excerpt).*

### 3. the CI intends to change the Internal Ratings Based Approach approved by

### _cr1413 - 3. the CI intends to change the Internal Ratings Based Approach approved by

### Internal Ratings Based (IRB) approach — approvals, changes and monitoring
- CIs and superordinate CIs may only make material changes to an approved Internal Ratings Based Approach or its application with the approval of the FMA.
- If a CI intends to change the Internal Ratings Based Approach approved by the FMA or its application it must:
  - demonstrate that the changes are immaterial; and
  - submit to the FMA and OeNB on a yearly basis a description of the validation of the models used, including the results and measures taken, as well as the results of stress tests performed.
- The use of the Basel II IRB approach requires approval by the FMA based on an expert opinion carried out by the OeNB (covering rating models and parameter estimation via an on-site examination).
- A yearly off-site evaluation of IRB rating models is carried out by the OeNB on the basis of validation reports delivered by the CIs.

### Supervisor powers and forward-looking capital management (EC6)
- The supervisor has the power to require banks to adopt a forward-looking approach to capital management (including the conduct of appropriate stress testing).
- The supervisor can require banks:
  - to set capital levels and manage available capital in anticipation of possible events or changes in market conditions that could have an adverse effect; and
  - to have in place feasible contingency arrangements to maintain or strengthen capital positions in times of stress, as appropriate in the light of the risk profile and systemic importance of the bank.
- Legal and regulatory framework:
  - CIs must take into account possible downturn scenarios when assessing capital adequacy (Article 45 of the Solvency Regulation).
  - Under ICAAP (Articles 39 and 39a of the Banking Act), CIs must apply a forward-looking approach, review suitability of strategies and procedures at least annually, and take into account macroeconomic risks (Article 39 para. 2b no. 10) and risks from unfamiliar new transactions (Article 39 para. 2c).
- OeNB stress testing:
  - OeNB regularly conducts macro-economic stress tests; typically two stress tests per year:
    - One “Joint Bottom-up Exercise” where top CIs perform calculations based on OeNB-designed scenarios and common assumptions.
    - One “Constrained Bottom-up Exercise” where CIs receive top-down results and may check plausibility; CIs may run their own calculations but are not obliged to do so.

### Capital framework, recent capital levels, and Basel III transition (AC1, AC2, Principle 16)
- For non-internationally active banks, capital requirements and definitions are broadly consistent with applicable Basel standards.
- Distribution of capital within banking groups:
  - Article 22 of the Banking Act requires all CIs to comply with regulatory minimum capital requirements on an individual basis.
  - For internationally active groups, minimum requirements for subsidiaries are decided by a college of supervisors.
- Assessment and recent figures:
  - Austria has applied Basel II through adoption of the EU CRD and will implement Basel III through CRD IV/CRR later this year.
  - Tier 1 capital at end June 2012 was about 10.5 percent.
  - The minimum 8 percent ratio: the FMA can require higher ratios; a minimum capital ratio of more than 8 percent applied to 6 out of the 677 Austrian banks on a consolidated basis at end 2012, covering 56 percent of consolidated total assets of the Austrian banking system.
  - Estimated additional capital required by the Austrian Bank Sector to meet Basel III at end June 2012 was EUR 8 billion to EUR 13 billion. The EUR 13 billion comprises:
    - EUR 4 billion CET1;
    - EUR 4 billion additional Tier 1 capital; and
    - a maximum of EUR 5 billion Tier 2.
  - The three largest banking groups (Erste Group Bank, Raiffeisen Zentralbank and Unicredit Bank Austria) meet the 7 percent threshold for Common Equity Tier 1.
  - As part of a restructuring scheme introduced in 2008, the Austrian Government and the private sector invested together a total of EUR 5.2 billion by way of participation shares in a number of Austrian banks; this is due for repayment at end 2017. Under a special transitional provision in CRD IV, this amount will rank as Tier I capital until maturity in 2017.
- Cooperative banks and capital raising:
  - Cooperatives (a majority in number) face difficulties raising Basel III capital; Article 30 (a) of the Banking Act allows certain permanently affiliated credit institutions to calculate capital adequacy on a consolidated basis, removing the need for individual cooperatives to hold capital in some circumstances.
- Assessment of Principle 16: Compliant.

### Credit risk management (Principle 17) — framework and supervisory arrangements
- Principle 17 summary: Supervisor determines banks have adequate credit risk management covering identification, measurement, evaluation, monitoring, reporting and control or mitigation of credit risk (including counterparty credit risk) across the full credit lifecycle.
- Legal and supervisory framework:
  - Articles 39 and 39a Banking Act, the Solvency Regulation, FMA/OeNB Minimum Standards and Guidelines set out credit risk management requirements consistent with EU/Basel standards.
  - Article 39 requires prudent conduct, administrative/accounting/control procedures that consider credit risks; Article 39a (ICAAP) requires plans/procedures to determine amount/composition/distribution of capital for material risks.
  - FMA published “Minimum Standards for the Credit Business and other Transactions entailing Counterparty Risks” (April 2005) addressing CIs with minimum capital requirement of EUR 30 million; covers independence of risk management, loan granting, credit analysis, early warning, problem loan management and reporting.
  - Internal audit must review risk management procedures and report to directors and—under conditions—to the supervisory board chair (Article 42 para. 4).
- Supervisory tools and processes:
  - On-site and off-site supervisory activities, regulatory reporting and supervisory colleges feed the supervisory credit risk assessment and SREP.
  - OeNB’s credit registry and monthly reporting: loans above EUR 350,000 must be reported to OeNB with information on risk classification, provision, collateral.
  - Annex to the Audit Report (prudential report, Article 63 paras. 4 and 5) requires external auditors to comment on weaknesses of processes and internal control environment.
  - OeNB/FMA may at any time require additional information (Article 70 para. 1 no. 1).
  - OeNB’s internal examination standards are implemented as modules in the IT system BOSS; last major update of modules was performed in 2012.
- Governance and board oversight (EC2, EC10):
  - Article 39 para. 1 requires directors to exercise diligence, obtain information, control, monitor and limit risks using appropriate strategies and mechanisms, and have ICAAP plans/procedures.
  - Internal credit risk reporting to the board is assessed in on-site inspections; off-site supervision regularly receives CI internal credit risk reports.
  - For CIs exceeding EUR 1bn in assets, a state commissioner attends supervisory board meetings and forwards documentation to the FMA (Article 76).
- Credit policy, approval and limits (EC3, EC6, EC5):
  - The “Minimum Standards” specify segregation of duties and a credit decision hierarchy; Article 27 para. 14: every large exposure (10% or more of the CI’s eligible capital) requires explicit prior consent of the supervisory board and reporting at least once per year.
  - Article 27 para. 17: where exposure exceeds 10% of eligible capital or amounts to at least EUR 750,000, directors must disclose economic circumstances of obligors/guarantors and remain sufficiently informed.
  - Article 28: loans to affiliated parties require unanimous directors’ decision and explicit supervisory board consent.
  - EC5 gap: there is no specific legal provision that requires banks to make credit decisions free of conflicts of interest and on an arm’s length basis; FMA relies on indirect measures (four-eyes principle, directors’ duties, voting exclusions for interested directors, segregation of duties).
- Model governance and validation (EC3, EC7, EC8):
  - Article 39 requires mechanisms to assess and monitor risks, including models; model aspects are covered by CEBS/EBA/OeNB and FMA Guidelines on rating models and validation and ICAAP guidelines.
  - For IRB CIs, OeNB assesses appropriateness and results of internal stress testing in on-site inspections; Guidelines recommend ICAAP include stress testing and scenario analyses.
  - OeNB performs yearly off-site evaluation of IRB models based on validation reports provided by CIs.
- Assessment of Principle 17: Largely Compliant.
  - Comment: comprehensive rules exist and are adequately observed, but weakness remains on EC5 (absence of explicit requirement to make credit decisions free of conflicts of interest).

### Problem assets, provisioning and reserves (Principle 18)
- Principle 18 summary: Supervisor determines banks have adequate policies/processes for early identification and management of problem assets, and maintenance of adequate provisions and reserves.
- Legal and reporting framework:
  - Article 39 Banking Act requires administrative/accounting/control procedures; internal audit must assess adequacy (Article 42).
  - CIs must report large exposures and loans exceeding EUR 350,000 to OeNB; OeNB maintains a credit register (Article 75).
  - ADR (additional data request): OeNB collects semi-annual consolidated data on problem loans (NPLs, renegotiated and restructured loans), collateral and provisioning, split by country of loan origination and including foreign subsidiaries.
  - Bank auditors must inform supervisors of substantial deteriorations (Article 63 para 3); auditors report on asset quality and provisioning in Annex to Audit Report.
  - On-site credit risk inspections place emphasis on troubled loan classification and adequacy of provisioning; a dedicated module in BOSS is used for reviews.
- Classification, provisioning and off-balance sheet (EC2, EC3, EC4, EC11):
  - Supervisory assessment is based on total exposure (on- and off-balance sheet) without conversion factors.
  - For portfolios with homogeneous characteristics, classification thresholds (e.g., 90 days past due) broadly align with Basel II default definitions.
  - Accounting standards: IFRS and Austrian GAAP require regular valuation/provisioning of significant exposures on individual basis; most CIs use Austrian GAAP, except one using IFRS.
  - Regulatory thresholds:
    - Loans above EUR 350,000 reported to OeNB (Article 75).
    - Large exposures: exposures equaling or exceeding 10 percent of CI’s own funds, or at least EUR 500,000, subject to strict approval and reporting procedures (Article 27).
- Supervisory powers to require remedial measures (EC7):
  - On-site exams may result in reclassification of assets, additional loan loss provisioning; under Pillar II SREP, additional capital may be required.
- Sector-wide monitoring and macroprudential oversight (EC12):
  - OeNB monitors trends and concentrations via macroprudential analyses and publishes (partially) in semi-annual financial market stability reports.
  - Risk assessment workshops (at least three times a year) and the FMK (FMA, OeNB, BMF high-level committee meeting at least four times a year) discuss system risks.
  - Ongoing engagement with ESRB, EBA, ECB reports and IMF publications for benchmarking.
  - “Bank forum” (Einzelbankforum - EBF) quarterly discussions of main risks and prudential actions.
- Assessment of asset quality and recent sector metrics:
  - The level of NPLs in Austria has remained more or less stable over recent years at less than 5 percent.
  - NPLs in CESEE have risen by 5 percentage points over the last 4 years and now stand at about 16 percent.
  - Consolidated overall NPL figure for Austrian banks is over 9 percent.
  - CESEE NPLs have stabilized in recent months but remain a major concern.
  - A stability program introduced a loan to local stable funding ratio of 110 to 100 for CESEE monitoring (not binding).
  - FX loans (domestic largely Swiss Francs, foreign subsidiaries largely Euros) are of particular concern:
    - These FX loans were first advanced in 2008 and now stand at more than EUR 50 billion.
    - No new FX loans are being advanced; many were structured as investment vehicles intended to repay in one bullet; investment proceeds are falling short and may be insufficient to clear loans on maturity, with potential FX losses; NPL rates tend to be higher in this category.
- Assessment of Principle 18: Compliant.
  - Comments highlight comprehensive monitoring through monthly schedules of large exposures, reporting of loans over EUR 350,000, semi-annual ADR data on problem loans, and auditor obligations to report substantial deterioration. Concerns are emphasized for CESEE NPLs and FX loan exposures.

*Source: IMF staff report excerpt as provided in the supplied content unit.*

### 15.9 percent at end June 2012 whereas the figure for FX loans stood at

### _cr1413 - 15.9 percent at end June 2012 whereas the figure for FX loans stood at

### Key statistic
- 15.9 percent at end June 2012 whereas the figure for FX loans stood at

*Source: _cr1413 - 15.9 percent at end June 2012 whereas the figure for FX loans stood at*

### 19.7 percent.

### _cr1413 - 19.7 percent.

### Principle 19 — Concentration risk and large exposure limits
- Supervisor expectation: banks have adequate policies and processes to identify, measure, evaluate, monitor, report and control or mitigate concentrations of risk on a timely basis. Supervisors set prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties.
- Connected counterparties: may include natural persons as well as a group of companies related financially or by common ownership, management or any combination thereof.

#### Essential Criteria — EC1 (Policies and processes)
- Legal basis:
  - Article 39 para. 2 Banking Act: every CI must cover, evaluate, steer and monitor its own risks using adequate methods considering type, size and complexity of business.
  - Article 39 para. 2b Banking Act: methods must consider concentration risk (definition in Article 2 no. 57b).
  - Article 39 para. 2c Banking Act: new transactions must capture and assess concentration risks.
- Definition (Article 2 no 57b Banking Act): “The potential adverse consequences which may arise from concentrations or interactions between similar and different risk factors or risk types, such as the risk arising loans to the same client, to a group of connected clients, to clients from the same geographic region or industry or to clients who offer the same goods and services, as well as the risk arising from the use of credit mitigation techniques and in particular from large indirect credit exposures.”
- Additional guidance: “Minimum Standards for the Credit Business and other Transactions entailing Counterparty Risks” (FMA, April 2005) — references to managing concentration risk via an adequate limit system (Chapter V. No. 40; Chapter VI. No. 80).
- Supervisory practice:
  - Adequacy assessed on documentation, measuring methods, reporting of identified concentrations, limit systems and monitoring via on-site inspections.
  - Supervisory view based on total exposure (on & off balance sheet) without conversion factors — integral to on- and off-site activity.
  - Quantification methods evaluated within JRAD process (Pillar II).

#### EC2 (Information systems and aggregation)
- Supervisory verification of management information systems for exposures creating concentrations and large exposures occurs in supervision (e.g., on-site inspections).
- CIs required to establish administrative, accounting and control procedures to record large exposures and subsequent changes and to monitor them per the CI’s exposure policy.
- Internal audit reviews adequacy and enforcement at least once a year (Articles 27 para. 18, 30 para. 7 and 39 Banking Act).
- Article 27 para. 14 Banking Act: every large exposure requires explicit prior consent of the supervisory board or other competent supervisory body; blanket pre-authorizations not permissible. Supervisory board must receive a report on every large exposure at least once per year.
- Limits and their execution evaluated regularly during on-site examinations on solo and consolidated basis.

#### EC3 (Thresholds, communication, board reporting)
- Risk management policies related to concentration risk outlined under EC1.
- Internal risk reporting (including concentration risk) to the board is assessed in on-site inspections; off-site supervision regularly receives and assesses internal risk reports.

#### EC4 (Supervisory information for portfolio concentrations)
- Large exposures reported to OeNB monthly (Article 74 para. 3 no. 1 Banking Act); compliance monitored by on-site inspections.
- Monthly reports gather sectoral concentrations on consolidated and unconsolidated basis and include collateral value, itemized valuation allowance, and rating class of loans.
- OeNB central credit registry (Article 75 Banking Act) provides sectoral and/or geographical concentration information on individual creditor-basis and aggregated basis.
- Internal risk reporting assessed in on-site inspections; off-site supervision regularly receives and assesses CI internal risk reports.

#### EC5 (Definition of group of connected counterparties)
- Article 27 paras 11 and 12 Banking Act: detailed, broad definition of “group of connected counterparties” based on “Natural or legal persons as well as other entities of which one may exercise control...”
- OeNB “Guidelines to the Major Loans Register” provide interpretation rules.

#### EC6 (Prudent large exposure requirements and monitoring)
- Large exposure definition consistent with EU CRD:
  - A large exposure = exposure representing ten percent or more of a CI’s capital.
  - Twenty five percent of a CI’s capital is the limit for a large exposure to private counterparties (including credit institutions) or a group of connected counterparties.
- Off balance sheet transactions are taken into account when calculating large exposures (Articles 27, paras 2 and 15 Banking Act).
- OeNB receives detailed information on any large credit exposure via reporting requirements and on-site inspections.

#### EC7 (Stress testing)
- Concentration risk and stress testing covered in guidelines by FMA and OeNB on Bank-Wide Risk Management.
- Guidelines recommend ICAAP reporting include results of stress testing and scenario analyses.
- OeNB assesses appropriateness and results of internal stress testing in annual ICAAP and SREP assessments and on-site inspections; off-site assessments based on ICAAP questionnaire distributed yearly.

#### Additional Criteria — AC1 (Large exposure thresholds)
- Requirements:
  - (a) ten percent or more of a bank’s capital is defined as a large exposure; and
  - (b) twenty-five percent of a bank’s capital is the limit for an individual large exposure to a private sector non-bank counterparty or a group of connected counterparties.
- Banking Act compliance: Article 27 paras. 2 and 15.

#### Assessment — Principle 19
- Compliant.
- Comment: FMA implements EU Directive for calculating large counterparty exposures. FMA does not set limits for sectoral, geographical, currency exposures; it monitors these and, if excessive, will increase capital cover for excesses. FMA lacks legal powers to issue directives/conditions forcing banks to limit or reduce such exposures (wider issue including sovereign debt). Will be addressed under Principle 11—Corrective and Sanctioning Powers of Supervisors.

### Principle 20 — Transactions with related parties
- Supervisor requires banks to transact with related parties on an arm’s length basis; to monitor transactions; to control or mitigate risks; and to write off exposures to related parties in accordance with standard policies and processes.

#### EC1 (Definition of related parties)
- Article 28 Banking Act defines “related parties”: includes directors, members of the supervisory board, spouses and close family members, any person representing directors or supervisory board members, and third party entities in which these persons have an interest.

#### EC2 (Arm’s length terms)
- No explicit legal requirement that related-party transactions must not be on more favourable terms than comparable non-related transactions.
- Article 28 para 1 Banking Act: a CI may enter into legal transactions with related parties only upon a unanimous resolution by all directors and subject to supervisory board consent. Party involved not entitled to vote on resolutions regarding such transactions. For loans, resolution must govern interest rate and repayment.
- Article 70 Stock Corporation Act: management board must conduct business for benefit of company.
- Article 84 Stock Corporation Act with Article 39 Banking Act: management board members must “exercise their duties with the due diligence of a prudent director.”
- Liability provisions: persons causing damage by granting special benefits liable; supervisory and management board members jointly and severally liable if negligent (Article 100 Stock Corporation Act in conjunction with Article 84).

#### EC3 (Board approval and conflict exclusions)
- Article 28 para. 1 nos. 1 to 6 Banking Act: transactions with management and related persons require unanimous director resolution and supervisory board consent. Party involved cannot vote on resolutions.
- Article 28 para. 3 Banking Act: if management board member or related person is economic owner or manager of a company, transactions with that company require supervisory board consent.

#### EC4 (Preventing beneficiaries from participating)
- Transactions involving directors and management or supervisory board require unanimous director resolution and supervisory board consent. Involved persons have no voting power (Article 28 para. 1).
- Transactions must be reported to the supervisory board annually (Article 28 para. 4).
- No explicit prohibition on persons benefiting from the transaction or their relatives being part of managing the transaction.

#### EC5 (Limits, capital treatment, collateral)
- No specific limits for exposures to related parties; general large exposure limits apply:
  - Individual large exposure limit to a single client or group of connected clients = 25 percent of the CI’s own funds.
- Participation limits:
  - Participation in a company not a CI or financial institution must not exceed 15 percent of the CI’s own funds; total such participations must not exceed 60 percent of the CI’s own funds (Article 29 paras. 1 and 2 Banking Act and CP 7).
  - Participation in CIs or Financial Institutions not part of the group may be deducted from own funds under defined circumstances (Article 23 para. 13 Banking Act).

#### EC6 (Identification, monitoring, reporting, independent review)
- CIs must set up management, accounting and control procedures adequate to extent and complexity of business; effectiveness audited annually (Article 39 para. 2 Banking Act).
- Monitoring and reporting rules:
  - a) Supervisory board must receive report on each management and related party transaction and loan at least once per year (Article 28 para. 4).
  - b) Large exposures reported to supervisory board at least annually (Article 27 para. 14).
- OeNB Guidelines for the Major Loans Register provide detailed rules on identifying connected parties.
- On-site inspections review related-party policies and specific exposures as relevant. Internal audit reviews large exposures annually.
- No explicit provision requiring exceptions to policies, processes and limits to be reported to senior management or Board for timely action.

#### EC7 (Supervisor access to aggregate related-party exposure)
- Reporting requirements:
  - CIs must report large exposures and any exposure above EUR 350,000 on a monthly basis (Article 74 paras. 2 and 3; Article 75 para. 1 Banking Act). This information reviewed monthly and during on- and off-site inspections.
- State commissioner must report to FMA quarterly and immediately if supervisory board resolutions violate Banking Act (Article 76 para. 5).
- Supervisory board and management board meeting minutes reviewed during on-site inspections; bank auditor specifies aggregate exposures to related parties in annual report to FMA.

#### Assessment — Principle 20
- Materially non-compliant.
- Key comments and shortcomings:
  - EC2: No explicit requirement that related-party transactions be on arm’s length terms; unanimous board resolution must govern interest rate and repayment but not require arm’s length terms.
  - EC3: No requirement that write-off of related exposures exceeding specific amounts or posing special risks be subject to prior board approval.
  - EC3 (also): Board/supervisory board members cannot vote on resolutions dealing with loans in which they would be beneficiaries, but no specific prohibition on participation in discussions or on beneficiary managing the account.
  - EC6: No explicit provision for exceptions to policies, processes and limits to be reported to senior management or Board for timely action.
  - EC7: Supervisor does not receive a specific listing of related party lending routinely; FMA can request such a list if necessary. Monthly/quarterly reporting covers large exposures and exposures above Euro 350,000; bank auditor provides aggregate related-party lending in annual report. Suggestion: FMA should receive a specific listing of all related party lending regularly and consider introducing specific, more restrictive limits for related party lending beyond general 10 percent/25 percent large exposure limits.

### Principle 21 — Country and transfer risks
- Supervisor requires banks to identify, measure, evaluate, monitor, report and control or mitigate country risk and transfer risk in international lending and investment activities.

#### EC1 (Policies and processes)
- Off-site supervision uses BIS statistics and OeNB Risk Statistics (Risikostatistik) showing ultimate country risks.
- Open foreign currency positions and minimum capital requirements monitored under Article 22 Banking Act and Article 223 Solvency Regulation.
- BIS statistics established per Article 39 and Article 39a Banking Act.
- FMA and OeNB published guidelines on “Bank-Wide Risk Management and the Internal Capital Adequacy Assessment Process” for ICAAP implementation.

#### EC2 (Board approval and oversight)
- CIs expected to include country and transfer risk in ICAAP; ICAAP framework must be approved by CI boards regularly.

#### EC3 (Information systems and controls)
- On-site inspections: OeNB verifies credit risk management, participation in other countries, loans to other countries and groups of connected clients with companies abroad (Article 27 para. 4 Banking Act) and internal audit unit (Article 42 Banking Act).
- SREP application (Articles 69 and 70 Banking Act) evaluates risk management systems, risk measurements and internal control systems including limitation issues.

#### EC4 (Provisioning oversight)
- Country risk provisions made on an individual basis subject to general rules for provisioning in the Banking Act.
- No specific published legal percentages or amounts for country risk provisions.
- Supervisors do not set percentage intervals per country.
- Certified public accountants publish general country quotations; banks’ directors decide on provisioning (Article 39 Banking Act); bank auditors assess provisioning (Article 63 Banking Act) and FMA/OeNB review.
- If CI substantially deviates from general quotation for country risk lending (secondary market prices), CI must publish this fact or bank auditor must not endorse annual financial statements or add a comment.

#### EC5 (Stress testing)
- Stress testing methodology based on EBA GL 32 (GL 10/93) — supervisors should consider transferability of capital and liquidity in stressed conditions.
- CIs tend to incorporate cross-border liquidity-transfer problems qualitatively in stress tests.
- Supervisory monitoring via “Supervisory guidance on the strengthening of the sustainability of the business models of large internationally active Austrian banks” (March 2012).

#### EC6 (Timely supervisory information)
- Supervisor obtains country risk information via BIS statistics, Risk Statistics, Major Loan Registers (credit engagements exceeding EUR 350,000).
- Annex to Audit Report on annual financial statements shows exposures by country; open foreign currency exposures and minimum capital requirements must be reported.

#### Assessment — Principle 21
- Compliant.
- Comment: Comments for Principle 19—Large Exposures are also relevant for this principle.

Italic line: Source: _cr1413 - 19.7 percent.

### 1. Legal Framework

### 1. Legal Framework

### Market risk rules and statutory basis
- The risks inherent in CIs’ Trading Books are explicitly quoted in the general due diligence requirements as set forth in Article 39 of the Banking Act, making a sound framework for quantifying and managing market risk in the Trading Book necessary for fulfillment of due diligence requirements.
- Articles 21e and 22p of the Banking Act and Articles 224 to 232 of the Solvency Regulation specify criteria for identification, measuring, monitoring and control of market risk for CIs that calculate minimum capital requirement for market risk based on an internal model (Value-at-Risk (VaR), stressed Value-at-Risk (sVaR) and if applicable All Price Risks measure (APR) for correlation trading products as well as Incremental Risk Charge (IRC)).
- For CIs applying the standardized approach or with a “small trading book” (trading book not exceeding limits in Article 22q para. 1 of the Banking Act), principles for measuring and controlling market risk are specified in Articles 39 para. 2 and 39a of the Banking Act.
- Article 22n of the Banking Act specifies criteria for assignment of positions to a CI’s Trading Book irrespective of the capital calculation approach.
- Article 22o of the Banking Act defines Risk Types in the Trading Book for which minimum capital requirements must be calculated, based either on the internal model based approach pursuant Article 22p of the Banking Act and Articles 224 to 232 of the Solvency Regulation or on the standardized approach according to Article 22o para. 2 of the Banking Act and Articles 203 to 223 of the Solvency Regulation.
- Articles 195 to 197 of the Solvency Regulation specify further requirements concerning assignment of positions to the Trading Book and their treatment.
- Articles 198 to 202 of the Solvency Regulation regulate position valuation, independent price verification, prudent valuation adjustments and necessary systems and controls.

### Governance and board responsibilities
- Article 39:
  - (1) Directors must exercise the diligence of a prudent and conscientious director as defined in Article 84 para. 1 of the Stock Corporation Act; obtain information on and control, monitor and limit risks using appropriate strategies and mechanisms; and have in place plans and procedures pursuant to Article 39a. They must consider the overall earnings situation.
  - (2) CIs must have administrative, accounting and control mechanisms for capture, assessment, management and monitoring of risks appropriate to the type, scope and complexity of banking transactions; mechanisms must capture possible arising risks where possible; organizational structure must prevent conflicts of interest and delineate responsibilities; adequacy must be reviewed by internal audit at least once per year.
- Article 195 of the Solvency Regulation requires board-approved strategies and policies for management of trading positions.
- Article 225 of the Solvency Regulation requires binding policies and documentation of risk management processes as qualitative criteria for admission of internal models for market risk capital calculation.

### Practical Application

### Supervisory review and model approval
- Rules in the cited Articles are reviewed during on-site inspections and off-site analyses of periodic reports provided by CIs.
- Market risk in the Trading Book is covered in internal examination standards for on-site inspections and is a relevant aspect in on-site inspections of CIs’ ICAAP (pursuant Article 39a of the Banking Act) and in the annual SREP / JRAD (see CP 15 EC 1).
- Off-site analyses and on-site inspections focus on commensurability of internal risk management processes, quantification models and internal rules with the complexity and scope of business and systemic importance of the CI and its trading operations.
- OeNB’s internal examination standards are implemented as modules in the IT system BOSS. The last major update of all BOSS modules was performed in 2012. (Currently, an English translation is being compiled which will be provided upon completion).
- Application of internal models for calculating minimum capital requirements is examined on-site during initial model approval and when assessing material model changes; once approved, internal models are subject to on-going off-site analysis.
- Bank auditors must confirm yearly that the institution complies with the rules set out in the referenced regulations (Article 63 para. 4 of the Banking Act in conjunction with the Regulation on the Annex to the Audit Report on the Annual Financial Statements).

### Guidance and supervisory convergence
- In implementing Basel II, FMA and OeNB issued guidelines to assist CIs redesigning methods and develop a mutual understanding with supervisors.
- CEBS and now EBA aim for convergence in supervisory standards and practices across the EEA; in implementing Basel III the EC demanded EBA develop a single supervisory handbook to complement the single rulebook. FMA and OeNB will decide case-by-case whether to replace Austrian guidelines with EBA guidelines or update Austrian guidelines themselves.
- OeNB’s Guidelines on Market Risk issued in 1999 provide guidance and general principles; six volumes are available in German covering:
  - Volume 1: General Market Risk of Debt Instruments (2nd revised and extended edition)
  - Volume 2: Standardized Approach Audits
  - Volume 3: Evaluation of Value at Risk-Models
  - Volume 4: Provisions for Options Risks
  - Volume 5: Stress Testing
  - Volume 6: Other Risks associated with the Trading Book

### EC2 — Board oversight and approval of market risk management
- The supervisor determines that banks’ strategies, policies and processes for management of market risk have been approved by the banks’ Boards and that Boards oversee management to ensure effective implementation and integration into overall risk management.
- Legal basis: Article 39 (see EC1) explicitly addresses criteria outlined in EC2.
- Article 39 requirements include board-approved strategies and policies; Article 195 of the Solvency Regulation requires board-approved strategies for trading positions; Article 225 of the Solvency Regulation requires binding policies and documentation for internal model admission.

### EC3 — Information systems, limits, exceptions, models, and trading book allocation
- The supervisor determines banks’ policies and processes establish an appropriate and properly controlled market risk environment including:
  - (a) effective information systems for accurate and timely identification, aggregation, monitoring and reporting of market risk exposure to the bank’s Board and senior management;
  - (b) appropriate market risk limits consistent with the bank’s risk appetite, risk profile and capital strength, and with management’s ability to manage market risk, understood by and regularly communicated to relevant staff;
  - (c) exception tracking and reporting processes ensuring prompt action at appropriate senior management or Board level;
  - (d) effective controls around use of models to identify and measure market risk, and set limits;
  - (e) sound policies and processes for allocation of exposures to the trading book.
- Ad (a): Article 39 paras. 1 and 2 require adequate, accurate and effective information systems for any CI; Article 195 para. 2 lit. d of the Solvency Regulation mandates Trading Book positions be part of risk reporting to board and senior management; Article 225 qualitative model standards require board members to subject daily market risk reports to strategic analysis focusing on risk bearing capacity for internal model CIs.
- Ad (b): Distinction between VaR CIs and other CIs:
  - VaR CIs: Article 22p para. 5 no. 1 requires limits set for individuals and organizational units responsible for trading; fulfillment is part of model approval. Article 21e para. 2 requires FMA to seek an expert opinion from OeNB on requirements, independence of CI-appointed expert, and size of the factor (multiplier) in Article 22p para. 2 no. 2; expert opinion is based on an on-site inspection by OeNB.
  - Other CIs: Articles 39 and 39a require directors to appropriately limit risks; Article 70 para. 1 no. 3 allows FMA to instruct OeNB to conduct on-site inspections reviewing orderly limitation of market risk.
- Ad (c): Exception tracking and reporting are assessed in connection with CIs’ information systems and reporting processes.
- Ad (d): Article 225 of the Solvency Regulation specifies detailed rules governing internal control processes for CIs using internal models; Articles 39 and 39a apply for all CIs including those using models for Pillar II.
- Ad (e): Article 22n of the Banking Act and Article 196 of the Solvency Regulation require sound policies and processes for assignment of positions to the Trading Book.

### EC4 — Valuation, data capture, independent verification and model validation
- The supervisor determines there are systems and controls to ensure marked-to-market positions are revalued frequently; transactions are captured timely; valuation uses consistent and prudent practices and reliable market data verified by a function independent of risk-taking units; in absence of market prices, internal or industry-accepted models are used; models used for valuation must be validated by an independent function; policies for valuation adjustments for concentrated, less liquid, and stale positions must be established and maintained.
- Legal basis:
  - Article 70 para. 1 no. 3 allows OeNB on-site inspections in any risk category; inspectors verify that CIs with a large trading book (exceeding limits in Article 22q para. 1) perform daily valuation and daily limit control and reporting.
  - Article 21e para. 2 requires OeNB during approval period to verify transactions are captured timely and daily evaluation uses appropriate market data.
  - Articles 198 to 202 of the Solvency Regulation specify requirements for valuation adjustments/reserves for positions that cannot be prudently valued.
  - Independent model validation is required by Article 225 para. 12 of the Solvency Regulation.
- Practical application: On-site inspections and off-site analyses review these rules; OeNB emphasizes revision of data supply for models and procedures and considers accurate and relevant input data a key issue in measurement and control of market risk.

### EC5 — Capital adequacy and valuation adjustments
- The supervisor determines banks hold appropriate levels of capital against unexpected losses and make appropriate valuation adjustments for uncertainties in fair value determination.
- Legal basis:
  - Article 39a para. 1 requires all CIs to have plans and procedures to determine regularly the amount, composition and distribution of capital available for quantitative and qualitative coverage of all material risks and to hold necessary capital based on nature, scope and complexity of transactions.
  - Valuation adjustments aspect is covered by Article 201 of the Solvency Regulation.
- Practical application:
  - Adequacy of models for determining internal capital and internal capital allocation are central in the annually conducted SREP/JRAD (see CP15 EC1).
  - SREP/JRAD includes off-site analysis of CI-submitted information and data.
  - Internal capital adequacy and quantification of market risk for Pillar II are extensively covered in on-site ICAAP inspections and market risk inspections.

### EC6 — Stress testing
- The supervisor requires banks to include market risk exposure in their stress testing program for risk management purposes.
- Legal basis:
  - VaR CIs: Article 22p para. 5 no. 1 lit. b of the Banking Act in conjunction with Articles 224 to 232 of the Solvency Regulation require VaR CIs to perform stress testing and reverse stress testing (Article 230 para. 5 of the Solvency Regulation); results must be sent to FMA and OeNB on a quarterly basis. OeNB examines stress testing procedures during the approval process.
  - All CIs: Article 70 para. 1 of the Banking Act allows OeNB on-site inspections in which stress testing issues are addressed.

*Source: _cr1413 - 1. Legal Framework*

### 2. Practical Application

### _cr1413 - 2. Practical Application

### On-site inspections, scenario analysis, stress testing and contingency planning
- The criteria laid down in EC 6 are reviewed in the course of on-site inspections.
- Scenario analysis, stress testing and contingency planning are addressed in detail in the OeNB Guidelines on Market Risk (Volume 3, “Evaluation of Value at Risk–Models”, and Volume 5, “Stress Testing”).
- Stress testing including reverse stress testing is covered in OeNB’s internal examination standards for on-site inspections.
- Stress testing results submitted by CIs which utilize an internal model based approach for calculating minimum capital requirements for market risk in the Trading Book are analyzed off-site on a quarterly basis.
- Assessment of Principle 22: Compliant

### Trading operations of Austrian CIs (comments)
- Trading operations of—even the largest—Austrian CIs are relatively limited.
- Focus: flow trading and limited warehousing positions to meet future clients’ needs.
- Proprietary trading strategies: “hardly exist anymore,” most were scrapped over the last four years.
- Traded instruments: mostly plain vanilla derivatives and cash instruments in FX and interest rate (including credit) markets.
- Equity instruments and derivatives: play a minor role.
- Exotic structures: traded in limited amounts; most noteworthy exposures to exotic markets arise from operations in CESEE countries, leading to small trading positions in those countries’ FX, interest rate and equity markets.

### Principle 23 — Interest rate risk in the banking book
- Principle summary: The supervisor determines that banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate risk75 in the banking book on a timely basis. Systems take into account the bank’s risk appetite, risk profile and market and macroeconomic conditions.
- Assessment of Principle 23: Compliant

#### EC1 — Strategy and management framework
- Legal basis: Interest rate risk in the banking book forms part of general due diligence obligations (directors’ responsibilities) per Article 39 of the Banking Act; general principles in Article 39 paras. 1, 2 and 2b.
- ICAAP requirement: CIs must develop and maintain an ICAAP that identifies risks and allocates adequate internal capital (Article 39a para. 1).
- Responsibility: Overall responsibility for ICAAP assigned to the management board; must ensure risk-bearing capacity and measurement/limitation of all material risks including interest rate risk.
- Supervisory monitoring: FMA and OeNB monitor interest rate risk based on Article 69 para. 2; Article 69 para. 3 requires FMA’s review (SREP) to include exposure to interest rate risk arising from non-trading activities and mandates measures if a CI’s economic value declines by more than 20% of own funds as a result of a sudden and unexpected change in interest rates, the size of which is prescribed by the FMA and must not differ between CIs.
- Prescribed shock: The interest rate shock prescribed by FMA is currently 200 bps.
- Guidance: FMA/OeNB guidelines on Interest Rate Risks in the Banking Book (“Leitfaden zum Management des Zinsrisikos im Bankbuch“), published in 2008.
- Supervisory practice: Commensurability of measurement, monitoring and steering subject to ongoing supervisory attention off-site and on-site; compulsory interest rate statistics (Zinsrisikostatistik) serve as basis for off-site evaluations; data combined with market data in an in-house Value-at-Risk model; Incremental-VaR used to interpret results relative to other sources of risk and risk bearing capacity.
- On-site: ICAAP and Pillar II risk categories are regular subjects of on-site inspections; OeNB internal examination standards implemented in IT system BOSS; last major update of BOSS modules performed in 2012 (English translation being compiled).

#### EC2 — Board approval and senior management implementation
- Legal framework reference: See EC1.
- Requirements: CIs must have administrative, accounting and control mechanisms for capture, assessment, management and monitoring of interest rate risk (Article 39 paras. 2 and 2b).
- Internal audit: Adequacy of procedures must be reviewed by internal audit at least once per year (Article 42 para. 4 no. 5).
- ICAAP/SREP coverage: Interest rate risk covered by ICAAP/SREP framework (Pillar II); reviewed off-site and via on-site inspections dedicated to market risks in the Banking Book.

#### EC3 — Measurement systems, model validation, limits, exceptions, information systems
- Legal basis: Article 39a pars 1 and 2 of the Banking Act.
- Requirements:
  - CIs must have systems for measuring, monitoring, controlling and reporting interest rate exposures capturing all material sources (Article 39).
  - Establish and enforce consistent limits and practices to maintain exposures within levels consistent with internal capital (Article 39 para. 1).
  - Assumptions underlying systems must be clearly understood and validated regularly (Article 39a para. 2).
  - FMA must act if economic value declines by more than 20 percent of own funds due to a sudden and unexpected interest rate change (currently 200 basis points); range of measures set in Article 70 paras. 4 and 4a.
- Supervisory methods: Review based on on-site inspections and off-site activities using reports and quantitative analysis models; EC3 (a)-(e) covered in OeNB internal standards for on-site inspections (ICAAP and market risks in the Banking Book).

#### EC4 — Stress testing
- Requirement: Banks must include appropriate scenarios into stress testing programs to measure vulnerability to loss under adverse interest rate movements.
- Context: Under Pillar II, CIs should consider stress testing for diagnostic and forward-looking assessment of internal capital adequacy.
- Supervisory expectations: CIs develop systems and stress tests commensurate with their risk profile; mechanisms must include macroeconomic environment risks (Article 39 para. 2b no. 10).
- Reporting requirement: CIs must provide results of internal measurement systems, in addition to a standardized approach, expressed as change in economic value relative to own funds (sum of Tier I and Tier II capital) using a parallel 200 basis point shift.
- Scenario types: Parallel shifts, basis risk, yield curve twists and butterflies, changes in volatility, shifts in customer behavior, etc.
- Stress testing objectives (what CIs should answer):
  - What will the loss be in the event of the specified scenarios?
  - What are the institution’s worst case scenarios?
  - What can CIs do to limit the losses incurred in the worst case scenarios?
- Guidance: FMA/OeNB guidelines on Interest Rate Risks in the Banking Book (2008), especially Section 4.4.3; OeNB internal examination standards comprehensively cover interest rate stress testing and underpin regular on-site inspections.

#### AC1 — Supervisor obtains internal measurement system results (standard shock)
- Reporting since end-2002: OeNB uses quarterly reports on interest rate statistics (“Zinsrisikostatistik”) to monitor interest rate risk in the banking book of all CIs.
- Reporting content and basis: Interest rate gap analysis following Basel Committee’s “Principles for the management and Supervision of Interest Rate Risk—Annex 4”; reporting requirements specified in Article 74 para. 1 of the Banking Act.
- Zinsrisikostatistik: Standardized reporting framework as part of the Asset, Income and Risk Statement; all interest-sensitive assets, liabilities and OBS positions slotted into 13 predefined time bands by residual maturity or repricing date; NOMALS assigned by judgment and past experience; material changes to assumptions must be documented and reported.
- Additional reporting: CIs must provide quarterly results of internal measurement systems in terms of threat to economic value using a standard rate shock defined as a parallel 200 basis point shift.
- Controls: Internal audit must review accuracy and completeness of notifications and reports; reported figures subject to off-site analysis by OeNB and ongoing supervision by FMA; FMA may demand additional information per Article 70 para. 1 no. 1.
- On-site validation: CIs’ modeling assumptions and differences between regulatory reporting and internal models are examined in on-site inspections.

#### AC2 — Assessment of internal capital measurement systems
- Supervisory framework: Supervisory Review Evaluation Process pursuant to Article 69 para. 2 monitors adequacy of capital for material risks and adequacy of procedures in Article 39 paras. 1 and 2 and Article 39a, with special regard to risks in Article 39 para. 2b.
- Interest rate risk inclusion: Article 69 para. 3 requires SREP to include interest rate risk in the banking book.
- Information sources: On-site inspections, bank auditor reports (Article 63 para. 3), and FMA’s authority to demand information (Article 70 para. 1 no. 1).
- Treatment: Adequacy of internal capital systems and interest rate risk treated in annual SREP/JRAD and during on-site inspections.
- Assessment of Principle 23: Compliant

### Principle 24 — Liquidity risk
- Principle summary: The supervisor sets prudent and appropriate liquidity requirements (quantitative or qualitative) that reflect banks’ liquidity needs; supervisor determines banks have a strategy enabling prudent management and compliance; strategy considers risk profile, market and macroeconomic conditions; at least for internationally active banks, requirements are not lower than applicable Basel standards.
- EC1 — Prescribed liquidity requirements and monitoring tools
  - Legal basis: Article 39 general due diligence obligations explicitly applicable to liquidity risk (Article 39 para. 2c); Article 25 para. 1 requires CIs to ensure they are able to meet payment obligations at any time via company specific financial and liquidity planning and maintaining sufficient liquid funds.
  - Documentation: CIs must maintain documentation to calculate the CI’s financial situation with reasonable accuracy at all times.
  - Two ratios under Article 25:
    - First degree liquidity: ratio of highly liquid assets (cash in hand, balances with the national bank, Euro sight deposits with the respective central institution) in relation to liabilities of the first degree (demand deposits or deposits with periods of notice or terms less than 6 months).
    - Second degree liquidity: ratio of second degree liquid assets (checks, bonds due, fixed income securities admitted to an Austrian stock exchange or regulated stock exchange of an EU member state, demand moneys and forward deposits with CIs subject to periods of notice or terms less than six months) in relation to second degree liabilities.
  - Required thresholds:
    - First degree liquidity has to exceed 1.0 percent.
    - Second degree liquidity has to exceed 20 percent of the corresponding liabilities (see Article 25 of the Banking Act and Article 1 of the 5th Regulation on Liquidity (5. Liquiditätsverordnung)).
  - Off-balance sheet: When calculating first and second degree liquidity ratios, CIs must consider off-balance sheet exposures arising from repurchase transactions.
  - Supervisory tool: The FMA also operates a cash-flow liquidity measurement system introduced in ... (text ends). 

*Source: _cr1413 - 2. Practical Application.*

### 2008. Data is therefore available for almost five years. Approx. 30 Austrian banks

### _cr1413 - 2008. Data is therefore available for almost five years. Approx. 30 Austrian banks

### Liquidity risk (Principle 24)
- Reporting coverage and frequency:
  - Approx. 30 Austrian banks (on a consolidated / sub-consolidated level) report on a weekly basis, covering more than 80 percent of total assets of the consolidated Austrian banking system.
  - Cash inflows broken down by 14 positions and outflows by 16 positions; available counter-balancing capacity reported in 11 positions.
  - Each position reported by maturity buckets: up to 5 days / 1 month / 3 months / 6 months / 1 year.
  - Currencies reported: EUR, USD, CHF, GBP, JPY, Other.
  - Reports are analyzed every Friday and serve as primary data source for the OeNB’s liquidity stress test.
- Legal and regulatory framework:
  - Article 25 para. 1 of the Banking Act requires CIs to ensure they can meet payment obligations at any time and to maintain sufficient liquid funds and company specific financial and liquidity planning.
  - Liquidity Risk Management Regulation (Liquiditätsrisikomanagementverordnung—LRMV) complements Articles 25 and 39 of the Banking Act and specifies qualitative minimum requirements (including CEBS guidelines application).
  - LRMV requires institutions to consider alternative scenarios, review underlying assumptions at least annually, adjust strategies/policies/limits, and develop contingency plans.
  - Article 25 of the LRMV obliges CIs to maintain a system of limits and liquidity buffers and an adequately diversified funding structure.
  - Article 1 para. 2 of the LRMV requires adaptation to respective currencies and adequate internal fund transfer prices.
- Supervisory expectations and practices:
  - Supervisors determine that banks must maintain sufficient liquidity to withstand a range of stress events, have board-approved policies, bank-wide liquidity views, and proportional strategies tailored to business lines, currencies, branches and legal entities.
  - LRMV (Articles 45–47) requires liquidity recovery plans (contingency funding plans) be in place, tested at least annually, and assessed via on-site and off-site supervision.
  - Article 5 and Article 6 para. 1 of the LRMV mandate inclusion of institution-specific, market-wide and combined scenarios; off-balance sheet items and SSPEs considered.
- Special issues and supervisory assessment:
  - Austrian banks have a stable funding profile relying heavily on retail and corporate funding; loan to deposit ratio both within Austria and including foreign subsidiaries is about 125 percent.
  - FMA will monitor a Loan to Local Stable Funding Ratio of 110 to 100 (local loans to local deposits) under the recently introduced sustainability package.
  - FX loan exposures of particular concern: FX loans currently stand at about EUR 50 billion; banks report appropriate swap arrangements in place.
- Assessment of Principle 24: Compliant

### Operational risk (Principle 25)
- Legal and supervisory framework:
  - Article 39 para. 2 of the Banking Act explicitly mentions operational risk among managerial duties.
  - Article 22i para. 1 of the Banking Act provides choice of three approaches to calculate operational risk minimum capital requirements: Basic Indicator Approach (BIA), Standardized Approach (STA), Advanced Measurement Approach (AMA).
  - As of June 2012, CIs covering approximately 70% in terms of total capital requirements use either AMA or STA.
  - Austrian supervisor published detailed guideline on management of operational risk (November 2005) and commits to apply EBA Guidelines (Article 69 para. 5 of the Banking Act).
  - Integrated EBA Guidelines include: Guidelines on AMA extensions and changes; Guidelines on management of operational risks in market-related activities; Guidelines on operational risk mitigation techniques; Compendium of Supplementary Guidelines on Implementation Issues of Operational Risk; Guidelines on Outsourcing.
- Board approval, ICAAP and oversight:
  - Supervisor requires banks’ operational risk strategies/policies/processes (including risk appetite) be approved and regularly reviewed by banks’ Boards.
  - CIs must submit an in-depth ICAAP questionnaire annually; CRO signs the questionnaire; on-site examinations validate implementation.
  - Risk appetite must be consistent across risk types and derived from overall target rating (example: confidence level of 99.95% and one year horizon for operational VaR when AA target and LDA used).
- Implementation and operational requirements:
  - Article 22k (TSA) and AMA requirements specify documented, effective assessment and management systems, clear responsibilities, reporting systems, integration into overall risk management, and annual reviews by auditors.
  - AMA users must have an independent operational risk function, operational risk managers across units, separation of responsibilities, Operational Risk Committee, and daily integration of measurement systems.
- Business continuity and IT:
  - Business continuity management (BCM) reviewed via on-site examinations; BCM examined during AMA approval, operational risk examinations, ICAAP, or IT examinations.
  - Article 39 paras. 1 and 2 imply duty to have appropriate IT policies/processes; comprehensive enterprise IT security policy required with sections covering: Information security objectives and strategy; Organisational structure; Risk analysis strategies; Considerations on data protection.
  - Supervisor increasing IT examination priority; IT examinations conducted in two of Austria’s largest CIs in the reported year.
- Data, reporting and loss data:
  - Article 22k requires collection of relevant operational loss data and reporting systems for management.
  - Loss-Data-Reporting Regulation requires TSA/AMA CIs to report yearly each loss-event above the CI-determined threshold with fields including subsidiary, gross loss amount, loss mitigation, business line, event type, date, verbal description.
  - All CIs currently report losses above either EUR 1,000 or EUR 5,000.
  - AMA CIs must submit a system description every three years and a validation report yearly.
- Outsourcing:
  - CIs required to have comprehensive outsourcing risk management programs, due diligence, written contracts/service level agreements, confidentiality protections, contingency plans and disaster recovery.
- Assessment of Principle 25: Compliant

### Internal control and audit (Principle 26)
- Legal framework and core requirements:
  - Article 39 paras. 1–2 Banking Act requires adequate administrative, accounting and control procedures; Article 42 requires internal audit unit reporting directly to the Executive Board.
  - Internal audit must examine adequacy and enforcement of procedures at least once a year; high-risk areas reviewed more frequently.
  - Article 63a para. 4 no. 2 requires audit committee for CIs with total assets exceeding EUR 1 billion or listed transferable securities; audit committee must convene at least twice in a business year.
  - Separation of duties and “four eyes” principle are enforced (Executive Board must comprise at least two members; individual powers of representation generally excluded).
- Accounting and reporting responsibilities:
  - Article 43 para. 1 and UGB (Company Code) principles govern bookkeeping and accounting; consolidated financial statements of listed companies must use IFRS per Regulation (EC) No. 1606/2002 for financial years starting on or after 1 January 2005.
  - Financial statements and auditors' reports must be submitted within six months after the end of the financial year (Article 44 para. 1); late submissions can be punished with up to EUR 50,000.
- Internal audit standards and minimum requirements:
  - FMA Minimum Standards for Internal Auditing (February 2005) specify qualifications, independence, permanent establishment, reporting lines, audit planning and reporting, prohibition of self-audit, and requirement to notify FMA of head of internal audit.
  - Internal audit must have unrestricted access to records, staff and group information necessary to perform duties.
- Compliance and control functions:
  - MiFID transposition (Securities Supervision Act 2007) imposes requirement for an independent compliance function for investment services; no explicit overall business-wide compliance function requirement for all banks (larger banks typically have one in practice).
- Resourcing and independence:
  - Minimum Standards require head of internal audit to have at least three years’ practical banking experience and ongoing training for staff.
  - Internal audit reports material results quarterly to supervisory board chairperson and must alert Executive Board without delay if CI’s existence or obligations at risk.
- Assessment of Principle 26: Largely compliant
- Comments:
  - EC3: narrow legal requirement for compliance function limited to securities services; recommendation that banks be required to establish a separate compliance committee for all banking business.
  - Consideration recommended to lower the audit committee threshold from EUR 1 billion to, e.g., EUR 500 million.

### Financial reporting and external audit (Principle 27)
- Board and management responsibility:
  - Executive Board responsible for legal compliance of annual and consolidated financial statements, management and group reports (Articles 43 and 44 Banking Act).
  - FMA issues and may amend forms/templates used for financial statements (Article 43 para. 2).
- Accounting standards and timing:
  - Solo financial accounts prepared using Austrian GAAP; consolidated financial statements of listed companies must be prepared on an IFRS basis.
  - Audited annual financial statements, consolidated statements, management reports and bank-specific questionnaire (Annex to the Audit Report) must be submitted within 6 months (Article 44 para. 1); late submission subject to up to EUR 50,000 penalty.
- External audit scope and requirements:
  - Article 60 para. 1 requires audits of financial statements and reports; professional rules and Chamber regulations align with International Standards on Auditing.
  - Article 63 para. 5 requires an Annex to the Audit Report (AP-VO) answering banking-specific questions; AP-VO defines form and layout.
  - Bank auditors must ensure continuing professional education and quality assurance per Article 62 and Article 63.
- Auditor appointment, independence and rotation:
  - FMA has power to reject and rescind appointment of external auditors per Article 63 paras. 1 and 1c and Article 62 listing exclusion criteria.
  - CIs must notify FMA of elected audit firm within 2 weeks of shareholders’ meeting; natural person(s) responsible for audit must be named.
  - Rotation: Article 271a UGB and banking rules require internal rotation after five years for individuals signing audit reports; firms or individuals must observe cooling-off periods.
- Auditor reporting to supervisor:
  - Article 63 para. 3 obliges bank auditors to report ad-hoc matters of material significance to FMA and OeNB (material legal violations, risk of inability to fulfill obligations, risk to CI’s existence); failure can be punished up to EUR 50,000.
- Access to auditors’ working papers:
  - Supervisor does not have power to access auditors’ internal working papers due to professional confidentiality; FMA considers inspection of working papers of minor additional value given extensive auditor regulatory functions.
- Assessment of Principle 27: Largely compliant
- Comments:
  - EC1: requirement for solo accounts in Austrian GAAP raises question of alignment with “accounting policies and practices that are widely accepted internationally”.
  - Recommendation: consider granting FMA power to access external auditors’ working papers where necessary.

### Disclosure and transparency (Principle 28)
- Legal requirements and scope:
  - Banking Act Articles 26 and 26a require publication at least once per year of information relating to organizational structure, risk management and risk capital position.
  - Disclosure Regulation (Offenlegungsverordnung—OffV) further specifies disclosure content, including risk management objectives and policies separately for each risk category.
  - CIs must ensure adequacy of disclosed information via binding internal policies and define medium of disclosure; disclosure in audited annual financial statements considered generally accessible.
  - FMA published a circular on disclosure (“Rundschreiben der FMA zu Sonderfragen der Offenlegung gemäß §§ 26 und 26a BWG”) in February 2009.
  - Directors’ failure to meet submission deadlines can be punished (Article 98 para. 2 no. 11).
- Content and frequency:
  - Disclosures must include strategies and processes to manage risks; structure and organization of risk management functions; scope and nature of risk reporting and measurement systems; policies for hedging/mitigating risk and monitoring effectiveness.
  - Article 26 para. 3 allows more frequent disclosure where necessary due to scope, nature, cross-border presence, market activities or participation in payment/settlement systems.
  - In practice, large CIs often disclose PIII information semi-annually.
- Remuneration and other specific disclosures:
  - Article 26 para. 9 Banking Act: FMA collects remuneration policy information and submits it to EBA for aggregate publication.
  - Article 15a of the Disclosure Regulation requires disclosure of remuneration policies and key elements, parameters and principles of remuneration systems.
- Group and entity-level disclosure:
  - Consolidated disclosure requirements and mapping to forms/templates specified (Article 43 para. 2; Article 59a; Disclosure Regulation sections referenced).
  - Subordinate CIs whose superordinate institution complies on consolidated basis may be exempted; Article 26a(5) can impose extra disclosure where an important subsidiary exists.
- Assessment of Principle 28: (assessment text truncated in source) — required disclosures and practice described in detail in the Disclosure Regulation and Banking Act.

*Source: Extract from the IMF Financial Sector Assessment/Report content provided in the input PDF chapter/section.*

### 3. The following information is to be provided:

### _cr1413 - 3. The following information is to be provided:

### EC4 — Supervisor review and enforcement of disclosure standards
- All CIs have to submit their financial statements, consolidated financial statements, notes and the PIII information to the FMA and OeNB.
- All reports are recorded and stored in a database and analyzed periodically by the supervisor.
- In case of inadequateness or error in disclosure, CIs are prompted by OeNB and FMA to make a comment.
- In case of material errors in disclosure standards:
  - CIs are instructed by the FMA, on pain of fines, to restore legal compliance within a certain period of time appropriate in light of the circumstances.
  - In cases of repeated or continued violations, the FMA prohibits the directors to conduct banking business completely or partly, unless inappropriate based on the nature and severity of the violation and if restoration of legal compliance can be expected soon.
- Enforcement by the FMA with regard to compliance with IAS/IFRS disclosure is currently established, and thus expected for 2014.
- PIII information is not being externally audited. Where included in notes to the financial statements, consistency with the audited accounts will be assessed.

### EC5 — Publication of aggregate banking system information
- FMA and OeNB periodically publish reports on the banking system via ad-hoc press releases and in their annual reports.
- OeNB regularly publishes the Banking Stability Report (Finanzmarktstabilitätsbericht) and special reports (Facts on CIs in Austria, Banking Supervision in Austria, FMA/OeNB Guidelines) on aggregated data of the banking system.

### Additional Criteria AC1 — Disclosure that aids understanding of risk exposures
- CI related public reports provided by OeNB and FMA can be downloaded from the supervisors’ websites.
- The report on Banking Supervision in Austria and published FMA/OeNB Guidelines (e.g. on operational risk, credit risk) help understand risk development of CI business in Austria.
- For individual CIs, detailed risk information is disclosed every year giving a good view of risk development on a bank-specific level.
- No specific indicators have been prescribed that provide risk information from one to the other year for individual CIs.
- Assessment of Principle 28: Compliant.
- Comment: Recommend developing specific indicators to provide risk information across years for individual CIs.

### Principle 29 — Abuse of financial services (overview)
- Principle intent: Supervisor determines banks have adequate policies and processes, including strict customer due diligence (CDD) rules, to promote high ethical and professional standards and prevent use of banks for criminal activities.

### EC1 — Legal basis for AML/CFT supervisory duties and powers
- FMA duties, responsibilities and powers defined in:
  - Articles 1 para. 1 and 2 para. 1 of the Financial Market Authority Act (FMABG) in conjunction with Article 69 of the Federal Banking Act (Banking Act) — establish the FMA as competent authority for enforcement of supervisory acts, including Federal Banking Act provisions regarding AML/CFT as set out in Articles 40–41 of the Banking Act.
  - Article 3 para. 9 of the Banking Act — grants the FMA power to perform on-site inspections related to AML/CFT supervision.
  - Article 70 para. 1 no. 1 of the Banking Act and Article 22b of the FMABG — grant the FMA power to request information and inspect relevant documents and data.
  - Article 70 para. 4 of the Banking Act — provides for enforcement measures to restore legal compliance.
  - Article 22c of the FMABG — grants the FMA the right to provide information on or make public any measures taken as a result of certain violations specified therein.
  - Articles 98 para. 5 and 99 para. 1 no. 9 of the Banking Act — establish the FMA’s sanctioning powers in case of violation of the Banking Act.
- Note: Criminal activities are regulated in the Austrian Criminal Code (StGB); the Federal Banking Act regulates prevention and combating of ML/FT.

### EC2 — Supervisor determines banks have adequate AML/CFT policies and processes (CDD)
- FMA supervises CIs’ compliance with AML/CFT legal provisions and due diligence obligations set out in Articles 40–41 of the Banking Act.
- Pursuant to Articles 40–41 Banking Act CIs are required to:
  - Apply customer due diligence (CDD), i.e.:
    - Identification and verification of the identity of customers, authorized representatives and beneficial owners.
    - Risk-based and appropriate measures to obtain information on the purpose and nature of the intended business relationship.
    - Risk-based and appropriate monitoring of the business relationship.
    - Simplified and Enhanced CDD.
    - Record keeping.
  - Report cases of suspicion / file suspicious transaction reports (STRs).
  - Nominate AML/CFT compliance officer.
  - Implement and apply appropriate internal AML/CFT policies and processes.
  - Perform ML/FT risk analysis.
  - Provide staff with AML/CFT training and guidelines.
  - Pay attention to reliability and attachment to legal values when selecting staff.
- FMA determines compliance by performing on-site inspections (duration 1-2 weeks), company visits (half a day) and off-site investigation proceedings.

### EC3 — Reporting to supervisor in addition to FIU
- In addition to reporting to the A-FIU (Article 41 para. 1 of the Banking Act) CIs are required to submit quarterly risk statements to the FMA containing, inter alia, AML/CFT compliance relevant information (Article 74 para. 1 in conjunction with Article 39 para. 2b no. 11 of the Banking Act).

### EC4 — Supervisor shares information with FIU and prosecutors
- Pursuant to Article 41 para. 5 of the Banking Act the FMA is obliged to report suspicious transactions to the A-FIU.
- FMA obliged to notify the public prosecutor’s offices when it becomes aware of instances indicating a potential criminal offence and to share all relevant information (Articles 78 and 79 of the Criminal Procedure Act (StPO)).

### EC5 — CDD programme elements and ongoing risk-based measures
- Article 39 para. 2 of the Banking Act: CIs must have control mechanisms for capture, assessment, management and monitoring of risks arising from banking transactions and operations; mechanisms must cover ML/FT risks (Article 39 para. 2b no. 11).
- Article 40 para. 2b: CIs must subject their business to risk analysis using suitable criteria — products, customers, complexity of transactions, customer business and geography.
- CIs must demonstrate to the FMA that measures taken are appropriate in view of ML/FT risks.
- Specific EC5 elements:
  - (a) Customer acceptance policy: Article 41 para. 4 no. 1 requires CIs to establish adequate CDD policies and procedures (including customer acceptance policy based on CI’s risk analysis).
  - (b) Customer identification, verification and due diligence: Article 40 paras. 1, 2 and 2a no. 1 require identification and verification of customers, authorized representatives and beneficial owners; Article 40 para. 2a no. 2 and 3 obliges risk-based measures to obtain information on purpose and to keep information up to date.
  - (c) Monitoring and recognizing unusual or potentially suspicious transactions: Article 40 para. 2a no.3 requires ongoing monitoring to ensure transactions are consistent with CI’s knowledge of the customer; Article 41 para. 1 requires special attention to complex or unusually large transactions and unusual patterns without apparent economic purpose.
  - (d) Enhanced due diligence on high-risk accounts: Article 40b requires additional due diligence measures on a risk sensitive basis and enhanced ongoing monitoring in higher risk situations; FMA’s Regulation on Money Laundering and Terrorism Financing Risk (GTV) identifies listed countries requiring enhanced CDD and monitoring, including FATF Public Statement countries with strategic deficiencies.
  - (e) Enhanced due diligence on politically exposed persons (PEPs): Article 40b para. 1 no. 3 requires procedures to determine whether a customer is a PEP; senior management approval required before establishing business relationships with PEPs; establish source of funds and conduct enhanced ongoing monitoring.
  - (f) Record retention: Article 40 para. 3 requires retention of CDD documents and records of all transactions for at least five years; FMA can issue regulations extending retention up to no longer than 15 years.
- FMA assesses adherence to CDD obligations via on-site inspections (duration 1–2 weeks), company visits (half a day), and off-site proceedings; sample case assessments used during on-site inspections.

### EC6 — Correspondent banking controls
- Correspondent banking relationships are subject to enhanced due diligence pursuant to Article 40b para. 1 no. 2 of the Banking Act.
- (a) Article 40b para. 1 no. 2 lit. a requires CIs to gather sufficient information about correspondent banks to understand nature of business and supervision quality based on publicly available information; Article 40b para. 1 no. 2 lit. c requires senior management approval before establishing new correspondent relationships.
- (b) Article 40b para. 1 no. 2 lit. b requires CIs to satisfy themselves of correspondent banks’ AML/CFT controls.
- Article 40d requires CIs not to enter into or continue correspondent relationships with a shell bank and to take measures to ensure they do not engage with CIs that permit their accounts to be used by a shell bank.
- FMA evaluates application of enhanced due diligence on correspondent relationships via on-site inspections (duration 1–2 weeks), company visits (half a day) and off-site proceedings; correspondent relationships serve as selection criteria for sample case assessments.

### EC7 — Controls and systems to prevent, identify and report ML/FT
- Article 41 para. 4 no. 1 obliges CIs to establish policies and procedures for CDD, reporting, record keeping, internal control, risk assessment, risk management, compliance management and communication to prevent ML/FT and to address misuse of new technologies for ML/FT.
- Article 41 para. 1 requires attention to complex or unusually large transactions and unusual patterns without apparent lawful purpose; background checks where transactions are linked to higher risk states.
- FMA determines compliance via on-site inspections (duration 1–2 weeks), company visits (half a day), and off-site proceedings; systems evaluation is a core audit module in on-site inspections.

### EC8 — Powers to take action against non-compliant banks
- Remedial actions applicable to AML infringements are set out in EC2 of Principle 11 (Corrective and Sanctioning Powers):
  - FMA can instruct CI on pain of penalties to restore legal compliance pursuant to Article 70 para. 4 of the Banking Act.
  - In repeated or continued violations, FMA may completely or partly prohibit directors from managing the CI.
  - FMA has power to revoke the license where other measures cannot ensure functioning of the CI.
- Article 98 para. 5: FMA can issue administrative penal sanctions where persons responsible for AML/CFT compliance are found guilty, even through negligence:
  - Punishment: term of imprisonment of up to 6 weeks or a fine of up to EUR 150,000.

### EC9 — Internal audit, compliance officers, screening, and training
- (a) Internal audit and external auditor responsibilities:
  - Article 42 para. 1 requires CIs to set up an internal audit unit reporting directly to directors for ongoing and comprehensive reviews, including AML/CFT compliance; FMA must have access to relevant documents (Articles 3 para. 9 and 70 para. 1).
  - Article 63 para. 4 no.3 requires external auditor to assess CI’s compliance with AML/CFT provisions; result presented in an annex to the audit report (Article 63 para. 5); annex must be submitted to the FMA (Article 63 para. 5 in conjunction with Article 44 para. 1).
  - External auditor obliged to report facts indicating violations directly to the FMA (Article 63 para. 3); FMA inspects annexes to determine if an investigation should be initiated.
- (b) Compliance officers:
  - Article 41 para. 4 no. 6 obliges CIs to nominate a special AML/CFT compliance officer who reports only to the board of directors, must have sufficient authority and free access to all information, data, records and systems related to ML/FT.
  - FMA has issued a circular on responsibilities and competencies of the AML/CFT compliance officer.
- (c) Screening for staff, agents, outsourcing:
  - Article 5 para. 1 of the Banking Act: FMA determines whether CI directors and holders of a qualified participation meet requirements for sound and prudent management, including personal reliability and professional qualification.
  - Article 41 para. 4 no. 3 requires CIs to pay attention to reliability and attachment to legal values when selecting staff; same attention prior to electing supervisory board members.
  - FMA Circular on Identification and Verification of Identity for Credit Institutions requires measures to familiarize agents with CDD obligations, including training and regular updates.
- (d) Training:
  - Article 41 para. 4 no. 3 requires CIs to take suitable measures to familiarize staff with provisions to prevent or combat ML/FT, including participation in special training programs to recognize potentially connected transactions.
- FMA determines compliance via on-site inspections (duration 1–2 weeks), company visits (half a day), and off-site proceedings.

### EC10 — Internal reporting channels and management information systems
- Article 41 para. 4 no. 1 requires implementation of appropriate strategies for reporting suspicious transactions.
- FMA’s Circular on Suspicious Transaction Reports elaborates that strategies must include:
  - Appropriate internal written instructions on procedures for filing STRs.
  - Information on responsibility for assessment of suspicious cases and filing of STRs.
  - Indication of cases in which a report should be made to the AML/CFT compliance officer.
  - Defined reporting hierarchy and administrative channels from front-line staff up to the compliance officer.

### EC11 — Protection for staff reporting suspicious activity
- Article 38 para. 2 no. 2 of the Banking Act: obligations to maintain banking secrecy do not apply for disclosing suspicious transactions.
- Labor laws ensure staff who act in good faith in carrying out their function cannot be held liable for their actions.
- Article 41 para. 7: damage claims may not be asserted because a CI or employee delayed or omitted execution of a transaction in negligent ignorance that the suspicion of ML/FT or violations was incorrect.

### EC12 — Information sharing with domestic and foreign supervisors
- Passing of information with other supervisory authorities is permitted under Article 77 of the Banking Act, based on EU Directives 2006/48/EC and 2002/87/EU.

### EC13 — In-house AML/CFT expertise and outreach
- In 2011 the FMA consolidated AML/CFT supervisory responsibilities in one division with currently 12 staff and an additional AML/CFT expert in “International Affairs and European Integration” division.
- FMA measures to raise awareness of ML/FT risks include:
  - AML/CFT workshops for CIs (in-house and on-site) and training courses at educational institutions.
  - Processing legal requests.
  - Publication of circulars:
    - Circular on Identification and Verification of Identity for Credit Institutions
    - Circular on Suspicious Transaction Reports
    - Circular on the Risk Sensitive Approach
    - Circular on the Transmission of Payer Information
    - Circular on AML Officer
- Article 41 para. 4 no. 6: the A-FIU must provide CIs with access to up-to-date information on practices and typologies related to ML/FT and indications leading to recognition of suspicious transactions.

### Assessment of Principle 29
- Assessment: Compliant.
- Comments:
  - Austria was the subject of a FATF Mutual Evaluation Assessment in June 2009. It was criticized for:
    - having exemptions from CDD rather than simplified due diligence;
    - not requiring identification of the beneficial owner and verification of the identification of the holder of saving accounts with a balance lower than EUR 15,000 and that are not registered in the customer’s name;
    - having a too limited list of suggested high-risk customers; and
    - not having issued guidelines on the risk-based approach for financial institutions.
  - The Mutual Evaluation Assessment of June 2009 was followed up by two follow-up reports (in 2011 and 2012). A third follow-up report is scheduled for later in 2013.
  - According to the FMA, there is just one issue outstanding relating to the definition of terrorist financing; FMA believes the issue is one of interpretation and will be cleared up at a forthcoming meeting. FMA has asked FATF that this be the last follow-up meeting.
  - As a consequence of the 2009 Mutual Evaluation Assessment, the FMA introduced new provisions, including raising the upper limit of sanctions for violations of AML/CFT obligations from EUR 75,000 to EUR 150,000.

*Source: _cr1413 - 3. The following information is to be provided: (PDF chapter/section).*

### 1. Responsibilities,

### 1. Responsibilities, objectives and powers

### Key findings
- C EC 2: The FMA’s mandate includes that it must consider the national economic interest in maintaining an efficient banking system and financial market stability. Taking into account the national economic interest when executing banking supervision, might endanger the primary objective to promote the safety and soundness of banks. This issue is further considered in the context of CP 2, EC 1.
- EC 6: The assessors view that a number of powers are lacking with respect to taking timely corrective actions, imposing sanctions to CI’s, directly taking a supervisory measure against a director and on triggering resolution. This is further considered in the context of CP 11.

---

### 2. Independence, accountability, resourcing and legal protection for supervisors

### Key findings
- LC EC 1: Findings that might endanger operational independence:
  - representatives of the industry are present in the supervisory board, although they do not have voting rights.
  - the supervisory board, with representatives from the MoF, the OeNB, the FMA and the industry, has to confirm new FMA staff that operate at the second level.
  - given the rules laid down on the starting dates in combination with the length of the terms of the individual members of the supervisory board, normally all members of the supervisory board would start and end their term at the same point in time. Given that the MoF will nominate the members of the supervisory board, this could be envisaged as appointments of supervisory board members along the lines of the political cycle.
  - Pursuant to Article 16 para. 4 FMABG, the Federal Minister of Finance is authorized to commission the FMA with conducting on-site inspections. Effectively, this right of the MoF could potentially set the priorities for undertaking on-site inspection activities and thereby endanger the FMA’s operational independence, though in practice this right has only been used once.
  - The FMA must obtain consent from the MoF when issuing new regulations that are mandated by the Banking Act to the FMA.; in providing consent, the MoF would especially determine whether the FMA would continue to act within its scope of activities and the mandate provided, though it is not clear whether this would be the only consideration.
  - The MoF has the right to receive all the information from the FMA that in its view is necessary to effectively oversee the operations by the FMA. In case the frequency would be too high, this may have adverse effect on the independent operations of the FMA, though we have understood that to date only a few queries for information have been made by the MoF.
  - In CP 1, the assessors already noted that FMA’s objectives as defined by law prescribe that it must consider the national economic interest in maintaining an efficient banking system and financial market stability, when monitoring compliance with the provisions of the Banking Act. Taking into account the national economic interest when executing banking supervision, might endanger the primary objective to promote the safety and soundness of banks and might also endanger its operational independence. In practice the assessors have not identified any circumstances whereby the national economic interest has impeded the FMA’s supervisory objectives. However, given its potential negative influence on FMA’s operational independence, it should be clarified that considering the national economic interest might never impede FMA’s supervisory considerations.
  - There is no direct access from Internal Audit to the Supervisory Board for all topics that it considers relevant.
- EC 2: There is no legal obligation to publicly disclose the reasons for the dismissal of a member of the Executive Board.
- EC 9: Weaknesses identified (in consultation with the FMA and OeNB legal experts):
  - (i) there is no cap on the liability of FMA/OeNB bodies and staff;
  - (ii) there are no safeguards for FMA/OeNB bodies and staff to protect them against self-incrimination while assisting the Bundes Finanzprokuratur;
  - (iii) FMA/OeNB bodies and staff are also held liable in cases where courts have found supervised financial institutions or their managers non-compliant with prudential rules.

---

### 3. Cooperation and collaboration

### Key findings
- C EC 2: In practice, with a number of foreign supervisory authorities outside the EEA that supervise subsidiaries of an Austrian parent CI, arrangements on confidential supervisory information exchange are absent, which means that confidential supervisory information cannot be exchanged. See comments under BCP 13 Home-host relationships.

---

### 4. Permissible activities

### Key findings
- C (no further detail provided in source excerpt)

---

### 5. Licensing criteria

### Key findings
- MNC EC 2: The FMA has no specific powers to set itself criteria for licensing banks, though the criteria set in law are are quite detailed and in practice have not hindered a thorough examination of an application.
- EC 7: The FMA performs a fit & proper test on all directors that comprise the management board irrespective of the balance sheet and on the chairman of the supervisory board for CI’s with total assets exceeding EUR 750 million. The FMA does not have the legal powers to undertake a fit and proper test on any other senior employee of the CI, on members of the supervisory board, or on the chairman of the supervisory board in CIs with total assets below EUR 750 million. Additionally, the supervisor does not have the power or legal basis to require changes in the composition of the supervisory board if members of the supervisory board are not fulfilling their duties relating to these requirements. In case the chairman of the supervisory board would no longer qualify, the FMA could address measures towards the CI, not directly towards the persons concerned. The FMA would then order the CI to have the chair of the supervisory board removed. In second instance the FMA could prevent senior management from taken decisions that need approval of the supervisory board and/or the FMA could make its order towards the CI about the chairman of its supervisory board public.
- Update noted: As of May 2013, based upon new EBA guidelines on fit and proper testing, the FMA performs fit & proper testing on all new supervisory board members and on existing members on a risk based manner and that the respective articles in the Banking Act are expected to be changed as of 1st Jan 2014.
- EC 11: New entrants are subject to all relevant regulations as of the time of their licensing. No specific supervisory regime applies to new entrants.

---

### 6. Transfer of significant ownership

### Key findings
- C EC 6: There is no explicit notification requirement in the Austrian legislative framework for CIs to notify to the supervisor as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest.

---

### 7. Major acquisitions

### Key findings
- MNC EC 1: There is no prior approval process for investments by CIs in non-bank financial institutions outside the EEA or for non-bank non-financial institutions inside or outside the EEA. No prior approval is necessary for setting up a credit institution in a third country when this would be done by means of a greenfield operation.

---

### 8. Supervisory approach

### Key findings
- C EC 1: There is no specific unit or functionary responsible for the further development of the supervisory approach and methods, nor is there a quality control unit or quality manager responsible for the accompanying monitoring of the supervisory processes.
- EC 6: The obligation to draw up recovery and resolution plans currently exists for the 3 largest internationally active Austrian banking groups (i.e., Erste Bank Group, Raiffeisen Zentralbank, UniCredit Bank Austria) which cover almost half of the total bank assets as part of the Austrian Sustainability Package. The process between these three Austrian CIs and FMA/OeNB started in December 2011. End 2012 the CI’s have provided the FMA/OeNB with their draft plans which are now being assessed.
  - Bank Reorganisation Act passed by Parliament mid this year and will enter into force on 1st January 2014. It will oblige all institutions to draft recovery and resolution plans that will be assessed by the FMA.
  - Restructuring plans submission deadlines:
    - by 1st July 2015 for most institutions;
    - by 1st July 2014 for credit institutions with a balance sheet total exceeding 30 billion euros and credit institutions that receive funds directly from the ESFS or the ESM.
  - Resolution plans submission deadlines:
    - by 31st December 2015 for most institutions;
    - by 31st December 2014 for the credit institutions mentioned above.
  - The FMA will be given a set of early intervention tools.

---

### 9. Supervisory techniques and tools

### Key findings
- C EC 2: An overall multi-year planning process has not been established, although specific multi-year planning cycles exist for CI’s that would not be examined each year.
- AC 1: No specific framework exists for a periodic independent review on the supervisory processes undertaken by FMA and OeNB.

---

### 10. Supervisory reporting

### Key findings
- C EC 2: In practice, most CI’s report based upon national GAAP. Just a few CI’s provide their prudential reports, based upon IAS/IFRS accounting. Most large CI’s use IFRS for their published financial statements. These CI’s will need to change their accounting principles used for their prudential reporting in the near future, as soon as the Basel III requirements come into force in the EEA, which is expected as of 2014. The draft Directive implementing Basel III requires CI’s to use IFRS for prudential purposes, insofar it is already used for their financial purposes. See Article 4 No.53 of the proposed CRR that refers to an ‘applicable accounting framework’.

---

### 11. Corrective and sanctioning powers of supervisors

### Key findings
- LC EC 3: The FMA does not have the powers to directly intervene at an early stage by issuing an order to remedy a deficiency in for instance the CI’s risk management systems or by issuing an order that would prohibit, limit or set other conditions on the business activities or exposures of [text truncated in source].
- EC 5: Not the CI, but only natural persons can be penalized for administrative and criminal offences respectively. Changes in that respect will enter into force on 1st of January 2014 by the transposition of CRD IV/CRR.
- EC 5: In case a director of a CI or a chairman of the supervisory board do not fulfill the conditions of Article 5 para. 1 nos. 6 to 13 Banking Act concerning fit & properness, the FMA itself cannot directly take a supervisory measure against such a person and relieve that person out of his or her position but would need to address the CI.

---

### 12. Consolidated supervision

### Key findings
- C (no further detail provided in source excerpt)

---

### 13. Home-host relationships

### Key findings
- LC EC 1 / 2: In practice, with a limited number of foreign supervisory authorities that supervise subsidiaries of a parent Austrian CI, arrangements on confidential supervisory information exchange are not in place due to legal restriction on national and European level, which means that confidential supervisory information between the home and host authorities cannot be exchanged and the foreign supervisor cannot take part in the college.
- EC 6: Except for the 3 largest CI’s (Erste, Raiffeisen and UniCredit Bank Austria) which account for almost half of total bank assets in Austria, resolution plans are not prescribed for CI’s. For the three institutions mentioned, the plans are still under development. As of 1st January 2014 the Bank Reorganisation Act will be applied and will prescribe credit institutions to develop resolution plans.

---

### 14. Corporate governance

### Key findings
- LC: The internal auditor reports directly to the board of directors. Material audit results based on audits performed must be reported quarterly to the chairman of the supervisory committee. Best practice recommendation: it would be more appropriate for the internal auditor to report directly to the chairman of the supervisory committee and have full access to the chairman on an on-going basis.

---

### 15. Risk management process

### Key findings
- LC: There is no explicit requirement for larger and more complex banks to have a dedicated risk management unit overseen by a Chief Risk Officer or equivalent function.
- Planned changes:
  - It is planned to introduce an explicit requirement for CIs to have a dedicated risk management function in the course of the year 2013. The main task of the risk management function, which will be independent from operational functions, will be to ensure that all material risks are identified, measured and properly reported.
  - Obligation for CIs to establish a “risk committee” as a subcommittee of the supervisory board. The risk committee shall advise the executive board on the CI’s overall risk strategy and will assist the supervisory board in overseeing the implementation of the risk strategy.

---

### 16. Capital adequacy

### Key findings
- C (no further detail provided in source excerpt)

---

### 17. Credit risk

### Key findings
- LC: There are no specific provisions requiring banks to make credit decisions free of conflicts of interest and on an arm’s length basis.

---

### 18. Problem assets, provisions, and reserves

### Key findings
- C: The FMA should ensure that it has appropriately trained staff who are familiar with local laws and regulations in the CESEE region, particularly in the area of collateral valuations (e.g. real estate). For legal questions outside its jurisdictions, the Austrian Supervisor is in full confidence that it will receive the information of local laws and regulation in the CESEE region to the extent necessary by the supervisory colleagues from the CESEE region.

---

### 19. Concentration risk and large exposure limits

### Key findings
- C (no further detail provided in source excerpt)

---

### 20. Transactions with related parties

### Key findings
- MNC:
  1. There is no explicit requirement to the effect that transactions with related parties must not be undertaken on more favourable terms than corresponding transactions with non-related counterparties.
  2. There is no requirement that the write-off of related party exposures exceeding specific amounts or otherwise posing special risks are subject to prior approval by the bank’s board.
  3. There is no explicit prohibition on board members with conflicts of interests from managing related party transactions.
  4. Banks have policies and processes to identify individual exposures to and transactions with related parties as well as the total amount of exposures and to monitor and report on them through an independent credit review or audit process. However, there is no explicit provision for exceptions to policies, processes and limits to be reported to the appropriate level of the bank’s senior management and, if necessary, to the board, for timely action.
  5. The supervisor should receive a specific listing of related party lending. The FMA can directly request such a listing at any time.

---

### 21. Country and transfer risks

### Key findings
- C (no further detail provided in source excerpt)

---

### 22. Market risk

### Key findings
- C (no further detail provided in source excerpt)

---

### 23. Interest rate risk in the banking book

### Key findings
- C (no further detail provided in source excerpt)

---

### 24. Liquidity risk

### Key findings
- C (no further detail provided in source excerpt)

---

### 25. Operational risk

### Key findings
- C (no further detail provided in source excerpt)

---

### 26. Internal control and audit

### Key findings
- LC: There is a very restrictive requirement for Austrian banks to have a compliance function. This relates to securities services. There is no general requirement for banks to have a total business-wide compliance function.

---

### 27. Financial reporting and external audit

### Key findings
- LC: It is questionable whether Austrian local GAAP through which all Austrian banks must prepare their unconsolidated financial statements—though based on harmonized EC law—can be regarded as widely accepted internationally.

---

### 28. Disclosure and transparency

### Key findings
- C (no further detail provided in source excerpt)

---

### 29. Abuse of financial services

### Key findings
- C (no further detail provided in source excerpt)

---

### Recommended actions to improve compliance with the Basel Core Principles and the effectiveness of regulatory and supervisory frameworks

- Responsibilities, objectives and powers
  - (No specific recommended actions listed in supplied excerpt beyond the general heading.)

- Independence, accountability, resourcing and legal protection for supervisors
  - On independence:
    - Delete the confirmation by the supervisory board of the second level staff, just below the level of the supervisory board.
    - Discontinue the presence of the industry in the Supervisory Board of the FMA, by creating a separate industry forum or panel not linked to the supervisory board.
    - Consider a staggered scheme for the starting and ending of the terms of the supervisory board members.
    - Introduce the legal obligation to publicly disclose the reasons for the dismissal of a member of the Executive Board.
    - Clarify at a minimum ex ante based upon which considerations and criteria the MoF could make use of Article 16 para 4.
    - Clarify ex ante that the MoF will always give its consent on a proposed FMA regulation, in case this regulation would fall within the scope of its mandate to set up such a regulation.
    - Consider a more limited and focused right for the MoF to receive information in the context of its oversight of the operations of the FMA.
    - Clarify that considering the national economic interest might never impede FMA’s supervisory considerations and might consequently not in any way weaken its operational independence.
  - On governance:
    - Provide internal audit direct access to the Supervisory Board for all topics that it considers relevant.
  - On resourcing:
    - Consider developing a multi-year audit planning.
  - On legal protection:
    - Remedy the weaknesses identified, especially in light of the envisaged resolution powers for the FMA, which are more intrusive and more publicly scrutinized than prudential measures.

- Cooperation and collaboration
  - (No specific recommended actions listed in supplied excerpt.)

- Permissible activities
  - (No specific recommended actions listed in supplied excerpt.)

- Licensing criteria
  - Introduce fit and proper criteria for all members of supervisory boards.
  - Provide the supervisor with the legal basis and powers to require changes in the composition of the Supervisory Board.
  - Implement a more hands-on regime for new entrants in their first years of establishment, to monitor progress in meeting business and strategic goals and to determine that supervisory requirements are met.

- Transfer of significant ownership
  - Introduce an explicit notification requirement for CI’s to notify the supervisor as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest.

- Major acquisitions
  - Provide the FMA with the necessary powers that will enable it to pre-approve investments or acquisitions in non-bank financial institutions as well as in non-bank non-financial institutions, given the risks involved.
  - Clarify or revise the current Banking Act so that greenfield operations when undertaken via setting up a subsidiary in another country would also need pre-approval by the FMA.

- Supervisory approach
  - Consider introducing a specific unit or functionary responsible for the further development of the supervisory approach and methods and for the quality control of the supervisory processes.
  - Provide the FMA the powers to require CI’s to set up recovery and resolution plans and to assess thereon the bank’s resolvability, and to require banks to adopt appropriate measures in case barriers for an orderly resolution would be identified and that it will be provided with a clear framework or process for handling CI’s in times of stress, such that any decisions to require or undertake recovery or resolution actions are made in a timely manner, in line with international best practices. The assessors have noted the legislative changes that will make it compulsory for CI’s to make recovery and resolution plans and that will provide the FMA with additional powers to assure that such plans exist and can be enforced.

*Source: _cr1413 - 1. Responsibilities*

### 9. Supervisory techniques

### 9. Supervisory techniques

### Supervisory planning and review
- Consider using a supervisory planning process beyond the time frame of one year, which also facilitates a multi-year audit plan. (See Recommendation under CP2).
- Consider to implement a periodic independent review on the supervisory processes undertaken by the FMA and OeNB.

### Supervisory reporting
- Implement the current draft Article 4 No.53 of the CRR as soon as possible, concerning the changeover for prudential purpose of national GAAP to IFRS.

### Corrective and sanctioning powers of supervisors
- Provide the supervisor with the powers to directly intervene at an early stage by issuing an order to remedy a deficiency in for instance the CI’s risk management systems or by issuing an order that would prohibit, limit, or set conditions on the business activities or exposures of a CI, when risks are building up or are not properly captured by the CI.
- Consider extending the FMA’s power in applying penalties to the CIs in addition to natural persons, which might also impact the maximum level of these penalties.
- Provide the FMA with the power to directly take a measure against a person (more specifically the director or member or chairman of the supervisory board of the CI) which is not deemed fit & proper.

### Consolidated supervision
- (No specific recommendations provided in the source text for this item.)

### Home-host relationships
- Evaluate the measures that have been taken to effectively exercise supervision in the absence of arrangements to exchange confidential information with other supervisory authorities, amongst others in the context of the effective handling of a crisis situation.
- Assess in the context of the supervisory college, the recovery and resolution plans that will be developed by the CI’s and assessed by the supervisory authority as a result of the changes to the law in Austria, in conjunction with the host authorities concerned.

### Corporate governance
- Require the internal auditor to report to the supervisory board in the first instance.

### Risk management process
- Introduce explicit requirements for all larger and complex banks to have a dedicated risk management unit overseen by a Chief Risk Officer or equivalent function.

### Capital adequacy
- (No specific recommendations provided in the source text for this item.)

### Credit risk
- Introduce specific provisions requiring banks to make credit decisions free of conflicts of interest and on an arm’s length basis.

### Problem assets, provisions, and reserves
- Ensure that the supervisor has appropriately trained staff who are familiar with local laws and regulations in the CESEE region, particularly in the area of collateral valuations (e.g. real estate).

### Concentration risk and large exposure limits
- (No specific recommendations provided in the source text for this item.)

### Transactions with related parties
- There are quite a number of deficiencies in the area of related party lending, although in certain areas there are indirect mitigants. It is recommended that the Austrian authorities re-examine the whole area of related party regulations.
- They should also consider introducing new, more restrictive, limits on such lending than that which exists currently.

### Country and transfer risks
- (No specific recommendations provided in the source text for this item.)

### Market risk
- (No specific recommendations provided in the source text for this item.)

### Interest rate risk in the banking book
- (No specific recommendations provided in the source text for this item.)

### Liquidity risk
- (No specific recommendations provided in the source text for this item.)

### Operational risk
- (No specific recommendations provided in the source text for this item.)

### Internal control and audit
- Introduce an explicit requirement for banks to have a total business wide compliance function (as opposed to the current restrictive securities-related one).
- Consider lowering the threshold for the need for banks to establish an audit committee from €1 billion to, say, €500,000 in total assets.

### Financial reporting and external audit
- Consider allowing banks to prepare their non-consolidated financial statements using IFRS.
- It is recommended that the FMA be given the power to access external auditors’ working papers, where necessary.

### Disclosure and transparency
- Consider developing specific indicators for publication that provide risk information from one to the other year for individual CI.

*Source: _cr1413 - 9. Supervisory techniques*

### 29. Abuse of financial

### 29. Abuse of financial services

### Authorities’ response — overview
- The Ministry of Finance (MoF), the Austrian Financial Market Authority (FMA) and the OeNB (OeNB) appreciated the discussions and analysis but provided detailed comments and clarifications across multiple Core Principles (CPs).

### CP 2: Independence, accountability, resourcing and legal protection for supervisors
- Independence:
  - Constitutional accountability requires legal supervision of bodies such as the FMA; legal supervision is limited to whether the FMA carries out business within the legal framework and does not interfere with operational work except in cases of wrongful action or omission.
  - § 16 FMABG must be read together with § 1 FMABG; the authorities do not agree to amending Article 16 FMABG as proposed by assessors.
  - The FMA has been commissioned only once with an on-site examination.
  - MoF consent on FMA regulations is limited to a small number of cases.
  - Article 16 para. 1 allows requests for information only to ensure statutory task fulfillment and to prevent law violations or scope overstepping.
  - Industry representatives participate in supervisory board meetings only on specific, cost-related topics, do not receive full documents and have no voting rights.
  - Appointment of supervisory board members follows the general approach for all corporations; terms of office are the same as for other Austrian corporations.
  - Possible reasons for dismissal of Executive Board members are stipulated in Article 7 para. 3 FMABG; MoF dismissals are subject to the Auskunftspflichtgesetz (Duty of Information Act) and Parliament’s information rights.
- Governance:
  - Austria uses a two-tier governance system: supervisory board monitors and oversees the executive board; executive board handles day-to-day management and issues binding instructions.
  - Internal Audit reporting line should reflect two-tier system: reporting first to executive board, then supervisory board; Internal Audit must report quarterly on significant findings to the chair of the supervisory board.
  - Direct and constant access of Internal Audit to the supervisory board is asserted not to fit the Austrian two-tier system.
- Legal protection:
  - FMA staff acting in good faith cannot be held directly (personally) liable by third parties; damages must be claimed against the Republic of Austria.
  - Under the Amtshaftungsgesetz - AHG, no compensation can be claimed by the Republic for minor or ordinary negligence; in gross negligence courts can reduce damages.
  - Where AHG does not apply, protection is provided by Organhaftpflichtgesetz—OrgHG or Dienstnehmerhaftpflichtgesetz—DNHG; no compensation for minor negligence and courts can reduce or release employees from damages for ordinary negligence.
  - Courts must not issue damage awards threatening an employee’s livelihood.
  - FMA must grant adequate legal protection to employees according to Article 14 para. 3 FMABG.
  - With the introduction of the SSM and when FMA acts on behalf of the ECB, complementary arrangements in the public liability framework need consideration; forthcoming resolution powers may raise new legal protection issues.

### CP 5: Licensing criteria
- Fit and proper criteria:
  - EBA Guidelines on the Assessment of the Suitability of the Members of the Management body and Key Function Holders (EBA/GL/2012/06, “F&P-GL”) enter into force on May 22, 2013; under Article 69 para. 5 Banking Act these Guidelines are directly applicable by the FMA.
  - F&P-GL apply to competent authorities and CIs; financial and mixed financial holding companies are included.
  - FMA published a Circular (Fit & Proper—Rundschreiben) as of May 2013 setting out criteria and minimum requirements.
  - “Key function holders” include staff with significant influence (heads of significant business lines, EEA branches, third country subsidiaries, support and internal control functions); considered equivalent to “senior employees”.
  - Fit and proper assessment applies to newly appointed members of management body, supervisory board and key function holders and includes ongoing review.
- Internal auditor suitability:
  - FMA monitors suitability of internal auditors under Article 42 paras. 1 and 2 Banking Act; duties must not be entrusted to persons lacking required expertise and experience in banking.
  - Internal auditor must be notified to the FMA and supporting documents presented; FMA can require exclusion of an inappropriate internal auditor under Article 70 para. 4 Banking Act.
- Implementation and enforcement:
  - FMA is incorporating F&P-GL into supervisory practices and expanding fit and proper assessments to all supervisory board members in a risk-based manner.
  - If a supervisory board member is not suitable, FMA will order CI to reestablish lawful conditions pursuant to Article 70 para. 4 Banking Act.
  - Upon amendment of the Banking Act as of 1 January 2014, FMA will have direct powers in the Banking Act to take greater action and require changes in supervisory board composition when necessary.
- New entrants:
  - No specific supervisory regime applies to new entrants beyond existing licensing requirements; new entrants must fulfill all relevant regulations at licensing.
  - License applicants must present business plan, budget calculation and necessary processes, systems, models; license only granted if plans are plausible and effective (in accordance with the OeNB).
  - Post-licensing monitoring via monthly/quarterly and annual reports submitted to the OeNB; considerable deviations would be detected and addressed by FMA.
  - FMA includes new entrants in yearly planning for on-site inspections jointly with OeNB.
  - FMA considers current procedures for new entrants to be “hands-on” and repeats that entrants are monitored during application and after licensing through reporting and planned on-site audits.

### CP 7: Major acquisitions
- Planned amendments:
  - Plan to introduce obligation for prior approval for setting up a CI in a third country by greenfield operation via amending Article 21 Banking Act.
- Powers over investments/acquisitions:
  - FMA can prohibit investments if deemed necessary; reference to CP 11 for related powers.
- Risk mitigation and monitoring:
  - OeNB and FMA have regular meetings with CI executive boards covering cross-border participations; state commissioner may provide additional information.
  - Limits on acquisitions:
    - An individual acquisition of a non-bank non-financial institution is permitted up to 15 percent of own funds.
    - Total share of such non-bank non-financial activities must not exceed 60 percent of own funds.
    - Any exceeding amount must be fully covered by own funds due to Article 29 Banking Act and is audited regularly by internal auditor and bank auditor.
    - An individual acquisition of a non-bank non-financial institution must not exceed 25 percent of own funds in any case.
  - Risks connected with participations in non-bank financial institutions are monitored on a consolidated group level (Article 30 Banking Act).
- Legislative coverage:
  - Only the aspect of prior permission of certain types of investments (mainly investments in non-bank non-finance institutions) is not fully covered by legislation among CP7’s essential criteria.

### CP 8: Supervisory approach with respect to recovery and resolution
- Bank Reorganisation Act:
  - Bank Reorganisation Act entered into force (Federal Law Gazette I Nr. 160/2013).
  - All institutions are obliged to draw up recovery and resolution plans assessed by the FMA; obligation is subject to proportionality.
  - FMA has a set of early intervention tools.

### CP 11: Corrective and sanctioning powers of supervisors
- Existing powers:
  - Article 70 Banking Act provides broad corrective and sanctioning powers when CI’s fulfillment of obligations to creditors is jeopardized.
  - In case of quick deterioration, FMA may issue administrative rulings under threat of penalty per Article 70 para. 2 Banking Act, which may:
    - Fully or partly prohibit withdrawal of capital and earnings and distributions.
    - Appoint an expert supervisor (state commissioner) who may prohibit transactions that exacerbate jeopardy.
    - Allow individual transactions not deemed to exacerbate jeopardy.
    - (Partly) prohibit directors from managing the CI.
    - (Partly) prohibit continuation of business operations.
- Prompt information:
  - FMA will be informed immediately of a “problem situation” by the bank auditor (Article 63 para. 3 Banking Act), the state commissioner (Article 76 para. 8 Banking Act), or the CI (e.g., occurrence of insolvency, over-indebtedness, non-compliance in excess of one month with Banking Act standards (Article 73 Banking Act)).
- Planned clarifications:
  - Plan to clarify range of possible supervisory tools in more detail, enabling FMA explicitly by law to:
    - Restrict or limit business, operations or network of credit institutions.
    - Request divestment of activities posing excessive risk.
    - Require reduction of risk inherent in activities, products and systems of CIs.
- Conclusion:
  - Under present rules FMA can intervene directly by issuing administrative rulings that prohibit, limit or set conditions on business activities or exposures; Bank Reorganisation Act provides additional early intervention measures.

### CP 13: Home-host relationships
- Cross-border cooperation:
  - FMA is fully committed to information exchange and cross-border cooperation; Austria aligns with EBA and European framework for supervisory colleges.
  - Recognition of equivalence of third countries must be assessed within European parameters and confidentiality regimes.
- Confidentiality requirements:
  - Article 131a Directive (EC) 2006/48 (=CRD) requires third-country competent authorities to be subject to confidentiality requirements equivalent to Articles 44 to 52 CRD to conclude confidential exchange arrangements.
  - Austrian supervisor must not conclude confidential information exchange with third-country authorities lacking equivalent confidentiality requirements.
- Resolution plans:
  - No European framework for resolution plans yet.
  - Ahead of regulation, Austrian supervisor received resolution plans from the three largest CIs accounting for almost half of total bank assets of the Austrian market.
  - Recovery and resolution plans will be discussed within supervisory colleges.

### CP 14: Corporate Governance
- Internal audit reporting:
  - Legal obligation for internal audit to report quarterly to the chair of the supervisory board and the audit committee.
  - An audit committee is obligatory for all banks with a balance sheet exceeding EUR 1 billion.
  - The audit committee provides frequent and direct reporting to the relevant committee of the supervisory board.
  - Reference to CP 2 comments on internal audit reporting line under two-tier governance.

### CP 15: Risk management process
- Dedicated risk officer and separation:
  - No explicit legal requirement currently to appoint a dedicated risk officer.
  - FMA Minimum Standards for the Credit Business and other Transactions entailing Credit Risks (FMA-MS-K) stipulate clear functional separation between front office and risk management / back office functions; similar supervisory expectations apply across other business lines.
  - Dedicated CRO is in place in all larger banks; strict separation of market/control functions exists.
- Planned requirements:
  - Planned introduction in 2013 of an explicit requirement for CIs to have a dedicated risk management function independent from operational functions to ensure identification, measurement and proper reporting of all material risks.
  - Obligation to establish a “risk committee” as a subcommittee of the supervisory board by amending the Banking Act.
  - Risk committee duties: advise executive board on overall risk strategy and assist supervisory board in overseeing implementation of risk strategy.

### CP 17: Credit Risk
- Supervisory framework:
  - Comprehensive rules and regulations regarding credit risk exist for credit institutions.
  - On credit decisions free of conflict of interest and arm’s length (EC 5): while no specific statutory provision exists, FMA relies on “Minimum Standards for the Credit Business and other Transactions entailing Counterparty Risks” and other requirements.
  - Minimum Standards: prudent lending practices imply segregation of duties and involvement of multiple persons when granting loans; different hierarchies depending on loan amount; involvement of loan officer, risk manager, credit committee, supervisory board provides high safety against conflicts of interest or external pressure.
  - Authorities state IMF assessment did not adequately reflect the supervisory reliance on these Minimum Standards.

### CP 18: Problem assets, provisions and reserves
- Supervisory colleges and host-country expertise:
  - Supervisory colleges guarantee mutual exchange with host-country colleagues knowledgeable of local laws, procedures and risks.
  - Supervisory actions in CESEE host countries can include inspections of host subsidiaries in coordination with local supervisors.
  - On-site actions have taken place in several CESEE countries in past years; OeNB supervisory staff have experience with local laws and risk management issues; some OeNB staff are partly from CESEE countries.

### CP 20: Transactions with related parties
- Legal and supervisory perspective:
  - Provisions on related party transactions primarily aim to protect shareholders (reflected by IFRS transparency) rather than reduce supervisory risks.
  - Liability and criminal law provisions also relevant; supervisory findings indicate related-party transactions are not a major concern in practice.
  - Under current legal regime:
    - Any transaction requires unanimous consent of the Board and approval of the Supervisory Board.
    - Annual reporting on these transactions to the Supervisory Board.
    - Supervisory Board has access to individual cases.
  - Authorities consider current framework comprehensive and based on experience and external recommendations.

### CP 26: Internal Control and Audit
- Compliance function:
  - Assessment did not adequately consider existing explicit legal requirement in Art. 15 and 18 Securities Supervision Act for all CIs carrying out investment services to have a compliance function with duties as in Directive 2004/39/EC (MiFID).
  - References: Article 18 para. 3 Securities Supervision Act, Article 18 para. 4 no. 2 Securities Supervision Act, Article 15 para. 1 Securities Supervision Act.
  - Investment services defined in Article 1 Securities Supervision Act (reception and transmission of orders; execution of orders on behalf of client; dealing on own account; portfolio management by way of managing portfolios in accordance with mandates given by clients on a discretionary client-by-client basis where such portfolios include one or more financial instruments; investment advice; underwriting and/or placing of financial instruments on a firm commitment basis; placing without firm commitment; operation of Multilateral Trading Facilities).

### CP 27: Financial Reporting and external audit
- Accounting frameworks and EU conformity:
  - Company Code (Austrian GAAP) complies with EC harmonized accounting standards defined in EC directives:
    - Fourth Council Directive 78/660/EEC on annual accounts of certain types of companies.
    - Seventh Council Directive 83/349/EEC on consolidated accounts of certain types of companies.
    - EC Regulation 1606/2002 on the application of international accounting standards.
  - EC Regulation rules are binding in Austria (Article 5 of EC Regulation 1606/2002).
  - Austrian GAAP widely accepted in the EC and internationally due to European regulation.
- Use of IFRS:
  - Austrian banks prepare unconsolidated financial statements in accordance with Austrian GAAP; consolidated financial statements are usually prepared in accordance with IFRS (binding or optional basis).
  - Consolidated accounts must be prepared according to Article 59a Banking Act using IFRS.
  - According to FINREP consolidated financial statements have to be prepared by using IFRS, beginning in 2014.
  - Within COREP context, IFRS will be used if it enhances data quality of institutions.
- Observations on raising public funds:
  - Authorities note that use of Austrian GAAP for unconsolidated statements cannot be connected to raising of public funds; small banks using Austrian GAAP typically do not raise public funds.
  - If the whole sector raises public funds, consolidated financial statements of the sector are prepared in accordance with IFRS.

*Source: Authorities’ response section of “29. Abuse of financial services” (Austrian contribution).*

---


_Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr1413.pdf_