## _cr14135 — INTRODUCTION and Key Findings ## Source details **Canonical URL:** [_cr14135 — INTRODUCTION and Key Findings](https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr14135.pdf) ## Other formats - [Markdown version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr14135.pdf.md) - [Structured JSON version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr14135.pdf.json) --- ### Overview and key findings - Ireland “significantly enhanced the legal framework to support banking supervision”; compliance with the Basel Core Principles (BCPs) assessed as “satisfactory.” - Crisis context and ongoing vulnerabilities: - The banking crisis had a public cost of €64.1 billion (some 40 percent of GDP). - “Acute crisis conditions have abated” but “continued elevated stress” and vulnerabilities persist. - Supervisory priorities: - Prepare industry for CRD IV/CRR implementation. - Adapt to redesigned regulatory architecture and strengthen recovery/resolution capacity. *Legal, institutional and supervisory reforms* - Central Bank Reform Act 2010: merged Financial Services Authority functions into Central Bank; Central Bank responsible for licensing, regulation and supervision of banks. - Central Bank (Supervision and Enforcement) Act 2013 (commencement August 1, 2013): harmonizes enforcement, provides regulation‑making powers on conduct of business and corporate governance, increases administrative sanction fines. - Central Bank Credit Institution Resolution Act (CBCIR) 2011: establishes resolution regime; Special Resolution Unit (SRU) established. - Central Bank designated competent authority under the Criminal Justice (Money Laundering and Terrorist Financing) Act (CJA) 2010 for supervising banks’ AML/CFT compliance. - Codes and guidance issued: Code of Practice on Lending to Related Parties (RPL, 2010); Corporate Governance Code; Impairment Provisioning and Disclosure Guidelines (December 2011; update May 2013). ### PRISM and risk-based supervision - PRISM (Probability Risk and Impact System) introduced in 2011 to allocate supervisory resources by risk profile and systemic significance. - PRISM components: - Multi-step process to identify, measure and grade banks’ risk profile and risk management processes. - Blend of onsite and offsite activities and a follow-up system (Risk Mitigation Program, RMP). - Four Impact ratings: High, Medium High, Medium Low, and Low. - KRIs (Key Risk Indicators) used for ongoing monitoring; triggers prompt supervisory attention. - Identified gaps in PRISM: - No KRIs for interest rate risk in the banking book. - Only a single indicator for market risk. - Offsite reliance and limited onsite frequency for Medium Low and Low Impact banks highlighted as a material weakness. ### Resourcing, staffing, and capacity - Banking Supervision Divisions operating below approved staffing level. - Pay and hiring constraints: Central Bank operates under Civil Service pay scales; salaries “un-competitive with industry.” - Staffing numbers (selected): - Front line supervisor: 2010 = 66, 2012 = 49 - Projects: 2010 = 4, 2012 = 6 - Risk specialists – Supervision Support: 2010 = 26, 2012 = 24 - Stress testing: 2010 = 2, 2012 = 5 - Divisional Operations: 2010 = 15, 2012 = 12 - Grand Total: 2010 = 113, 2012 = 96 - Turnover rates (selected): - Front line supervisor: 2011 = 4.5%, 2012 = 1.8% - Risk specialists: 2011 = 7.7%, 2012 = 16.7% - Grand Total: 2011 = 6.2%, 2012 = 5.6% - Recommendations: - Review turnover and recruitment constraints; consult peers for pay flexibility/exemptions; tailor advancement opportunities for technical experts. ### Areas requiring further attention (selected) - Review provisioning requirements to assess alignment with market conditions. - Complete implementation of CJA 2010 (AML/CFT); issue statutory guidelines envisaged by Section 107. - Strengthen monitoring and reporting on related party transactions: expand coverage beyond lending (asset purchases, deposits); enhance reporting detail (terms, dates of Board approval). - Enhance AML/CFT supervision: increase onsite testing and include branches of member state banks. - Seek legislative changes to codify/foster Central Bank independence (examples listed in source text). --- ### Macroeconomic and Banking Sector Context ### Macroeconomic outlook and risks - Household debt and wealth: - Household debt around €172 billion — “over 200 per cent of disposable income and over 100 per cent of GDP.” - Public finances and growth: - Department of Finance projects government deficit to narrow from 7.3 per cent of GDP in 2013 to 2.9 per cent in 2015. - Department of Finance forecasts average nominal GDP growth of 2.6 per cent per annum over 2013 to 2015. - Risk: output growth falling below forecast could prevent meeting the 3 per cent deficit target for 2015. - Policy outcomes post-programme: strengthened fiscal framework, stabilized financial sector, sovereign spreads fallen to lowest since early 2010. ### Banking sector structure and trends - Deleveraging: balance sheets continued to reduce; Irish loans now account for more than two thirds of total loan book; mortgage lending share >58 per cent. - Mortgage arrears (end-June 2013): - Total outstanding balance on all mortgage loans in arrears of more than 90 days: €27.3 billion. - PDH (>90 days): 12.7 percent of accounts (increase of 9.4 percentage points since end-September 2009). - PDH >360 days: 7.4 per cent of total PDH accounts; just over half of these >720 days. - BTL 90-days arrears: 20.4 per cent; BTL >360 days: 12.9 per cent. - Restructuring at end-June 2013: ~80,000 PDH accounts classified as restructured; 53 per cent of those restructured were not in arrears; of the 142,892 PDH accounts 90+ days in arrears, 37,048 or 26 per cent were classified as restructured. - Preliminary estimate: 15,000 people could avail main non-judicial settlement arrangements within 12 months; further 3,000 applying for bankruptcy. - Household balance sheet: Household net worth decreased in Q1 2013 after quarters of growth in late 2012. ### Profitability and capital - Profitability: domestic retail banks reported slight increase in net interest income in 2013 interim reports but not yet returned to profitability; domestic banks remain reliant on central bank funding. - Solvency and capital ratios: - Domestic banks’ Core Tier 1 (CT1) ratios deteriorating but remain above the 7% Basel III target. - Domestic banks above the 10.5% CT1 target imposed under Ireland’s external support program. - Aggregate compliance with minimum CRD capital requirement (8%). - International wholesale banks’ average CT1 ratio skewed; excluding two institutions, sector average = 30.07%. - Covered banks and PCAR: - PCAR (prudential capital assessments) used to determine additional capital requirements for covered banks (examples referenced; see specific figures under capital sections). --- ### Resolution, ELA and Deposit Protection ### Bank resolution and IBRC - IBRC background: - Formed 2011 via merger of Anglo Irish Bank and Irish Nationwide. Promissory Notes issued in 2010. - IBRC liquidation (Irish Bank Resolution Corporation Act 2013, Feb 7, 2013): - Central Bank took ownership of collateral held against ELA lending to IBRC of €39.45 billion (Promissory Notes, NAMA bonds and other assets). - Central Bank acquired assets held as collateral against standard Eurosystem borrowing by IBRC of €333 million (excess value returned to special liquidator). - Central Bank did not suffer any loss on ELA lending to IBRC. - Central Bank will sell bonds “as soon as possible provided that conditions of financial stability permit” and to remain compliant with prohibition on monetary financing. ### Exceptional Liquidity Assistance (ELA) - Statutory basis: Central Bank Act 1942 — Section 5B(d) and financial stability objective Section 6A(2)(a). - ELA provided in recent years: - At end-December 2012 ELA extended: €40 billion. - Historical annual ELA amounts cited: €11.5bn in 2009, €49.5bn in 2010 and €42bn in 2011. - February 2013: Central Bank’s ELA operations ceased on liquidation of IBRC. ### Deposit Guarantee Scheme (DGS) - Eligible deposits guaranteed up to €100,000 per person per institution. - DGS obliged to issue compensation within 20 working days of a credit institution failing. - DGS administered by Central Bank and funded by credit institutions; each institution required to maintain a Deposit Protection Account equivalent to 0.2 per cent of total deposits. - DGS payments example: as at 30 April (year implied by context), DGS had paid out €9.6 million to 594 eligible depositors (IBRC liquidation context). --- ### Accounting, Audit, and Reporting ### Accounting standards and auditing framework - Listed entities: group financial statements in accordance with IFRS as endorsed by the EU. - Other entities: may adopt local GAAP or IFRS; local GAAP has largely converged with IFRS. - Auditors must apply International Standards of Auditing (UK and Ireland) as issued by the FRC; auditors must comply with Ethical Standards published by the FRC and professional ethics requirements. - IAASA (Irish Auditing and Accounting Supervisory Authority) oversees how Prescribed Accountancy Bodies supervise members — inspections, complaints investigations, discipline. ### Auditor duties and supervisory interaction - Auditor statutory reporting obligations (examples): - Must report to Central Bank without delay if reason to believe circumstances materially affecting ability to meet obligations, material control defects, material inaccuracies in returns, proposed qualified opinion, or decision to resign. - Central Bank powers: - Section 27E (Central Bank Act 1997) allows Central Bank to commission a report from an auditor on accounting records or systems. - Section 27F allows Central Bank to require a copy of records provided/obtained by the auditor. - Central Bank cannot remove an auditor directly but can veto appointment or reappointment under Section 46(2) of Central Bank Act 1989. - Practical arrangements: - Auditor Protocol and working groups with IAASA and accountancy bodies to develop guidance on auditors’ assurance over internal governance. ### Financial reporting, Pillar 3 and transparency - Central Bank uses a Pillar III operational checklist for quantitative supervisory checks and compares Pillar 3 disclosures with supervisory returns. - Central Bank does not assess compliance with IFRS accounting frameworks (IAASA role) but monitors that financial statements have auditor opinions expressing that they give a true and fair view. - Central Bank publishes system‑level data: Monthly Statistics, Macro Financial Review, mortgage arrears data, Quarterly Summary Financial Return (QSFR), etc. --- ### AML/CFT, Financial Sanctions and Supervisory Findings ### Legal framework and supervisory mandate - Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (CJA2010) — in force 15 July 2010; Central Bank appointed competent authority for credit and financial institutions. - Criminal Justice Act 2013 amends CJA2010 (selected enhancements listed). - Core AML/CFT obligations include Customer Due Diligence (CDD), suspicious transaction reporting, policies and procedures, enhanced measures for higher risk, and record retention. ### Supervisory activity and gaps - AML/CFT supervisory activity since September 2010: - 8 onsite inspections; 4 in-depth inspections covering firms representing c.40% of gross sector assets. - Offsite risk assessment questionnaires covering 21 banks. - Branches of foreign banks have not been incorporated in AML compliance reviews. - Identified supervisory improvements needed: - Issue statutory guidelines envisaged by Section 107 of CJA2010 to clarify “reasonable measures” and expectations. - Increase onsite testing and extend supervisory coverage to branches of foreign banks. - Require internal audit/external expert independent evaluation of AML/CFT frameworks (no statutory requirement currently). - Assessment: Principle 29 — Materially Noncompliant. --- ### Related-Party Lending (RPL) and Large Exposures ### RPL Code (effective January 1, 2011; revised 2013) - Key requirements: - Loans to related parties must be on arm’s-length terms; Board or dedicated subcommittee approval required for loans/variations. - Prior Central Bank approval required for any loan in excess of €1m. - Senior management must report at least quarterly to the Board on deviations; deviations reported to Central Bank within five business days. - Quantitative limits: - Exposure to any one director/senior management and connected persons: 0.5% of Own Funds (aggregate not to exceed 5.0% of Own Funds). - Exposure to any one significant shareholder: 5.0% of Own Funds (aggregate not to exceed 15% of Own Funds). - Exposures to a client/group where the institution has significant shareholding: 5.0% of Own Funds (aggregate not to exceed 15%). - Supervisory practice: - Quarterly RPL reporting template required; desktop analysis supplemented by onsite testing. - Identified gap: - RPL Code covers lending but excludes asset purchases, deposits and many non‑lending transactions; supervisory reports lack sufficient detail to monitor terms/rates and ensure arm’s‑length compliance. - Assessment: Principle 20 — Materially Noncompliant. ### Large exposures and concentration reporting - Large exposure thresholds and limits (transposed CRD rules): - Large exposure: exposure ≥ 10% of Own Funds. - Limit: exposure to a client/group of connected clients shall not exceed 25 per cent of Own Funds (with €150,000,000 alternative for exposures including institutions). - Reporting: - Quarterly large exposure returns and sectoral breakdowns required. - Supervisory collection of top 100 exposures and sector data to feed Pillar 2 concentration assessment. - Concentration risk monitoring: - Central Bank internal model used to estimate Pillar 2 add-ons for name/sector concentration where banks’ models are inadequate. --- ### Supervisory Assessments against Selected BCPs (selected grades from source text) - CP 1 Responsibilities, objectives, powers: Compliant (C) - CP 2 Independence, accountability, resourcing and legal protection: Materially Noncompliant (MNC) - Legal constraints: Ministerial consent required to deny or revoke a license in specified circumstances; Minister may remove Commission members under broad grounds; Secretary General of Department of Finance sits ex-officio on Commission; Ministerial approval required for levy increases. - CP 8 Supervisory approach (PRISM): Compliant (C) - CP 9 Supervisory techniques and tools: Materially Noncompliant (MNC) - Primary concern: calibration of PRISM mix of onsite/offsite supervision for Medium Low and Low Impact banks; insufficient verification and onsite testing. - CP 14 Corporate governance: Largely Compliant (LC) - For Medium‑Low and Low banks, supervisory activities insufficient to assess governance robustness (EC2/EC8). - CP 15 Risk management process: Largely Compliant (LC) - Insufficient ongoing qualitative/quantitative info for business continuity monitoring (EC12); model validation/testing frequency needs enhancement (EC6). - CP 17 Credit risk: Largely Compliant (LC) - Frequency/depth of onsite credit risk reviews for lower impact banks insufficient (EC3). - CP 18 Problem assets, provisions and reserves: Largely Compliant (LC) - Need greater onsite testing of provisioning models, collateral valuations and recognition of default (EC7). - CP 20 Transactions with related parties: Materially Noncompliant (MNC) - CP 21 Country and transfer risks: Largely Compliant (LC) - Country Risk Policy issued August 2013; compliance monitoring under development. - CP 22 Market risk: Largely Compliant (LC) - Limited onsite market risk coverage and insufficient verification of mark‑to‑market valuations (EC4). - CP 23 Interest rate risk in banking book: Largely Compliant (LC) - Detailed reviews for High Impact banks; less frequent for lower impact banks; KRIs missing in PRISM. - CP 25 Operational risk: Largely Compliant (LC) - Operational risk policy implemented; first monitoring reports to be filed as of September 30, 2013 — effectiveness not yet assessable. - CP 26 Internal control and audit: Largely Compliant (LC) - No regulatory requirement for Board responsibility for internal control environment; supervisory assessment below High Impact relies on desk-based exception reporting. - CP 27 Financial reporting and external audit: Largely Compliant (LC) - Central Bank does not have power to reject/rescind external auditor (EC6). - CP 28 Disclosure and transparency: Compliant (C) - Central Bank ensures financial statements have an auditor’s opinion that they give a true and fair view. - CP 29 Abuse of financial services (AML/CFT): Materially Noncompliant (MNC) - Branches of foreign banks excluded from AML compliance reviews; limited onsite testing; statutory guidelines not yet issued; no requirement for internal audit/external expert AML reviews; no required dedicated reporting officer. --- ### Key supervisory recommendations and actions (selected, as provided) - Strengthen Central Bank independence via legislative amendments (removal conditions for Commission members; authority to revoke/deny licenses without Ministerial approval; exclude Secretary General of Department of Finance from Commission; remove Ministerial approval of levy schedule). - Enhance PRISM KRIs to include interest rate risk in the banking book, operational risk metrics, and additional market risk indicators. - Rebalance onsite/offsite supervisory mix for Medium Low and Low Impact banks — increase frequency and depth of onsite verification and loan file reviews; expand credit‑risk specialist allocation. - Expand RPL Code coverage to include asset purchases, deposits and other related party transactions; improve RPL reporting detail to monitor terms and arm’s‑length compliance. - Issue statutory AML/CFT guidelines under Section 107 of CJA2010; extend AML supervision to branches and increase onsite testing; require internal audit/external expert AML reviews and dedicated reporting officer appointment. - Review provisioning guidance and extend onsite verification of provisioning assumptions and collateral valuation across the sector (proportionality). - Consider legal powers regarding external auditors (power to reject/rescind auditor) — authorities observed to consider this recommendation. - Continue implementation of CBCIR resolution powers and require recovery plans; formalize SRU/Supervisory interaction (MOU) and extend recovery/resolution planning beyond two largest groups. --- *Source: IMF assessment document "_cr14135 - INTRODUCTION" and related excerpts from the IMF staff report (assessment period: September 25 to October 10, 2013) as provided in the supplied content unit.* ### INTRODUCTION __________________________________________________________________________________ 4 ### _cr14135 - INTRODUCTION ### Overview and key findings - Ireland has "significantly enhanced the legal framework to support banking supervision" and implemented a risk-based supervisory approach; compliance with the Basel Core Principles for Effective Banking Supervision (BCPs) is described as "satisfactory." - The financial crisis and state intervention transformed the Irish banking system; "acute crisis conditions have abated" but "continued elevated stress" and vulnerabilities persist. - Ongoing supervisory pressure includes preparing industry for CRD IV/CRR and adapting to a redesigned regulatory architecture. ### Legal and institutional reforms - Central Bank Reform Act 2010 combined functions of the Financial Services Authority of Ireland into the Central Bank, giving it responsibility for licensing, regulating and supervising banks. - Central Bank (Supervision and Enforcement) Act 2013 enacted in July 2013 (commencement date: August 1, 2013) harmonizes enforcement across financial sectors, provides regulation-making powers on conduct of business and corporate governance, and increases administrative sanction fines. - Central Bank Credit Institution Resolution Act (CBCIR) enacted in 2011 establishes a resolution regime; a Special Resolution Unit was established to make the legislation operational. - Central Bank designated as competent authority under the Criminal Justice (Money Laundering and Terrorist Financing) Act (CJA) 2010 for supervising banks' compliance. - In 2010 the Central Bank issued the Code of Practice on Lending to Related Parties (RPL) and the Corporate Governance Code. ### PRISM and the risk-based supervisory framework - In 2011 the Central Bank implemented PRISM (Probability Risk and Impact System) as a structured framework for banking supervision to allocate resources based on risk profile and systemic significance. - PRISM is based on: (i) a multi-step process to identify, measure and grade banks’ risk profile and risk management processes; (ii) a blend of onsite and offsite activities; and (iii) a follow-up system to track corrective action. - Within PRISM, banks are assigned one of four Impact ratings: High, Medium High, Medium Low, and Low. - PRISM features ongoing monitoring using financial ratios that, if triggered, prompt supervisory attention/intervention; risk ratings are updated after supervisory activities. - Supervisory intrusiveness and resources increase with the Impact rating; High Impact banks receive ongoing offsite monitoring, frequent onsite reviews, and ongoing engagement with senior management. ### Resourcing and staffing - The Central Bank Banking Supervision Divisions are "operating below approved staffing level." - The Central Bank operates under Civil Service pay scales and hiring rules, making salaries "un-competitive with industry." - The Central Bank is encouraged to: review turnover rates in skilled staff and reasons for turnover; consult other central banks to gauge how they attract skilled staff and achieve exemptions from Civil Service pay limitations; and review advancement opportunities tailored to technical experts. ### Areas requiring further attention - Review provisioning requirements to determine whether they accurately reflect current market conditions. - Continue implementation of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (as amended) (CJA 2010). - Strengthen monitoring of compliance with the related party lending (RPL) code; expand coverage of related party transactions beyond lending (e.g., asset purchases or deposits) and enhance reporting detail (terms of loans, dates of Board approval). - Strengthen supervision of AML/CFT compliance: issue statutory guidelines envisaged by Section 107 of the CJA 2010; review extent of onsite testing and follow-up supervisory action; subject branches of member state banks to AML monitoring. - Seek legislative changes to codify and foster Central Bank independence, including consideration of: - stipulating in the Central Bank Act the exact conditions under which the Commission can be dismissed or removed by the Minister for Finance; - granting the Central Bank authority to revoke a license or deny a licensing application without Ministerial approval; - not including the Secretary General of the Department of Finance on the Central Bank Commission; and - eliminating the need for the Minister to approve the levy schedule. ### Assessment scope, methodology, and context - The BCP assessment was conducted from September 25 to October 10, 2013 as part of the ROSC of Ireland’s financial system undertaken by the IMF. - The assessment reflects the regulatory and supervisory framework "in place as of the date of the assessment" and "is not intended to represent an analysis of the state of the banking sector or crisis management framework." - Assessment followed the Revised Core Principles (BCP) Methodology issued by the BCBS; the revised methodology has a heightened focus on risk management and supervisors’ expectations. - Ireland chose to be assessed against the Essential and Additional Criteria but to be graded only against the Essential Criteria. - The grading system used: compliant; largely compliant; materially noncompliant; noncompliant; and non-applicable. - The assessment was based on legal framework (Central Banking Acts, CJA 2010, and other regulations/guidelines), prudential returns, licensing documentation, supervisory records, on-site reports, off-site analysis, and meetings with Central Bank, Department of Finance, Financial Intelligence Unit, auditors, and bank participants. Authorities provided a comprehensive self-assessment and supplementary material. - The assessment excludes the Irish Credit Union Sector due to recent legislative and regulatory changes under Ireland’s EU-IMF financial support program commitments. - The BCPs were applied with the concept of proportionality to account for jurisdictional differences in complexity, interconnectedness, size, risk profile, and cross-border operations. - The assessment notes that EU rules and supervisory practices may not always align with BCP requirements (e.g., supervision of EU banking branches and host involvement). ### Box: The 2012 Revised Core Principles (summary) - The revised BCPs reflect lessons from the 2008-2009 financial crisis and FSAP, G-20 and FSB recommendations. - Key emphases include: (i) greater supervisory intensity and allocation of adequate resources to deal with systemically important banks; (ii) applying a system-wide, macro perspective to micro-prudential supervision to identify systemic risk; (iii) effective crisis preparation, recovery and resolution measures; and (iv) fostering market discipline through corporate governance, disclosure and transparency. - Supervisors are required to assess risks banks pose to the banking and financial systems, considering macroeconomic environment and risk build-up. - The revised BCPs increase focus on actual use of supervisory powers in a forward-looking approach through early intervention. - Quantitative changes in the revised BCPs: number of principles increased from 25 to 29; number of essential criteria expanded from 196 to 231 (including 35 new essential criteria); and there are 16 additional criteria for jurisdictions choosing to be assessed against them. *Source: IMF assessment document "_cr14135 - INTRODUCTION" (assessment period: September 25 to October 10, 2013).* ### 18. The mission appreciated the very high quality of cooperation received from the ### _cr14135 - 18. The mission appreciated the very high quality of cooperation received from the ### Institutional and market structure - overview - The Central Bank Reform Act, 2010, created a new single unitary body – the Central Bank of Ireland – responsible for both central banking and financial regulation, replacing the Central Bank and the Financial Services Authority of Ireland and the Irish Financial Services Regulatory Authority. - The Central Bank of Ireland has overall prudential responsibility for the authorization, regulation and supervision of Credit Institutions operating in Ireland, including Banks, Building Societies and Designated Credit Institutions. - The Central Bank of Ireland is responsible for oversight of liquidity, Anti-Money Laundering and conduct of business for branches of non-Irish licensed banks operating in Ireland. - Key regulatory functions exercised by the Central Bank: - making rules or setting standards; - licensing persons who wish to engage in regulated financial services activity; - disciplinary or enforcement function. - Supervisory objectives for Credit Institutions: - (i) to foster a stable banking system; and - (ii) to provide a degree of protection to depositors with individual credit institutions. - Central Bank Act 1942 (as amended): the Bank shall perform its functions and exercise its powers in a way that is consistent with: - The orderly and proper functioning of financial markets, - The prudential supervision of providers of financial services, and - The public interest and the interest of consumers. - The Central Bank of Ireland operates a risk based approach to supervision and introduced the Probability Risk and Impact System (PRISM) in 2011. - Constitutional note: primary legislation is made by the Oireachtas; primary legislation concerning financial services is ordinarily initiated by the Minister for Finance; the Central Bank cannot itself initiate primary legislation. ### Preconditions for effective banking supervision — A. Macroeconomic overview - Ireland exited an exceptionally deep banking crisis with the support of the EU-IMF program that began in December 2010; the banking crisis had a public cost of €64.1 billion (some 40 percent of GDP). - Policy outcomes observed: - strengthened fiscal framework, - stabilized financial sector, - spreads on Irish sovereign bonds fallen to their lowest level since early 2010. - Identified ongoing risks to recovery: - Public debt is high and still growing; - Banking system not yet serving financing needs, including of the job-intensive SME sector; - Households face heavy debts and depleted net wealth; - High unemployment compounds financial distress, undermines skills, and drives emigration; - Euro area crisis creates uncertainty for exports, financial markets, and fixed investment. - Corporate/SME financing: - Volume of new lending by Irish banks to NFCs has remained below 12 percent of GDP since 2011, below the pre-bubble level of around 20 per cent in 2003-05. - Nominal interest rates on NFC loans up to €1 million are higher, suggesting higher real interest rates for SMEs. - NFC debt dynamics: - NFC debt levels are high, but debt owed to Irish banks is falling due to net loan repayments, write-downs, and transfers to NAMA. - NAMA was created in 2009 to acquire nonperforming, property-related loans from the domestic banking sector. - NFC sector’s net debt remained stable because of corresponding acquisitions of debt instrument assets. - Mortgage arrears: - Mortgage arrears remain a key risk; level is high relative to other developed-country banking crises. - Unemployment is a significant driver of arrears. - Central Bank measures in early 2013 included publication of performance targets for main mortgage banks; new personal insolvency legislation reduced bankruptcy term from twelve years to three and introduced non-judicial insolvency procedures. - Preliminary estimates: 15,000 people could avail of the main non-judicial settlement arrangements within 12 months, with a further 3,000 applying for bankruptcy. - Total outstanding balance on all mortgage loans in arrears of more than 90 days was €27.3 billion at end-June 2013. - Longer-term arrears accelerated despite a decline in formation of new arrears in recent months. - At end-June 2013: - 12.7 percent of accounts of principal dwelling houses (PDH) were 90 days or more in arrears (an increase of 9.4 percentage points since first collected at end-September 2009). - 7.4 per cent of the total stock of PDH accounts was more than 360 days in arrears, and just over half of these were more than 720 days in arrears. - For buy-to-let (BTL) accounts, the 90-days arrears rate was 20.4 per cent and more than 12.9 per cent of all BTL accounts were 360 days or more in arrears. - Restructuring activity at end-June 2013: - Almost 80,000 PDH accounts classified as restructured, of which 53 per cent were not in arrears. - Of the total stock of 142,892 PDH accounts 90 days or more in arrears at end-June, 37,048 or 26 per cent were classified as restructured. - Residential property market: - Conditions remain fragile: house price increases in recent months, mortgage lending low, residential construction at long-term lows. - Two-tier market: Dublin stabilizing with year-on-year price growth each month since start of 2013 and rents increasing faster than elsewhere; prices outside Dublin continue to decline. - Commercial property exposure relevant to financial stability, including NAMA exposure. - Household balance sheets: - Household net worth decreased during first three months of 2013 after consecutive quarters of growth in late 2012. - Household debt in absolute terms around €172 billion, which equates to over 200 per cent of disposable income and over 100 per cent of GDP. - Consumption and public finances: - Personal consumer expenditure declined in recent years; forecasts indicate modest growth in consumption for 2014. - Department of Finance projects government deficit to narrow from 7.3 per cent of GDP in 2013 to 2.9 per cent in 2015. - Department of Finance forecasts average nominal GDP growth of 2.6 per cent per annum over 2013 to 2015. - Risk noted: output growth falling below forecast could prevent meeting the 3 per cent deficit target for 2015 and worsen public finances given the size of the debt ratio. - Recent liquidation of IBRC and replacement of Promissory Notes with a portfolio of longer-term non-amortizing Irish government bonds expected to help return public finances to a sustainable position. ### Preconditions for effective banking supervision — B. Overview of the banking sector - Balance sheet trends: - Irish banks’ balance sheets have continued to reduce across the industry, driven by deleveraging and repayments exceeding new business. - Slight increase in net interest income for domestic retail banks in 2013 interim reports, but they have yet to return to profitability. - International banks report reduced net interest income in the past year; international wholesale sector recorded a profit in March 2013. - Solvency and capital ratios: - Core tier 1 ratios for domestic banks continue to deteriorate but remain above the 7% target level under Basel III. - Irish domestic banks also remain above the 10.5% target imposed under Ireland external support program with the EU and IMF. - Majority of international retail banks received capital injections from parents in 2013 per Central Bank requirements. - International wholesale banks’ average CT1 ratio is skewed by two institutions; excluding them, the sector holds a very healthy ratio (30.07%). - On aggregate, both domestic and international institutions are meeting their minimum CRD capital requirements (8%). - Asset quality and profitability: - Stock of impaired mortgages and SME loans has continued to rise and is the main short-term risk. - Data: 12.7 per cent of the total stock of primary dwelling loans were in arrears for more than 90 days in June 2013, compared with 12.3 per cent in March 2013. - Domestic banking sector must reconfigure business models to focus on core lending to the real economy; bank margins remain very narrow and banks are still reliant on central-bank funding. - Cost-to-income ratios remain under pressure due to restructuring and loan workout unit costs. - Domestic banks benefited from a decline in the flow of impaired loans, but impaired loans remain the single biggest determinant of overall losses. - Gains from debt buybacks and revaluations on NAMA transfers realised in 2011 were not as significant in 2012. - Short-term outlook for bank profitability remains weak due to anaemic income prospects and unresolved mortgage arrears. - Deleveraging and portfolio composition: - Deleveraging under the Financial Measures Program (FMP) remains on track and at a lower cost than initially foreseen. - Focus on selling overseas assets and prior transfers to NAMA has resulted in smaller and more concentrated loan books. - Irish loans now account for more than two thirds of the total loan book, while the relative share of mortgage lending has increased to over 58 per cent. - Provisions and coverage: - Ratio of provisions to nonperforming loans increased marginally in Q2 2013. - Differences persist between institutions reflecting varying sectoral and geographic exposures. - High cover ratios considered necessary given the scale of the Irish nonperforming loan problem. - Mortgage arrears management and regulation: - Progress in tackling mortgage arrears has been slow; lenders have often focused on forbearance. - Number of accounts over two years in arrears increased by 43 per cent between Q3 2012 and Q2 2013 to 4.3 per cent of outstanding mortgage accounts. - Central Bank measures of 13 March 2013 include publication of performance targets requiring banks to meet specific targets for proposing and concluding sustainable solutions for borrowers in arrears over 90 days. - Code of Conduct on Mortgage Arrears review completed; new code effective since July 1st 2013 addressing contact restrictions, definition of non-cooperative borrower, and conditions for removing tracker interest rates only as last resort. - Legislative initiatives include addressing the Dunne judgment and establishing the Insolvency Service of Ireland to administer new debt settlement arrangements in the Personal Insolvency Act. - Basel III transition: - Basel III will be phased in in the EU until 2019 and is expected to reduce banks’ headline capital ratios due to treatment of deferred tax assets, pension-fund deficits, and shortfalls on provisions for expected losses. - Banks’ published pro-forma ratios show an average common equity tier 1 ratio of around nine per cent for the domestic banks, which includes €5.3 billion in Government preference shares eligible until December 2017. ### Bank resolution — C. Bank Resolution - IBRC background: - IBRC formed in 2011 through merger of Anglo Irish Bank and Irish Nationwide Building Society, both taken fully into public ownership. - Promissory Notes were issued by the Irish State to Anglo Irish Bank and Irish Nationwide Building Society in 2010 to ensure compliance with regulatory capital requirements; these Promissory Notes were obligations with a non-standard amortising structure and represented Irish sovereign debt. - IBRC used the Promissory Notes (combined with other assets) to access exceptional liquidity assistance (ELA) lending from the Central Bank of Ireland. - Liquidation and asset transfers: - Irish Bank Resolution Corporation Act 2013 passed on February 7th 2013, providing for winding up of IBRC under a special liquidation regime. - As a result, the Central Bank of Ireland took ownership of collateral held against ELA lending to IBRC of €39.45 billion, consisting of Promissory Notes, NAMA bonds and other assets. - NAMA acquired the floating charge over IBRC’s assets from the Central Bank via a special purpose vehicle and issued government guaranteed NAMA bonds to the Central Bank in exchange. - Liquidation terminated IBRC’s market repo of the 5.4 per cent Irish 2025 bond, which was acquired by the Central Bank of Ireland. - Central Bank acquired, on behalf of the Eurosystem, assets held as collateral against standard Eurosystem borrowing by IBRC of €333 million; excess value of this collateral over the amount lent to IBRC was returned to the special liquidator. - The Central Bank did not suffer any loss on its lending to IBRC under exceptional assistance lending. - Disposal strategy and financial stability: - The Central Bank of Ireland will sell the bonds as soon as possible provided that conditions of financial stability permit. - Disposal strategy will maintain full compliance with the prohibition on monetary financing enshrined in the EU's Treaty on the Functioning of the European Union. - Transaction contributes to financial stability by allowing IBRC to be resolved definitively, ending reliance on exceptional liquidity arrangements, and replacing non-standard Promissory Notes with standard government bonds. *Source: IMF staff report text as provided in the content unit.* ### 50. Company law requires listed entities to prepare their group financial statements in ### _cr14135 - 50. Company law requires listed entities to prepare their group financial statements in ### Accounting standards and entity-level accounting (paragraphs 50–51) - Listed entities are required to prepare their group financial statements in accordance with International Financial Reporting Standards (IFRS) as endorsed by the European Union. - All other entities may adopt either local Generally Accepted Accounting Principles (GAAP) or IFRS. - Listed Irish licensed credit institutions prepare group financial statements in accordance with IFRS and may adopt local GAAP or IFRS at the entity level. - Local GAAP has, in the main, converged with IFRS. - Auditors in Ireland (including auditors of Irish licensed credit institutions) must apply International Standards of Auditing (UK and Ireland) as issued by the FRC. - These standards are based on the International Standards on Auditing issued by the IAASB, supplemented with additional standards and guidance for UK and Irish legal, regulatory, legislative, cultural and business context. - Auditors must comply with Ethical Standards published by the FRC, professional ethics requirements in legislation and any standards of professional conduct issued by the auditor’s own Recognized Accountancy Body. - Failure to apply these standards may result in disciplinary actions from the auditor’s applicable oversight bodies. ### Oversight of accountancy bodies (paragraph 52) - The Irish Auditing and Accounting Supervisory Authority (‘IAASA’) oversees how the ‘Prescribed Accountancy Bodies’ (‘PABs’) supervise their members (auditors, accountants and students), including: - inspecting audit firms and audit work; - investigating complaints; and - disciplining where appropriate. - PAB members are regulated by the PABs themselves subject to the Bye-Laws of their institutions; IAASA has a secondary, oversight role. - The model is State supervised regulation rather than direct regulation. ### Payment systems framework (paragraphs 53–54) - Retail clearing and settlement in Ireland is conducted through: - The Irish Retail Electronic Payments Clearing Company Limited (IRECC) — clears retail electronic payment instruments (debit and credit). - The Irish Paper Clearing Company Limited (IPCC) — clears paper payment instruments, mainly cheques. - Each company constitutes a payment system for the purposes of Part 11 of the Central Bank Act, 1972. - Settlement takes place in TARGET2. - IRECC and IPCC operate under the Irish Payment Services Organization Limited (IPSO). - The Central Bank of Ireland maintains regular contact with IPSO and the two clearing companies and is represented on IPSO and the clearing companies’ Boards, primarily in an observer capacity. - The Central Bank is directly engaged in oversight: monitoring developments and planned changes, assessing against oversight principles/standards, and fostering change to promote payment and settlement systems that are safe and efficient. - For cross-border payment and securities settlement systems, the Central Bank engages in cooperative oversight arrangements (mainly oversight assessments and development of oversight standards). ### Trade in Irish securities (paragraph 55) - Irish Government Bonds are settled in Euroclear Bank in Belgium. - Equities and other securities are settled in the Euroclear UK and Ireland CREST system in the United Kingdom. - The Central Bank provides euro settlement services for securities settled in the CREST system. - There are no central counterparties (CCPs), Central Securities Depositories (CSDs) or Trade Repositories (TRs) located in Ireland. ### Deposit Guarantee Scheme (DGS) — Financial safety net (paragraphs 56–57) - Deposits held with banks, building societies and credit unions authorised in Ireland are protected by the Deposit Guarantee Scheme (DGS). - All eligible deposits up to a limit of €100,000 per person per institution are guaranteed to be repaid by the DGS. - DGS protection includes deposits held at branches of authorised Irish institutions operating in other EU member states. - The DGS generally protects deposits belonging to individuals, small companies, partnerships, clubs, associations, schools etc. - Exclusions: deposits belonging to large and medium sized companies, public authorities, insurers, pension funds, collective investment schemes, banks and certain other financial institutions. - The DGS is obliged to issue compensation to depositors duly verified as eligible within 20 working days of a credit institution failing. - The DGS is administered by the Central Bank of Ireland and funded by the credit institutions covered by the scheme. - Each credit institution is required to maintain a Deposit Protection Account (DPA) equivalent to 0.2 per cent of their total deposits, in order to fund the DGS. - The DGS was established under the European Communities (Deposit Guarantee Schemes) Regulations, 1995 (S.I. No.168 of 95) and amended by European Communities (Deposit Guarantee Schemes) (Amendment) Regulations, 2009 (S.I. No. 228 of 2009). ### Exceptional Liquidity Assistance (ELA) (paragraphs 58–59) - The Central Bank may grant Exceptional Liquidity Assistance (ELA) to a credit institution when deemed necessary for financial stability purposes; this is distinct from regular ECB monetary policy funding. - Statutory basis: Central Bank Act 1942 — Section 5B(d) provides a general power to lend against security to credit institutions in pursuit of the Bank’s financial stability objective provided by Section 6A(2)(a) of the 1942 Act. - ELA provided in recent years: - At end-December 2012, the Bank had extended ELA of €40 billion. - Historical annual ELA amounts cited: €11.5bn in 2009, €49.5bn in 2010 and €42bn in 2011. - In February 2013, on the liquidation of IBRC, the Bank’s ELA operations ceased. ### Recovery and resolution (paragraphs 60–61) - Central Bank Credit Institution Resolution Act (CBCIR) enacted in 2011 establishes the resolution regime. - The Special Resolution Unit (SRU) was established within the Central Bank to operationalize CBCIR. - SRU must be operationally separate from supervisory areas. - CBCIR does not apply to institutions covered by the Credit Institutions (Stabilization) Act 2010 (‘CISA’); while CISA remains in place, CBCIR will not apply to those banks covered by CISA. - CBCIR applies to credit unions, IFSC licensed banks and foreign owned banks licensed to operate in the jurisdiction. - The CBCIR permits the Central Bank to request recovery plans and confers powers to resolve credit institutions where recovery is not likely. - Resolution action is taken by the Central Bank under powers vested in the Governor; the Governor instructs the SRU team, with support from supervisory functions. - CBCIR is relatively new legislation and has not yet been used to resolve an authorised credit institution in the jurisdiction. - The recovery plan aspect has yet to be fully implemented. - Central Bank implementation may be deferred pending a review of proposed arrangements under an EU proposed Directive on Crisis Management and Bank Resolution. ### Summary of assessment results — Responsibilities, powers, independence, and cooperation (CPs 1–3) (paragraphs 62–66) - The Central Bank is the sole authority responsible for supervision of the banking system. - Legislative description of Central Bank objective: “the proper and effective regulation of financial services and markets.” - Responsibilities include safety and soundness of prudential supervision, monitoring bank compliance with consumer protection regulation and AML/CFT legislation. - Central Bank has discretionary powers buttressed by legislative enhancements, including: - Central Bank Reform Act 2010; - Central Bank (Supervision and Enforcement) Act 2013; - Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (CJA2010). - The Central Bank is the competent authority for monitoring compliance with CJA2010. - The Central Bank is operating below its approved staffing levels; prompt staffing of vacancies would enhance capacity. - The Central Bank can issue enforceable policies and codes and impose license conditions; examples include a code on related party lending, operational risk requirements, approval/notification for significant acquisitions, and increased country risk monitoring. - In AML/CFT, statutory guidelines envisaged by Section 107 of the CJA 2010 have not been issued and would strengthen the Central Bank’s position if issued. - Independence concerns: Minister for Finance may remove a member of the Central Bank Commission “if in the Minister’s opinion it is necessary or desirable to do so to enable the Commission to function effectively.” No concrete statutory definition of conditions for removal is provided. - Other concerns: need for Ministerial approval to increase industry levies to fund banking supervision; requirement to seek Ministerial approval to deny or revoke a banking license despite Central Bank being licensing authority. ### Ownership, licensing, and structure (CPs 4–7) (paragraph 67) - The Central Bank grants banking licenses to entities which may have unregulated corporate parents, domestically and cross-border, producing a de facto ring-fence regime for newly licensed banks. - The Central Bank lacks authority to perform fit-and-proper reviews on management of unregulated parents and to take enforcement action on parents. - Until the Central Bank (Supervision and Enforcement) Act 2013, the Central Bank also lacked authority to require submission by the parent of information needed for supervision. - Options to address lack of access to parent include imposing restrictions at licensing and requiring parent and management agreement to provide information and comply with fit-and-proper requirements. ### Methods of ongoing supervision (CPs 8–10) (paragraphs 68–70) - PRISM model is the supervisory framework used to assign bank risk ratings, allocate supervisory resources, and determine supervisory intensity and frequency. - Onsite reviews and intrusive supervision are mainly allocated to High Impact banks; Medium-Low and Low impact banks rely more on reactive processes. - Offsite supervision is largely automated and relies on triggers of financial ratios rather than deep analysis of regulatory returns. - Quality, frequency and depth of qualitative data to assess risk are limited; onsite activity is limited, particularly for Low Impact banks where no minimum frequency of onsite reviews is prescribed by PRISM. - A reactive approach for lower impact banks and reliance on exception reporting may not allow sufficient identification, assessment and mitigation of risks; aggregate build-up across lower impact banks could create systemic vulnerabilities and reputational risk. - Supervisory focus primarily on impact of failure can distort resource allocation; supervision should be preventive/corrective and bank-specific with greater flexibility in supervisory activities. - PRISM includes KRIs categorized into: capital, liquidity, credit, business model/strategy and market risk. - Identified gaps: - No KRIs for interest rate risk in the banking book. - Only a single indicator for market risk. - Recommendation: expand KRIs to ensure all material risks are monitored to detect changes in risk profile. ### Corrective and sanctioning powers (CP 11) (paragraphs 71–73) - The Central Bank has sufficient discretionary enforcement powers to address weaknesses or non-compliance. - The Central Bank (Supervision and Enforcement) Act 2013 expands authority to require preventive and corrective action over a broad range of activities. - Enforcement process is linked to PRISM; a Risk Mitigation Program (RMP) is used when issues requiring remediation are identified. The RMP sets out the issue, prescribed action, required outcome and timeline. - The Central Bank follows an Administrative Sanctions Procedure (ASP) when bringing enforcement action, can issue supervisory warnings, enter into settlements, and following an Inquiry impose sanctions from cautions/reprimands to fines and disqualification of individuals. ### Consolidated and cross-border supervision (CPs 12–13) (paragraph 74) - The Central Bank applies prudential standards on a group-wide basis where responsible for consolidated supervision. - The Central Bank undertakes supervisory activities to understand banking group structure and supervises material activities including nonbanking activities in the wider group, domestic and cross-border. - The Central Bank collects and analyses financial and other information considered adequate for effective consolidated supervision. - The Central Bank acts when group risks are identified that could jeopardize safety and soundness. - Home-Host relationships and supervisory colleges are working well. ### Corporate governance (CP 14) (paragraph 75) - The Central Bank has issued a Corporate Governance Code that goes beyond CRD minimum requirements and sets obligations for all financial institutions. - The Code provides detailed guidance on Board role, senior management role and requires an annual compliance statement. - The Central Bank holds extensive powers regarding fitness and probity of directors and certain senior management positions. ### Prudential requirements, supervisory resources and reporting (CPs 15–29) (paragraph 76) - Supervisors evaluate adequacy of bank risk management strategies, policies, processes and limits through periodic risk assessments and engagement with senior personnel. - For onsite risk reviews, dedicated specialist teams exist: Credit, Treasury, Risk Analytics (Quantitative Models Unit & Portfolio Analytics and Stress testing Unit) and Business Model Analytics. - Specialist teams analyze risk management processes and assess offsite reporting. - Under risk-based supervision, monitoring frequency varies by PRISM impact rating; highest impact banks have ongoing engagements with actions tracked via RMPs within PRISM. - Where onsite activities are not performed, considerable reliance is placed on self-assessments to make ongoing risk assessments. - The range of qualitative and quantitative information (e.g., for business continuity) was not sufficient to reliably monitor robustness of arrangements on an ongoing basis. *IMF staff report content unit _cr14135 (excerpts as provided).* ### 77. To assess asset soundness and credit risk management, resources are heavily weighted ### _cr14135 - 77. To assess asset soundness and credit risk management, resources are heavily weighted ### Supervisory focus and resource allocation - Resources are heavily weighted towards the High Impact banks, described as the banks of greatest systemic importance and the largest exposure to credit risk. - Routine supervisory activities for High Impact banks: - provide a variety of inputs to assess credit risk management processes against changes in market and macroeconomic conditions. - include analysis of regulatory data and enhanced reporting requirements to detect changes in risk profile on an ongoing basis. - are considered adequate to assess the Board’s involvement in developing and regularly approving the credit risk management strategy and significant policies and processes. - Evidence indicates supervisors are going beyond routine tasks and minimum activities prescribed by PRISM. ### Onsite loan-file reviews and credit risk assessment - When onsite review of loan files is performed (with credit risk specialists assisting), supervisors can: - assess whether senior management has implemented the Board-approved credit risk strategy. - assess whether underwriting practices are consistent with policy and prudent for market and economic conditions. - Limitations identified: - Frequency and depth of onsite credit risk reviews for lower risk institutions and allocation of credit risk specialists could be enhanced. - For banks assigned PRISM Impact ratings below High (especially Medium Low and Low), variance analysis might not provide insight into credit risk management application until after risks begin to crystallize, resulting in breaching Central Bank triggers for supervisory attention. ### Provisioning, valuation, and onsite verification - The Central Bank has: - updated and expanded guidance regarding provisioning and valuation practices. - performed more frequent and in-depth onsite assessments. - allocated considerable resources over the last several years to encourage prudent provisioning practices with a significant focus on the covered banks. - issued update guidance that goes beyond that of other authorities in the region where IFRS is applied. - overseen various externally led balance sheet exercises. - Impact: multiple activities have increased the conservatism of banks’ loan loss provisioning practices. - Recommendation: Supervisory activities should place greater reliance on onsite verification of bank processes, particularly: - assessing processes for the early identification of problem assets; - application of prudent valuations for collateral; - testing assumptions that feed into provisioning models. - Implementation status: - Evidence suggests this process commenced with the covered banks but had not yet been extended across the sector (with due regard to proportionality). - Greater frequency and depth of onsite reviews will allow supervisors to verify provisioning practices by loan sampling and testing assumptions against actual experience and market/economic changes, enabling better assessment of whether provisions are adequate for prudential purposes. ### Related-party transactions and country risk - Code of Practice on Lending to Related Parties: - Issued in 2010. - Establishes requirements for transactions with affiliates to be at arms’ length and uses a broad definition of related parties. - Scope limitation: only lending transactions are covered; asset purchases and deposit terms are excluded. - Country risk policy: - Issued in August 2013 and in the process of implementation. - Policy is comprehensive; the Central Bank is developing monitoring procedures and conducting reviews. - One bank examination conducted, another ongoing, and another in-process at time of the BCP assessment. - Monitoring compliance will require improved reporting by banks, incorporation into the PRISM process, and reviews of bank compliance; banks will need to implement internal processes to meet policy requirements. ### Operational risk and reporting - A detailed operational risk policy has been implemented and a number of onsite reviews conducted. - A report to be filed by banks has been implemented; the first reports are to be filed as of September 30, 2013. ### Anti-Money Laundering (AML) - Anti-Money Laundering legislation implemented in 2010 (CJA 2010). - Scope of the legislation is comprehensive; the Central Bank is implementing its monitoring and enforcement program. - Elements still to be implemented for effective supervision: - analysis of data from risk assessments and in-depth inspections to underpin publication of inspection findings; - inform sector-wide risk mitigation actions; - identify targets for thematic inspections. - Strengthening measures suggested: - Issuance of statutory guidelines as envisaged by Section 107 of the CJA 2010 would strengthen the Central Bank’s position. - Compliance activity to date: - Compliance assessments via risk assessment questionnaires have been carried out on 21 banks. - Branches of foreign banks have not been incorporated in AML compliance reviews; most reviews were questionnaire-based with limited onsite testing. - No requirement exists to appoint a dedicated officer to whom potential abuses of the banks’ financial services are reported. - The CBI plans to issue communications following inspections setting out principal findings and expectations for demonstrating compliance with the CJA 2010. - The CBI has not issued specific requirements for internal audit and/or external experts to independently evaluate AML risk management policies, processes and controls. ### Summary compliance with the Basel Core Principles (selected assessments and comments) - Core Principle 1 (Responsibilities, objectives and powers): C - Core Principle 2 (Independence, accountability, resourcing and legal protection for supervisors): MNC - Legislation requires approval of the Minister for Finance for setting levy structure to fund supervision, denying a license application, involuntary revocation of a banking license. - Minister may remove Commission members for specified reasons; Secretary General of the Department of Finance sits on the CBI Commission ex-officio. - Core Principle 8 (Supervisory approach): C - PRISM model is centerpiece assigning bank risk ratings and determining supervisory intensity and frequency. - Core Principle 9 (Supervisory techniques and tools): MNC - Primary concern: calibration of PRISM for mix of onsite/offsite supervision for Medium Low and Low Impact banks. - Analysis of regulatory returns should be strengthened; greater focus needed on testing and sampling of risk management processes. - Core Principle 14 (Corporate governance): LC - For banks rated Medium-low and Low, supervisory activities are not adequate to assess governance robustness (EC2); insufficient attention to board stewardship and understanding of risk and corporate governance (EC8). - Core Principle 15 (Risk management process): LC - Insufficient qualitative and quantitative information to monitor business continuity on an ongoing basis (EC12). - Frequency of onsite testing and verification of model validation results needs enhancement (EC6). - Core Principle 17 (Credit risk): LC - Frequency and depth of onsite credit risk reviews for lower risk institutions and allocation of credit risk specialists is not sufficient (EC3). - For Medium Low and Low PRISM Impact ratings, variance analysis may not provide insight until after risks crystallize and supervisory triggers breached (EC1). - Core Principle 18 (Problem assets, provisions, and reserves): LC - Need greater frequency and depth of onsite reviews of loan loss provisioning practices (e.g., testing assumptions against experience, recognition of default, prudent valuations). - Core Principle 20 (Transactions with related parties): MNC - Only credit transactions covered; compliance monitoring mainly offsite with some onsite testing; reports filed by banks lack information to monitor terms, rates and other RPL Code requirements. - Core Principle 21 (Country and transfer risks): LC - Requirements issued in August 2013; CBI developing monitoring process and conducting initial compliance reviews. - Core Principle 22 (Market risk): LC - Limited onsite market risk coverage by Treasury Team, proportional to low traded market risk in most banks. - Insufficient onsite testing to verify mark-to-market valuations and revaluations; oversight of internal models on an ongoing basis is inadequate (EC4). - Core Principle 23 (Interest rate risk in the banking book): LC - Detailed reviews by treasury team on High Impact banks; less frequent Full Risk Assessments for lower impact banks supplemented by quarterly risk dashboards and twice yearly meetings; reliance on self-assessment for lower Impact banks. - Core Principle 25 (Operational risk): LC - First monitoring reports filed as at September 30, 2013; effectiveness of monitoring and enforcement cannot be assessed at this time. - Core Principle 26 (Internal control and audit): LC - No regulatory requirement for Board responsibility for internal control environment; supervisory assessment for banks below High Impact relies on desk-based review of exception reporting without sufficient supporting documentation (EC4 and EC5). - Core Principle 27 (Financial reporting and external audit): LC - Central Bank does not have power to reject and rescind the external auditor as required by EC6; cannot influence audit scope or establish standards for external audit. - Core Principle 28 (Disclosure and transparency): C - Central Bank will ensure financial statements have an auditor’s opinion expressing that they give a true and fair view. - Core Principle 29 (Abuse of financial services): MNC - Branches of foreign banks excluded from AML compliance reviews; limited onsite testing; statutory guidelines under Section 107 of CJA 2010 not yet issued; no requirement for internal audit/external experts to independently evaluate AML risk management; no requirement for a dedicated reporting officer. ### Assessment methodology - Observation categories used: compliant; largely compliant; materially noncompliant; noncompliant; non-applicable. - Definitions summarized: - "Compliant": all EC and ACs met without significant deficiencies. - "Largely compliant": only minor shortcomings; clear intent to achieve full compliance within a prescribed period. - "Materially noncompliant": severe shortcomings despite formal rules; supervision clearly not effective. - "Noncompliant": principle not substantially implemented; several ECs not complied with; supervision manifestly ineffective. - "Non-applicable": criteria do not relate to the country’s circumstances or principle does not apply given structural, legal and institutional features. *Source: _cr14135 - 77. To assess asset soundness and credit risk management, resources are heavily weighted* ### 86. Table 2 below provides a detailed principle-by-principle assessment of the BCP. The ### _cr14135 - 86. Table 2 below provides a detailed principle-by-principle assessment of the BCP. The ### Table structure and purpose - The “description and findings” sections provide information on the legal and regulatory framework, and evidence of implementation and enforcement. - The “assessment” sections contain only one line, stating whether the system is “compliant,” “largely compliant,” “materially non-compliant,” “non-compliant” or “not applicable.” - The “comments” sections explain why a particular grading is given and reflect the assessment team’s judgment on strengths and areas for further improvement. ### Institutional framework — summary findings - The Central Bank of Ireland (CBI) is the single authority responsible for prudential banking supervision. - CBI responsibilities are defined in Section 6 A (2) (b) of the CBI Act as “the proper and effective regulation of financial service providers and markets.” - The Central Bank Act 1942 (CBI Act) states CBI objectives: the stability of the financial system overall; the proper and effective regulation of financial institutions and markets while ensuring the best interests of consumers of financial services are protected; the efficient and effective operation of payment and settlement systems; the provision of analysis and comment to support national economic policy development; and the discharge of such other functions and powers as are conferred on it by law. - The CBI is responsible for licensing and monitoring anti-money laundering regulation compliance in banks. - The primary function of the Banking Supervision Divisions is the onsite and off-site supervision of all Irish licensed credit institutions. - Assessment of Principle 1: Compliant ### Principle 1 — Essential criteria findings (EC1–EC7) - EC1: Responsibilities and objectives of supervisory authorities are clearly defined in legislation and publicly disclosed. - The CBI is the single prudential supervisor; responsibilities set out in Section 6 A (2) (b) of the CBI Act. - EC2: Primary objective is to promote safety and soundness of banks; broader CBI responsibilities do not subordinate or conflict with banking supervision. - Stated objectives in supervising Credit Institutions: (i) to foster a stable banking system and (ii) to provide a degree of protection to depositors with individual credit institutions. - CBI also has broader responsibilities (monetary policy as part of the ESCB; financial market operations; payments and settlements; other financial services supervision) but banking supervision is not subordinate to these. - Banking supervision is adequately funded and represented by a Deputy Governor. - EC3: Laws and regulations provide a framework for setting and enforcing minimum prudential standards; supervisor can increase prudential requirements for individual banks and groups. - Minimum prudential standards established through primary legislation (e.g. Central Bank Acts), secondary legislation (e.g. Statutory Instruments implementing Directives such as the CRD), or regulatory requirements issued by the CBI. - CBI issues regulatory requirements under Section 10 of the CBI Act 1971; also issues “policy” and “Codes” which are enforceable. - CBI powers to impose requirements primarily under regulation 70 of S.I. 661 of 2006, Section 10 of the CBI Act 1971, and the CBI (Supervision and Enforcement) Act 2013. - CBI may notify appropriate authorities for possible criminal sanctions where contraventions are designated criminal offenses; pursues corrective/enforcement action through an Administrative Sanctions Procedure (ASP). - CBI can require risk mitigation programs (RMP), issue supervisory warnings or directions, and hold inquiries under Part IIIC of the CBI Act 1942 that may lead to sanctions/fines. - CBI can impose additional prudential requirements (examples cited: limiting deposit-taking to no deposits of less than €500,000; liquidity requirements set out in “Requirements for the Management of Liquidity Risk” imposed as additional license requirements on all banks). - Regulation 70 enables requirement that credit institutions “that does not meet the requirements of any law of the State giving effect to take the necessary actions or steps at an early stage to address the situation.” - Regulation 70 used to impose additional capital requirements in PCAR, most recently in March 2011, and to re-issue a RMP. - EC4: Banking laws and prudential standards are updated as necessary and are subject to public/European-level consultation as appropriate. - EU Directives are the channel for updates (e.g. Basel II implemented via the CRD); Member States transpose Directives into national law. - Since 2010 significant revisions to CBI legislation, including enhancements to enforcement authority in 2013. - EC5: Supervisor has powers to access banks’ Boards, management, staff and records; review overall activities of banking groups (domestic and cross-border); and supervise foreign banks incorporated in jurisdiction. - Section 17A and Section 18 of the Central Bank Act 1971 give inspection and access powers. - Primary legislative powers apply at consolidated, sub-consolidated or solo level; S.I. 475 of 2009 sets out when consolidated supervision is applicable. - Part 3 of the CBI (Supervision and Enforcement) Act 2013 grants extensive authorized officer powers and information-gathering powers to “associated enterprises” and can be used outside the State (subject to liaison). - Supervisory authority extends to all banks operating in Ireland regardless of home country. - EC6: Supervisor can require timely corrective action; impose a range of sanctions; revoke licenses; cooperate with relevant authorities for orderly resolution. - Regulation 70 of S.I. 661 requires banks not meeting CRD requirements to take necessary actions at an early stage. - CRD measures available to the CBI include: - (i) obliging credit institutions to hold own funds in excess of the minimum level set out in the CRD; - (ii) requiring reinforcement of arrangements, processes, mechanisms and strategies for CRD compliance; - (iii) requiring credit institutions to apply a specific provisioning policy or treatment of assets in terms of own funds requirements; - (iv) restricting or limiting business, operations or network of credit institutions; - (v) requiring reduction of risk inherent in activities, products and systems. - The CBI may, with the consent of the Minister, revoke a license. - Section 45 of the Central Bank (Supervision and Enforcement) Act 2013 permits the CBI to issue “directions” requiring corrective actions (dispose of assets; suspend activity up to 12 months; raise capital; change internal systems and controls; address law violations). - Credit Institutions (Resolution) Act 2011 (CBCIR) establishes process for resolution of failed/failing banks; CBI must apply to court before resolving a bank; liquidation governed by company law with CBI-appointed liquidator; CBI and Minister for Finance represented on liquidation committee. - EC7: Supervisor can review parent and affiliated companies’ activities to determine impact on bank/group safety and soundness. - CBI supervises “Home” banks on a consolidated basis (including bank and nonbank subsidiaries), up to and including financial holding companies; prudential/regulatory requirements imposed at financial holding company or parental level under the CRD. - S.I. 475 of 2009 transposes relevant CRD parts and deals with reviewing parent activities. - Foreign-owned subsidiaries are subject to solo supervision and must comply with minimum prudential requirements on a subsidiary basis. - Consolidated supervision considers all group companies including unregulated subsidiaries; regulated entities must comply with minimum regulatory requirements on a solo basis; discretion only where subsidiaries are unregulated. - For unregulated parents, CBI monitors financial condition through information from the Irish operation and public financial statements; applies fit and proper requirements to controlling owners but not to senior management during licensing review; Irish operation is ring-fenced from unregulated parent. - CBI (Supervision and Enforcement) Act 2013 enhances powers to obtain information from “related persons,” exercisable outside the State subject to liaison. - Regulation 15(a) of S.I. 661 of 2006 provides that parent credit institutions in the State shall comply with the CRD on the basis of their consolidated financial situation. ### Principle 2 — Independence, accountability, resourcing and legal protection (EC1–EC2 excerpt) - EC1: Operational independence, accountability and governance are prescribed in legislation and publicly disclosed; no government or industry interference compromises independence; supervisor has full discretion to take supervisory actions. - CBI is an independent statutory body acting in accordance with the Treaty on the Functioning of the European Union and the ESCB Statute and within the statutory regime of Irish financial services law (primarily Central Bank Act 1942 and Schedule 2 enactments). - CBI has full regulatory and supervisory powers to supervise and take enforcement action without consultation or interference, except in specific circumstances requiring consultation or Minister for Finance approval (e.g. involuntary revocation of license, application of levies, denial of license). - Governor/Deputy Governor and senior management appear before the Joint Oireachtas Committee. - Internal governance structures are not set out in legislation but are determined by the CBI and explained in public documents. - CBI’s decisions can be appealed to the Irish Financial Services Appeals Tribunal and judicially reviewed. - CBI must prepare and submit a strategic plan every three years to the Minister for Finance (section 32B of the Central Bank Act 1942) and prepare a statement relating to the CBI’s performance under chapter 2A Article 32L of the Central Bank Act 1942 (inserted by the Central Bank Reform Act 2010). - EC2: Appointment and removal processes for heads and governing body members are transparent and set out in law. - Appointment and removal of the Central Bank Commission (Board), Governor and Deputy Governors (including Deputy Governor for Financial Regulation) are set out in the Central Bank Act 1942. - Commission composition includes: - (1)(a) persons for the time being holding or performing the duties of: (i) Governor; (ii) Head of Central Banking; (iii) Head of Financial Regulation; (iv) Secretary General of the Department of Finance, and - (1)(b) at least 6, but no more than 8, other members appointed by the Minister. *Source: _cr14135 - 86. Table 2 below provides a detailed principle-by-principle assessment of the BCP. The* ### Section 24B of the Central Bank Act 1942 limits a Commission member to holding the ### _cr14135 - Section 24B of the Central Bank Act 1942 limits a Commission member to holding the ### Terms of office and removal powers - Section 24B of the Central Bank Act 1942 limits a Commission member to holding the position for a period of 5 years unless he or she previously ceases to hold that office in accordance with a provision of this Part. May be renewed once. - Section 25 of the Central Bank Act 1942 provides that the Minister may remove an appointed member of the Commission from office: - (a) for proven misconduct or incompetence, or - (b) if in the Minister’s opinion it is necessary or desirable to do so to enable the Commission to function effectively. - Governor: - Section 19: The Governor shall be appointed by the President on the advice of the Government. A person appointed as Governor holds office for 7 years from the date of the person’s appointment. The President, on the advice of the Government, may appoint a person holding office as Governor for a further period of seven years to take effect at the end of the person’s current period of appointment. - Section 21: - (1) The President may, on the advice of the Government, remove the Governor from office on the ground that the Governor has, because of ill-health, become permanently incapacitated from carrying out the responsibilities of Governor. - (2) The President may, on the advice of the Government, remove the Governor from office on one or more specified grounds of serious misconduct. - Observations from the text: - The current Governor is a number of years into his 7 year contract while the previous Governor served longer than the 7 year term. - The current Governor is the first not to come from the Secretary General position at The Department of Finance. - The recently appointed Deputy Governor for Financial Regulation and the prior one were from other member EU states. ### Accountability and publication of objectives (EC3) - The CBI annually publishes its objectives and the extent of achievement of those objectives. - The CBI must prepare and submit to the Minister for Finance a strategic plan every three years; this plan is laid before the Houses of the Oireachtas (section 32B). - The CBI is required to prepare a statement relating to the CBI’s performance in regulating financial services under chapter 2A Article 32L (inserted by the Central Bank Reform Act 2010). - Within one month after receiving a performance statement from the CBI, the Minister will lay it before each House of the Oireachtas. - The Governor or a Head of Function may be requested by a Committee of the Oireachtas to: - (a) attend before the Committee, and - (b) provide that Committee with information relating to the Bank’s performance statement, and shall: - (i) appear before the Committee, and - (ii) subject to section 33AK(1A), provide the Committee with such information relating to the performance statement as the Committee requires. - The CBI published its Annual Performance Statement on its financial regulatory activities for 2012 in April 2013. The Governor/Deputy Governor and senior management have appeared before the Joint Oireachtas Committee on the performance and discharge of their duties. ### Internal governance, decision-making and conflict of interest (EC4, EC5) - Governance and decision processes: - The Commission has approved a ‘delegation of powers’ framework and an extensive assignment of responsibilities pursuant to section 32A of the Central Bank Act 1942 to ensure decisions are taken at the appropriate level and in a timely manner. - Two significant committees have been established: the Policy Committee and the Supervisory Risk Committee. - Legal provisions on conflicts: - CBI Act 1942 sets out requirements in relation to avoiding conflicts of interest for Commission member (Section 24), Governor (Section 19 & 20), Deputy Governor (Section 23). - Internal codes and rules: - All staff are subject to the Staff Code of Ethics and Behavior and the Employee Trading Rules. - The code requires staff not to put themselves in positions giving rise to actual or apparent conflicts and requires senior officers not to be active members of any political party or organization. - Employee Trading Rules require staff to abstain from economic or financial transactions that may hinder independence and impartiality. - Staff must disclose any shareholdings to ensure transparency and highlight potential conflicts of interest. - Confidentiality: - Staff are required by legislation (Central Bank Act, 1942 section 33AK) to preserve the confidentiality of information. Internal information security policies are also in place. - Perception and credibility: - Discussions with industry disclosed a consensus that CBI staff are professional, have increased skills, and add value through the supervisory process. ### Resources, staffing and supervisory capacity (EC6, EC7, EC8, EC9) - Funding and autonomy: - The CBI applies levies on the banks to fund its regulatory duties/activities. The amount of the levy must be approved by the Minister. The ability to charge levies is set out in the CBI Act 1942. - The CBI considers Banking Supervision Divisions are adequately resourced to perform their supervisory functions. - Staffing policies and flexibilities: - The CBI evaluates staffing levels and skillsets continuously. - As a Public Sector entity the CBI cannot offer the same remuneration as private sector but has flexibility in entry points within hierarchical grading, greater certainty of tenure, and a defined benefit pension scheme as recruitment tools. - The CBI can commission external experts; under the Central Bank (Supervisory and Enforcement) Act 2013 the cost of external experts can be applied directly to the banks and non-employees can be appointed as authorized officers. - Training and technology: - The CBI has a significant training budget; Banking Supervision has its own training budget and a Training Needs Analysis process and core curriculum. - The CBI operates a centralized technology budget; divisions present business cases for new projects. - Travel and cross-border cooperation: - Banking Supervision has a significant travel budget to facilitate relevant travel, cross-border cooperation and participation in international meetings. - Staffing numbers (by category): - Front line supervisor: 2010 = 66, 2012 = 49 - Projects: 2010 = 4, 2012 = 6 - Risk specialists – Supervision Support (credit, treasury, business model, risk model): 2010 = 26, 2012 = 24 - Stress testing: 2010 = 2, 2012 = 5 - Divisional Operations (admin, reporting, policy): 2010 = 15, 2012 = 12 - Special resolutions: (values implied blank) - Grand Total: 2010 = 113, 2012 = 96 - Turnover rates: - Front line supervisor: 2011 = 4.5%, 2012 = 1.8% - Projects: 2011 = 0.0%, 2012 = 0.0% - Risk specialists (credit, treasury, business model, risk model): 2011 = 7.7%, 2012 = 16.7% - Stress testing: 2011 = 0.0%, 2012 = 12.5% - Support (admin, reporting, policy): 2011 = 13.3%, 2012 = 0.0% - Special resolutions: 2011 = 0.0%, 2012 = 0.0% - Grand Total: 2011 = 6.2%, 2012 = 5.6% - Historical resource change: - There has been a doubling of banking supervision resources since the beginning of the current financial crisis (i.e. July 2007) with a consequential increase in levies to reflect this. - Allocation framework and risk-based supervision (PRISM) (EC8): - PRISM assigns supervised firms to one of four impact categories: High, Medium High, Medium Low and Low. - Supervisory resources are allocated based on impact assessment with minimum supervisory engagement programs per category and resource buffers to supervise above the minimum. - Legal protection for staff (EC9): - The CBI and its employees have statutory protection from being liable in damages for actions carried out while performing the functions of the CBI provided they have not acted in bad faith. - Section 33AJ applies to specified persons and states a person to whom this section applies is not liable for damages for anything done or omitted in the performance or purported performance or exercise of any of its functions or powers, unless it is proved that the act or omission was in bad faith. - In the past 5 years there have been no cases of litigation taken against the Central Bank of Ireland arising from its supervisory functions, nor has it had to pay any compensation arising from this role. - Practice: while no formal policy exists on provision of costs for staff defending their actions, the practice to date has been that the Central Bank does support its staff (noting reimbursement is ex-post). ### Assessment, material noncompliance and identified legal weaknesses - Assessment of Principle 2: Materially Noncompliant - Key comments and identified legal constraints: - The Minister may remove an appointed member of the Commission from office if, in the Minister’s opinion, it is necessary or desirable to do so to enable the Commission to function effectively. To date the Minister has not utilized this power. The CBI has requested that this legislative provision be repealed, however the Department of Finance has indicated that it will not be taking any action on the basis of this request. - The CBI can only revoke a banking license (i.e. where revocation is not being sought by the license holder) with the prior consent of the Minister for Finance. - The CBI may not deny a license application or revoke a license granted based on false information without the consent of the Minister of Finance. - The Secretary General of the Department of Finance is a member of the CBI commission. - The CBI must seek approval of the Minister to increase levies imposed on the industry when it considers current levels are insufficient to properly perform its function. - CBI staff are held to equivalent civil/public service pay scale and conditions. Banking Supervision is operating with vacancies and turnover in key skilled positions is high. - The record shows no evidence of interference by the Minister for Finance to date, but the legal framework should be amended to document the practice and ensure its continuity as players change. - Although, as a matter of practice, the CBI reimburses staff for legal expenses, this is done ex-post. ### Cooperation and information sharing with domestic authorities (Principle 3, EC1) - The Central Bank is responsible for supervision of financial service providers and markets and for financial stability. Other relevant domestic authorities include: - The Garda Síochána, Revenue Commissioners, Director of Corporate Enforcement, Competition Authority and National Consumer Agency; liaising with the Department of Finance and/or Minister for Finance is required from time to time. - Legal and informal arrangements: - Specific provision in European and domestic legislation, and agreed protocols with some agencies, allow for cooperation and sharing of confidential information. - Formal gateways in domestic legislation exist to mandatorily report to and share information with relevant authorities. - Informal, non-legal arrangements exist for cooperation and information sharing (e.g., Department of Finance, Office of the Director of Corporate Enforcement (ODCE)). - Memoranda of Understanding (MoUs): - 2008 MoU between the Central Bank and the Irish Auditing and Accounting Supervisory Authority (IAASA) allowing exchange of relevant information and cooperation on investigations. - MoU between the Central Bank and the Department of Finance in place since 2011 regarding oversight of the banking sector (in addition to a Financial Stability MoU in place since 2007), which sets out responsibilities, principles for cooperation and information exchange, and confirms applicability of Section 33AK and professional secrecy in the CRD. *Source: _cr14135 - Section 24B of the Central Bank Act 1942 limits a Commission member to holding the* ### Section 33AK of the Central Bank Act 1942 is the key piece of legislation regarding ### Section 33AK of the Central Bank Act 1942 is the key piece of legislation regarding ### Overview - Section 33AK of the Central Bank Act 1942 is the key piece of legislation regarding coordination and collaboration between the domestic authorities involved in financial sector regulation. ### Main provisions - Sections (3) and (5) are the main sections: - Subsection (3) – Requires the Central Bank to report certain matters to the bodies. - Subsection (5) – Enables the Central Bank to disclose confidential information to relevant parties. ### Functional focus - Coordination and collaboration between domestic authorities involved in financial sector regulation. - Reporting obligations of the Central Bank (as specified in Subsection (3)). - Confidential information disclosure authority of the Central Bank (as specified in Subsection (5)). *Source: _cr14135 - Section 33AK of the Central Bank Act 1942 is the key piece of legislation regarding* ### Section 33AK(3)states: ### _cr14135 - Section 33AK(3)states: ### Section 33AK(3) reporting obligations and statutory recipients - Section 33AK(3) requires the Bank to report, as appropriate, to: - (i) the Garda Síochána, - (ii) the Revenue Commissioners, - (iii) the Director of Corporate Enforcement, - (iv) the Competition Authority, - (iva) the National Consumer Agency, - (v) any other body, whether within the State or otherwise, charged with the detection or investigation of a criminal offence, - (vi) any other body charged with the detection or investigation of a contravention of: - (I) the Companies Acts 1963 to 2001, or - (II) the Competition Act 2002, or in so far as any commencement order under that Act does not relate to the repeal of provisions of the Competition Acts 1991 and 1996, which would otherwise be subsisting those Acts, - The Bank shall report any information relevant to those bodies that leads it to suspect that: - (A) a criminal offence may have been committed by a supervised entity, or - (B) a supervised entity may have contravened a provision of an Act to which subparagraph (vi) relates. ### EU legal framework and professional secrecy (CRD) - Article 47 of the CRD referenced as most relevant; Articles 44(1) and 45 do not preclude exchange of information within or between Member States with specified authorities, including: - (a) authorities supervising other financial organisations and insurance companies and the authorities responsible for the supervision of financial markets; - (b) bodies involved in liquidation and bankruptcy of credit institutions and similar procedures; - (c) persons responsible for carrying out statutory audits of accounts of credit institutions and other financial institutions. - Articles 44–52 (Exchange of Information and Professional Secrecy) and Articles 131 & 132 (Supervision) apply; Article 44 requires professional secrecy for persons working for competent authorities and limits disclosure except in summary or collective form or as otherwise allowed (e.g., criminal law cases, bankrupt/compulsory wind-up with caveats). ### Domestic cooperation arrangements and governance - Internal Central Bank framework to facilitate cooperation and information sharing among safety-and-soundness, financial stability, and supervisory areas. - Committee structures include: - the Governor’s Committee, - the Senior Leadership Committee, - the Financial Stability Committee, - the Supervisory Risk Committee, - the Policy Committee. - Supervisory staff attendance overlaps: Directors of Credit Institutions and Insurance Supervision attend both Supervisory Risk Committee and Policy Committee. - PRISM framework incorporates Financial Stability Division assessment of Environmental Risk (including macro-economic and sector-specific risks); ratings/rationales agreed centrally between Financial Stability, Risk division and supervisory divisions and available to supervisors for import and amendment. ### Practical domestic cooperation examples and operational practices - Consultations on formal supervisory decisions (bank license applications, material M&A requiring supervisory approval, Department of Finance consultations with the Governor). - Reporting breaches and suspicions: - Reporting breaches of certain regulatory requirements to the Gardaí. - Reporting suspicions of unlawful conduct, financial crime, and/or fraud to the Gardaí Síochána, Revenue Commissioners, ODCE as appropriate. - Formal consultations with the Minister for Finance where he intends to exercise powers relating to the banking system (e.g., Direction/Transfer Orders in the CISA 2010). - Quarterly reporting to the Minister on banks’ compliance with the Credit Institutions (Financial Support) Scheme 2008. ### Cross-border cooperation, Colleges, MoUs, and legal basis for disclosure abroad - Central Bank cooperates and shares information with foreign supervisory authorities both within and outside the EU; arrangements include formal legal provisions and non-legal MOUs and Multilateral Cooperation Agreements. - Examples of Bilateral MoUs: Bahrain, Belgium, Canada, Denmark, Dubai, Malaysia, U.S. - Example Multilateral MoUs: U.S. (Federal Reserve Board, OCC and FDIC signed in April 2013). - Central Bank Act, 1942 – Section 33AK(5) permits disclosure of confidential information: - (d) to an authority in a jurisdiction other than that of the State duly authorized to exercise similar statutory functions and having similar nondisclosure obligations; - (e) to any institution of the European Community because of the State’s membership of the Community, or to the European Central Bank for the purpose of complying with the Rome Treaty or the ESCB Statute. - Subsection (6) requires recipients of confidential information under subsection (3)(a) or (5) to comply with professional secrecy provisions in Supervisory Directives. ### Supervisory Colleges and joint risk assessment practice - Central Bank leads supervisory Colleges for two High Impact banking groups in Ireland and is a host member of Colleges for groups in UK, Italy, Germany, US and Canada. - Colleges comprise both EU and non-EU supervisors; minutes showed: - joint risk assessment of the group, - decisions on capital adequacy, - sharing plans on future supervisory activities. - Joint Risk Assessment Documents (JRADs) agreed in both years; Colleges overseen by EBA observers. - For lower risk PRISM Impact banks, engagement with Home supervisors mainly through formal college arrangements; for High Impact banks, engagement is more frequent, less formal and supervisor-to-supervisor. ### Confidentiality safeguards, MOUs, and use restrictions (EC3 and EC4) - Legal safeguards specify purposes for which shared information may be used (professional secrecy under CRD implemented via Section 33AK(5)). - MOUs require that confidential information: - will only be used in performance of regulatory and supervisory functions, - is subject to any agreed restrictions, - must recognize professional secrecy obligations under EU and domestic law. - Section 33AK(5)(d) & (6) and Articles 44–52 of the CRD govern cooperation and sharing of confidential information. - MOUs and Multilateral Cooperation Agreements set clear principles for handling confidential information. - Central Bank legal position: - cannot provide confidential information except in specified circumstances (consent of the authority that provided it; required for criminal proceedings; provided to another supervisory authority subject to same professional secrecy laws). - must inform originating authority if legally compelled to disclose and use best endeavours to resist disclosure where consent is not given. - Central Bank is not subject to the Freedom of Information Act at present. - The Central Bank exercises powers under Section 33AK of the Central Bank 1942 to refuse to share confidential information in response to public, media, parliamentary or other requests relating to individual banks. - No identified examples of the Central Bank being legally compelled to pass on information received from another supervisor and having to use best efforts to resist the demand (or vice versa). ### Recovery, resolution, Deposit Guarantee Scheme and operational arrangements (EC5) - CBCIR Act 2011 establishes an effective resolution regime for certain institutions at the least cost to the State and led to establishment of the Special Resolution Unit (SRU) within the Central Bank. - Supervisory Function and SRU are operationally separate but both sit within the Central Bank; an MOU is envisaged to formalize interaction covering: - Early notification of distress, - Consideration of triggers, - Development of Recovery & Resolution (R&R) plans. - CBCIR Act 2011 does not currently apply to credit institutions under emergency legislation introduced during the banking crisis (those institutions received State support and are of greatest systemic importance). - Central Bank has requested recovery plans from the two largest banking groups in Ireland; CBCIR Act 2011 permits the Central Bank to request recovery plans and SRU has prepared draft recovery plan guidelines to be consulted upon and finalized after implementation of the Banking Recovery and Resolution Directive. - Deposit Guarantee Scheme (DGS) administration and relevant instruments: - Administered by the Payments and Securities Settlements Division of the Central Bank. - MOU in place between Payments and Securities Settlements Division, Banking Supervision and the SRU. - DGS established under: - The European Communities (Deposit Guarantee Schemes) Regulations, 1995 (S.I. No.168 of 95) and amended by European Communities (Deposit Guarantee Schemes) (Amendment) Regulations, 2009 (S.I. No. 228 of 2009); and - The Financial Services (Deposit Guarantee Scheme) Act 2009. - DGS invocation example: - Liquidation of Irish Bank Resolution Corporation in February 2013 was initiated under special legislation (IBRC Act 2013) rather than CBCIR Act 2011. - As at 30 April, the DGS had paid out €9.6 million in compensation to 594 eligible depositors. - Special Liquidators continue to review deposits for potential set off; further payments may follow. - A coordinating committee was established within the Central Bank to oversee supervisory and compensation aspects of the liquidation. ### Assessment of Principle 3 and key conclusions - Assessment: Compliant - Summary findings: - Central Bank responsible for regulation of financial service providers and markets in Ireland and ensuring financial stability. - European and domestic legislation provide for cooperation and sharing of confidential information with supervisors within and outside the EU; supplemented by MOUs and Multilateral Cooperation Agreements. - Evidence suggests these arrangements were working effectively in practice. - Formal and informal arrangements facilitate cooperation and coordination between relevant authorities, including an MoU between the Central Bank and the Department of Finance in place since 2011 regarding oversight of the banking sector and State-supported credit institutions. - Central Bank leads supervisory colleges for two systemic banking groups and participates in JRADs; processes shown to work in practice for sharing relevant information and coordinating supervisory activities. - Gap noted: CBCIR Act 2011 does not currently apply to credit institutions under emergency legislation from the crisis; those institutions remain subject to heightened supervision and State support and would be intended to come under CBCIR Act 2011 when they exit State support. - Recovery plans have not been required from all credit institutions; they have been requested from the two largest domestic banking groups. - Ireland is not a Home supervisor for any G-SIBs. - Additional numeric and administrative notes: - PRISM framework and environmental risk assessments are embedded in supervisory processes. - Since 2011 the CBI has approved 11 applications for use of the word ‘Bank’, with one application being rejected; one “non-objection” issued based on EEA rules. *Source: _cr14135 - Section 33AK(3)states:* ### Section 7 of the Central Bank Act 1971 provides that: ‘Subject to the provisions of this Act, a ### Section 7 of the Central Bank Act 1971 ### EC5 — Public disclosure of licensed banks - The CBI publishes on its website: - Register of Credit Institutions (which includes branches of foreign banks, and foreign banks which provide services on a cross-border basis in Ireland). This is updated on a daily basis. - Register of designated credit institutions under the Asset Covered Securities Act 2001. This is also updated on a daily basis. - An annual list of bank license holders at the end of the previous year. - The Registers icon appears on opening the Central Bank Homepage, making this data easily located by the public. - Assessment of Principle 4: Compliant ### Principle 5 — Licensing criteria (overview) - The licensing authority has the power to set criteria and reject applications for establishments that do not meet the criteria. - At a minimum, the licensing process consists of an assessment of: - the ownership structure and governance (including the fitness and propriety of Board members and senior management) of the bank and its wider group, - the strategic and operating plan, - internal controls, - risk management, and - projected financial condition (including capital base). - Where the proposed owner or parent organization is a foreign bank, the prior consent of its home supervisor is obtained. ### EC1 — Authority for granting and withdrawing licenses (description and findings) - The CBI is the authority for licensing of banks. - Denial of a licensing application requires the consent of the Minister for Finance; in these cases the views of the CBI will be considered by the Minister for Finance. - The CBI is also the competent authority for supervising banks and imposes prudential conditions on all newly licensed banks; these may be adjusted to reflect the nature and/or complexity of the bank. - The Authorization Team meets with the Supervision team in advance of and following authorization. - Relevant legal provisions cited: - Article 6 and Article 9 of the CRD (authorization requirement and circumstances in which authorization shall not be granted). - Section 9(1) of the CBI Act 1971 identifies the CBI as the competent authority for both granting and withdrawing a license; Ministerial approval required in specified circumstances. - Section 11(1) of the Central Bank Act 1971 allows the Central Bank to revoke a license where the license holder so requests; Ministerial consent is required in other specified circumstances. - Section 10 of the CBI Act 1971 enables the CBI to impose conditions/requirements on all newly-licensed banks where relevant. - Section 18 of the CBI Act 1971 enables the CBI to request that certain information or returns are provided to it. - Section 23 of the Central Bank Act 1971 enables the Central Bank to require credit institutions to maintain specified ratios. ### EC2 — Power to set licensing criteria and reject applications (description and findings) - The CBI has the power to: - set criteria for licensing banks, - reject an application if the criteria are not fulfilled or if the information provided is not adequate, - revoke a banking license if it was granted based on false information (Ministerial consent is required in this instance). - The CBI needs Minister for Finance consent to deny an application. - Criteria and legal references: - Article 6 of the CRD: “Member States shall require credit institutions to obtain authorization before commencing their activities. Without prejudice to Articles 7 to 12, they shall lay down the requirements for such authorization and notify them to the Commission.” - Section 9(4) of the CBI Act 1971: “An application for a license shall be in such form and contain such particulars as the Bank may from time to time determine.” - Section 6(1) of S.I. 395 of 1992 permits the CBI to set a higher capital requirement than €5 million if deemed necessary. - The CBI’s regulatory document “Banking License Application under the CBI Act, 1971 (as amended) – Guidelines on completing and submitting Banking License Applications” gives guidance on the criteria for applying for a banking license. - Text of Section 9 of the CBI Act 1971 included: - 9.- (1) Subject to the provisions of this section, the Bank may, in its discretion, grant or refuse to grant to any person applying to it for the grant thereof a license authorizing the holder to carry on banking business. - (1A) The Bank shall not grant a license under this section to an applicant unless the applicant satisfies the Bank that- - (a) it is a body corporate, - (b) its registered office and its head office are both located in the State, - (c) it is a credit institution that is authorised for the purposes of the Recast Credit Institutions Directive, - (d) its business as a credit institution is directed by at least 2 persons who are of good repute and have sufficient experience to direct that business, and - (e) those persons’ direction of that business is real and not merely nominal. - (2) The Bank shall not refuse to grant a license without the consent of the Minister and unless it is satisfied that the grant of the license would not be in the interest of the orderly and proper regulation of banking, and the Minister shall not grant his consent to the refusal unless he is satisfied that the grant of the license would not be in the interest of the orderly and proper regulation of banking. - Revoke authorisation if granted on basis of false information: - Section 11(1) of the CBI Act 1971 states the Bank may, with the consent of the Minister, revoke a license if the holder of the license has obtained the license through false statements or any other irregular means. - Article 17 of the CRD: “The competent authorities may withdraw the authorization granted to a credit institution only where such an institution: b) has obtained the authorization through false statements or any other irregular means.” ### EC3 — Consistency of licensing criteria with ongoing supervision (description and findings) - The criteria for issuing licenses are consistent with those applied in ongoing supervision. - The CBI’s regulatory document states each potential applicant must assess whether its proposed business model: - Requires a banking license (including meeting the definition of “banking business“ in the Act), - Complies with the Central Bank’s requirements; and - Will comply with the requirements that must be adhered to by credit institutions on an ongoing basis. - The “Checklist for completing and submitting Bank License Applications” seeks information on all criteria required on an ongoing basis, including section 7 requiring details of the “Organization of the Applicant and Governance Arrangements.” - Detailed information sought on “Risk Oversight” includes: - Audit; - Compliance; - Risk Management; - Treasury; - Financial Control; - Credit; - Internal Controls/Policies; - Anti-Money Laundering Procedures; - Conflict of Interest; - Liquidity; - Outsourcing; and - Reporting Structures. - Corporate governance requirement: - One criterion for issuing licenses is that the proposed corporate governance structure is in compliance with the Central Bank’s regulatory document entitled “Corporate Governance Code for Credit Institutions and Insurance undertakings.” All licensed banks are required to comply with this code on an ongoing basis. - Cross-border notifications: - Where, as part of the banking license application, the applicant bank proposes providing services into an EU Country on a cross-border basis or branch basis, the CBI writes to the host country to notify it of the bank’s intention to passport its services into that country. The notifications are not issued until the entity has received its banking license. ### EC4 — Assessment of structures for effective supervision (description and findings) - The CBI reviews proposed legal, managerial, operational and ownership structures of both the applicant bank and the group to ensure they would not hinder: - (i) effective supervision on a consolidated basis and/or - (ii) effective implementation of corrective measures in the future. - Bank applicants owned by credit institutions: - The CBI performs this review at both solo and group level. - Bank applicants owned by corporates: - In accordance with the CRD, the CBI issues licenses to subsidiaries of unregulated entities. - These structures may reduce the transparency of transactions between the parent and the regulated Irish entity. - The CBI performs fit and proper review on the controlling owner but not on management of the unregulated parent. - To mitigate risks from the unregulated parent, the CBI imposes additional conditions at applicant level such as: - ring-fencing the Irish entity from the rest of the group; or - requiring the Irish entity to submit specified documentation relating to both it and the group on a regular basis (Section 18 of the Central Bank Act 1971 requires that the bank shall “provide the Bank, at such times, or within such periods, as the Bank specifies from time to time, with such information and returns concerning the relevant business carried on by the person as the Bank specifies from time to time”). - The CBI lacks enforcement power over an unregulated parent or its management. - Section 8(1) of S.I. 395 of 1992 requires that the CBI consults with the competent authority in another Member State before it grants an authorization to a credit institution in any case in which that credit institution is a subsidiary or fellow subsidiary of a credit institution authorized in that Member State. *Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr14135.pdf* ### Section 9(1) of the CBI Act 1971 requires that the applicant is a body corporate, that its ### _cr14135 - Section 9(1) of the CBI Act 1971 requires that the applicant is a body corporate, that its ### Licensing requirements and processed licenses - Section 9(1) of the CBI Act 1971 requires that the applicant is a body corporate, that its registered office and its head office are both located in the State, that its business as a credit institution is directed by at least 2 persons who are of good repute and have sufficient experience to direct business, and that those persons’ direction of that business is real and not merely nominal. - In the period, 2008 to 2013, the following banking licenses have been processed: - One on behalf of a US corporate - granted - One conversion of a building society into a licensed credit institution – granted - Three mortgage banks – granted - One credit institution – granted ### EC5 — Identification and suitability of major shareholders (ultimate beneficial owners and significant influence) - Regulatory requirement: - The licensing authority identifies and determines the suitability of the bank’s major shareholders, including the ultimate beneficial owners, and others that may exert significant influence. - It also assesses the transparency of the ownership structure, the sources of initial capital and the ability of shareholders to provide additional financial support, where needed. - Description and findings: - All qualifying shareholders (greater than 10% shareholding) who are natural persons are required to submit an Individual Questionnaire (requests information such as prior experience, skills, expertise, other directorships and shareholdings). This form is reviewed by the Regulatory Transactions Division within the CBI to determine suitability. - Where the shareholder is a company or bank the CBI seeks detailed financial information. - The CBI ensures the promoter of the new bank has sufficient funds to establish a bank and to provide additional capital where required. - For unregulated, cross-border parent company, the CBI lacks authority to perform fit and proper tests on senior management. - The CBI’s “Checklist for completing and submitting Bank License Applications” requires full details of the owners, ownership structure, sources of initial capital and the ability of shareholders to provide additional financial support where needed. Sections 2, 4, 9 and 10 of the checklist are particularly relevant. - The CBI ensures the Applicant has sufficient funds to meet all regulatory obligations; evidenced by financial statements and requests a bank statement of the applicant bank prior to bank license being issued to ensure that the funds have been lodged. - Regulatory provisions: - Regulation 7(1) of S.I. 395 of 1992 requires that the CBI be notified of the identity of all persons having a qualifying holding in the applicant and the size of the holding in question. - Regulation 7(2) of S.I. 395 of 1992 requires that the CBI must be satisfied as to the fitness and probity of all qualifying shareholders such that they will exercise their rights in the interest of the orderly and proper regulation of credit institutions in the State. ### EC6 — Minimum initial capital amount - Regulatory requirement: - A minimum initial capital amount is stipulated for all banks. - Description and findings: - The CBI requires all banks to hold the initial capital amount of €5 million in accordance with legislation. - As part of the CBI’s business model analysis and financial analysis, the team ascertains how much capital is actually required to support the planned business both on a base and stressed position. Therefore, in reality, newly licensed banks will be required to hold much more capital depending on size, strategy, anticipated level of RWAs, etc. - The capital must be in the form of cash. - The CBI would require the promoter to have sufficient funds to cover the share capital required and ongoing capital requirements, and would not permit the initial disbursement of capital to occur with borrowed funds. - Legislative reference: - Article 9 of the CRD (as transposed into Irish legislation by Regulation 6(1) of S.I. 395 of 1992) requires that authorization will not be granted unless the bank has initial capital of €5 million. ### EC7 — Fit and proper evaluation of Board members and senior management - Regulatory requirement: - The licensing authority, at authorization, evaluates the bank’s proposed Board members and senior management as to expertise and integrity (fit and proper test), and any potential for conflicts of interest. - Fit and proper criteria include: (i) skills and experience in relevant financial operations commensurate with the intended activities of the bank; and (ii) no record of criminal activities or adverse regulatory judgments that make a person unfit. - The licensing authority determines whether the bank’s Board has collective sound knowledge of the material activities the bank intends to pursue, and the associated risks. - Description and findings: - Legislation and standards govern the fit and proper regime; the CBI evaluates all proposed board members and certain identified senior management. - On 1 October 2010, Part 3 of the CBI Reform Act 2010 introduced a statutory system for regulation by the CBI of persons performing controlled functions (CF) or pre-approval controlled functions (PCF). - There are 18 senior positions in banks designated as Pre-Approval Controlled Functions (PCF). CBI approval is required before appointments may be made to these positions. - On 1 December 2011, the CBI issued Standards of Fitness and Probity (‘the Standards’) which apply to all persons performing CFs or PCFs. A regulated financial service provider may not appoint a person to perform a CF unless the firm is “satisfied on reasonable grounds” that the person complies with the Standards and has agreed to abide by them. - Standards require a person to be: - a) competent and capable; - b) honest, ethical and to act with integrity; and - c) financially sound. - For PCF roles, Standards require qualifications, experience, competence and capacity appropriate to the relevant function. Demonstrable competence may be shown by prior functions that would be subject to the Code, current controlled functions, or similar roles. - In relation to criminal activities or adverse regulatory judgments, Standards require demonstration that ability to perform the relevant function is not adversely affected to a material degree where the person has, in any jurisdiction: - a) been convicted of an offence either of money laundering or terrorist financing (or their equivalents); - b) been convicted of an offence which could be relevant to that person’s ability to perform the relevant function; or - c) had a finding, judgment or order made against him/her involving fraud, misrepresentation, dishonesty or breach of trust or where the person is subject to any current proceedings for fraud, misrepresentation, dishonesty or breach of trust. - CBI non-statutory guidance on bankruptcy or criminal conviction matters advises regulated firms to: - Seek and obtain signed written confirmation from the person performing or proposing to perform a CF as to whether circumstances in the Standards apply. - Require underlying documents relevant to the matter (for example, a final decision or report and/or key correspondence). - Make an assessment based on all information received as to whether the matter is material to the performance of the CF. - Factors relevant to materiality include: - a) its seriousness; - b) the relevance to the duties to be performed; - c) repetition and duration of the behavior; - d) the passage of time since the matter under consideration; and - e) evidence of rehabilitation. - The Fitness and Probity process is assessed at two levels: - Initial assessment by Regulatory Transactions Division. - Second level check by the relevant supervisory division, taking a holistic view of the applicant’s role. - If the PCF has worked for entities supervised by other competent authorities or for other entities supervised by the CBI, those other competent authorities and/or supervision teams are contacted for observations/comments. - Legislative reference: - Article 11 of the CRD (as transposed by Section 9 of the CBI Act 1971) requires at least two persons who effectively direct the business of the bank; these persons must be of sufficiently good repute and have sufficient experience. - Corporate Governance Code requirements (selected): - The board shall be of sufficient size and expertise and shall have a minimum of 5 directors (7 directors where the institution is deemed to be a “Major” institution). - The majority of the board shall be independent non-executive directors. - Directors must attend a majority of board meetings. - Each board member shall have sufficient time to devote to the role. - The number of directorships held by each director shall be limited. - Appointments cannot proceed where potential conflicts of interest are significant to the overall work of the board. - Institutions shall review board membership at least once every three years; a formal review is required every 9 years. - Detailed guidelines relate to Chairman, CEO, Independent Non-Executive Directors, Non-Executive Directors and Executive Directors. - Conflict of interest checks: - The CBI reviews directorships, shareholdings and executive tasks carried out by the individual to ensure no apparent conflicts of interest. - The bank itself is required to check all applicants’ fitness and probity; Guidance advises that “probity may also include individuals ensuring that they act without conflicts of interest.” - Board collective knowledge requirements: - INEDs must bring an independent viewpoint objective and independent of management and the institution. - Executive Directors, INEDs and Non-Executive Directors shall have knowledge and understanding of the business, risks and material activities to contribute effectively. - Board composition should include individuals with relevant skills, experience and knowledge (such as accounting, auditing and risk management). - The CEO shall have relevant financial services expertise, qualifications and background and the necessary personal qualities, professionalism and integrity. ### EC8 — Review of strategic and operating plans; corporate governance, risk management, internal controls, outsourcing - Regulatory requirement: - The licensing authority reviews the proposed strategic and operating plans of the bank, including that an appropriate system of corporate governance, risk management and internal controls (including those related to detection and prevention of criminal activities) and oversight of proposed outsourced functions will be in place. The operational structure must reflect the scope and degree of sophistication of proposed activities. - Description and findings: - All banking license applications are reviewed by the CBI’s Business Model Unit (within Banking Supervision Division) in conjunction with the authorization team to assess feasibility of proposed strategic and operating plans; reviews typically result in questions to the applicant for further details or clarification. - Corporate governance, risk management and internal controls (including AML and oversight of outsourcing) are assessed in detail using the CBI’s internal procedures. - The “Checklist for completing and submitting Bank Licence Applications” contains detailed information with supporting documentation; for outsourcing there is a checklist of 13 questions to assist the examiner. - Legislative and checklist references: - Article 7 of the CRD requires applications to be accompanied by a program of operations setting out, inter alia, the types of business envisaged and the structural organization of the credit institution. - Section 9(4) of the Central Bank Act 1971 requires that “An application for a license shall be in such form and contain such particulars as the Bank may from time to time determine.” - The “Corporate Governance Code for Credit Institutions and Insurance Undertakings” defines corporate governance and sets requirements to ensure appropriate and robust frameworks reflecting risk and nature of institutions. - Requirement 6.3 of the Code requires robust governance arrangements including clear organizational structure, effective processes to identify, manage, monitor and report risks, adequate internal control mechanisms, IT systems and controls, remuneration policies consistent with sound risk management, and regular internal review. - CBI “Checklist for completing and submitting Bank Licence Applications”: - Section 6 requires full information on the legal structure of the applicant. - Section 7 requires details of the “Organisation of the Applicant and Governance Arrangements.” - Detailed information is sought on Risk Oversight, including: - Audit; - Compliance; - Risk Management; - Treasury; - Financial Control; - Credit; - Internal Controls/Policies; - Anti-Money Laundering Procedures; - Conflict of Interest; - Liquidity; - Outsourcing; and - Reporting Structures. ### EC9 — Review of pro forma financial statements and projections - Regulatory requirement: - The licensing authority reviews pro forma financial statements and projections, assessing adequacy of financial strength to support the proposed strategic plan and financial information on principal shareholders. - Description and findings (process): - All banking license applications are reviewed by the Business Model Unit in conjunction with the Authorization Team. Together they assess: 1. Whether or not the bank has adequate financial strength to support the proposed strategic plan of the bank. *Italicized source attribution: IMF staff report content from the provided PDF excerpt.* ### 2. Financial information on the principal shareholders of the bank. ### 2. Financial information on the principal shareholders of the bank. ### Application requirements and checklist - The application is based on the CBI’s “Checklist for completing and submitting Bank License Applications” which contains specific sections dealing with financials and strategy: - Section 9 – Capital, Funding and Solvency – includes 5 year projections and solvency ratios - Section 10 – Financial Information and Projections – includes previous 3 years of audited accounts for the group, projected income statement, balance sheet, prudential ratios and capital structure, projected key financial indicators and stress test of financials assuming a down turn. (NB: all projected financials are for a period of 5 years) ### Financial information required on principal shareholders - Where the shareholder is an individual: - An Individual Questionnaire setting out, inter alia, details of directorships, past employments and shareholdings. - Where the private shareholder is the owner of a company, the financials of the company are also assessed. - Where an individual holds shareholdings or interests in other companies: - The financials of those companies are assessed. - Where shareholders are companies: - The financial statements for those companies are required to ensure that the finances are satisfactory. - Credit institutions are required to provide shareholder information annually to the CBI, including: - A list of shareholders or beneficial owners of 10% or more of the share capital. ### Cross-border entry and EC10: host/home supervisor interaction - For foreign banks establishing a branch or subsidiary, before issuing a license the host supervisor establishes that no objection (or a statement of no objection) from the home supervisor has been received. For cross-border operations the host supervisor determines whether the home supervisor practices global consolidated supervision. - Process followed: - In relation to EEA: the home supervisor sends the CBI a notification form; it is implicit that the home competent authority has no objection if not stated. - For subsidiaries: the CBI contacts (in writing) the home supervisor and requests as part of the banking application (see Section 2 of the “Checklist for completing and submitting Bank License Applications”): - Details on the parent/group including background; ownership/structure (including details on the organization structure); the legal structure of each of the entities in the organization structure; details on activities, lines of business, debt ratings for parent/group; and confirmation that the board of the parent has approved the submission of the application. - Confirmation that “the supervisory authority in the country of origin of that bank or group exercises effectively its supervisory responsibilities on a consolidated basis.” - Confirmation that the applicant has obtained the prior consent of their home country supervisory authority. - For cross-border operations notified in a European-agreed format, it is inherent that the home supervisor practices global consolidated supervision. - Relevant transpositions and regulations: - Article 6 of the CRD requires authorization before commencing activities; transposed into Irish law by Section 9(4) of the Central Bank Act 1971: “An application for a licence shall be in such form and contain such particulars as the Bank may from time to time determine.” - Regulation 20(1) of S.I. 395 of 1992 (underlying CRD articles 23 and 25) permits a credit institution authorized in another Member State to carry on business in the State by establishing a branch provided relevant requirements are complied with in full. - Regulation 23(1) requires the CBI to notify the parent credit institution within two months of receipt of information of enactments and regulatory provisions applying to the branch's conduct of business. ### Subsidiaries and consultation requirement - Regulation 8(1) of S.I. 395 of 1992 requires the Bank to consult the competent authority in another Member State before granting authorization where the credit institution is a subsidiary or fellow subsidiary of a credit institution authorized in that other Member State or is under common control with such institutions. - Regulation 20(1) also covers cross-border activities; Article 28 notifications imply consolidated supervision by the home authority. - Article 24 of the CRD requires home competent authorities to ensure supervision of passporting institutions regarding own funds, acquiring transactions, prudential supervision, sharing of information and the right to sanction. ### Monitoring new entrants (EC11) and supervision approach - EC11: The licensing authority or supervisor has policies and processes to monitor the progress of new entrants in meeting business and strategic goals, and to determine compliance with license conditions. - Description and findings: - No specific policies solely for newly licensed banks; however detailed policies and processes exist for monitoring the business and strategic goals of all supervised banks and compliance with licensing requirements. - Policies and processes vary depending on the risk impact rating of the bank. - For banks, the minimum engagement under PRISM requires analysis of the business model and strategic goals as part of a FRA (carried out on different frequencies depending on impact of the bank). - The minimum engagement model for relevant banks intensifies where necessary based on identification or crystallization of risk. - Supervision teams prioritize newly licensed banks as part of work plans within PRISM requirements. - Assessment of Principle 5: Compliant - Comment: Licenses are granted to cross-border unregulated corporate parents in line with CRD requirements. The CBI does not perform fit and proper tests on senior management of the unregulated parent, and cannot take enforcement action on the parent. As a result the banks are ring-fenced from inception. ### Transfer of significant ownership and controlling interests (Principle 6) - Principle summary: The supervisor has the power to review, reject and impose prudential conditions on proposals to transfer significant ownership or controlling interests held directly or indirectly in existing banks to other parties. EC1 — Definitions of significant ownership and controlling interest - Significant Ownership: - The CBI uses the legal definition of “Qualifying holding” per Article 4(11) of Directive 2006/48/EC, transposed via Regulation 2(1) of S.I. 395 of 1992: “a direct or indirect holding in an undertaking which represents 10% or more of the capital or of the voting rights or which makes it possible to exercise significant influence over the management of that undertaking.” - Controlling Interest: - Regulation 4 of S.I. 395 of 1992, Article 4(9) of the CRD, defines “Control” as including "any power, whether arising from a contract or agreement or otherwise, whereby one party can direct the affairs of another and a parent undertaking shall be deemed to control its subsidiaries." The reference to “one party” could include parties acting in collusion depending on the circumstances. EC2 — Requirement for supervisory approval or notification of ownership changes - Prior approval of the CBI is required for Acquiring Transactions as defined in Regulation 14 of S.I. 395 of 1992. - An Acquiring Transaction includes acquisition or increase of a qualifying holding that reaches or exceeds thresholds of 20%, 33% or 50% ownership. - The Acquiring Transaction Notification Form is published on the CBI’s website. - Prior approval is required under: 1. Article 19 of the CRD (2006/48/EC) [as amended], transposed by Regulation 14 of S.I. 395 of 1992, applying to: - Acquisition, directly or indirectly, of a “qualifying holding” in a target entity. - Direct or indirect increase in a “qualifying holding” whereby (i) the resulting holding would reach or exceed the “prescribed percentages:” 20%, 33% and 50% of the capital of, or voting rights in, a target entity or (ii) a target entity would become the proposed acquirer’s subsidiary. - Disposal, directly or indirectly, of qualifying holdings in a target entity. 2. Chapter VI of Part II of the CBI Act, 1989 (as amended) for acquiring transactions not covered by S.I. 395 of 1992 (for example, increases in shareholding that do not by themselves reach prescribed thresholds, e.g., increase from 75% to 85%). - Recent activity: In the past 12 months there have been 20 approvals under Statutory Instrument No. 395 of 1992. EC3 — Powers to reject, modify, reverse transactions and to address false information - The CBI has legal power to reject applications and reverse a purported acquisition. - Regulation 14(3) of S.I. 395 of 1992 requires acquiring transaction notifications to include sufficient information to consider the proposed acquisition against the criteria in Regulation 14(C), including who the proposed acquirers are, individuals responsible for management, financing details, and the structure of the resulting group. - Regulation 14(G) (transposing Article 19(a)(2) of the CRD) allows the CBI to oppose a proposed acquisition on reasonable grounds based on review of: suitability of acquirer, financial soundness, reputation, experience, possible impact on compliance with regulation, transparency of structure, or reasonable grounds to suspect money laundering or terrorist financing (within the meaning of Article 1 of Directive 2005/60/EC), or that the acquisition could increase the risk of money laundering or terrorist financing. - Where information is incomplete or not provided in response to requests, the CBI may request additional information. - Regulation 14(I)(2) (transposing Article 21(1) of the CRD) provides that a purported completion of an acquisition without prior notification or approval: - (a) is of no effect to pass title to any share or any other interest, and - (b) any exercise of powers based on the purported acquisition of the holding concerned is void. - Provision of false information: - Provision of false information in an application is an offence (Regulation 14(L) of S.I. 395 of 1992). - Legislation does not refer specifically to CBI powers where the CBI has approved a transaction based upon ‘false’ information. If discovered pre-approval the application could be rejected as “incomplete.” If discovered post-approval the Central Bank would go to Court under Regulation 14(M) to have the transaction reversed. EC4 — Reporting of names and holdings of significant shareholders and beneficial owners - Credit institutions provide shareholder information annually to the CBI, including: - A list of shareholders or beneficial owners of 10% or more of the share capital. *Source: _cr14135 - 2. Financial information on the principal shareholders of the bank.* ### 2. Where shares are registered in the name of a nominee, a list identifying the ultimate ### _cr14135 - 2. Where shares are registered in the name of a nominee, a list identifying the ultimate ### Nominee-registered shares and supervisory review - Where nominee shares constitute more than 5% of the shares or of the voting rights attaching to the shares in a credit institution, a list identifying the ultimate beneficial owner of the shares must be provided. - This information is reviewed by the supervision teams. - Regulation 14(K) of S.I. 395 of 1992 (transposing Article 21 of the CRD) requires a credit institution, at times specified by the CBI and at least once a year, to notify the CBI of the names of shareholders or members who have qualifying holdings and the size of each such holding. ### EC5 — Power to address unauthorized change of control - Regulation 14(I)(2) of S.I. 395 of 1992 (transposing Article 21(1) of the CRD) provides that if a proposed acquirer purports to complete a proposed acquisition in contravention of paragraph (1) of Regulation 14(I) (i.e., without prior notification to or approval by the Central Bank), then: - (a) the purported acquisition is of no effect to pass title to any share or any other interest, and - (b) any exercise of powers based on the purported acquisition of the holding concerned is void. - EC5 finding: The supervisor has the power to take appropriate action to modify, reverse or otherwise address a change of control that has taken place without the necessary notification to or approval from the supervisor. ### EC6 — Ongoing notification of material negative information and suitability assessment - Laws/regulations/supervisor require banks to notify the supervisor as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest. - Suitability assessment: - The suitability of a major shareholder is assessed at the time of acquisition of the holding as set out in the procedures “Acquiring Transactions – assessing an application to acquire an interest of greater than 10 per cent in a credit institution.” - This guidance provides procedures for assessing suitability and requires adherence to Directive 2007/44/EC (as transposed into Irish law by S.I. 395 of 1992). - Ongoing notification requirement: - A requirement for banks to provide notification to the CBI on an ongoing basis in relation to material negative information was imposed by means of a license condition on all banks. ### Assessment of Principle 6 - Compliant ### Principle 7 — Major acquisitions: scope and powers - Principle summary: The supervisor has the power to approve or reject (or recommend to the responsible authority the approval or rejection of), and impose prudential conditions on, major acquisitions or investments by a bank, against prescribed criteria, including the establishment of cross-border operations, and to determine that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision. ### EC1 — Definition of acquisitions/investments requiring approval or notification (findings) - Prior approval: - Credit Institutions are required, by means of a license condition imposed in August 2013, pursuant to Section 10(3) of the CBI Act 1971 and Section 17 of the Building Societies Act 1989, to seek the prior approval of the CBI for Major Acquisitions. - A Major Acquisition is defined as a transaction in which a credit institution acquires an interest (this includes an investment) which is equal to or greater than 9% of the Own Funds of the credit institution in any undertaking that falls outside of the EU Acquiring Transaction regime. - The CBI’s Policy on Major Acquisitions provides for certain other categories of exemption from the requirement for prior approval but not prior notification. - CRD transposition and limits: - CRD, Articles 120-122, transposed via S.I. 661 of 2006 and S.I. 395 of 1992, stipulate specific limits on holdings by credit institutions in other bodies corporate and qualifying holdings outside the financial sector and powers of the CBI in enforcing these limits. - Regulation 62 of S.I. 661 of 2006 provides: - A credit institution shall ensure that it does not have in an undertaking a qualifying holding the amount of which exceeds 15% of its own funds, unless the undertaking is a permitted undertaking. - A credit institution shall ensure that the total amount of the institution’s qualifying holdings in undertakings (other than permitted undertakings) do not exceed 60% of its own funds. - The limits set out in paragraphs (1) and (2) may be exceeded only in exceptional circumstances. - Where paragraph (3) applies to a credit institution, the Bank shall require the institution to increase its own funds or to take other equivalent measures. - For the purposes of Regulation 62, a permitted undertaking is one of the following: - a credit institution; - a financial institution; - an undertaking that carries on one or more activities that either are a direct extension of banking, or involve the provision of services that are ancillary to banking (such as leasing, factoring, the management of unit trusts and the management of data processing services). - Regulation 64 of S.I. 661 transposes Article 120 of the CRD concerning qualifying holdings of credit institutions outside the financial sector and includes provisions about exemptions and own funds coverage where limits are exceeded. - Regulation 15 of S.I. 395 of 1992 is similar to Regulation 62; Regulation 15(6) allows the Bank to prescribe rules and standards for application of the Regulation, and Regulation 15(4) permits the CBI, where it has reason to believe a credit institution has exceeded limits, to require actions including increasing own funds or disposal of specified shareholdings. - Prior-event notification (license condition imposed August 2013, pursuant to Section 10(3) of the Central Bank Act, 1971, and Section 17 of the Building Societies Act, 1989): - Credit institutions must provide prior notification to the CBI (prior approval not required) of: - a) Acquisitions that fall outside of the EU Acquiring Transaction regime which exceed 5% of the Own Funds of the Credit Institution but are less than 9% of Own Funds. - b) Debt restructuring where the overriding purpose is to maximize the amount of credit that can be recovered; - c) Short term acquisitions that are held for sale investments; - d) Indirect acquisitions by independently managed funds where the transaction is in line with the funds objectives; - e) Activities of nominee companies established by the credit institution that are acting on the nominees behalf; and, - f) Undertakings falling within Regulations 62, 63(1) and (2) and 64(1) of Statutory Instrument 661 of 2006 (European Communities (Capital Adequacy of Credit Institutions) Regulations 2006). - g) The disposal of any undertaking which was previously approved under the Major Acquisitions regime. - In addition, credit institutions for which the CBI is the consolidating supervisor must notify the CBI in advance of major acquisitions by other non-regulated entities within the license holder’s group. - For items b) to f), prior notification is required where the interest being acquired exceeds 5% of the own funds of the credit institution. There is no upper limit. - From August 2013, credit institutions are required to notify the CBI of major acquisitions by other entities in the banking group which are not regulated by the CBI; the CBI may require measures to insulate the credit institution if concerned about risks or supervision impact. - Requirements for prior approval and notification were imposed on credit institutions in August 2013 pursuant to Section 10(3) and Section 18 of the Central Bank Act 1971 and Section 17 of the Building Societies Act 1989. - In the last five years six “Major Acquisitions” (as defined under a previous regime which had no legal basis) were approved by the CBI. No applications were denied. ### EC2 — Criteria to judge individual proposals - CBI Policy criteria for assessing Major Acquisitions proposals: 1. The potential impact of the acquisition on the credit institution. 2. Whether the proposed acquisition will expose the credit institution to undue risks. 3. Whether the credit institution has the financial, managerial and organizational capacity to handle the proposed investment. This is particularly important where the undertaking being acquired is involved in nonbanking related activities. 4. Whether the acquisition falls within the scope of the credit institution’s internal control and risk management framework. 5. Whether the proposed acquisition will hinder effective supervision. 6. Whether the proposed acquisition will hinder effective implementation of corrective measures in the future (i.e. whether the proposed acquisition creates an obstacle to the orderly resolution of the credit institution). 7. In relation to overseas acquisitions, the effectiveness of supervision in the host country and the ability of the Central Bank to exercise supervision on a consolidated basis (including information flows from the host country). 8. The impact, if any, on financial stability. - Items 1 to 5 inclusive have been included in the license condition imposed in August 2013. ### EC3 — Objective criteria consistent with licensing requirements (findings) - The supervisor uses objective criteria that any new acquisitions and investments do not expose the bank to undue risks or hinder effective supervision. - The supervisor determines, where appropriate, that new acquisitions and investments will not hinder effective implementation of corrective measures in the future. - The supervisor can prohibit banks from making major acquisitions/investments (including establishment of cross-border banking operations) in countries with laws or regulations prohibiting information flows deemed necessary for adequate consolidated supervision. - Criteria as set out in the Policy by which the CBI will review applications: 1. Whether the proposed acquisition will expose the credit institution to undue risks. 2. Whether the proposed acquisition will hinder effective supervision. 3. Whether the proposed acquisition will hinder effective implementation of corrective measures in the future (i.e. will the proposed acquisition create an obstacle to the orderly resolution of the credit institution). *Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr14135.pdf* ### 4. In relation to overseas acquisitions, the effectiveness of supervision in the host ### 4. In relation to overseas acquisitions, the effectiveness of supervision in the host country and the ability of the Central Bank to exercise supervision on a consolidated basis (including information flows from the host country) ### CBI powers and policy framework for acquisitions - The CBI has the power to prohibit banks from undertaking transactions which fall within the ambit of the Acquiring Transactions regime. - The requirements of the Policy were imposed on credit institutions in August 2013 pursuant to Section 10(3) of the Central Bank Act 1971 and Section 17 of the Building Societies Act 1989. - In addition to the Policy on Major Acquisitions, the CBI requires prior approval for: - Establishment of a subsidiary outside the EEA where that subsidiary is a bank or other licensed entity; - Establishment, formation or taking part in forming a company, other body corporate or an unincorporated body of persons which is a non-licensed subsidiary, in the European Economic Area or elsewhere; - Establishment of a branch in a non-EU(Third Country). ### EC4 — Supervisor determines adequate resources for acquisition/investment - Requirement: supervisors must assess whether the credit institution has the financial, managerial and organizational capacity to handle the proposed investment. - The requirements of the Policy were imposed on credit institutions in August 2013 pursuant to Section 10(3) of the Central Bank Act 1971 and Section 17 of the Building Societies Act 1989. - Note: In the case of major acquisitions, determination may take into account whether the acquisition or investment creates obstacles to the orderly resolution of the bank. ### EC5 — Risks from nonbanking activities and mitigation - Requirement: the supervisor is aware of risks that nonbanking activities can pose to a banking group and has the means to take action to mitigate those risks; the supervisor considers the bank’s ability to manage these risks prior to permitting investment in nonbanking activities. - Description and findings: - The CBI requires supervisors, in assessing Major Acquisitions applications, to consider whether the credit institution has the financial, managerial and organizational capacity to handle the proposed investment. - The Policy states this assessment “is particularly important where the undertaking being acquired is involved in nonbanking related activities.” - As part of supervisory review, the CBI will assess governance and internal capital assessment to determine the level of own funds required, including assessment of risks from nonbanking activities (e.g., unregulated entities such as special purpose vehicles established for securitization purposes, assessing liquidity requirements, level of implicit support, significant risk transfer, etc.). - The CBI may impose supervisory measures to address deficiencies identified. - CBI supervisors are aware of risks posed by nonbanking (including non-regulated) entities and activities to banking groups, particularly where those activities are regulated by other divisions within the CBI (e.g., insurance entities). - Mitigation of such risks and approval of acquisitions is the responsibility of relevant supervision teams in those divisions; there is regular formal (e.g., internal CBI colleges) and informal contact between banking group supervisors (the ‘lead regulators’) and those supervisory teams to ensure awareness of risks posed to the banking group. - The requirements of the Policy were imposed on credit institutions in August 2013 pursuant to Section 10(3) of the Central Bank Act 1971 and Section 17 of the Building Societies Act 1989. ### Assessment of Principle 7 - Assessment: Largely Compliant - Comment: In August of 2013 the CBI implemented the legal framework and process to meet the requirements of this CP. However, currently there is no evidence of the effectiveness of the process and the regulation. ### Principle 8 — Supervisory approach (overview) - Principle 8 summary: An effective system of banking supervision requires the supervisor to develop and maintain a forward-looking assessment of the risk profile of individual banks and banking groups, proportionate to their systemic importance; identify, assess and address risks from banks and the system as a whole; have a framework for early intervention; and have plans, in partnership with other authorities, to resolve banks in an orderly manner if non-viable. ### EC1 — Methodology for determining and assessing risks (PRISM) - The methodology addresses business focus, group structure, risk profile, internal control environment and resolvability of banks, and permits relevant comparisons between banks. Frequency and intensity of supervision reflect this analysis. - Description and findings: - PRISM is the methodology used by the Central Bank for determining and assessing on an ongoing basis the nature, impact and scope of risks to which banks or banking groups are exposed. - Supervisors must apply, at a minimum, the engagement model appropriate for their firm’s impact category as specified under PRISM. - PRISM prescribes a minimum supervisory plan; supervisors can and do go beyond the minimum. - Risk assessment under PRISM is judgment based comprising qualitative and quantitative assessments as appropriate. - Supervisors must provide a rationale on the PRISM system to support their probability risk rating. - The 12 point risk rating scale is non-numeric and supports judgment based supervision. - The rating scale is divided into four Impact categories: High, Medium High, Medium Low and Low; within each Impact category the supervisor can assign a positive, negative or neutral rating. - PRISM has ten risk categories: credit; market; operational; insurance; capital; liquidity; governance; strategy/business model; environment; and conduct. Several categories have sub-categories (e.g., credit risk broken into inherent risk, quality of control and concentration). - Inherent risk and quality of controls are assessed within the same risk category to determine a net risk rating. - Each risk category is assigned a rating reflecting the risk of failure from that category. The ten risk categories form the basis of the overall probability risk rating. - Standardized weightings are assigned to each of the ten risk categories. - Business focus is captured under Strategy/Business Model Risk via Business Model Analysis for High Impact banks and Full Risk Assessment (FRA) for Medium High and Medium Low Impact banks. - Group structure is assessed under business model analysis and governance reviews for High Impact banks and as part of FRA for Medium High and Medium Low Impact banks; structural complexity is considered as part of Governance to assess resolvability. - Quality and effectiveness of internal controls are assessed per risk via engagement with the bank and external stakeholders (e.g., external auditor). Risk Management Quality is a discrete sub-category of Governance in PRISM. - Predetermined peer groups exist within PRISM; customized peer group reports capability provided in May 2012. - Specialist treasury and credit teams prepare detailed packs on a quarterly basis for higher impact banks including peer analysis for liquidity and credit risk. - Minimum frequency and intensity of supervision is a function of impact categorization (assessment of impact of a bank’s failure on the economy, the taxpayer and consumers); the impact assessment is purely quantitative and conducted on an ongoing basis as new impact metric data become available (typically on a quarterly basis). - Impact metrics for banks are: - Total balance sheet and off・-balance sheet size - Concentration of lending ・ - Intra・-financial system assets - Retail deposit base ・ - Core Tie・r 1capital - Minimum engagement plan under PRISM is driven by Impact on financial stability from a bank failure rather than risk of failure; banks with significant domestic presence in deposits and liabilities are more likely assigned a higher Impact rating and receive greater supervisory attention. - From a resourcing perspective, impact categorization determines the minimum number of supervisors allocated; resource buffers are determined with reference to impact category and managed at divisional level to engage above the minimum as required. - PRISM is an ongoing assessment updated through onsite or offsite supervisory activity (e.g., Financial Risk Review or analysis of regulatory returns FINREP, COREP) and intended as a continuous risk assessment. - PRISM captures group-wide risks in key areas depending on nature of subsidiary (e.g., Insurance Risk Category and capital section include risk from an insurance subsidiary). - The Risk Governance Panel provides opportunity for group issues to be discussed among responsible supervisors for regulated entities within the group. - As Host supervisor, the Central Bank will take into consideration the risk profile of the parent (e.g., when rating liquidity risk, Central Bank considers parent liquidity risk profile, especially if group pursues a group funding model). - Processes to compare risk profile against peer group provided in PRISM and predominantly used for Risk Governance Panels. ### KRIs and data sources in PRISM - Triggers (Key Risk Indicators) alert supervisors to changes in financial ratios; numerous KRIs cover balance sheet and risk categories including: - Capital: - CET1 ratio (solo and consolidated); - Balance Sheet Leverage Ratio (solo and consolidated); - Pillar 1 solvency ratio (solo and consolidated). - Credit: - Provisions coverage ratio of impaired assets; - largest 10 exposures as a percentage of total drawn loans to customers. - Liquidity: - Wholesale funding as a percentage of total funding (solo and consolidated); - liquid assets as a percentage of total funding; - liquidity ratio sight to 8 days. - Market Risk: - Market risk capital as a percentage of total capital. - Business Model/Strategy: - Cost to income ratio (solo and consolidated); - net interest income to total loans and advances (solo and consolidated). - Data feeding KRIs is sourced from FINREP, COREP, Liquidity Return, the Quarterly Summary Financial Return (QSFR) and other relevant returns (Impairment Provisions and Large Exposures). ### EC2 — Processes to establish forward-looking view of risk profile - PRISM is the framework supervisors use to understand banks’ risk profiles and establish a forward-looking view. - The engagement model provides operational context for risk assessments. - Supervisors have access to guidance material within PRISM to ensure consistency. - Risk Guidance Materials: - Written for each of the ten probability risk categories and each of the twenty four sub-categories. - Updated on an ongoing basis to ensure relevance. - For a given sub-category the materials: - (i) explain the sub-category; - (ii) outline key questions for the supervisor; - (iii) contain information specific to certain sectors; - (iv) provide sample characteristics of high, medium high, medium low and low probability risk. - Guidance materials are web-based and accessible via links from PRISM modules; engagement task guidance is provided for components of the engagement model. - Guidance materials are amended to reflect new supervisory practices as legislation and experience demand change. - Centrally available assessments generated by Consumer, Financial Stability and Risk Divisions provide context for assessing and monitoring risks facing banks. - Supervisors monitor movements in quantitative KRIs on an ongoing basis via PRISM. - Engagement with institutions is forward looking and directs future supervisory engagements; for covered institutions this includes assessment of how banks will return to viability. - Submission and assessment of liquidity and capital management plans (e.g., three year capital management plan) are key elements of forward-looking analysis. - Regulatory obligations: - Regulation 66 of S.I. 661 of 2006 (transposing Article 124 of the CRD) obliges the Central Bank to review arrangements, strategies, processes and mechanisms implemented by credit institutions to comply with the CRD and evaluate risks taking into account technical criteria in Annex XI of that Directive. - Section 5A of the Central Bank Act 1942 (as amended) enables the Central Bank to do whatever is necessary for, or in connection with, or reasonably incidental to the performance of its functions. - Section 6A of the Central Bank Act 1942 stipulates one of those functions is the proper and effective regulation of financial services providers and markets while ensuring the best interests of consumers are protected. ### EC3 — Assessment of compliance with prudential regulations - PRISM engagement model sets out minimum supervisory engagement and provides a tool for systematic and structured assessment of risks and to ensure compliance with prudential requirements and legislation including the CRD, EBA guidelines and Central Bank guidelines. - PRISM’s alert functionality assists supervisors to prioritize work and focus on emerging risks, trends and potential or actual breaches of regulatory requirements. - There was evidence of the Central Bank taking action as a result of analysis of banks’ non-compliance with regulations. ### EC4 — Macroeconomic and cross-sectoral considerations - The macro-economic environment is assessed for supervisors by the Central Bank’s Financial Stability Division and Risk Division, working with BSD, as part of monitoring environmental risk. - The assessment currently focuses on: 1. Risk of disorderly sovereign defaults in the euro area; 2. Domestic sovereign debt sustainability; 3. Economic growth covering: - International risks to Irish economic growth - Domestic risks to Irish economic growth. - Environmental risk assessment also attributes ratings and describes sector specific risk aspects; current retail bank focus areas: 1. Business Environment 2. Funding/Liquidity Risk 3. Asset Encumbrance 4. Increasing Regulation 5. Personal Insolvency Bill and Mortgage Arrears Resolution Strategy 6. Taxation *Source: _cr14135 - 4. In relation to overseas acquisitions, the effectiveness of supervision in the host country and the ability of the Central Bank to exercise supervision on a consolidated basis (including information flows from the host country).* ### 7. Consumer Implications ### 7. Consumer Implications ### Supervisory update frequency and risk assessment - Ratings and assessments are updated at a minimum frequency of twice-yearly, with ad hoc updates when circumstances change sufficiently to require an update. - Supervisors take account of the macro-economic environment in reviews of balance sheet, investments, funding/liquidity risk and earnings/income profile. - The Central Bank of Ireland is the single prudential regulator for financial services in Ireland. Risk Division produces environmental risk assessments for banking, investment firms, insurance and credit unions sectors. A cross-sector team produces analysis of emerging risks which is communicated to supervisors. ### Macro and systemic risk analysis (EC5) - EC5: The supervisor, with other relevant authorities, identifies, monitors and assesses build-up of risks, trends and concentrations within and across the banking system, including banks’ problem assets and sources of liquidity (such as domestic and foreign currency funding conditions, and costs). The supervisor incorporates this analysis into its assessment of banks and addresses proactively any serious threat to stability. Significant trends or emerging risks are communicated to banks and to other relevant authorities with responsibilities for financial system stability. - Description and findings re EC5: - Responsibility for bank supervision and financial system stability falls under the Central Bank. - Financial Stability Division (FSD) publishes a Macro Financial Review twice per year which identifies risks to financial stability. - In forming their view, the FSD meets with supervisors and risk specialist teams involved in bank engagements; results are updated in Environment Risk as a risk category in PRISM for supervisors to consider. - Supervisors are assisted by the Central Bank’s research work, including Research Technical Papers and Economic Letters, in identifying, monitoring and assessing system-wide build-ups of risks, trends and concentrations. ### Loan Loss Forecasting and models - With regard to problem assets, supervisors are assisted in PCAR preparation by the development of loan loss forecast models. - The Financial Stability Division initiated modelling of Loan Loss Forecasting (LLF), delivering improved capability to forecast loan losses as part of oversight and supervisory functions. - Models are being developed for asset classes: Mortgages, Commercial Real Estate, Corporate, Small and Medium Enterprises (SME), Micro-SME and Non-Mortgage Retail. - LLF delivers a model development framework which: - is capable of providing an independent and credible estimate of future loan losses, under various scenarios; - is capable of being used as the key input to the PCAR; - can incorporate areas of specific importance to the Central Bank and key stakeholders, including overlays, assumptions and policy changes; and - is ultimately capable of being maintained and updated by the Central Bank, independent of third party support. ### Funding and liquidity framework changes - Example of proactive action: replacement of Loan-to-Deposit Ratios with an Advanced Monitoring Framework (AMF). - The AMF removed the requirement for each bank to meet specific funding targets within prescribed timeframes, which may have induced banks to take individual actions with negative implications for Irish financial stability. - The AMF should ensure that the FMP banks will become compliant with Basel III liquidity requirements in a timely manner and move to a more sustainable funding profile in the future. ### Coordination and legal provisions for consolidated supervision - In accordance with Regulation 67 of S.I. 661 of 2006, implementing Article 129 of the CRD, where the Central Bank is responsible for supervision on a consolidated basis of EU parent credit institutions and credit institutions by EU parent financial holding companies, it shall: - Coordinate the gathering and dissemination of relevant or essential information in going-concern and emergency situations; - Co・ordinate supervisory activities in going concern situations, including in relation to Articles 123 (Regulation 65 concerning ICAAP), 124 (Regulation 66 of S.I. 661 of 2006 concerning supervisory review) and 136 (Regulation 70 concerning supervisory measures), and in Annex V of the CRD (concerning the organisation and treatment of risks), in cooperation with the other competent authorities involved; and - Plan and coordinate supervisory activities in cooperation with the other competent authorities involved, and if necessary with other Central Banks, in preparation for and during emergency situations, including adverse developments in credit institutions or in financial markets using, where possible, existing defined channels of communication for crisis management. - Planning and coordination include exceptional measures in accordance with Article 132(3)(b) of CRD, preparation of joint assessments, implementation of contingency plans, communication to the public. - Where the Central Bank is responsible for supervision on a consolidated basis it shall, in accordance with Article 67(A), further transposing Article 129 of the CRD, make reasonable efforts to reach a joint decision with the other competent authorities concerned on: - (a) The application of Regulations 65 and 66 of S.I. 661 of 2006 to determine the adequacy of the consolidated level of own funds held by the group with respect to its financial situation and risk profile; and - (b) The required level of own funds for the application of Regulation of Regulation 70(4) of S.I. 661 of 2006 regarding a specific level of additional own funds in cases where deficiencies are identified with the internal capital adequacy assessment process (Regulation 65 of S.I. 661 of 2006) and Governance arrangements (Regulation 16 of S.I. 395 of 1992). ### Resolvability and resolution planning (EC6, EC7) - EC6: Drawing on information from the bank and other national supervisors, the supervisor, with the resolution authority, assesses the bank’s resolvability, having regard to risk profile and systemic importance. When bank-specific barriers to orderly resolution are identified, the supervisor requires, where necessary, banks to adopt appropriate measures (e.g., changes to business strategies, managerial, operational and ownership structures, and internal procedures), taking into account their effect on soundness and stability of ongoing business. - Description and findings re EC6: - Section 93(1) of the CBCIR Act 2011 allows the Central Bank to prepare a Resolution Report where it has previously requested a Recovery Plan from a credit institution. - Although the Central Bank received powers to request recovery plans and to produce resolution plans under the CBCIR Act 2011 in October 2012, a local recovery and resolution plan regime has not yet been implemented. - The Special Resolutions Unit has developed guidelines for banks for producing recovery plans, which would precede resolution plans. - The Central Bank, in line with EBA recommendations, has requested recovery plans from two high impact credit institutions. - Resolution planning is at an early stage and has not been fully implemented across all credit institutions. - EC7: The supervisor has a clear framework or process for handling banks in times of stress, so decisions to require or undertake recovery or resolution actions are made in a timely manner. - Description and findings re EC7: - Legal basis for resolution handling is derived from: The Credit Institutions and Central Bank (Resolution) Act 2011; Section 106 of the CBCIR Act 2011 allows issuance of codes of practice relating to the Act; Section 107 allows issuance of guidelines or policy statements in relation to exercise of functions conferred by the Act—subject to prior consultation with the Minister for Finance. To date, the Central Bank has not used these powers. - The CBCIR Act 2011 provides power to take action prior to a bank failing. Section 9 sets out qualitative and quantitative conditions which must be met before the Central Bank can intervene. - In the absence of simple financial triggers and recognising the last resort nature of the powers, the Central Bank has taken a pragmatic approach. - Under a draft MoU, Banking Supervision Divisions will inform the Standing Resolution Committee (SRU) when a bank exhibits signs of financial or regulatory distress; the SRU will begin to plan for a failure and may recommend that the SRU begin preparing a resolution case for the Governor to consider when supervisory tools are exhausted. - The framework for resolution planning and handling is yet to be fully implemented, although the CBI has undertaken considerable crisis management and supervision work during periods of stress. ### Unauthorized banking and perimeter enforcement (EC8) - EC8: Where the supervisor becomes aware of bank-like activities performed fully or partially outside the regulatory perimeter, the supervisor takes appropriate steps to draw the matter to the attention of the responsible authority and to address restructuring to avoid the regulatory perimeter. - Description and findings re EC8: - Unauthorized Providers Unit (UPU), within the Enforcement Directorate, deals with unauthorized activity fully outside the regulatory perimeter (firms not regulated). - Where unauthorized activity arises in relation to a regulated firm, the matter is referred to the relevant supervision team for escalation/close-out. - If the UPU receives a query or complaint alleging a firm is acting as a bank or offering banking services without authorization, it writes to the firm seeking clarification of regulatory status and a written description of activities. - If the firm is regulated by the Central Bank and alleged to be acting outside its authorization, the query is referred to the firm’s prudential supervisor for appropriate action. - Any allegation of unauthorized banking brought to the UPU’s attention is referred to the Police (Garda Bureau of Fraud Investigation) pursuant to the Central Bank’s obligations. *Source: _cr14135 - 7. Consumer Implications* ### Section 33AK. ### Section 33AK. ### Unauthorized banking activity and enforcement - It is an offence to carry on “banking business” without an authorization; see section 7 of the Central Bank Act 1971 and section 58(1) of the Central Bank Act 1971. - Section 59 of the Central Bank Act 1971 states that the Central Bank may bring a summary prosecution for any offence in this regard. - An Garda Síochána prosecute any offences brought on indictment. ### Complaints and supervisory responses (2011/2012) - A complaint was referred to the Central Bank in respect of two unauthorized firms: - Firms were purporting to be based in/operating in Ireland and using the word ‘bank’ in their titles. - The Central Bank issued a warning (pursuant to the Central Bank’s statutory powers) to alert the public that neither firm held any authorization or license, nor were they appropriately licensed in another EEA member state as a credit institution with authority to provide services in Ireland under a passporting arrangement. - A further complaint was referred in respect of another entity purporting to be based in Ireland and using the word ‘bank’ in its title: - The UPU wrote to the website registrant and the entity’s website was removed. - This entity was claiming to operate from the premises of a licensed credit institution in Dublin, so the matter was referred to Banking Supervision for them to contact the licensed entity to alert them. - A warning was not issued in respect of this entity. ### Assessment of Principle 8 / PRISM methodology (summary finding) - Assessment: Compliant - Key features and findings: - PRISM supports a structured and proportionate approach to supervision with a strong linkage between impact and supervisory intensity. - Framework allows structured approach to resource allocation and planning of supervisory activities. - Ongoing monitoring capability uses financial ratios that, if triggered, prompt supervisory attention/intervention. - Risk rating in PRISM is updated after a supervisory activity is completed and is an ongoing measure of risk. - Impact in PRISM measures the impact to the system of an individual bank failing. - Banks that maintain a predominantly retail banking footprint represent the greatest risk to the system and are assigned High Impact ratings. - Resources, supervisory attention and intrusiveness are increased where the impact rating is higher; High Impact banks receive ongoing monitoring through offsite supervision, frequent onsite reviews and ongoing engagement with bank senior management. - As the Impact rating decreases, the level of supervision also decreases. ### Principle 9 — Supervisory techniques and tools (overview) - Principle 9: The supervisor uses an appropriate range of techniques and tools to implement the supervisory approach and deploys supervisory resources on a proportionate basis, taking into account the risk profile and systemic importance of banks. ### EC1 — mix of on-site and off-site supervision - Requirement: The supervisor employs an appropriate mix of on-site and off-site supervision to evaluate condition, risk profile, internal control environment and corrective measures; regularly assesses quality, effectiveness and integration of on-site and off-site functions. - Description and findings: - The Central Bank employs a mix of on-site and off-site supervision. - Uses prudential reports (COREP, FINREP, Quarterly Summary Financial Return etc.), statistical returns, etc., to regularly review and assess safety and soundness, evaluate material risks, and identify necessary corrective actions. - Prudential Reports are reviewed at high level by a specialist Prudential Reporting team with some on-site testing and in greater detail by the supervision teams. - Supervisory engagement model is determined by PRISM, based on the impact of each institution (details under CP8), directing resources to highest impact institutions. - On-site presence (including attendance at internal bank senior management meetings) is significantly higher for High Impact institutions than for Medium Low Impact institutions. - Primary engagement tasks used to identify and assess risk and evaluate internal control frameworks: - (a) financial risk reviews and full risk assessments; - (b) business model analysis; - (c) review of the outcome of stress tests undertaken by the bank; - (d) governance reviews, including risk management and internal control systems; - (e) meetings with senior management and Board members; - (f) meetings with internal and external auditors; - (g) horizontal peer reviews; - (h) model validation reviews; - (i) The Supervisory Review and Evaluation Process (ICAAP review); - (j) participation in supervisory colleges; - (k) Thematic reviews. - Central Bank communicates findings to banks and requires action to mitigate vulnerabilities. - Supervision teams assisted by specialist units (Credit, Treasury, Business Model Analytics, Financial Reporting, Portfolio Analytics, Stress testing and Quantitative models among others). - Minimum levels of on-site and off-site supervision prescribed for specific review types and engagement with Management Team. - Supervision Team minimums: - The Supervision Team should at a minimum carry out 6 FRRs for a High Impact firm over a two year period. - Full Risk Assessments (FRAs) are carried out on a 2-4 year cycle for Medium High institutions. - At a minimum, 10% of Medium low banks are subject to a Full Risk Assessment on an annual basis. - No Irish licensed bank could be categorized as Low impact notwithstanding the impact assessment results. - Some branches operating cross-border in Ireland categorized as Low Impact (scope of responsibilities extends only to liquidity, anti-money laundering and conduct of business). - While firms are given advance notice of on-site inspection, specific elements of a review are unscheduled (walkthroughs, selecting loan files). - Thematic inspections are carried out, generally driven by the Consumer Directorate; Reporting Unit conducts sample testing in selected institutions. - Thematic review areas include Regulatory Reporting, Effectiveness of Risk Committees and Effectiveness of Internal Audit. - Banking Supervision is resourced to supervise above the minimum engagement model and engages well above minimum as determined by divisional management. - Legal powers relevant to EC1: - Section 18 of the Central Bank Act 1971 obliges holders of licences and others to provide Bank with required information and returns. - Part 3 of the Central Bank (Supervision and Enforcement) – Act provides powers for authorised officers. - Regulation 66 of S.I. 661 of 2006, implementing Article 124 of the CRD, obliges the Central Bank to review arrangements, strategies, processes and mechanisms implemented by credit institutions to comply with the CRD and evaluate risks, taking into account technical criteria set out in Annex XI of that Directive. - Regulation 70 of S.I. 661 of 2006, implementing Article 136 of the CRD, enables the Central Bank to require any credit institution that does not meet requirements to take necessary actions at an early stage; supervisory measures include requiring credit institutions to: (i) hold additional own funds; strengthen capital via net profits; reinforce governance and internal capital adequacy assessment processes; apply specific provisioning policy; restrict / limit business operations; or reduce risk inherent in business products and systems. - The Central Bank regularly assesses its supervisory approach and engagement model: - Supervision Support Team (SST) continually reviews quality of supervision via firm specific reviews, survey reviews etc. - Internal Audit conduct reviews on implementation of the risk based approach to supervision. - An independent review commenced in Quarter 2, 2013, due to report towards the end of the year. ### EC2 — planning and execution of on-site and off-site activities - Requirement: Coherent process for planning and executing on-site and off-site activities with policies and processes ensuring thorough and consistent conduct, clear responsibilities, objectives and outputs, and effective coordination and information sharing. - Description and findings: - The planning module in PRISM sets out the minimum level of engagement with institutions dependent on impact category. - PRISM guidance materials set out processes for conducting reviews of credit institutions. - SST carries out reviews of practical implementation of PRISM and quality of supervision. - Supervision teams are responsible for on-site and off-site supervision and developing a supervision plan; supported by specialist teams with regular and scheduled coordination and information sharing. - Governance Review process guidance includes: - Objective of the Governance Review; - Stages in the Analysis Process; - Initial planning; - Visit preparation; - Firm inspection; - Visit; - Analysis, quality assurance and write-up. - Process includes estimate of duration of each stage and appropriate time to spend on-site and off-site. ### EC3 — information and data used for supervision - Requirement: Use variety of information to regularly review and assess safety and soundness, evaluate material risks, identify necessary corrective and supervisory actions; determine reliability of information and obtain additional information as necessary. - Description and findings: - CBI uses a mix of information sources and receives a full suite of regulatory returns including: COREP; FINREP; Large Exposure; Sectoral Limits; Related Party Lending; Liquidity Returns; Funding Reports; Impairment Return; Quarterly Summary Financial Return; and Deposit Protection. - Returns analyzed periodically for High and Medium High Impact banks. - To assess reliability of data: - High level review of regulatory returns by Financial Reporting Unit in Banking Supervision. - Supervision team performs detailed analysis of data identifying trends and underlying drivers to use with supervisors’ engagement to probability risk rate the firm. - Detailed analysis of key risk indicators and regulatory returns carried out for all banks (irrespective of impact category). - For banks in lower two Impact categories analysis of regulatory returns is automated. - Prior to meetings, supervisors review supplementary data and request additional relevant information (MI data, risk appetite statements, risk policies, limits, Board and Board sub-committee meeting minutes, Board and Committee terms of reference). - On average, one such meeting is held on a quarterly basis with Medium Low banks; the character is robust and intrusive. - Legal basis for submission of regulatory returns and other supervisory material: Section 18 of the Central Bank Act 1971. - Regulation 65 and 66 of the CRD covers the ICAAP and SREP respectively. - Regulation 72 of S.I. 661 of 206, transposing Article 145 of the CRD, requires credit institutions to adopt formal policy to comply with disclosure requirements and publicly disclose annually information set out in Part 2 of Annex XII of the CRD. - Other information received and used to assess bank risk: - Audit Reports: from Internal and External Audit. - Internal Capital Adequacy Assessment Process (ICAAP) submissions. - Annual information – financial statements, Banking Supervision Assets and Liabilities return, reconciliation between financial statements and regulatory returns. - Annual Compliance Statements with Regulatory Codes (e.g., Corporate Governance Code; Internal Audit on liquidity risk management). - Publicly available information (media reports, rating agencies, analyst reports). - Pillar III disclosures by institutions. - Evidence to support the implementation of RMPs. - Key Risk Indicator Review: - Once a key risk indicator limit or threshold is breached a detailed analysis is carried out by the supervisor, which can include requesting further quantitative or qualitative information with detailed rationale for closure to be provided within the PRISM system. - Supervisors determine what the movement suggests about the bank’s risk profile. - Depth of regulatory returns review determined by impact category as opposed to inherent risk. - Regulatory Returns Review: - Detailed analytical work on High and Medium High banks. - Supervisory tool developed (banking cube) ensures supervisors analyze movements in excess of thresholds of all regulatory returns and trend analysis on a quarterly basis. - Tool allows investigation of irregular completion of returns (e.g., review of risk weights applied). - Supervisors required to comment on validity of all movements, investigate as necessary and make judgements about risk profile before return is signed off. - Submission of data validated through investigative questioning; recalculating data using regulatory rules; and on-site testing (thematic reviews, FRA and FRRs). ### EC4 — supervisory tools and communication of findings - Requirement: Use variety of tools (financial statement analysis, business model analysis, horizontal peer reviews, stress test reviews, governance analysis) and communicate findings to banks requiring remedial action. - Description and findings: - Tools used: - Reviews of annual accounts (and quarterly accounts where appropriate). - Business Model Reviews required every two years for High Impact institutions. - In completing an FRA for Medium High/Low Impact institution a business model analysis is completed. - Objective: assess risks the firm is taking, vulnerabilities, capacity to identify risks/threats and ability to react timely; identify operational flexibility to respond to major shocks. - Reviews of outcome of stress tests on an annual basis in completing FRA and ICAAP reviews (performed for all banks as directed by the CRD). - For banks with an Impact rating of Medium High and Medium Low for the year when a FRA has not been performed, a self assessment questionnaire is completed by the bank and supported by aspects of the ICAAP – business plan, capital plan, risk appetite statement, material changes in the ICAAP etc. - Horizontal peer reviews conducted by the Treasury and Credit Teams for High and some Medium High Impact institutions. - Peer group analysis reports available in PRISM comparing KRIs and showing trends. - Some Medium High and Medium Low Impact institutions do not have relevant peers for comparison. - Governance reviews required every two years for High Impact institutions. - In completing an FRA for Medium High/Low Impact institutions, a governance review is conducted. - Objective: establish institution is managed soundly and prudently, that “seat of control” is the Board and not a parent company; consider culture of Board, attributes valued in directors, expectations of directors, interplay between executive and Board. - Corporate governance reviewed annually as part of ICAAP review; institutions required to submit annual statement of compliance with Corporate Governance Code. - Pillar 3 reports reviewed when available as part of offsite supervision. - Communication and follow-up: - Findings communicated to institution; initial findings may be informally communicated at a meeting with senior management, with a formal letter to follow. - Where weaknesses identified, a RMP (Remedial/Regulatory/Mitigation Plan) is developed to ensure institution takes appropriate action. - RMPs are authorised either by a RGP or, when no RGP is planned, by a member of the divisional management team. - RGP brings together experience and expertise to help supervisors reach high quality judgments on supervisory actions. - If breaches of regulation/legislation are identified during an inspection, Supervision Team escalates violation to Divisional Management, documents violation in inspection report, and completes an escalation report for the SRC, with possible referral to the Enforcement Directorate. ### EC5 — systemic and macro-prudential oversight - Requirement: Supervisor, with other authorities, identifies, assesses and mitigates emerging systemic risks, potentially including supervisory stress tests, communicates findings and requires action where appropriate. - Description and findings: - Section 6A (2) (a) of the Central Bank Act, 1942 (as amended by the Central Bank Reform Act, 2010) gives the Central Bank of Ireland a leading role in macro-prudential policy in relation to the “stability of the financial system overall”. - Legislative provisions exist for co-operating with public bodies with material impact on financial stability; Central Bank has employed macro-prudential tools both pre-emptively and as crisis management: - Pre-emptively: imposing sector capital requirements in 2006 to curb mortgage lending. - Crisis management: in 2011 imposing capital and loan-to-deposit requirements under the Financial Measures Program. - Central Bank is developing a national macro-prudential framework in line with ESRB recommendations; Financial Stability Division undertaking analytical work to support framework. - Implementation of Basel III in Europe via amended CRD and CRR (collectively CRD IV) will come into force on 1 January 2014 and will allow implementation of certain macro-prudential measures such as additional capital buffers and broader macro-prudential discretions. - New framework requires Member States to designate an authority (the “Designated Authority”) responsible for measures to prevent or mitigate systemic or macro-prudential risks posing a threat to financial stability at national level. - In Irish case, Designated Authority has not yet been formally confirmed; Department of Finance (DoF) has indicated its intention to assign the Central Bank of Ireland to this role. - Central Bank actively engaging with DoF on transposition of CRD IV and intends to issue a revised CRD implementation document on its intended exercise of discretions and options in due course. - Central Bank identifies, assesses and communicates banking risks through the Macro Financial Review prepared by the Financial Stability Division. - Minister for Finance has legislative responsibility for financial stability in proposing legislation and Government policy that promotes financial stability; Central Bank and Department of Finance have an agreed MoU. - Within Central Bank governance: - Deputy Governors for Financial Regulation and Central Banking report to the Governor who has overall responsibility for Financial Stability. - Governor chairs a Financial Stability Committee (FSC). - FSC advises the Governor on issues central to the Central Bank mandate to contribute to financial stability in Ireland and the Euro area. - FSC role involves monitoring and assessing domestic and international economic and financial developments and highlighting potential areas of concern relevant to the Irish financial system. *Source: _cr14135 - Section 33AK.* ### conclusions from the analysis. A key focus of the committee is to identify potential actions ### _cr14135 - conclusions from the analysis. A key focus of the committee is to identify potential actions ### Committee role, actions, and environmental risk assessment - The committee's key focus is to identify potential actions that can be taken to mitigate risks to financial stability and to follow up on past measures. - Formulation of specific actions may be delegated by the Governor to management within or outside the FSC. - Actions may take the form of consideration, implementation, and review of micro-prudential and/or macro prudential policy instruments. - The Financial Stability Division in conjunction with the Risk Division provides an environmental risk assessment for PRISM, which contributes to individual risk scores. ### Stress testing, PCAR, and communication of results - The Central Bank has conducted sector-wide macro stress tests in the past. - In recent years supervisory stress tests, Asset Quality Reviews, Balance Sheet Assessments and Data Integrity Verification exercises — under the PCAR process — have been conducted by the Central Bank (with the assistance of external bodies) to determine the Covered Banks capital requirements. - In preparation for the next loan level PCAR exercise in 2014, the Central Bank has undertaken the development of loan loss forecasting models for four asset classes: residential mortgages, non-mortgage retail, micro SME and SME/Corporate. - The Central Bank communicates its findings to industry through press releases/conferences and updating the Central Bank web-site. - The Central Bank communicates its findings to banks via meetings with the senior management team and formal letters or requirements in the case of supervisory stress test results. - The Central Bank requires banks to take actions, such as maintaining capital at a specific level. ### EC6 — Internal Audit function evaluation and PRISM engagement - The supervisor evaluates the work of the bank’s internal audit function, and determines whether, and to what extent, it may rely on the internal auditors’ work to identify areas of potential risk. - PRISM guidelines for High Impact institutions require the team to meet the Internal Audit function on an annual basis. - Medium High Impact institutions are required to meet the Internal Audit function every two years. - The minimum engagement model for Medium Low firms does not prescribe a minimum engagement level with Internal Audit; supervisors can and do include such meetings in their supervisory engagement. - Supervisors have met with the Internal Audit functions in 30% of the Medium Low bank population since PRISM roll-out. - PRISM engagement model for Internal Audit: - High – annual - Med high every two years - Med Low/Low – no frequency. - There is no requirement for an IA function in the regulations issued by the Central Bank although the EBA guidelines GL44 set out the requirements for internal control functions. - For High Impact banks it is expected that an IA function be in place. - The PRISM guidelines state the objective of the IA meeting is to determine the adequacy of procedures and satisfy the supervisor as to the effectiveness of policies and practices, and that management takes appropriate corrective action in response to internal control weaknesses. - Central Bank has confirmed to all Irish licensed banks that EBA guidelines constitute Central Bank guidance and must be complied with. - Thematic reviews of the effectiveness of Internal Audit functions across the banking system are carried out by the Central Bank. - Analysing and forming a view of the effectiveness of the Internal Audit function is a key element of the Governance Review as set out in the PRISM guidelines. - Governance Reviews are required at least every two years for High Impact institutions and as part of an FRA for Medium High and Medium Low Impact firms. - In Q1 2011, the Central Bank carried out a thematic review of the “effectiveness of the internal audit function” across the banking and insurance sectors; letters issued to the banks involved in Q3 2011. ### EC7 — Contact with Board, non-executives, and senior management - The supervisor maintains sufficiently frequent contacts as appropriate with the bank’s Board, non-executive Board members and senior and middle management to develop an understanding and assess matters such as strategy, group structure, corporate governance, performance, capital adequacy, liquidity, asset quality, risk management systems and internal controls. - Engagement with the Board is determined by a bank’s impact category; the purpose is to develop understanding and assessment of business models, strategy, structure, governance, capital adequacy, liquidity, asset quality, risk management systems and internal controls. - The Central Bank also has robust engagement with institutions where it identifies weaknesses, and supervisors challenge Boards and senior management where appropriate. - Minimum frequency of engagement with a Board by impact category: - High Impact – at least on an annual basis, supervisors meet the CEO, CFO, CRO, Chairman, Senior Non-Executive Director, Internal Audit and External Auditor; teams meet with middle management functions. - Medium High – at least on an annual basis, supervisors meet the CEO, CFO, Chairman, Senior Non-Executive Director, External Auditor and on a 2-year cycle CRO and Internal Auditor; they also meet senior and middle management with day-to-day responsibility for credit, market, operational and liquidity risks. - Medium Low – with due regard to risk and on a staggered basis, over an 18-24 month cycle supervisors meet with the CEO, CFO, Chairman, Senior Non-Executive Director and External Auditor; on a two-year cycle they meet with the CRO. - Low – not specified (note there are no Irish licensed banks in this rating category). - The Central Bank will meet with the full board when presenting results from the RGP; on an annual basis, meetings will be held with individual Board members (INED and Chair) separately. - Legal powers referenced: - Section 17A part (e), of the Central Bank Act 1971 provides powers to meet with and question bank staff. - Central Bank (Supervision and Enforcement) Act 2013 provides new extensive powers, e.g. Part 3 in relation to Authorised Officers and a new general information gathering power. - In practice, supervision teams have contact with and meet senior management on a much more regular basis for the High impact banks. - Supervisors challenge current strategy and assumptions; the typical questions are set out in the PRISM guidelines. ### EC8 — Communication of supervisory analyses and meetings - The supervisor communicates findings of on- and off-site supervisory analyses in a timely manner by written reports or through discussions or meetings with the bank’s management. - PRISM engagement model involves a schedule of ongoing meetings between supervisors and senior management (CEO, CRO, CFO, Head of Internal Audit) and board members (Chairman and senior INEDs); frequency is determined by impact rating. - For banks rated Medium-Low and Low, engagement with bank’s management will not typically take place. - The Central Bank communicates findings from on-site and off-site reviews via written letter with an RMP attached. - The Central Bank meets with the Board and the Senior Management Team to discuss the RMP. - Supervisors and senior management of the Central Bank frequently meet with banks’ senior management and board members on prudential and consumer protection matters (examples include recapitalisations; asset deleveraging; mortgage arrears resolutions and distressed credit operation capabilities; internal model methods for capital purposes; and new business applications). ### EC9 — Follow-up, monitoring RMPs, and escalation - The supervisor undertakes appropriate and timely follow-up to check that banks have addressed supervisory concerns or implemented requirements communicated to them, including early escalation if action points are not addressed. - PRISM requires supervisors to ensure that deadlines for the completion of RMP actions are met. - PRISM allows the supervisor to monitor, track and close RMP actions. - Supervisors follow up on the implementation of RMPs through desk top analysis and on-site inspections, dependent on the nature of the mitigation required. - The CBI can engage Third party or independent party validation to ascertain the extent to which RMPs have been implemented. - Example process: if an institution is required to implement a credit policy, supervisors will complete a desk top review of the policy and will then visit the institution to test its implementation. - The planner facility allows the supervisor to see when RMP actions are falling due. - As soon as the supervisor receives an RMP response from a firm, the supervisor is required to change the action’s status in PRISM to ‘Results Under Review’. - Supervisors should review RMP actions within three weeks of their becoming due, assess their success, change their status to concluded and provide a closure narrative. - PRISM can generate reports highlighting to Divisional Management the RMPs that are overdue; these reports show institutions that are late in meeting RMP deadlines and reviews by supervisors that have not been completed within the three week requirement. - In certain circumstances, for example when an on-site visit is required, it is possible to extend the review beyond three weeks. - If action points are not addressed, the supervisor escalates internally by following the Central Bank’s escalation policy; in additional circumstances the Central Bank writes to the Board of the bank. ### EC10 — Notification requirements for substantive changes or adverse developments - The supervisor requires banks to notify it in advance of any substantive changes in their activities, structure and overall condition, or as soon as they become aware of any material adverse developments, including breach of legal or prudential requirements. - The Central Bank has imposed a requirement on credit institutions to notify the Central Bank in advance of any substantive changes in activities, structure and overall condition. - Notification requirements also exist within regulatory requirements and legislation that cover changes in activities, structure and condition. - Examples from regulatory codes: - The Corporate Governance Code for Credit Institutions and Insurance Undertakings requires that “any institution which becomes aware of a material deviation from this Code shall within 5 business days report the deviation to the Central Bank, advising of the background and the proposed remedial action.” - The Requirements for the Management of Liquidity Risk requires that “where there are breaches or a credit institution foresees a possible breach of the liquidity requirements outlined in this paper, the Financial Regulator must be notified immediately.” - Specific legislation incorporates notification requirements, for example the CRD. - Under Regulation 57 (5) of S.I. 661 of 2006, transposing Article 111(4) of the CRD, banks are required to report to the Central Bank without delay exposures that exceed the limits set out in the CRD for Large Exposures. - In issuing a banking license the Central Bank requires banks to confirm that they will comply with a set of requirements; historically the Central Bank has required institutions to confirm they will seek prior approval before expanding the range of proposed products beyond those in the application. ### EC11 — Use of independent third parties and skilled person reviews - The supervisor may make use of independent third parties, provided there is a clear and detailed mandate for the work; the supervisor cannot outsource its prudential responsibilities to third parties. - The power to require a skilled person review has recently been enacted and is contained in the Central Bank (Supervision and Enforcement) Act 2013. - The Central Bank’s ability to gather information from auditors of regulated financial service providers is covered by the Central Bank Act 1997 (as amended), specifically Sections 27 (B) – 27 (F). - The use of third parties is set out in the PRISM guidelines on ‘Skilled Person Reviews’. - Where the Central Bank has additional firm-specific needs, the supervisor may request a special report prepared by a third party in accordance with a brief from the Central Bank. - The supervisor will consider: - a) the competence and capabilities necessary to prepare the report on the matter concerned; - b) the ability to complete the report within the period specified by the supervisor; - c) any relevant specialized knowledge, including specialized knowledge of the firm, the nature of the business carried on by the firm and the matters to be reported on; - d) any potential conflict of interest in reviewing the matters to be reported on, including any arising from the fact that the matters may raise questions relating to the quality or reliability of work previously carried out by the proposed reviewer; - e) sufficient detachment, having regard to any existing professional or commercial relationship, to give an objective opinion; and - f) previous experience in preparing reports under this Part or reports of a similar nature. - During the course of the review the supervisor will have regular meetings with the skilled person, with progress reports where projects are of longer duration. ### EC12 — Information systems for prudential data processing, monitoring, and analysis - The supervisor has an adequate information system which facilitates the processing, monitoring and analysis of prudential information and aids identification of areas requiring follow-up action. - The Central Bank of Ireland has implemented three systems to facilitate the processing, monitoring and analysis of prudential information: 1. Prudential data is submitted to the Central Bank via the online reporting system. This system has the facility to upload the data submitted by banks, and to validate and store the data. 2. Viewpoint has the ability to retrieve the prudential information submitted by institutions. It provides the supervisor with the ability to monitor and analyse prudential information through the running of numerous reports, from generating the prudential returns to generating analysis reports. Viewpoint also has a query system, enabling the supervisor to generate large pieces of information in relation to specific return items for trend analysis. 3. PRISM allows the supervisor to monitor KRIs and aids the identification of areas requiring follow-up action, with alerts being generated for significant changes in impact metrics, KRIs, new information becoming available, and activity being required in relation to risk mitigation issues. Alerts are only closed once a supervisor has acted upon the alert and provided a narrative within PRISM. PRISM also generates numerous reports, such as alerts listings (both open alerts and those closed within 30 days), RMP issues, engagement models, risk profiles, impact profiles, RGP documents, peer group reports, firm reports and stress test reports. ### AC1 — Periodic independent review framework - The supervisor has a framework for periodic independent review, for example by an internal audit function or third party assessor, of the adequacy and effectiveness of the range of its available supervisory tools and their use, and makes changes as appropriate. *Source: _cr14135 - conclusions from the analysis. A key focus of the committee is to identify potential actions* ### Section 32 (L) 3 of Part IIIA of the Central Bank Act 1942 sets out the legal basis for periodic ### _cr14135 - Section 32 (L) 3 of Part IIIA of the Central Bank Act 1942 sets out the legal basis for periodic ### Legal basis for periodic independent review - Section 32 (L) 3 of Part IIIA of the Central Bank Act 1942 sets out the legal basis for periodic independent review: "The review of the Bank’s regulatory performance required by subsection (2)(b) shall include details of the activities carried out during the relevant year by- (a) the part of the Bank responsible for internal audit." - Internal Audit charter: Internal Audit is "an independent and objective appraisal function, which is required to provide audit assurance that the system of risk management and internal control is adequate to manage and control those risks to which the Bank is exposed. It also assists the Bank in its pursuit of efficiency and effectiveness." ### PRISM development, validation, and rollout - Following reports into the Banking Crisis the Central Bank reviewed supervisory tools and overhauled its approach with implementation of PRISM. - Development responsibility: Risk, Governance and Accounting Policy Division (independent of the Supervisory Divisions). - External validation: Independent consultants hired to opine on the adequacy and effectiveness of PRISM during development. - Rollout completion: November 2012. - Senior management stock take: independent assessment commenced with a final report and recommendations presented to the Governor and Commission at the January 2014 meeting. ### Internal Audit, Supervisory Support Team (SST), and second-line assurance - Internal Audit objective includes review of effectiveness of Supervision tools and their use; Internal Audit recommendations cover these areas. - Second line of defense: Supervisory Support team (SST), a unit within the RGP Division. - SST principal objective: provide senior management with "reasonable assurance" on: - practical implementation of PRISM in supervisory divisions, and - quality of supervision such that PRISM is being implemented appropriately and supervisory engagement provides "reasonable assurance" on identification and mitigation of risk. - Responsibility: Divisional Management must ensure concerns raised by independent parties are addressed appropriately. ### Independent reviews and examples - Examples of independent reviews conducted: - Internal Audit carried out in first half of 2012 on the use of PRISM in Banking Supervision. - SST review of the supervision of two banks in Q3 2012. - Independent consultants opined on the adequacy and quality of the engagement model, impact metrics models, the risk structures and the logic behind PRISM during its development. - Independent assessment of PRISM effectiveness in delivery of high quality risk based supervision commenced; final report presented January 2014. ### Assessment of Principle 9 — supervisory approach and material non-compliance - Overall assessment: Materially non compliant. - Central features and concerns: - PRISM is the centerpiece of the supervisory framework used to assign bank risk ratings, allocate supervisory resources, and determine frequency and intensity of supervisory activities. - Primary concern: mix of offsite and onsite supervisory activities prescribed by PRISM for lower impact ratings may be inappropriate. - Specific issues for impact categories: - Medium Low Impact: - Reliance heavily on reactive processes. - Analysis of regulatory returns largely automated using sensitivity analysis of financial ratios. - Quality, frequency and depth of verification of qualitative data to assess risk are limited. - Onsite activity prescribed by PRISM is on a random-spot check basis with limited coverage by risk specialists. - Low Impact banks (all foreign bank branches with limited prudential supervision mandate set out in the CRD): - No minimum frequency of onsite or offsite supervision. - Absence of prescribed supervisory cycle for offsite and onsite will not facilitate an assessment of risk in the banking system from this sector. - High Impact banks: - More intrusive onsite reviews and broader risk dashboards. - Risks and consequences: - Lack of onsite activity not supported by sufficiently detailed offsite analysis hampers accurate assessment to identify and mitigate risk. - Aggregation of risks across lower impact banks could create vulnerabilities in the banking system and reputational risk for the Central Bank and threaten banking system integrity. - Focusing supervisory process primarily on the impact of a failure distorts resource allocation; supervision should be preventive/corrective to maintain safety and soundness, not focused on impact of resolution. - Conclusion on sufficiency of activities: - Supervisory activities to identify risk are insufficient for banks with an Impact rating below High. - Materially insufficient for Medium Low and Low. - Activities such as onsite reviews and intrusive supervision techniques are mainly allocated to High Impact banks. - Recommendations and supervisory design points: - More appropriate mix of onsite and offsite supervision practices (with due regard for proportionality) to encourage proactive supervision. - More attention to verification of self assessment of compliance with regulations and assessment of risk profile. - Supervisory scope should focus on bank-specific risks so activities differ across banks even between high risk banks — no need for a full suite of activities uniformly. ### Key risk indicators (KRIs), recovery planning, and resolution - KRIs integration: - KRIs are fed into PRISM sourced from a number of returns submitted by banks across various time buckets (e.g. monthly, quarterly). - KRIs built into capital, liquidity, credit, business model/strategy and market risk. - Gaps: no KRIs for operational risk and interest rate risk in the banking book and only a single indicator for market risk. - KRIs are a key feature of exception reporting framework especially for lower impact rated banks and should be expanded to ensure all material risks are monitored. - Separate risk dashboard for High Impact banks covers broader suite of risk metrics for liquidity and market risk. - Recovery and resolution: - Central Bank has power to request recovery plans, but a local recovery planning regime is yet to be fully developed and implemented. - Recovery plans for the two high impact firms have been requested but not received and analysis has not commenced. - Processes for resolution handling not fully developed (EC6). - Macro-prudential tools and powers: - Central Bank employed macro-prudential tools pre-emptively (imposing sector capital requirements in 2006 to curb mortgage lending) and as crisis management tool (in 2011 imposing capital and loan-to-deposit requirements) under the Financial Measures Program. - Implementation of Basel III in January 2014 will provide the Central Bank further powers to implement certain macro measures such as the CCyB. ### Principle 10 — Supervisory reporting overview and Essential Criteria (EC1–EC6) findings - Principle summary: The supervisor collects, reviews and analyses prudential reports and statistical returns from banks on both a solo and a consolidated basis, and independently verifies these reports through either on-site examinations or use of external experts. - EC1: Power to require information and types of information collected - Supervisor power: The CBI requires submission of various returns by credit institutions on a regular basis; solo and CRD consolidated data are collected. - Main regulatory returns: COREP and FINREP. - Frequency: EBA minimum frequency for COREP is six-monthly (CRD), with no frequency specified for FINREP (CEBS GL06). Both COREP and FINREP are collected quarterly, with monthly submission by the covered banks. - Legal powers derive from CBI Act 1971, Section 18, subsections 2 & 3: - (2) A person to whom this section applies shall provide the Bank, at such times, or within such periods, as the Bank specifies from time to time, with such information and returns concerning the relevant business carried on by the person as the Bank specifies from time to time. - (3) A person to whom this section applies shall, at such time or within such period as the Bank specifies, provide the Bank with such information or return (not being information or a return specified under subsection (2)) as it requests in writing concerning the relevant business carried on by the person. - Other reporting requirements: - The CRD, namely S.I. No. 661 of 2006 sets out the requirements for solvency and large exposures reporting. - Reporting on the Code of Practice on Related Parties specified by the CBI pursuant to Section 117(3)(a) of the CBI Act 1989. - Quantitative prudential liquidity requirements imposed under section 23 of the CBI Act 1971 or Section 39 of the Building Societies Act 1989. - The Impairment Return is a condition pursuant to Section 10 of the CBI Act 1971 or Section 17 of the Building Societies Act 1989. - EC2: Reporting instructions and accounting standards - Full instructions for each return are provided by the CBI or by reference to external bodies such as the EBA. - Most regulatory reports compiled under CRD rules and under IFRS/Irish GAAP. - Where different bases are required, this is clearly stated and instructions provided. - EC3: Valuation methodologies, controls, and supervisor challenge - Legal requirement: banks must manage business in accordance with sound administrative and accounting principles; reports compiled under CRD or IFRS/Irish GAAP using EBA guidelines and templates. - Detailed rules on calculation/valuation of items set out in directives or accounting standards; banks obliged to follow these rules. - CBI framework for analysis of regulatory returns specifies type and frequency of review and is supported by a suite of reports for supervision teams. - CBI has challenged banks’ valuations (e.g., provisions) and required adjustments for capital adequacy and regulatory reporting. - Regulation 16 of S.I. No. 395 of 1992 requires credit institutions to have internal control and reporting arrangements and robust governance arrangements (clear organizational structure, effective risk processes, adequate internal control mechanisms, sound administrative and accounting procedures, and remuneration policies promoting sound risk management). - Examples: - High Impact banks were challenged on loan loss forecasting and collateral valuation; banks required to adjust reported data for impairments and provisions. - A Medium High Impact bank had concerns over independent third party valuations in CRE portfolio; the bank updated actions to ensure appropriate CRE valuations, performed independently, and valuations were reduced in some cases. - EC4: Frequency commensurate with risk profile - Data collection frequencies range from weekly to annually depending on nature of data and bank risk profile (CBI Act 1971, Section 18, subsections 2 & 3). - EC5: Comparable data across consolidated supervision - Returns collected from all banks and banking groups subject to consolidated supervision using CRD scope of consolidation. - All returns have common reporting dates across all banks. - Peer group analysis available using default and custom peer groups. - A detailed management information pack for all banks is compiled quarterly providing granular bank-by-bank information on own funds and solvency, funding profile, asset quality, overall balance sheet and profitability metrics. - Quarterly information provided to the CBI’s Supervisory Risk Committee where key issues and trends are highlighted. - EC6: Power to request group information and internal management information - Processes for resolution handling not fully developed (EC6) as noted earlier under recovery and resolution; Central Bank has power to request and receive relevant information from banks and entities in the wider group where material to condition or risk assessment or needed to support resolution planning. *IMF staff compilation based on the source content provided.* ### Section 18 of the Central Bank Act 1971 allows the Central Bank to request information ### _cr14135 - Section 18 of the Central Bank Act 1971 allows the Central Bank to request information ### Legal basis for information requests (Section 18, Central Bank Act 1971) - Section 18 establishes the Central Bank’s authority to request information from any licensed bank for the purpose of supervision. - Central Bank Act 1971, Section 18, subsections 2 & 3: - (2) A person to whom this section applies shall provide the Bank, at such times, or within such periods, as the Bank specifies from time to time, with such information and returns concerning the relevant business carried on by the person as the Bank specifies from time to time. - (3) A person to whom this section applies shall, at such time or within such period as the Bank specifies, provide the Bank with such information or return (not being information or a return specified under subsection (2)) as it requests in writing concerning the relevant business carried on by the person. ### Powers of entry, inspection, and data acquisition (Central Bank (Supervision and Enforcement) Act 2013) - Statutory powers to enter premises and access records: - Section 26.-(1): An authorized officer may at all reasonable times enter any premises if the officer has reasonable grounds to believe they are or have been used for, or in relation to, the business of a person to whom this Part applies, or where records relating to that business are kept. - Specific inspection and evidence-gathering powers (Section 27.-(1)): - (a) search and inspect premises entered under section 26 or pursuant to a warrant under section 28; - (b) require any person to whom this Part applies who apparently has control of, or access to, records, to produce the records; - (c) summon, at any reasonable time, a person to whom this Part applies to: - (i) give to the authorized officer such information as the authorized officer may reasonably require, - (ii) provide to the authorized officer any records which the person has control of, or access to, and which the authorized officer may reasonably require, - (iii) provide an explanation of a decision, course of action, system or practice or the nature or content of any records provided under this section; - (d) inspect records so produced or found in the course of searching and inspecting premises; - (e) take copies of or extracts from records so produced or found; - (f) subject to subsection (3), take and retain records so produced or found for the period reasonably required for further examination; - (g) secure, for later inspection, any records produced or found and any data equipment, including any computer, in which those records may be held; - (h) secure, for later inspection, premises entered under section 59 or pursuant to a warrant under section 61, or any part of such premises, for such period as may reasonably be necessary for the purposes of the exercise of his or her powers under this Part, but only if the authorized officer considers it necessary to do so in order to preserve for inspection records that he or she reasonably believes may be kept there; - (i) require any person to whom this Part applies to answer questions and to make a declaration of the truth of the answers to those questions; - (j) require any person to whom this Part applies to provide an explanation of a decision, course of action, system or practice or the nature or content of any records; - (k) require a person to whom this Part applies to provide a report on any matter about which the authorized officer reasonably believes the person has relevant information; - (l) require that any information given to an authorized officer under this Part is to be certified as accurate and complete by such person or persons and in such manner as the Bank or the authorised officer may require. - Attendance at meetings (Section 29): - 29.-(1) An authorized officer may attend any meeting relating to the business of a regulated financial service provider if the authorized officer considers that it is necessary to attend in order to assist the Bank in the performance of any of its functions under financial services legislation. - 29.-(2) The attendance of an authorized officer pursuant to subsection (1) at a meeting referred to in that subsection does not in any circumstances limit the powers of the authorized officer or of the Bank. ### Access to board, management, staff, and records (EC7 findings) - EC7 finding summary: - The supervisor has the power to access all bank records for the furtherance of supervisory work. - The supervisor also has similar access to the bank’s Board, management and staff, when required. - Description and findings re EC7: - The CBI has unrestricted access to all material available to a license holder which the CBI requires for the supervision of any bank or banking group where it is the consolidated supervisor. - Material can be requested directly from the institution, or the CBI can appoint an “authorized officer.” - Conclusion: Under the Acts cited, the Central Bank has access to the Board, management and staff of a bank. ### Enforcement of reporting obligations and sanctions (EC8 findings) - EC8 finding summary: - The supervisor has a means of enforcing compliance with the requirement that the information be submitted on a timely and accurate basis. - The supervisor determines the appropriate level of the bank’s senior management responsible for the accuracy of supervisory returns, imposes sanctions for misreporting and persistent errors, and requires that inaccurate information be amended. - Description and findings re EC8: - Compliance with reporting requirements is a legal obligation, subject to sanction by the CBI for any breaches. - All regulatory returns must be signed off by a director of a bank. - Any material inaccuracy in a return, once discovered by either the reporting bank or the supervisor, is required to be corrected. - Incorrect or misleading information to the Central Bank may be a prescribed contravention for the purposes of section 33AQ of the Central Bank Act 1942. - A prescribed contravention is subject to the powers of sanction under Part IIIC of the Central Bank Act 1942 (administrative sanctions procedure – settlements, inquiries, etc.). - Persons involved in the management of the entity concerned may be liable for administrative sanction if they participated in the commission of the contravention. - Whether or not a contravention has occurred will be determined by members of the Inquiry appointed by the Central Bank. - Enforcement example: - The Central Bank reprimanded a High Impact institution and required it to pay a monetary penalty of €1,960,000 for errors in regulatory reporting. Five contraventions in total were identified. ### Validation, verification, and use of external experts (EC9–EC11 findings) - EC9 finding summary: - The supervisor utilizes policies and procedures to determine the validity and integrity of supervisory information, including a programme for the periodic verification of supervisory returns by supervisor staff or external experts. - Description and findings re EC9: - The CBI has a framework for the analysis of regulatory returns specifying the type and frequency of review of the main returns. - The framework is supported by a suite of reports for use by supervision teams. - The CBI has used external parties to verify data on its behalf. - The framework is currently being reviewed with a view to: - (a) its application across the various risk categories of banks (i.e. PRISM categories); - (b) generating supporting data for PRISM alerts; and - (c) maximizing use of latest technology. - The Financial Reporting Unit is undertaking a series of themed regulatory reporting reviews across a sample of banks: two reviews, each covering five different banks (i.e. 10 banks). The first review covers FINREP balance sheet compilation and the second review covers COREP market risk calculation. - The calculation of risk weighted assets generated using internal models based approaches is being reviewed. - The Central Bank is engaging in a cross European analysis of RWAs through the EBA; this work is ongoing. - In 2012 the CBI required a High Impact bank to engage a third party to review its regulatory returns. - EC10 finding summary: - The supervisor clearly defines and documents the roles and responsibilities of external experts, assesses suitability and quality, and considers conflicts of interest. - Description and findings re EC10: - There is no specific policy for the engagement of external experts for the review of regulatory returns. - The CBI operates under public sector procurement rules (tendering, etc.), and when external parties are engaged such engagement is subject to a service level agreement that sets out roles and responsibilities of both the CBI and the service provider. - There is provision in the Central Bank Act 1989 for auditors of an institution to report certain matters to the Central Bank, and for the Central Bank to require an auditor to furnish certain information to it. - Auditors’ duties are elaborated further in Chapter III of the Central Bank Act 1994. - EC11 finding summary: - The supervisor requires that external experts promptly bring to its attention any material shortcomings identified during the course of work undertaken for supervisory purposes. - Description and findings re EC11: - Central Bank Act 1989 – Part II, The Central Bank / Chapter III Licensing and Supervision of License Holders. *Source: _cr14135 - Section 18 of the Central Bank Act 1971 allows the Central Bank to request information* ### 47. Duties of auditor ### 47. Duties of auditor ### Auditor reporting obligations (statutory provisions) - If the auditor of a holder of a license: - (a) has reason to believe that there exist circumstances which are likely to affect materially the holder's ability to fulfil his obligations to persons maintaining deposits with him or meet any of his financial obligations under the Central Bank Acts, 1942 to 1989, or - (b) has reason to believe that there are material defects in the financial systems and controls or accounting records of the holder, or - (c) has reason to believe that there are material inaccuracies in or omissions from any returns of a financial nature made by the holder to the Bank, or - (d) proposes to qualify any certificate which he is to provide in relation to financial statements or returns of the holder under the Companies Acts, 1963 to 1986, or the Central Bank Acts, 1942 to 1989, or - (e) decides to resign or not seek re-election as auditor, - he shall report the matter to the Bank in writing without delay. ### EC12 — Reporting framework review and data needs - The Central Bank of Ireland (CBI) follows EBA guidelines and templates for the bulk of its regulatory reporting requirements. - The CBI is an active participant in EBA reporting groups and networks. - In a recent review of the EBA guidelines for solvency and regulatory reporting, the CBI (in conjunction with its European counterparts) reviewed the existing reporting framework, assessing the usefulness of existing templates and the reporting requirements under CRD IV. - This process took a number of years; the text notes this is acceptable because a change in the reporting framework should only occur relatively infrequently to facilitate trend analysis. - Data needs are subject to continuous review; where new requirements are identified, new returns are created or existing returns enhanced. - The CBI is engaging with the ECB in the development of a new reporting framework for Irish banks covered by the single supervisory mechanism. ### Assessment of supervisory powers and corrective tools (Principle 11) - Assessment re Principle 10: Compliant - Principle 11 summary: - The supervisor acts at an early stage to address unsafe and unsound practices or activities that could pose risks to banks or to the banking system. - The supervisor has at its disposal an adequate range of supervisory tools to bring about timely corrective actions, including the ability to revoke the banking license or to recommend its revocation. ### EC1 — Early engagement, RMP process and PRISM - The supervisor raises concerns with the bank’s management or, where appropriate, the bank’s Board, at an early stage, and requires these concerns be addressed in a timely manner. - Where the supervisor requires significant corrective actions, these are addressed in a written document to the bank’s Board (i.e., the Risk Mitigation Programme, RMP). - The CBI requires regular written progress reports and checks that corrective actions are completed satisfactorily. - The CBI follows through conclusively and in a timely manner on identified matters through desk-top analysis and onsite engagement. - PRISM: - Provides a structured framework for the supervision of banks (and other firms). - Sets out and documents guidance to supervisors on how to assess the risk profile of a bank. - Sets out and documents the basis and process for issuing an RMP to a bank and the process for monitoring compliance with it. - Methods to impose RMP actions: - Where there is a breach of the European Communities (Capital Adequacy of Credit Institutions) Regulations 2006 (S.I. No. 661/2006), an RMP may be imposed under Regulation 70(2)(e) of S.I. 661/2006. - Regulation 70 (4) of S.I. 661/2006 has been used to impose additional capital requirements on credit institutions where the Central Bank has assessed that a credit institution already holds a level of internal capital adequate to cover the nature and level of the risks to which it is or might be exposed. - An RMP can be imposed via Section 10 of the Central Bank Act 1971 (power to impose conditions on licenses). - Section 21 of the Central Bank Act 1971 confers broad powers of direction on the Central Bank. - More general RMP actions which do not result from a direct breach of CRD requirements are imposed by way of agreement. - Where an agreed RMP is not satisfactorily delivered, the CBI can escalate and legally impose the RMP (where a breach of CRD has occurred) using powers under Regulation 70 of S.I. 661/2006; to date the Central Bank has used its powers once in this regard. - RMPs have been issued to all High Impact and certain Medium High Impact and Medium Low Impact banks following risk assessment by the Central Bank. - The Central Bank used its powers under Regulation 70 of S.I. 661/2006 as part of its 2011 FMP to impose additional capital requirements to cover potential future loan losses. ### EC2 — Range of supervisory tools (description and enforcement) - The CBI has available a range of supervisory tools when a bank is non-compliant, engaged in unsafe or unsound practices, or when depositors' interests are threatened. - Risk Mitigation Program (RMP): - Used where issues require remediation, including breaches of legislative or regulatory requirements; unsafe or unsound practices; or threats to depositors' interests. - RMP sets out issue basis, prescribed actions, required outcomes, and defined timelines. - Legislative Tools: - Section 10 of the CBI Act 1971: powers to impose conditions on banking licences. - Section 21 of the CBI Act 1971: allows the CBI to give a direction in writing to the holder of a licence. - Regulation 70 of S.I. 661 of 2006: requires the CBI to require any credit institution that does not meet the requirements of any law of the State to take necessary actions or steps at an early stage; such steps could include restricting or limiting the business of a bank; taking actions to reduce the risks in its activities; applying specific provisioning policy; or imposing additional own funds requirements in excess of the minimum required. - Supervisory Warnings: - Non-public, not underpinned by legislation. - Set out concerns relating to certain activities. - May be taken into account when considering subsequent enforcement action but may not be taken into account in imposing sanctions following such action. - May be imposed following a specific referral or in the context of the ASP where: - The matter is minor in nature; - Immediate remedial action has been taken; - Full cooperation has been received; - Other considerations supporting another enforcement approach do not apply. - Enforcement (formal enforcement actions available): 1. The administrative sanctions procedure under Part IIIC of the CBI Act 1942, which permits the CBI to: - a) caution or reprimand, - b) direct the refund or withholding of money charged or paid for the provision of a financial service, - c) direct payment to the CBI of an amount up to €5,000,000 for corporate bodies and €500,000 for natural persons, - d) disqualify natural persons from being concerned in the management of a bank, - e) direct payment of all or part of the costs to the CBI of holding an inquiry and investigating a matter, - f) direct persons to cease a contravention, - g) enter into a settlement with the relevant person; 2. Fitness and Probity Investigations under Part 3 of the CBI Reform Act 2010, permitting suspension or prohibition from performing a controlled function in a credit institution; 3. Revocation of authorization of a bank (with Ministerial consent); 4. Summary criminal prosecution. - Enforcement case acceptance: - Internal policies define minimum thresholds for accepting an Enforcement case. - There is no mandatory trigger for enforcement; acceptance is left to supervisors' judgment. - Grounds for acceptance in the Enforcement Referral Process: - (a) Reliable grounds — sufficient evidence to demonstrate it is likely that a breach has occurred. - (b) Policy grounds — consideration of the CBI’s statutory objectives and priorities, how the referral supports those objectives, and the public message an administrative sanction would convey. - The CBI (Supervision and Enforcement) Act 2013: - Enhanced the range of sanctions available. - The level of fines was doubled for both firms and individuals, with an alternative calculation of maximum fine for firms based upon 10% of annual turnover. - The CBI’s approach to Enforcement proceedings is documented in its published Outline of the Administrative Sanctions Procedure and Inquiry Guidelines. - The process of referring cases from banking supervisory divisions to Enforcement has been formalized. ### Resolution powers - Under Resolution powers and subject to certain conditions (including that the CBI is satisfied that the bank concerned has failed or is likely to fail to meet a regulatory requirement imposed by law, or a requirement or condition of its license, and that there is a threat to financial stability), the CBI has the following powers: - (a) Appointment of a Special Manager - (b) Transfer of Engagements - (c) The ability to create a Bridge Bank - (d) Liquidation - (e) Powers to go to court to wind up a bank - Resolution powers are intended to be used as a last resort to bring about orderly resolution of institutions that are about to fail or have already failed. - European legislation applies in relation to bankruptcy of banks, e.g. 2011/48 – The European Communities (Reorganization and Winding-up of Credit Institutions) Regulations 2011, together with relevant parts of the Companies Acts for companies in liquidation. - The Resolution Act provisions might also apply if that Act is used to wind up the bank concerned. ### Appeals process and outcomes - The Irish Financial Services Appeals Tribunal, established under the Central Bank and Financial Services Authority of Ireland Act 2003, acts like a court outside the normal court system to hear appeals relating to some CBI decisions. - The CBI has entered into settlement agreements and issued public notices for a number of banks. - In its Financial Measures Project 2011, under Regulation 70 of S.I. 661/2006, the Central Bank required banks to hold capital in excess of the minimum set out in S.I. 661/2006. - The Central Bank has issued Supervisory Warnings to a number of firms. ### EC3 and EC4 — Early intervention thresholds and breadth of measures - EC3: The CBI has the power to intervene at an early stage to require a bank to take action to prevent it from reaching regulatory threshold requirements, using Regulation 70 of S.I. 661 of 2006, Section 21 of the Central Bank 1971 and Section 45 of the Central Bank (Supervision and Enforcement) Act, 2013. - The corrective action process is commenced early through the RMP; RMP notices are sent promptly following supervisory activities that disclose areas in need of attention. - Supervisory Warnings are also issued at an early stage. - EC4: The CBI has a broad range of measures to address early-stage scenarios, including requiring timely corrective action or imposing sanctions expeditiously. - Enforcement measures listed include: 1. The ASP (administrative sanctions procedure) allowing: - a) caution or reprimand - b) direct refund/withholding of monies charged or paid - c) direct payment to the CBI of an amount up to €5,000,000 for corporate bodies and €500,000 for natural persons - d) disqualify natural persons from bank management - e) direct payment of costs to the Central Bank of holding an inquiry and investigating a matter - f) direct persons to cease a contravention - g) enter into a settlement with the relevant person 2. Fitness and Probity Investigations under Part 3 of the Central Bank Reform Act 2010 permitting suspension or prohibition from performing a controlled function 3. Revocation of authorization of a regulated financial service provider *Italic: IMF summary of "47. Duties of auditor" (content unit: _cr14135 - 47. Duties of auditor).* ### 4. Summary criminal prosecution ### 4. Summary criminal prosecution ### EC5 — Sanctions on banks and individuals - The supervisor applies sanctions not only to the bank but, when and if necessary, also to management and/or the Board, or individuals therein. - The CBI may initiate administrative sanctions proceedings (ASP) against both the regulated entity itself and against persons concerned in their management where they have “participated” in a prescribed contravention (section 33AO of the 1942 Act). - ASP may be progressed: - against the regulated entity and person concerned in its management individually and separately, - collectively, or - against one but not the other. - It is possible to impose sanctions following an ASP on a person concerned in the management without having proceeded against the regulated entity. - Sanctions under Part IIIC of the 1942 Act include the ability to disqualify an individual from being concerned in the management of a bank for such period as specified (section 33AQ(5)(c) of the 1942 Act). - The CBI’s fitness and probity regime permits prohibition of persons who may exercise significant influence within regulated financial service providers from performing all or part of a controlled function (section 43 of the 2010 Act). - The CBI or Governor may issue a Prohibition Notice if a person is found not to be of sufficient fitness and probity, having particular regard to: - the need to prevent potential serious damage to the financial system in the State and ensure the continued stability of the system, and - the need to protect users of financial services. - The CBI’s procedures relating to ASP and the fitness and probity regime have been documented and published. ### EC6 — Corrective actions and ring-fencing powers - The supervisor has the power to take corrective actions, including ring-fencing of the bank from the actions of parent companies, subsidiaries, parallel-owned banking structures and other related entities in matters that could impair the safety and soundness of the bank or the banking system. - Regulation 70 of S.I. 661 of 2006 allows the CBI to require any bank that does not comply with any law of the State giving effect to Directive 2006/48/EC to take necessary action to address the issue, including restricting or limiting the business of a bank. - Under Section 21 of the CBI Act 1971 the CBI can direct banks to take corrective and other actions, including: - requiring the holder to suspend, for a specified period not exceeding 6 months, any specified banking activity except as authorized by the Bank. ### EC7 — Cooperation on orderly resolution and cross-border coordination - The supervisor cooperates and collaborates with relevant authorities in deciding when and how to effect the orderly resolution of a problem bank situation (which could include closure, assisting in restructuring, or merger with a stronger institution). - Before exercising resolution powers in relation to an authorized credit institution that carries on business in a jurisdiction other than that of the State, the CBI should inform the corresponding authority in that other jurisdiction. - The revised CRD requires establishment of colleges of supervisors to strengthen supervision of cross-border banking groups and facilitate tasks of the consolidating supervisor and host supervisors. - Central Bank participation in Supervisory Colleges supports: - Exchanging information - Views and assessments - Voluntary work-sharing and delegation - Developing a common understanding of the risk profile of the group at both the group and solo levels - Taking due account of macro-prudential risks - Colleges also assist preparation for and handling of emergency situations and crisis management. - For domestic cooperation, there is a MoU on Financial Stability between the Central Bank and the Department of Finance entered into in 2007. ### Additional criteria — AC1 & AC2 - AC1: Laws or regulations guard against the supervisor unduly delaying appropriate corrective actions. - There are no legal provisions or regulations setting out timeframes for supervisors to take action. Notwithstanding this, the CBI endeavors to act on a timely basis when dealing with corrective action. - AC2: Coordination with supervisors of nonbank financial entities when taking formal corrective action. - The Central Bank informs the supervisors of nonbank related financial entities which are supervised by the Central Bank of intended action and coordinates its actions with them. - In the case of one high impact bank, the bank supervisors coordinated their approach with Insurance supervisors. *Assessment re principle 11: Compliant* ### Principle 12 — Consolidated supervision (overview) - Principle 12: The supervisor supervises the banking group on a consolidated basis, adequately monitoring and, as appropriate, applying prudential standards to all aspects of the business conducted by the banking group worldwide. ### EC1 — Understanding group structure and group-wide risks - The supervisor understands the overall structure of the banking group and is familiar with all material activities (including nonbanking) conducted by entities in the wider group, domestic and cross-border. - The Central Bank collects and analyses financial and other information adequate for consolidated supervision; legal platform largely contained within S.I. 475 of 2009. - Frequency and intensity of supervision depend on PRISM Impact rating: - High Impact banks: supervisory plan typically annual; offsite and onsite activities include: - Financial Risk Reviews (minimum of six across a two year period) considering group structures and foreign operations. - Governance Category assessments requiring assessment of group structure. - Meetings with key personnel covering strategy, structure and activities across the banking group. - Medium-High and Medium-Low Impact banks: Full Risk Assessment (FRA) performed on at least a two to four year frequency. - FRA reports are presented at the Risk Governance Panel (RGP) after desk-based analysis and onsite examinations; identified actions are agreed at panel meetings and set out in the SREP letter and attaching RMP. - Legal and direction-making powers relevant to consolidated supervision: - Regulation 70 of S.I. 661 2006 (transposes Article 136 of the CRD 2006/48). - Section 37 of the Central Bank (Supervision and Enforcement) Act 2013 allows directing a bank to dispose of certain assets. - Part 3 of the Act provides powers usable outside the State and in relation to “related undertakings”. - Regulation 18 and Regulation 20 of S.I. 475 of 2009 relate to information gathering and authorized officer powers. - Section 21 of the Central Bank Act 1971 allows directing suspension, for a period not lasting six months, of disposal or acquiring of assets. - The Central Bank reviews oversight by parent companies and affiliates (including nonbank) that have material impact on safety and soundness and takes appropriate supervisory action. - The Central Bank considers effectiveness of supervision in host countries and visits foreign offices periodically; location and frequency determined by risk profile and systemic importance. The College framework supports information-sharing with host supervisors. ### EC2 — Consolidated prudential standards and data collection - The supervisor imposes prudential standards and collects and analyses financial and other information on a consolidated basis covering capital adequacy, liquidity, large exposures, exposures to related parties, lending limits and group structure. - The Central Bank develops specific Codes and attaches these Codes to banking licenses as appropriate, thereby imposing additional prudential standards; framework based on CRD transposed via S.I. 661 of 2006. - Relevant powers for collecting financial information: regulation 20 of S.I. 475 of 2009 and enhanced powers in the 2013 Supervision and Enforcement Act (Part 5 and section 37(3)). - The CBI’s “Framework for the Review and Monitoring of Prudential Data Submitted by Credit Institutions” governs collection and analysis of prudential data on a solo and consolidated basis. - Reporting framework (quarterly by all banks and banking groups; some reports more frequent where required): - COREP, FINREP, Impairment, Liquidity, Large Exposures, Sectoral Lending Limits, Funding, Related Party Lending and Deposit Protection — reported quarterly. - Liquidity reporting may be required monthly. - Where warranted by group structure, reports are required both on a solo and consolidated basis. - Each report framework includes: - A description of the report - A description of supporting reports and query facilities - Details of any guidelines and legal basis - A description of the minimum review process required - Confirmation of compliance with Codes is required on an annual basis (e.g., the 2010 Corporate Governance Code for Credit Institutions and Insurance Undertakings). ### EC3 — Oversight of foreign operations and host jurisdiction access - The supervisor reviews whether oversight of a bank’s foreign operations by management is adequate with regard to risk profile and systemic importance and assesses hindrances in host countries to access material information. - Oversight of foreign operations is reviewed on a proportionate basis determined by risk profile and systemic importance. - On-site inspections of foreign entities/branches will be carried out where warranted. - For High Impact banks: - FRRs (annually) include review of activities of all subsidiaries and foreign operations and interaction with host supervisors. - Appropriateness of significant policies assessed as part of FRRs to ensure alignment with group policies. - Expertise of those directing cross-border operations considered via Fit and Proper checks and ongoing assessment supplemented by discussions with other supervisors; Colleges form basis for this engagement with frequent engagement for High Impact banks and onsite visits evident. - For Medium High and Medium Low Impact banks: - Reviews of foreign subsidiaries/branches may be ad-hoc or part of themed reviews; requirement for review based on risk profile and systemic importance. - Examiner guidance prompts supervisors to consider materiality of wider group or foreign office activities. - The Central Bank has a policy to assess local jurisdiction hindrances to accessibility of information relevant to branches or subsidiaries and to assess effectiveness of supervision in the host country. *Italic: Source — _cr14135 - 4. Summary criminal prosecution* ### Part 3 of the Central Bank (Supervision and Enforcement) Act has extensive authorised ### _cr14135 - Part 3 of the Central Bank (Supervision and Enforcement) Act has extensive authorised officer powers. ### Supervisory oversight of foreign operations (EC4) - The home supervisor visits foreign offices periodically; location and frequency are determined by the risk profile and systemic importance of the foreign operation. - The supervisor meets host supervisors during visits; local supervisors are always informed and given the opportunity to attend intended on-site visits. - Assessment process: - Commences with a desk-based review of material activities. - Proportionality is considered regarding materiality of operations compared with overall size. - Information from Supervisory Colleges is a key input. - Formal documented guidance in PRISM sets high-level principles including: - To what extent review of other entities (including nonbanking) is required. - How to assess those risks, the level of analysis and approach to be applied. - Whether action is needed to address unacceptable risks or activities in affiliate operations. - Legal basis: - Oversight of branches operating in Ireland: CRD Articles 30–34 (transposed via S.I. 395 of 1992, Regulations 27, 29 and 34). - Power to visit foreign operations: Article 129 of the CRD (2006/48), transposed via Regulation 67 of S.I. 661 2006. - Requirement for full consolidation (proportionate): Article 133 of the CRD (2006/48), transposed via Regulation 7 of S.I. 475 2009. ### Parent and affiliated company oversight (EC5, AC1) - Supervisor reviews main activities of parent companies and affiliates that materially impact safety and soundness, and takes appropriate supervisory action. - Findings on parent assessment: - Review of parent activities is completed during bank license applications and routinely reassessed as part of the FRR/FRA. - Frequency of FRAs depends on PRISM Impact rating: - For High Impact banks the ongoing assessment of the parent is included in activities to be performed on an annual basis. - For Medium-High Impact this is on average every three years in the FRA. - Less frequent for lower impact rated banks. - Remedial powers and precedents: - Examiners can instruct cessation of particular activities, impose capital add-ons, and other supervisory measures where risks increase. - Examples of licence conditions: higher solvency ratio; reduced large exposure limit to affiliate/group companies; other onerous conditions under Section 9 and Section 10 of the Central Bank Act 1971. - No examples exist where a supervisor has instructed an entity supervised by the Central Bank to cease activity at an affiliated company. - Fitness and Probity over parents (AC1): - Central Bank cannot apply its Fitness and Probity regime to owners and senior management of parent companies except where owners are natural persons and are qualifying shareholders (greater than 10% shareholding) in the Irish licensed bank. - Expertise of parent senior management is reviewed during licensing and ongoing FRR/FRA; extent depends on control and materiality. - No official policy exists on formally enforcing Fitness and Probity at parents; no examples of attempted enforcement. - Article 135 CRD (transposed via Regulation 69 of S.I. 661 of 2006) applies to persons directing a financial holding company but does not extend to corporate parent companies. - Central Bank Supervisory & Enforcement Act 2013 includes power to obtain information from an unregulated parent and to require a third-party skilled person report, including on senior management, but appears limited to information-gathering rather than extended fit-and-probity enforcement. ### Limiting group activities and locations (EC6) - The Central Bank has power to limit range and location of activities; authority derived from Article 136 (a)-(e) of the CRD, transposed via Regulation 70.2 of S.I. 661 of 2006. - Legal connection: Article 136 actions address group compliance with Article 22 (transposed via Regulation 79 of S.I. 661 2006) which requires robust governance arrangements. - Demonstrated supervisory actions: - Firms restricted to activities set out in banking licence applications; subsequent activities require prior Central Bank approval. - Examples: - Firm instructed to cease any new lending activity for breaching Central Bank sectoral limits. - Firm required to seek prior approval of the Central Bank for any new activity as a condition of the licence. - Firm instructed to cease lending for apartment purchases and restricted to providing property loans to a maximum Loan-to-Value of 80%. ### Solo and consolidated supervision (EC7) - Central Bank supervises individual licensed entities on both a solo and consolidated basis in accordance with CRD requirements. - Regulatory reporting obligations are imposed on each individual bank within the group. - Group structure assessment and relationships between member entities are explained in the RGP Report as part of FRR/FRA. - Legal provisions: - Recital 13 of the CRD and Articles 42, 131 and 141 referenced for solo and consolidated capital requirements and supervisor collaboration. - Article 130 CRD (2006/48/EC), transposed via Regulation 68 of S.I. 661 of 2006, provides for immediate alerting by consolidated supervisor of host competent authority where group situations may jeopardise host financial stability. ### Home-host relationships and supervisory colleges (Principle 13; EC1–EC10) - Establishment and operation of Supervisory Colleges: - Central Bank holds Supervisory Colleges for all banking groups with material cross-border operations where it is the consolidating supervisor. - Membership determined by nature (subsidiaries or branches) and significance of cross-border entities. - Central Bank is consolidating supervisor for AIB plc. and The Governor and Company of the Bank of Ireland (BoI); European consolidating supervisor for Citibank Europe plc. - Central Bank engages in bilateral information sharing and has MoUs with a number of supervisors. - Colleges provide an agreed communication strategy and framework for cross-border crisis cooperation and coordination. - Information sharing (EC2): - Colleges and bilateral communications ensure timely sharing of relevant information; the College forum communicates risk assessments and uses CEBS Guidelines templates for Joint Risk Assessment Decision (JRAD). - Central Bank has signed Agreements covering exchange of information and confidentiality with College members. - Outside Colleges, an MoU process exists for formal exchange of information; exchange often occurs on an ad-hoc request basis. - All banks for which the Central Bank is a host supervisor are subject to consolidated supervision at the parent level except two. - Coordination of supervisory activities (EC3): - Central Bank establishes annual plans for Colleges to align member work, facilitate Joint Decision, identify joint work areas, and agree meeting schedules and submission timelines. - Supervision plans are agreed during the annual RGP which precedes the College. - Article 129(1)(b) CRD (transposed by Regulation 67(1) of S.I. 661 of 2006) provides legal basis for colleges and joint decision-making. - Communication strategy (EC4): - College supervisory plans set out ongoing communication including regular teleconferences and submission of information for JRAD. - Communication intensity reflects relative importance and riskiness of entities; communications to banks are agreed in advance where appropriate. - Article 129 CRD (transposed by Regulation 67 of S.I. 661 of 2006) provides legal basis for establishment of Supervisory Colleges and the reaching of a joint decision. - Cross-border crisis cooperation (EC5, EC6): - Central Bank has a Special Resolutions Unit (SRU) liaising with Banking Supervision Divisions where viability threats arise. - Member of Cross Border Stability Group (CBSG) comprising Irish Department of Finance; UK Prudential Regulatory Authority; Bank of England; Her Majesty’s Treasury to share information on Irish banks with significant UK operations. - Where Central Bank is home supervisor in a College, cross-border crisis management frameworks established covering: - Definition of “Emergency Situation”. - Communication between supervisors in an emergency. - Coordinated supervisory response. - External communications. - Simulation exercises. - Contingency planning. - Frameworks reviewed at least annually. - Central Bank recently signed a Cooperation Agreement with Federal Deposit Insurance Corporation FDIC to share information. - Recovery and resolution planning status: - Central Bank received power to request recovery plans and produce resolution plans under the CBCIR Act 2011 in October 2012. - A local recovery and resolution plan regime has not yet been implemented; CBCIR has not yet been used to resolve an authorized credit institution in this jurisdiction. - Recovery plan aspect has yet to be fully implemented; implementation may be deferred pending EU proposed Directive on Crisis Management and Bank Resolution. - Section 93(1) of the CBCIR Act 2011 allows the Central Bank to prepare a Resolution Report where it has requested a Recovery Plan. - Central Bank has requested recovery plans from two high impact credit institutions in line with EBA recommendations. - Host supervision and branches (EC7–EC9): - Cross-border operations of foreign banks operating in Ireland are subject to same basic standards as domestic institutions; requirements on domestic institutions may be more onerous due to systemic importance and risk profile. - For EU branches oversight is limited to AML, Liquidity and Conduct of Business supervision; some branches receive a Liquidity Concession Waiver where liquidity oversight is responsibility of home regulator at parent level. - No third-country branches currently in Ireland; if established, Central Bank would undertake significantly higher oversight than for EU branches. - Licensed banks must comply with CRD transpositions and Central Bank Acts; Central Bank may issue regulatory notices (e.g., Corporate Governance Code, Requirements for the Management of Liquidity Risk). - Part 3 of the Central Bank (Supervision and Enforcement) Act 2013 provides legal basis for powers to access local offices and subsidiaries and to conduct cross-border onsite inspections where foreign entity poses a risk to financial stability. - No booking offices currently in Ireland; Central Bank would adhere to internationally-agreed standards and would not permit shell banks; Section 8 of the Central Bank Act 1971 prohibits carrying on banking without a license. - Consultation before action (EC10): - Central Bank, as good practice, would inform another supervisor that it intends to take action based on information provided by that supervisor. ### Corporate governance oversight (Principle 14; EC1–EC4) - Corporate Governance Code for Credit Institutions and Insurance Undertakings: - Sets out corporate governance requirements proportionate to institution size ('major institutions' face more stringent requirements). - Responsibilities of Board and Chief Executive are detailed. - Board responsibilities include appointing CEO and senior management with appropriate integrity, knowledge, experience, skill and competence; endorsing appointments with material impact on risk profile; ensuring succession plans. - Board must set business strategy, understand risks, and establish documented risk appetite expressed in qualitative terms and quantitative metrics (examples: Value at Risk (VaR), leverage ratio, range of tolerance for bad debts, acceptable stress losses, economic capital measures). - Central Bank has power via the Code to require changes in Board composition if individuals are not fulfilling duties. - Remuneration: - FSB standards for compensation transposed into Irish law via S.I. 625 2010, effective 1 January 2011. - Supervisors ensure compensation systems give appropriate consideration to risk, capital, liquidity and likelihood/timeliness of earnings. - Remedial actions have included overhauls of remuneration policies and implementation of new processes. - Pillar III disclosures are assessed for remuneration disclosures where appropriate. - Legal basis and enforcement: - Code introduced as a condition pursuant to multiple statutory provisions including Section 10 Central Bank Act 1971 and various other Acts and Regulations. - Part 3 of the Central Bank Reform Act 2010 gives extensive powers regarding fitness and probity of directors. - Supervisory assessment frequency and methods (EC2): - PRISM prescribes minimum supervisory activities proportional to PRISM Impact rating: - High Impact: full governance review at least once every two years; annual meetings with Board and senior management; six FRRs conducted every two years. - Medium-High: governance review on average every three years (FRA), full review at minimum 2-4 years. - Medium-Low and Low: assessment is more reactive; Medium-Low frequency is 18 months for meetings with Board/senior management; Low has no prescribed frequency. - For High and Medium-High Impact banks the ICAAP is assessed annually; for Medium-Low and Low a Self-Assessment Questionnaire (SAQ) is required. - Institutions must report any material deviation from the Code within 5 business days with proposed remedial action. - Each institution must submit an annual compliance statement as set out at Section 25 of the Code. - Board composition, appointment and committees (EC3–EC4): - Code requires Board endorsement of material appointments; Board responsibility for appointment or proposing non-executive directors; adequate training for non-executive directors. - Majority of the board should be independent non-executive directors, though subsidiaries may have majority group non-executive directors provided at least two independent non-executive directors exist (or a greater number if required). - Board shall review membership at least once every three years and formally review those with nine years or more service. - Committees: - Minimum: Audit Committee and Risk Committee (unless group-level committees relied upon). - Major institutions required to establish Audit, Risk, Remuneration and Nomination Committees. - Composition rules: Audit Committee composed of non-executive directors with majority independent; Risk Committee to have appropriate representation of non-executive and executive directors; Remuneration and Nomination Committees to have majority independent non-executive directors where possible. - Nomination Committees (major institutions) must make recommendations on new appointments and prepare comprehensive job descriptions considering board skills, expertise and time commitment. - Supervisory findings on governance assessment sufficiency: - For High and Medium-High Impact banks, frequency and range of supervisory activities provide regular assessment of corporate governance. - For Medium-Low and Low Impact banks, the supervisory range and frequency are not adequate to assess robustness of governance; approach is more reactive and will not include assessment of policies and procedures unless a risk is identified. - Information for governance evaluation is obtained through observation, ad-hoc engagements, Central Bank MI reports, SREP engagement/FRA, and thematic reviews. *Source: _cr14135 - Part 3 of the Central Bank (Supervision and Enforcement) Act has extensive authorised officer powers.* ### Part 3 of the Central Bank Reform Act 2010 gives extensive powers to the Central Bank in ### _cr14135 - Part 3 of the Central Bank Reform Act 2010 gives extensive powers to the Central Bank in ### Fitness and Probity regime (PCFs and CFs) - Part 3 of the Central Bank Reform Act 2010 introduced a statutory system regulating persons performing “controlled functions” (CFs) and “pre-approval controlled functions” (PCFs). - Under the Fitness and Probity Regime, a Director is a PCF; the Central Bank must approve in writing before an institution can appoint a person to a PCF. - Approval process requirements: - Submission of an individual questionnaire containing a section on ‘Professional Experience, Educational Qualifications, Professional Memberships and Relevant Training’. - Central Bank has power to call PCF applicants for interview. - Standards of Fitness and Probity require individuals to be: - a) Competent and capable (this standard requires individuals to have the appropriate qualifications); - b) Honest, ethical and to act with integrity; and - c) Financially sound. - Institutional obligations before appointing CF/PCF holders: - Confirm, after necessary due diligence, that it is satisfied on reasonable grounds that persons are compliant with the Fitness and Probity Standards. - Obtain those persons’ written agreement to abide by the Fitness and Probity Standards. - Enforcement and consequences: - Failure to comply may lead to refusal of Central Bank approval for PCF appointment; - May lead to an investigation into fitness and probity for persons performing CF/PCF; - May cause that person to be the subject of a prohibition notice under Central Bank Reform Act 2010. - Ongoing oversight: - Board members are assessed in respect of their fitness and probity. - Ongoing oversight of approved PCF holders is managed by the respective supervisory divisions. ### EC5 — Board approval and oversight of strategy, risk appetite, culture, and controls - Supervisory determination: the bank’s Board approves and oversees implementation of the bank’s strategic direction, risk appetite and strategy, and related policies, establishes and communicates corporate culture and values, and establishes conflicts of interest policies and a strong control environment. - Central Bank Corporate Governance Code: - Sets corporate governance requirements in relation to strategy, risk appetite and related policies required of all credit institutions. - Adherence to the Code is monitored on an ongoing basis by supervisors through various supervisory activities. - Institutions must submit an annual compliance statement as set out at Section 25 of the Code specifying whether the institution has complied with the Code. - Corporate culture and values: - The Code does not refer to corporate culture and values explicitly. - Corporate culture and values are reviewed as a PRISM governance risk sub-category; guidance is provided to supervisors for assessment. - Supervisory practices by impact rating: - High and Medium High banks: effectiveness of Board members assessed via review of Board minutes and meetings with Board members; for High Impact banks supervisors may attend Board meetings (supervisors attended a number of Board meetings of all High Impact banks after the financial crisis). - For all High Impact banks: the Deputy Governor (Financial Regulation) and the Director of Credit Institutions Supervision meet with Board members on an ad-hoc basis to discuss issues including strategy implementation (e.g. mortgage arrears resolutions strategy and asset deleveraging). - Medium-Low and Low Impact banks: determination that Boards discharge responsibilities is through receipt and review of an annual compliance statement asserting a self assessment by management; supervisor will meet periodically with the bank but testing through onsite examination or supporting evidence of compliance is not conducted by the Central Bank. - Low Impact banks: entire population are foreign bank branches and do not have a Board. ### EC6 — Fit and proper standards, succession planning, and oversight of senior management - Scope of PCFs and CFs: - There are 41 senior positions which are PCFs, including functions such as CEO, Director or Heads of Compliance, Risk, and Retail Sales. - Central Bank approval required before appointments to these positions. - CFs: functions undertaken by staff who exercise a significant influence on the affairs of the financial service provider, monitor compliance, or perform customer-facing roles; Central Bank approval not required for CF appointments. - Standards of Fitness and Probity: - Issued by the Central Bank and apply to all persons performing CFs or PCFs in regulated financial service providers, including credit institutions. - A regulated financial service provider is not allowed to appoint a person to perform a CF/PCF unless the firm is “satisfied on reasonable grounds” that the person complies with the Standards and has agreed to abide by the Standards. - Standards require persons to be: - a) Competent and capable; - b) Honest, ethical and to act with integrity; and - c) Financially sound. - Corporate Governance Code requirements: - Board shall ensure there is an appropriate succession plan in place; Nominations Committee shall be involved in succession planning for the Board, bearing in mind future demands and existing skills and expertise. - Board shall formally review overall performance, and that of individual directors, relative to the Board’s objectives, at least annually; the review shall be documented. - Supervisory activities to oversee senior management execution of Board strategies: - Meet with Independent Non-Executive Directors; - Meet external auditors; - Evaluate reviews conducted by Boards against strategy. - Ongoing oversight of approved PCF holders is managed by respective supervisory divisions. ### EC7 — Compensation governance and alignment with prudent risk-taking - Compensation requirements: - Introduced in 2011 and apply to credit institutions. - Leading up to implementation, expectations were communicated to banks; a thematic review was performed in 2011 obtaining compensation policies from all banks. - Supervisor’s oversight mechanisms: - Meetings with HR to discuss compensation systems. - Internal Audit reviews: Internal Audit is required to review Remuneration Policies and Practices; examiners ensure reviews are carried out and follow up on issues identified. - Thematic reviews (Remuneration review undertaken in 2011). - Governance Inspection, where remuneration may form part of the review. - Corporate Governance Code requirements on remuneration: - Ensure that the institution’s remuneration practices do not promote excessive risk-taking. - Design and implement a remuneration policy to meet that objective and evaluate compliance with this policy. - Major institutions required to establish Remuneration Committees to establish remuneration policies and procedures based on best practice and any Central Bank requirements. - Supervisor reviews Remuneration Committee’s terms of reference to determine suitability and fitness for purpose. - CRD III requirements: - Irish credit institutions also must comply with remuneration requirements under CRD III. - Article 22 of the CRD, as amended by CRD III, lays down the fundamental principle that institutions ensure remuneration policies and practices are consistent with and promote sound and effective risk management. - Further remuneration requirements of CRD III are included in Annex V, Section 11 and Annex XII, Part 2, point 15 of the CRD. - Considered together, remuneration requirements in the annexes are divisible into three blocks: governance (Annex V), risk alignment (Annex V) and transparency (Annex XII). Proportionality is relevant for all three blocks. ### EC8 — Understanding and oversight of operational structure and transparency risks - Supervisory determination: - Board and senior management know and understand the bank’s and banking group’s operational structure and its risks, including risks from structures that impede transparency (e.g. special-purpose or related structures), via attendance at board meetings, review of board packs, and meetings with board members and senior management. - Management and mitigation of risks determined through ongoing risk assessment of institutions. - Supervisory intensity and scope: - Over recent years, intensity and intrusiveness of meetings increased with greater focus on effectiveness of meetings with the Board of Directors as a mechanism to assess the Board. - No prescribed supervisory cycle within PRISM for onsite meetings with Low Impact banks unless warranted (e.g. FRAs, FRRs to assess corporate governance). - No minimum prescribed supervisory cycle for analysis of organizational structure or use of special purpose vehicles. - For Low Impact banks (i.e. Foreign Bank Branches), the Corporate Governance Code does not apply; assessment is covered by the Home supervisor (legislated for in the CRD). ### EC9 — Supervisory power to require changes in Board composition - Supervisor has the power to require changes in the composition of the bank’s Board if it believes individuals are not fulfilling their duties related to satisfaction of these criteria. *International Monetary Fund — Ireland: selected findings and supervisory descriptions from the Central Bank Reform Act 2010 and Corporate Governance Code, as presented in the source content.* ### Part 3 of the Central Bank Reform Act 2010 has given the Central Bank powers to (inter ### Part 3 of the Central Bank Reform Act 2010: Powers, Fitness & Probity, Corporate Governance and Risk Management ### Central Bank powers under Part 3 - The Central Bank has powers to: - refuse to appoint a proposed director to any pre-approval controlled function where prescribed by the Central Bank pursuant to Part 3 of the Central Bank Reform Act 2010; and/or - suspend, remove or prohibit an individual from carrying out a controlled function where prescribed by the Central Bank pursuant to Part 3 of the Central Bank Reform Act 2010. ### Consequences of failing Standards of Fitness and Probity - Failure by a person to comply with the Standards of Fitness and Probity may (inter alia): - Where the approval of the Central Bank is being sought to permit a person to perform a pre-approval controlled function, lead to approval being refused; - Where a person is performing a controlled function (pre-approval controlled functions are also “controlled functions”), lead to an investigation being conducted in relation to the fitness and probity of that person to perform the relevant function; - Cause that person to be the subject of a prohibition notice under Central Bank Reform Act 2010. ### Additional criterion AC1 — notification requirements - Legal/regulatory requirement: - Banks must notify the supervisor as soon as they become aware of any material and bona fide information that may negatively affect the fitness and propriety of a bank’s Board member or a member of the senior management. - Description and findings: - The online Individual Questionnaire (part of the Fitness & Probity assessment) requires the applicant and proposing entity to undertake to inform the Central Bank of any material changes after submission. - Applicant undertaking text: “I will promptly notify the Central Bank of Ireland of any material changes in the information which I have provided and confirm that I will inform the Central Bank of Ireland in writing of the details of such changes and any other relevant/ material information of which I may become aware at any time after the date of this declaration,” - Proposing entity agreement text: “Please confirm the proposing entity will notify the Central Bank of Ireland without delay of any material change in circumstances that would render the information contained in this application out of date/inaccurate.” - Notifications are forwarded to relevant supervisory divisions for ongoing oversight. - Any director with a material concern about overall corporate governance must report the concern to the Board without delay and, if not satisfactorily addressed within 5 business days, promptly report the concern directly to the Central Bank, advising background and proposed remedial action. This is without prejudice to the director’s ability to report directly to the Central Bank. ### Assessment of Principle 14 (Corporate governance oversight) - Assessment: Largely Compliant - Findings and comments: - The Central Bank’s Corporate Governance Code supplements CRD requirements and addresses elements of this CP. - For High and Medium High Impact banks, supervisory activities provide regular assessment of corporate governance; evidence shows action is taken where institutions breach the Code. - Central Bank has extensive powers regarding fitness and probity of directors and holders of certain senior management positions. - For Medium-Low and Low Impact banks: - Supervisory process is largely reactive, relying on banks’ self-assessment of compliance with the Code. - Unless a red flag is triggered, governance assessments by supervisors are not performed on a regular basis. - For Medium-low and Low banks, the range and frequency of supervisory activities to assess governance is not adequate to assess robustness of governance (EC2). - There does not appear to be an adequate level of attention to senior management’s stewardship and understanding of risk and corporate governance for Low Impact banks (EC8). ### Principle 15 and Essential Criteria EC1 — Risk management process - Principle 15 summary: - Supervisor determines banks have a comprehensive risk management process (including effective Board and senior management oversight) to identify, measure, evaluate, monitor, report and control or mitigate all material risks on a timely basis and to assess adequacy of capital and liquidity relative to risk profile and market and macroeconomic conditions. Includes development and review of contingency arrangements and recovery plans where warranted. Process is commensurate with risk profile and systemic importance. - EC1 requirements for Boards and senior management: - Boards must approve appropriate risk management strategies and set a suitable risk appetite. - Board responsibilities include: - (a) establishing a sound risk management culture throughout the bank; - (b) developing policies and processes for risk-taking consistent with strategy and risk appetite; - (c) recognizing uncertainties attached to risk measurement; - (d) establishing appropriate limits consistent with risk appetite, risk profile and capital strength, understood by and regularly communicated to relevant staff; - (e) ensuring senior management monitors and controls all material risks consistent with approved strategies and risk appetite. - Description and findings re EC1: - Central Bank requires compliance with Irish and EU legislation and guidelines; assesses compliance through periodic risk assessments (including SREP) and thematic reviews. - Regulation 16 of S.I. 395 of 1992 requires every credit institution authorized by the Central Bank to manage its business in accordance with sound administrative and accounting principles and to put in place and maintain internal control and reporting arrangements and procedures. - Frequency and granularity of periodic risk assessments depend on individual banks’ impact scores and evaluation of probability and materiality of risk. - A thematic risk review in 2011 examined seven banks’ risk management frameworks, including strategies, risk appetite statements and culture. - Where deficiencies are found, supervisors raise RMP items outlining required actions and completion deadlines. - Banks must self-certify compliance with the Corporate Governance Code annually (under section 25(1)); non-compliance must be highlighted and remedial actions taken. - Central Bank’s expectations are based on the Code of Corporate Governance, EBA guidelines on Internal Governance (September 2011) and relevant legislation; assessments are conducted as part of ongoing supervisory engagement under the PRISM engagement model. - For High Impact banks: - Key risk management policies are required to be submitted and assessed as part of the Full Risk Assessment and relevant Financial Risk Reviews. - Central Bank evidenced a significantly greater number of activities with covered (High Impact) banks; intensity and intrusiveness were commensurate with complexity and risk. - Supervisors have a range of powers under the Central Bank Acts 1942 to 2010 (for example, issuance of directions to firms to make modifications to systems and controls) to address weaknesses. - Recovery and resolution planning: - Under the Central Bank and Credit Institutions (Resolution) Act 2011 (CBCIR Act 2011), the Central Bank has the power to require a credit institution to produce a recovery plan. - The Act allows the Central Bank to direct an authorised credit institution to prepare a recovery plan setting out actions that could be taken to facilitate continuation or secure the business where the institution is experiencing financial difficulty. - The Central Bank is complying with the EBA’s recommendation on development of recovery plans by specified credit institutions by 31 December 2013. - A supervisory themed review took place in Q3 2011 which looked at the role and effectiveness of the Board Risk Committee. Objectives included: 1. Assess whether the institution’s Risk Committee was adequately fulfilling its role in line with regulatory expectations. *Italic: IMF staff report extract (Ireland), Part of source content unit _cr14135* ### 2. Assess whether in discharging this role, the Risk Committee demonstrably adds ### 2. Assess whether in discharging this role, the Risk Committee demonstrably adds value to the management of risk in the credit institution. ### Regulatory and governance requirements - Corporate Governance Code requirements: - 14(1) The Board shall establish a documented risk appetite for the institution. - 14(3) The Board shall ensure that the risk management framework and internal controls reflect the risk appetite and that there are adequate arrangements in place to ensure that there is regular reporting to the board on compliance with the risk appetite. - 22(3) The Risk Committee shall oversee the risk management function. - 22(4) The Risk Committee shall ensure the development and ongoing maintenance of an effective risk management system within the financial institution that is effective and proportionate to the nature, scale and complexity of the risks inherent in the business. - Code 6(3): “All institutions shall have effective processes to identify, manage, monitor and report the risks to which they are or might be exposed.” - EBA Guidelines on Internal Governance (September 2011) excerpts: - 22(1) Risk management framework shall include policies, procedures, limits and controls providing adequate, timely and continuous identification, measurement or assessment, monitoring, mitigation and reporting of risks at business line and institution-wide levels. - 22(2) Framework should establish and maintain internal limits consistent with risk tolerance/appetite; risk profile should be kept within these limits and breaches escalated and addressed with appropriate follow up. - 22(3) Develop forward-looking and backward-looking tools when identifying and measuring risks. - 22(6) Explicitly address relevant macroeconomic environment trends and integrate assessments into material risk decisions. - 22(7) Regular and transparent reporting mechanisms to provide timely, accurate, concise, understandable and meaningful reports to the management body. - 20(2), 20(3), 20(6): Roles for business units, risk culture, and independent review of risk management framework. - 27(2): CRO responsible for providing comprehensive and understandable information on risks. ### Supervisor expectations and legal instruments - Regulation and supervisory obligations: - Regulation 16 of S.I. 395: every credit institution authorized by the Central Bank must manage its business in accordance with sound administrative and accounting principles, and put in place and maintain internal control and reporting arrangements and procedures. - Regulation 66(4) of S.I. 661 of 2006 governs frequency of ICAAP submissions based on: - The nature, size and systemic importance of the credit institution. - The outcome of the credit institution’s most recent SREP. - Any changes to the credit institution’s governance arrangements or business. - The consequence of any merger or acquisition activity to which the credit institution might be exposed. - Central Bank Fitness and Probity Regime came into effect on 1 December 2011. - Central Bank arrangements: - Dedicated teams: Credit, Treasury, Risk Analytics (Quantitative Models Unit) and Business Model Analytics monitor Business, Credit, Liquidity and Market Risk and Interest Rate Risk in the Banking book. - Level of monitoring varies by size, scale, complexity and PRISM impact rating. - PRISM engagement model: higher intensity for covered and High Impact banks; Medium-Low and Low use compliance statement tools and SAQ in ICAAP. ### Supervisor findings and activities (EC2 — EC6) - EC2: Supervisor requires banks to have comprehensive risk management policies and processes to identify, measure, evaluate, monitor, report and control or mitigate all material risks. Supervisor determines adequacy: - (a) to provide a comprehensive “bank-wide” view of risk across all material risk types; - (b) for the risk profile and systemic importance of the bank; - (c) to assess risks arising from the macroeconomic environment affecting the markets in which the bank operates and to incorporate such assessments into the bank’s risk management process. - EC2 description and evidence: - Corporate Governance Code 6(3) and EBA Guidelines (September 2011) expected compliance. - Regulation 16 of S.I. 395 requires sound administrative/accounting principles and internal controls. - Central Bank performs PRISM risk assessment, thematic reviews, and focused reviews on material risks. - Example: supervisory themed review in Q3 2011 on role and effectiveness of Board Risk Committees and risk management policies. - Example findings: one bank lacked risk management processes/policies for credit concentration risk and interest rate risk in the banking book; two supervisory measures imposed in 2010 remained until issues addressed; 2011 on-site inspection found insufficient understanding of these risks at subsidiary level. - EC3: Supervisor determines that risk management strategies, policies, processes and limits are: - (a) properly documented; - (b) regularly reviewed and appropriately adjusted to reflect changing risk appetites, risk profiles and market and macroeconomic conditions; - (c) communicated within the bank. - Exceptions receive prompt attention and authorization by appropriate management and Board where necessary. - EC3 description and evidence: - Central Bank performs financial risk reviews, full risk assessments and thematic reviews focused on material risks or signals. - Probability risk ratings updated on an ongoing basis; supervisors assess completeness, quality and appropriateness of risk management policies, strategies and limits during updates. - Banks required to submit annual statement of compliance with the Corporate Governance Code; Central Bank reviews and follows up with regulatory action where deviations identified. - Actions to assess communication and handling of exceptions include: - Review of internal reporting (CRO reports) focusing on material exceptions advised to Board. - Compliance reporting. - Internal audit reports. - Operational risk logs to identify non-compliance issues. - Onsite interviews with personnel across levels to assess knowledge and understanding. - Policies reviewed during onsite reviews; example: operational risk policies (outsourcing, new product approval and business continuity) of one bank were reviewed and many found inadequate or out-dated. - Medium-Low impact banks: similar approach with less intensity; ICAAP assessment requires SAQ and copy of risk appetite and business strategy; PRISM minimum engagement model relies on compliance statement for EC assessment; limited analysis and verification unless exceptions self-reported. - EC4: Supervisor determines Board and senior management obtain sufficient information and understand the nature and level of risk and how this relates to capital and liquidity; they regularly review and understand implications and limitations (including risk measurement uncertainties) of risk management information. - EC4 description and evidence: - Corporate Governance Code section 14(3) requires regular reporting to Board on compliance with risk appetite; section 6(3) requires effective processes to identify, manage, monitor and report risks. - EBA Guidelines 22(7) require timely, accurate, concise and meaningful reporting to management body. - Central Bank liquidity management requirements place onus on senior management to provide Board and ALCO with relevant and timely liquidity information; liquidity reporting to Board/ALCO should be carried out more frequently in times of stress (section 3(2)(2)). - ICAAP expectations per EBA Guidelines on Pillar 2 (GL03): ICAAP should enable banks to assess capital adequacy relative to risk profile and be integral to decision-making. - Supervisory review of Board/committee packs: requested and reviewed more frequently for covered banks; deficiencies in management information and board reporting found in a number of banks and addressed via RMP actions and supervisory measures. - Evidence of supervisors’ analysis of Board packs and routine meetings (e.g., with Independent Non-Executive Director and Chair) as part of PRISM. - Integration of risk assessment with liquidity and capital most evident in covered and High Impact banks; summary ICAAP (SAQ) submissions received less detailed assessment. - EC5: Supervisor determines banks have appropriate internal process for assessing overall capital and liquidity adequacy relative to risk appetite and profile; supervisor reviews and evaluates internal capital and liquidity adequacy assessments and strategies. - EC5 description and evidence: - Capital: - Central Bank expects ongoing ICAAP assessment. - Frequency of ICAAP submission governed by Regulation 66(4) of S.I. 661 of 2006 (criteria listed above). - Central Bank completed two PCARs (2010 and 2011) for the Irish covered banks; PCAR assessed capital requirements for expected base and potential stressed loan losses and other financial developments over a 3 year time horizon. - PCAR exercise to be completed in 2013 in conjunction with the EBA stress tests. - Liquidity: - Central Bank established requirements for management of liquidity risk (June 2009). - All banks required to produce regular reporting returns covering capital adequacy and allocation, liquidity and solvency; supervision teams review and query anomalies/erroneous movements. - Treasury Team receives daily liquidity reports from covered and large wholesale banks. - Specialist liquidity team conducts thematic reviews: ALCO thematic review and review of behavioural assumptions applied by 7 banks conducted in 2012; transfer pricing and deposit behaviour review completed Q1 2013; market risk review conducted in 2011. - EC6: Where banks use models to measure components of risk, supervisor determines that: - (a) banks comply with supervisory standards on their use; - (b) Boards and senior management understand limitations and uncertainties of model outputs; - (c) banks perform regular and independent validation and testing of models. - Supervisor assesses whether model outputs appear reasonable as a reflection of assumed risks. - EC6 description and evidence: - Central Bank model validation reviews determine that banks comply with supervisory standards on model use. - Central Bank determines that Boards and senior management have appropriate understanding of use and limitations of internal models used for regulatory capital determination. ### Examples of supervisory actions and outcomes - Thematic review on Board Risk Committees: Q3 2011. - Supervisory measures imposed in 2010 on a bank lacking credit concentration and IRRBB policies; follow-up on-site inspection in 2011 found insufficient subsidiary-level understanding. - PCAR exercises completed in 2010 and 2011; PCAR to be completed in 2013 with EBA stress tests. - Thematic liquidity reviews: ALCO and behavioural assumptions review in 2012; transfer pricing and deposit behaviour review in Q1 2013; market risk review in 2011. - Review findings include inadequate or out-dated operational risk policies in at least one bank. *Source: _cr14135 - 2. Assess whether in discharging this role, the Risk Committee demonstrably adds value to the management of risk in the credit institution.* ### 3. Banks are required to perform regular and independent validation and testing of ### 3. Banks are required to perform regular and independent validation and testing of ### Validation and supervisory assessment - Banks are required to perform regular and independent validation and testing of their internal models. - The supervisor, in conjunction with the Central Bank’s Quantitative Model review team, assesses whether the model outputs "appear reasonable as a reflection of the risks assumed." - A regulatory Notice was issued by the Central Bank in December 2006 outlining policy and procedures for institutions applying to use the IRBA for calculation of regulatory capital for credit risk pursuant to Directive 2006/48/EC and Directive 2006/49/EC (the CRD). - The Central Bank challenges banks’ model processes as outlined by the banks and determines whether they "is adequate." Supporting evidence was provided during the mission. ### Pillar I models: approval, review scope, and criteria - Approval process follows the CRD; model performance is reviewed on a yearly basis for high impact banks. - Current practice: - Yearly review is limited to the covered banks and two international subsidiary banks (with significant Irish retail exposures). - Not all banks’ internal models are reviewed at the same yearly frequency. - For all other banks (all international banks), once a model is approved, no further formal reviews are carried out on an ongoing basis (including ongoing assessment of Board and senior management understanding of models). - Home regulators perform their own monitoring of centrally developed models. - Decision criteria for periodical [ongoing] reviews of a bank’s Pillar 1 IRB models depend on: - (a) whether the Central Bank is a consolidating or host supervisor, - (b) whether the models are centrally or locally developed, and - (c) whether central or local data have been used. - Ongoing reviews mainly focus on: - (a) banks where the Central Bank is the consolidating supervisor, and - (b) host institutions where models are calibrated to Irish experience (and the institution has material retail exposures in Ireland). - Specific Central Bank position for host institutions under IRB: - The Central Bank will only exercise its obligation to feed into the "joint decision" process (provided under Article 129(2) of the CRD) where the institution has material exposures in Ireland. - The Central Bank will rely on the home supervisor to ensure adequacy of models used for regulatory capital purposes (Pillar 1) where the institution is lower-impact. - The review [as part of the model approval process] of centrally developed models used by host institutions for their non-retail exposures shall only focus on: (a) model governance, (b) the use test, (c) senior management understanding, and (d) impact from regulatory capital and solvency ratio perspective. ### Supervisory approach, frequency, and depth - Reviews are conducted in accordance with the Central Bank’s overall supervisory framework, taking into account the proportionality principle. - Reviews consider the Credit RWA Supervisory Framework/procedures for IRB model performance reviews developed by the Central Bank’s Risk Modeling Unit. - Frequency and depth of individual reviews consider the proportionality principle (PRISM impact rating of the relevant institution). - All material approved models used by banks where the Central Bank is a consolidating supervisor, and those used by host institutions for their Irish retail exposures, are reviewed on an annual basis. ### Coverage of IMA and AMA models - Currently, there is only one institution using the IMA approach to market risk. - No home institution has so far been approved to use AMA for operational risk. - At present, five host institutions use the AMA for operational risk. - When a host institution applies to use a group AMA on an allocation basis, the Central Bank is required to ensure that local staff of the host institution have good knowledge of the group model and the allocation process. - Approval of AMA models to be used by subsidiaries based in Ireland is done taking into account the provisions of Article 129(2) of the CRD; the Central Bank has a right to feed into the Joint decision process. ### Pillar II models and ECAP - For Pillar II models, the Central Bank assesses model reasonableness by comparison with the output of its own Central Bank models (if available) or by expert judgment if unavailable. - This assessment is generally carried out as part of the SREP process and, at its most frequent, is completed on a yearly basis. - Home regulators of international banks under the Central Bank’s supervision perform their own monitoring of centrally developed models. - The Central Bank does not grant regulatory approval for use of Pillar 2 models/Economic Capital Models. - Where a bank uses output of such models to inform allocation of capital to specific risk types as part of the Pillar 2 process, the Central Bank reviews the outputs and underlying assumptions. - The review of ECAP models, normally done as part of the ICAAP review process, aims to determine the degree of reliance the Central Bank places on the bank’s outputs in determining Pillar 2 capital add-ons. - The output of the Central Bank’s "capital toolbox" together with its view on the bank’s general model assumptions and model parameters feed into the decision on whether to rely on the bank’s own ECAP estimates. ### Credit model supervision and on-site file inspections - The Credit Team conducts regular on-site inspections in credit institutions to review samples of borrower loan files as part of the ongoing Banking Supervision engagement plan. - The Credit Team uses a risk-based approach and selects loan files of borrowers with higher risk credit grades, i.e., watch risk and impaired risk. - On-site review includes checking pertinent customer data such as the most recent credit reports, up-to-date financial information, and collateral valuation reports. - Primary objectives of on-site loan file inspections: - i. Assess the reliability of a credit institution’s credit grading system by reviewing credit grade model outputs to check that internal credit risk rating systems reflect borrower exposure credit risk profiles. - ii. Assess the adequacy of impairment provisions by reviewing DCF model inputs and outputs for exposures classified as impaired risk to evaluate provision calculations and check sufficiency to absorb likely loan losses based on point-in-time data. - The Credit Team completes an individual Credit Review template for all loan files examined. - On completion of on-site loan file reviews, the Credit Team completes a Summary Report outlining review findings with recommendations where appropriate to strengthen credit controls and mitigate identified risks. - Deficiencies in credit grading reliability or DCF model outputs (provision adequacy) are reflected in the Summary Report. - The Summary Report is forwarded to the relevant Supervisory Team; on receipt, a RMP is agreed with Banking Supervision management. - Supervisors may meet with the CRO / CCO and CEO of the bank to discuss review findings and obtain feedback to refine supervisory conclusions. *Source: _cr14135 (excerpt provided).* ### conclusions. A post-review letter is then sent to the credit institution addressed to the CEO ### _cr14135 - conclusions. A post-review letter is then sent to the credit institution addressed to the CEO ### Post-review communication and follow-up - A post-review letter is sent to the credit institution addressed to the CEO to formally communicate significant findings and to highlight credit control weaknesses identified during the review. - The letter outlines risk mitigation actions required and a time line for the completion of the actions. - The bank is required to respond with an appropriate action plan to address the review findings. - The RMP is uploaded to PRISM to ensure timely follow up and tracking. ### Testing of Board and Senior Management understanding at application stage - Banks are required to carry out a self-assessment of quality of senior management understanding of models as part of application for approval of new IRB models. - The Central Bank carries out an onsite assessment of the level of senior management understanding of rating systems by interviewing specific senior management within the relevant institutions. - The overall assessment of senior management understanding feeds into the assessment of the use test and the decision on whether to approve the relevant models or on the conditions to be placed on approval of such models. - Example interviewees for one institution seeking IRB approval included: - Head of Business; - Member of the designated approval committee; and - Divisional head of credit. - Key elements of rating systems considered included: - (a) IRB concepts, - (b) use of ratings, - (c) key material drivers of PD, LGD and Cash Flow, - (d) discriminatory power of the model, - (e) model life cycle, - (f) IRB stress testing, and - (g) challenge and model weaknesses (amongst others). - Where the Central Bank was not satisfied with the level of understanding, it recommended conditions on permission requiring improvement of the senior management understanding program in terms of scope, frequency and depth of training provided, with a specific timeframe, to demonstrate compliance with the requirements for senior management understanding in Annex VII, Part 4 of the CRD. ### Ongoing review of senior management understanding - As part of the Central Bank’s Pillar II reviews, the Central Bank seeks to ensure that Board/Senior management have an appropriate knowledge of models, including an understanding of their limitations and uncertainties relating to the output of the models and the risk inherent in their use. ### Case example: F-IRB application (Autumn 2011) - A bank applied for permission to use an F-IRB model to calculate their Pillar I charge for their branch banking Ireland portfolio. - The bank submitted documentation as required under the CRD and the Central Bank consulted with the bank via face-to-face meetings, conference calls and emails. - Approval for use of the F-IRB method was given on the condition that: - their process around calculating downturn Loss Given Defaults (LGDs) was improved, and - a review of the factor weights in their Probability of Default (PD) models was carried out. - To date, the bank is not yet using F-IRB for this portfolio. ### EC7 — Information systems for risk measurement, assessment and reporting - EC7 summary: The supervisor determines that banks have information systems that are adequate (both under normal circumstances and in periods of stress) for measuring, assessing and reporting on the size, composition and quality of exposures on a bank-wide basis across all risk types, products and counterparties, and that these reports reflect the bank’s risk profile and capital and liquidity needs, provided on a timely basis to the bank’s Board and senior management in a form suitable for their use. - Applicable guidance and requirements cited: - EBA Guidelines on Internal Governance section 30(1) and 30(2). - Corporate Governance Code section 14(6). - Central Bank’s 2009 requirements for the management of liquidity risk section 3(4). - Central Bank actions and tools: - Developed a new IT framework and assessment methodology rolled out within the last two months. - Framework provides a structured approach for reviewing IT capability of banks and includes an in-depth online assessment tool used to challenge senior bank management. - Framework encompasses review of IT policies and procedures and IT internal audit reports. - Supervisors evaluate capability to produce close to real-time management information across portfolios to aggregate total exposure positions. ### EC8 — New product approval and Board/senior management understanding of new risks - EC8 summary: The supervisor determines that banks have adequate policies and processes to ensure that the banks’ Boards and senior management understand the risks inherent in new products, material modifications to existing products, and major management initiatives, and that these activities require approval by their Board or a specific committee where appropriate. - Applicable guidance and requirements cited: - EBA Guidelines on Internal Governance (GL44) section 23: institutions shall have a well-documented New Product Approval Policy (“NPAP”) approved by the management body; NPAP should cover considerations before entering new markets, products or services; NPAP should set out main issues to be addressed; risk control function should be involved in approving new products or significant changes. - Corporate Governance Code section 11(3). - Central Bank expectations and practices: - Requires institutions to have a well-documented NPAP approved by the management body and that risks inherent in new products or changes be set out and subject to a multidisciplinary review. - It is not a prerequisite that the Board or a subcommittee approve all new products; however, Central Bank requested that significant new products be signed off by the Board or a nominated subcommittee in an RMP example. - Example: new advanced forbearance mortgage products launched by banks were approved by the boards of the relevant banks. - Compliance monitored through corporate governance reviews, vetting of new directors and senior managers via the fitness and probity regime, annual compliance statements under section 25(1), and PRISM engagement activities. - New product approval processes are assessed as part of the assessment of banks’ operational risk framework using Banking Supervision’s Operational Risk Assessment Methodology; review frequency depends on whether a signal of risk exists. ### EC9 — Risk management functions covering all material risks - EC9 summary: The supervisor determines that banks have risk management functions covering all material risks with sufficient resources, independence, authority and access to the banks’ Boards, clearly segregated from risk-taking functions, reporting directly to the Board and senior management, and subject to regular internal audit review. - Central Bank practices and findings: - Reviews risk management functions to determine skill sufficiency, delineation between first and second lines of defense, and access to Boards via meetings with relevant personnel (including CRO) and review of risk committee and executive minutes. - For covered banks, supervisors attend Risk Committee meetings and credit review meetings to validate independence, authority and ability of the Risk function. - Supervisors of all High Impact institutions meet with the Internal Auditor at least once a year, focusing on the annual audit plan and scope including the risk management function. - Corporate Governance Code requires the bank’s system of governance be subject to regular internal review (6(3)). - Guidelines on the Application of the Supervisory Review Process under Pillar 2 identify the need for a risk control function in large, complex and sophisticated institutions to monitor each material risk. - Central Bank requires a risk control function proportionate to the nature, scale and complexity of the institution and adherence to Section D part IV of the EBA Guidelines on Internal Governance (GL 44). - Regular engagement with CROs provides assessment opportunities; onsite risk activities FRR and FRA processes are also used to assess adequacy of resources, authority and independence. ### EC10 — Dedicated risk management unit and CRO oversight - EC10 summary: The supervisor requires larger and more complex banks to have a dedicated risk management unit overseen by a Chief Risk Officer (CRO) or equivalent function; removal of the CRO should be with prior Board approval and generally publicly disclosed, and discussed with the supervisor. - Central Bank expectations and guidance: - Corporate Governance Code requires governance structures to be sufficiently sophisticated given the nature, scale and complexity of the business (6(4)) and robust governance arrangements including clear organisational structure, effective processes to identify, manage, monitor and report risks, adequate internal control mechanisms, IT systems and controls, remuneration policies aligned with risk management, and regular internal review (6(3)). - Guidelines on the Application of the Supervisory Review Process under Pillar 2 (GL03) state the risk management function should be central, structured to implement risk policies and manage risk; large, complex and sophisticated institutions could consider risk management functions to cover each material business line. *IMF staff summary based on the provided content unit.* ### Section 13.7 of the Central Bank’s Corporate Governance Code requires that removal from ### _cr14135 - Section 13.7 of the Central Bank’s Corporate Governance Code requires that removal from ### Removal of Controlled Function Heads and PCF resignation reporting - Section 13.7 requires that removal from office of the head of a Controlled Function (including the CRO) shall be subject to prior Board approval. - The Central Bank does not require public disclosure of such removals, but: - A record of the removal is maintained by the Central Bank and will be taken into account if the person later seeks appointment to a pre-approval role. - CRO is deemed a PCF under the Central Bank’s fitness and probity regime; a comprehensive assessment is conducted prior to issuing a letter of non-objection to appointment. - When a person who holds a PCF resigns (including in the case of removal), the following information must be provided to the Central Bank: - Full name of person resigning - Financial Service Provider name and number - PCF held - Date of resignation - Reason given for resignation (including copy of resignation letter) - Contact details for person resigning, including email address and postal address (The Central Bank may contact PCF who have resigned in the course of regulation of Financial Service Providers) - Contact details for Financial Service Provider ### EC11 – Supervisory issuance of standards (credit, market, liquidity, operational risk) - Findings: - The Central Bank has issued numerous standards and guidance covering credit risk; market risk; operational risk; Corporate Governance; liquidity risk; and capital. - Institutions must ensure operations are consistent with all EBA guidelines unless otherwise instructed (as outlined in the Central Bank’s notice “Implementation of the CRD” (28 December 2006, as amended January 2011)). ### EC12 – Contingency arrangements and business continuity (BCP) - Requirements and guidance referenced: - BCBS “Sound Practices for the Management of Operational Risk” (Principle 7) and BCBS High Level Principles for Business Continuity (August 2006). - EBA Guidelines on Internal Governance Section E(31) — key requirements include establishing sound business continuity management, quantitative and qualitative analysis of exposure to severe business disruptions, documented contingency/business continuity/recovery plans, and ensuring residual risk aligns with risk tolerance/appetite. - Supervisory practice and findings: - Supervisors assess contingency arrangements typically as part of thematic operational risk reviews; frequency increases if signals of risk are identified. - Banking Supervision’s Methodology for the Assessment of Operational Risk outlines signals of business continuity risk and expected mitigants. - The quality and depth of BCP analysis in routine offsite supervision was insufficient; scarcity of regular routine reports on continuity arrangements limited monitoring—regime was largely exception-based after an event. - Onsite review of business continuity is assessed as part of operational risk within the FRR/FRA; thematic approach meant not systematic in identifying higher inherent risk banks. - Following a recent systems issue at a major bank, retail banks were required to review BCPs and examine risk of similar issues; operational risk and IT risk assessments have been completed in many banks and are being rolled out further. - Conclusion: Onsite reviews largely reactive; systematic testing and evaluation of continuity arrangements remains incomplete. ### EC13 – Stress testing programs and supervisory assessment - Legal and supervisory framework: - CRD Annex VII, Part 4 (2006/48/EC - Points 40-42) requires sound stress testing processes for capital adequacy assessment. - Annex V of CRD (2006/49/EC - 2G) details stress test coverage (illiquidity, concentration, one-way markets, event/jump-to-default risks, non-linearity, deep out-of-the-money positions, gapping of prices). - Central Bank Stress Testing and Capital Planning Supervisory Framework is an in-house implementation of EBA GL 32 and best practice; applies proportionality principle. - S.I. 661 of 2006 transposes CRD stress testing requirements into Irish law. - EBA GL32 and EBA Guidelines on Internal Governance referenced. - Framework expectations (firm obligations): - (a) promotes risk identification and control on a firm-wide basis: - Stress testing conducted on a firm-wide basis covering market, credit, operational and liquidity risks. - Explicit coverage of complex and bespoke products and portfolio-specific stress tests. - (b) adopts suitably severe assumptions and addresses feedback/system-wide interactions: - Stress testing based on exceptional but plausible effects; incorporate system-wide interactions and feedback effects; range of severities including severe economic downturns; reverse stress tests encouraged. - Scenario considerations include collateral valuations; trading strategies; market disturbance/breakdown in correlations; failure of hedging techniques; illiquid markets; major systems/process/people failures. - (c) benefits from active involvement of Board and senior management: - Evidence of senior management participation; candid discussion on modeling assumptions between board and risk managers; stress testing actionable and integrated into decision-making; Stress Testing Committee involvement where present. - (d) is appropriately documented and regularly maintained: - Written policies and procedures; regular review and assessment for fitness of purpose. - Supervisory assessment and practice: - Supervisor requires corrective action if material deficiencies are identified or results not taken into account in decision-making. - Central Bank focuses on model outputs, reviews macro-economic factors and performs peer comparisons (including PCAR 2011 scenarios). - Monitoring involves desk-based review (framework documents, internal results, gap analysis against GL 32, committee terms of reference) and on-site work (governance, implementation, scenario formulation, translation, quantification, use of outputs). - Risk Modeling Unit developed a Stress Testing and Capital Planning Framework for consistency. - PRISM assessment of capital risk includes: quality of stress testing process; role in capital/business planning; feasibility of contingency measures. ### EC14 – Internal pricing, performance measurement, new product approval - Supervisory measures to assess bank practices: - Business Model Reviews for High Impact firms (every 2 years) assess accounting for risk in internal pricing. - Remuneration Reviews (2010 and 2011) considered inclusion of risk in performance measurement. - Operational Risk Reviews assess new product approval under criteria of completeness, quality, and effectiveness (including involvement of IT, risk, business lines; testing; internal audit). - Regulatory/guidance framework: - EBA Guidelines on Internal Governance (Section 23) require formalized new product approval, involvement of risk control functions, and compliance verification. - BCBS Principles: Management of Credit Risk (Principle 3) and Principles for Sound Liquidity Risk Management and Supervision (September 2008, Principle 4) require incorporation of liquidity costs/risks in internal pricing and new product approval. - Performance measurement: - New legal requirements on remuneration from amended CRD effective 1 January 2011, supplemented by EBA guidelines; Central Bank required banks to ensure compliance and carried out a Remuneration Review in 2011. ### AC1 – Policies/processes for other material risks (reputational, strategic) - Legal basis: - Article 123 of Directive 2006/48/EC (CRD) requires sound strategies/processes to assess and maintain internal capital for risks faced. - Corporate Governance Code requires robust governance, effective processes to identify/manage/monitor/report risks, adequate internal controls, IT systems and controls. - Supervisory practice: - SREP process and ICAAP review assess processes around all material risks. - Reputational and strategic risks considered in Business Model Reviews, including evaluation of strategy, business plan assumptions, determination of earnings at risk, and impact of reputational issues. ### Assessment of Principle 15 (Risk management) — Largely Compliant - Findings and limitations: - Central Bank determines banks have a comprehensive risk management process via on- and off-site supervision in line with PRISM. - Supervisors evaluate adequacy of risk strategies, policies, processes and limits through periodic risk assessments, FRAs and FRRs. - Dedicated onsite teams exist for Credit, Treasury, Risk Analytics (Quantitative Models Unit & Portfolio Analytics and Stress testing unit) and Business Model Analytics; specialist team for operational risk does not exist, though an operational risk methodology has been developed and rolled out. - Onsite business continuity reviews are largely reactive; range of qualitative and quantitative information insufficient to reliably monitor business continuity on an ongoing basis; systematic approach to test/evaluate continuity arrangements incomplete. - Monitoring frequency is determined by PRISM impact rating; for High Impact banks coverage is adequate; for Impact rating less than High, reviews performed via FRA with minimum frequency between 2-4 years. - Model performance reviews conducted annually for high impact firms: 5 of the 14 institutions with regulatory approval to use internal models receive annual performance reviews; for the remaining 9 institutions, reliance on parent/home supervisor assurances is used. ### Principle 16 (Capital adequacy) — Key findings across EC1–EC5 - EC1 — Definition and calculation of capital - Capital defined under CRD as transposed by Irish statutory instruments (primarily S.I 661 of 2006, Regulations 3-11). - CBI defines CT1 in line with EBA definition of April 2011 for stress testing purposes; when setting 10.5% CT1 requirement in 2011, CBI defined CT1 consistent with regulatory policy on Alternative Capital Instruments (ACIs). - CRR capital rules to apply from 1 January 2014; instruments issued must be “forward-proofed” to meet CRR requirements. - Hybrid capital instruments with incentive to redeem treated as innovative and limited to a maximum of 15% of total Tier 1 under S.I. 661 of 2006. - Non-Cumulative preference shares considered hybrids; non-innovative may account for a maximum of 50% of total Tier 1; not included in CT1 except in specific emergency state aid circumstances (applicable to Irish covered banks) which cease to count as CT1 post-2017 (end of grandfathering period). - Prudential filters: banks required to filter out fair value reserves related to cash flow hedges on amortized cost instruments and gains/losses on liabilities measured at fair value due to own credit standing; CEBS Guidelines for Prudential Filters applied. - Deductions entirely from Tier 1: intangible assets; own shares at book value held by the institution, and losses (material or otherwise) of the financial year. - 50:50 deductions (50 percent from Tier 1 and 50 percent from Tier 2) include holdings in other credit/financial institutions above thresholds; participations in insurance undertakings; IRB Provision shortfall and IRB equity expected loss amounts; securitization exposures not included in RWA. - EC1 — Minimum capital requirements - Minimum total capital ratio: 8%, incorporating minimum ratio of 4% Tier 1 to RWA. - Of the 4% Tier 1, at most half may comprise hybrid capital instruments which convert into Article 57(a)-compliant instruments at issuer initiative or in emergency situations. - Within hybrid limit: no more than 35% may be instruments without convertibility but without incentive to redeem; no more than 15% may be instruments with an incentive to redeem. - Up to 50% of Tier 2 may comprise dated subordinated debt and fixed term cumulative preference shares. - Basel I capital floors using an adjustment factor of 80% or higher continue to be applied to Irish banks using IRB/AMA approaches. - All banks required to meet minimum requirements on a solo basis unless waived by CBI. - Minimum “Initial Capital” required is €5m or higher, as specified by the CBI, comprising fully paid-up shares or reserves (Article 57(a) and (b) of 2006/48/EC). - Authorization is iterative between Central Bank and applicant; CBI may exempt institutions from initial amounts for a specified period to rectify or arrange orderly cessation/winding-up. - EC4 — Risk/profile/systemic importance and additional requirements - CBI has powers to apply higher minimum ratios as a condition of license or as Pillar 2 measures. - Three High Impact banks subject to FMP minimum consolidated CT1 ratio of 10.5% until at least the end-2013 (applied as minimum requirements rather than capital add-ons). - EBA December 2011 Recommendation requires a 9% CT1 amount (EBA stress test definition) once CRR is in effect. - For PCAR banks, the 8.25% Core Equity Tier 1 trigger (calculated using national Basel III phase-in rules) in Tier 2 CoCos will constitute the minimum capital requirement. - Average CT1 ratio for the three banks was c.14.67% at June 2013. - CBI imposed PCAR additional capital requirement of €18.7bn across four banks to meet target of 10.5% CT1 in the base and 6% CT1 in the adverse scenario. - CBI added further capital 'buffer' of €5.3bn across the four banks. - CBI applied conservative assumptions and additional capital floors ranging from 80% to 100% of Basel 1 capital requirements; LDR targets and deleveraging targets applied under Regulation 70 of S.I. 661 of 2006. - Risk weights: Standardized Approach applies 35% risk weight for owner-occupier residential mortgages with LTV < 75%; speculative commercial real estate may be risk weighted at 150%. - EC5 — Use and approval of internal models - CBI has internal model validation review process for market and credit risk models; process for AMA (operational risk) much less tested due to low usage. - No consolidated Irish licensed bank has applied for, or been approved for, AMA. - Annual model performance review (IRBA) conducted by Risk Modeling Unit with Examination Team; covers approved internal models used by home institutions where CBI is consolidating supervisor and host institutions with significant retail presence (models developed using Irish relevant data). - Article 129 of CRD / Regulation 67(2) of S.I. 661 of 2006 requires group-basis application for internal model approval; Irish licensed banks may apply to CBI when it is home supervisory authority; subsidiaries of EU parent may use internal models where approval granted under “Joint Decision.” - Qualifying standards referenced: CRD Article 84(2) (Regulation 29(3) of S.I. 661 of 2006) requires IRBA approach be “sound and implemented with integrity” and meet further article requirements. *Italic: Excerpt from Section 13.7 and related sections of the Central Bank review in the provided IMF document.* ### Annex VII part 4 are met. These requirements apply to all institutions and may not be ### _cr14135 - Annex VII part 4 are met. These requirements apply to all institutions and may not be ### Scope and applicability - Annex VII part 4 are met. These requirements apply to all institutions and may not be abrogated in full or in part by supervisors, except where explicitly permitted by the CRD. - Approval to use the AMA can be given only if the competent authority is satisfied that the institution’s systems for measuring operational risk meet the qualifying criteria in Article 310, Chapter 1, and Tittle III of CRD. ### Regulatory authorities and powers - Regulation 51 of S.I. No. 661 of 2006 sets out the CBI’s powers to allow credit institutions to use the AMA for operational risk capital requirements. - Annex X, part 3 of the CRD (2006/48/EC) sets out the qualifying criteria for AMA, including both qualitative and quantitative requirements. ### Key terms and references - AMA (Advanced Measurement Approaches) - CRD (including references to Article 310, Chapter 1, and Tittle III) - CBI (Central Bank as referenced via Regulation 51 of S.I. No. 661 of 2006) - Annex VII part 4; Annex X, part 3 (CRD (2006/48/EC)) *Source: _cr14135 - Annex VII part 4 are met. These requirements apply to all institutions and may not be — PDF chapter/section.* ### Annex V of Directive 2006/49/EC as amended allows for the CBI to grant approval for banks ### _cr14135 - Annex V of Directive 2006/49/EC as amended allows for the CBI to grant approval for banks ### Annex V and CBI internal model approval framework - Annex V of Directive 2006/49/EC (as amended) allows the CBI to grant approval for banks to calculate capital requirements for position risk, foreign-exchange risk and/or commodities risk using their own internal risk-management models. - Annex V sets out eligibility criteria relating to quantitative and qualitative criteria. - The CBI has developed internal model policies, implementation notices, and model application packs setting out its requirements and processes for internal model use relating to credit, market and operational risk. ### Model validation review (CRD/VR/1.2) - The model validation review process consists of 7 stages which an applying institution must comply with. - Institutions must have documented policies and procedures to support their internal model framework. - The CBI assesses and challenges the robustness of each of the 7 stages during its review. - The framework applies to credit, market and operational risk; it is much less tested for operational risk given the low level of AMA use within Irish licensed institutions. ### IRBA regulatory model approval and conditions (Article 84 of the CRD (2006/48/EC)) Approval is granted with detailed conditions covering: - Scope of permission for internal model use – legal entities, exposure classes, permanent and temporary exemptions, exclusions of use. - Capital requirements – legal powers under which capital requirements should be, supervisory minimum floors applied, consolidated capital reporting and permanent exemptions for portfolios using the standardised capital rules. - Prerequisites – conditions to be satisfied before permission to use the internal models approach. - Ongoing requirements – model specific elements, including terms and conditions and a general requirement for institutions to report any significant model changes to the Central Bank on an ongoing basis. - Joint decisions (Article 129 of the CRD) could contain group-specific or nation-specific terms and conditions. ### Ongoing review focus areas and recent activity The ongoing review of credit risk models covers three broad areas: - (a) parameter appropriateness, - (b) deployment of regulatory capital calculation process, - (c) RWA forecasting. Parameter appropriateness: - Assessment of reasonableness of inputs and outputs (PDs, Exposure at Defaults (EADs), LGDs, etc.). Deployment quality: - Assessment of governance, ownership and testing of the end-to-end capital calculation process. Performance monitoring: - The last IRB model performance review was presented to the RGP in December 2012 and remedial actions were communicated to the banks; actions are being tracked and all are due for closure by the end of the year. - Ongoing review focuses on the three institutions where the CBI is the consolidating supervisor and the two institutions with significant retail presence in Ireland. ### Market risk models and back-testing - Banks with approval to use an internal value-at-risk model must submit details of any back-testing exception within 5 working days of occurrence. - In practice, the CBI assesses 500 days of back-testing data during the model validation review stage. - Under paragraph 8 of annex V of CRD II the Central Bank can revoke market risk model recognition or impose measures if numerous over-shootings indicate the model is not sufficiently accurate. - In practice, the CBI applies add-on factors for both qualitative and quantitative weaknesses. Enforcement for IRBA non-compliance: - If a bank ceases to comply with IRBA requirements, Regulation 29 of S.I. 660 of 2006 requires the bank to either present a plan for a timely return to compliance or demonstrate that the effect of non-compliance is immaterial. - A proposal to revoke an Article 129(2) decision can be made by the consolidating supervisor, a host supervisor, or the institution; revocation requires joint agreement of the consolidating supervisor and host supervisors or, absent agreement, may be made by the consolidating supervisor alone. A host supervisor cannot revoke an Article 129(2) decision acting on its own. - The CBI can direct a bank to cease using an IRBA model for regulatory capital purposes if found not fit for purpose via annual model performance review or ad-hoc analysis. ### EC6 — Forward‑looking capital management and stress testing Supervisor powers: - The supervisor has the power to require banks to adopt a forward-looking approach to capital management (including the conduct of appropriate stress testing). - The supervisor can require banks: - (a) to set capital levels and manage available capital in anticipation of possible events or changes in market conditions that could have an adverse effect; and - (b) to have in place feasible contingency arrangements to maintain or strengthen capital positions in times of stress, as appropriate in light of the risk profile and systemic importance of the bank. CBI requirements and practices: - The CBI requires all banks to have an ICAAP process, as per Article 123 of the CRD. - ICAAP responsibilities: adequately identify, measure, aggregate and monitor risks; hold adequate internal capital in relation to risk profile; use sound risk management systems and develop them further. - The institution is responsible for defining and developing its ICAAP. - Article 124 of the CRD sets out CBI requirements for the SREP; under SREP the CBI assesses banks’ ICAAPs including adequacy of capital for pillar 1 and pillar 2 material risks. - As per EBA guidelines, institutions should conduct appropriate stress tests that take account of jurisdiction-specific risks and business cycle stages. - The CBI has adopted the EBA guidelines on stress testing. - Example: In July 2011, three banks subject to the FMP issued contingent convertible Tier 2 instruments subscribed by the State; instruments convert to common equity on a going-concern basis once a pre-defined trigger is breached and at point of non-viability as identified by the CBI. - Basel III/CRD IV: countercyclical buffer may be applied and is available to Member States to be phased in at a minimum from 2016 onwards. ### AC1 and AC2 — Capital framework consistency and intra-group capital distribution AC1 — Capital requirements consistency: - For non-internationally active banks, capital requirements (definition of capital, risk coverage, method of calculation, scope of application and capital required) are broadly consistent with principles of applicable Basel standards relevant to internationally active banks. - Minimum requirements and regulations relating to capital are applied to all banks with no exceptions. AC2 — Distribution of capital within banking groups: - The supervisor requires adequate distribution of capital within different entities of a banking group according to risk allocation. - All banks are required to meet risk-based minimum capital requirements on a solo basis. - Irish-licensed parent institutions and Irish-licensed parent financial holding companies must also meet capital requirements on a consolidated basis. - The Central Bank may permit exclusion of certain subsidiaries from regulatory consolidation or conditionally allow subsidiaries to be incorporated in the parent’s calculations (solo consolidation). - Subsidiary banks must apply capital requirements on a sub-consolidated basis if they (or their holding company) have a bank/financial institution/asset management company as a subsidiary in a third country, or hold a participation in such an undertaking. ### Principle 17 — Credit risk supervision: scope and supervisory approach - Principle 17 requires banks to have an adequate credit risk management process covering the full credit lifecycle: credit underwriting, credit evaluation, ongoing management of loan and investment portfolios, including counterparty credit risk and potential future exposure. EC1 — Bank-wide credit risk processes - At minimum, all credit institutions must comply with the CRD. - CRD requirements include: credit-granting based on “sound and well-defined criteria”; clearly established processes for approving, amending, renewing and refinancing credits; effective systems for ongoing administration and monitoring of credit portfolios and exposures for identifying and managing problem credits and making adequate value adjustments and provisions; adequate diversification given target markets and overall credit strategy (Annex V of 2006/48/EC, Paragraphs 3-5). - CRD is supplemented by EBA Guidelines GL 44 expanding Article 22 and Annex V requirements and establishing governance expectations. - Article 123 of 2006/48/EC (Regulation 65 of S.I. 661 of 2006) mandates appropriate levels of internal capital to cover nature and level of risks. - Annex V and Article 22 (transposed by Regulation 16 of S.I. 395 of 1992) require sound administrative and accounting principles, internal control and reporting arrangements, and comprehensive risk management commensurate with the scope, size and complexity of activities. CBI supervisory instruments and guidance: - The Central Bank issued “Impairment Provisions for Credit Exposures” (Oct 2005) with requirements for credit risk management policies and procedures. - Under the Banking Supervision engagement model, the Central Bank supervises banks via the PRISM framework through assessment of a bank’s ‘Quality of Credit Risk Controls’. EC1 findings on differentiated supervisory approach - The CBI adopts a differentiated approach based on PRISM Impact rating: High Impact, Medium High, Medium Low, Low. - High Impact banks: dedicated credit specialist resource assisting Examination Team; assessment areas include Governance and culture; Skills and resources; Concentration risk; Credit approval process; Credit monitoring process; Credit control and collections; Impairment and provisions; Management information and modeling. - Analysis of quarterly prudential returns supplemented by more frequent management information given prevailing economic conditions. Data submission requirements and history: - “Covered Credit Institutions” submit: - Quarterly Summary Financial Return (QSFR) – loan losses, nonperforming loans, and additional information on loans. - Arrears return – extensions/rollovers, restructured loans. - 3 years of QSFR data is available. - 3 years of “Impairment Provisions” data is available. Offsite analysis uses: - Analysis of quarterly prudential returns. - Reviewing Credit Management Information monthly or quarterly depending on institution size. - Reviewing strategy documentation and implementation plans for Distressed Loan Portfolios (Mortgage, SME & Real Estate). - Reviewing supporting documentation for Risk and Credit Committees. - Results feed into PRISM. Onsite supervision practices: - Examination Teams undertake quarterly reviews of regulatory returns (impairments, nonperforming loans, loan trends). - Ongoing engagement with credit institutions to discuss credit risk issues. - Regular meetings with key bank personnel, e.g., quarterly with divisional heads of credit; monthly meetings with CEOs in some High Impact banks on Mortgage Arrears. - Key credit risk policies assessed annually. High Impact banks: - Onsite Credit Risk Review typically on at least a two year cycle with Credit Risk Team and supervision team participation. - Review assesses documentation and meets staff from all lines of defense, challenging credit risk assessment across lifecycle from origination to monitoring and internal audit. - FRR on Credit Risk assesses documentation including: Risk Appetite Statement; Impairment Policy; Credit Policy; Collateral Valuation Policy; Risk Framework; Credit Review Procedures & Controls; Collateral Security Procedures; Credit Grading Management & Procedures. - Onsite review includes sample testing of loan files and assessment of credit risk grading accuracy. - At least annually, a full assessment of credit risk will be conducted for High Impact banks and presented to RGP. Medium High banks: - Quarterly analysis of regulatory returns, supplemented by Board information when requested. - A Financial Risk Assessment (FRA) will be conducted at minimum between two to four years; FRAs include credit risk assessment. - Medium High banks receive support from credit specialists where necessary, particularly to lead onsite file reviews. - Key credit risk policies assessed as part of the FRA. - Credit risk discussed in meetings with senior management (CEO, CRO, Board) and external auditors. Medium Low / Low banks: - A proportion are included in annual cycle of FRAs. - Subject to variance analysis where specified deviations in quarterly regulatory return data trigger supervisory attention. - PRISM engagement model requires FRA and RGP on a spot/random basis for onsite credit risk reviews. - 10 percent of banks assigned Medium Low Impact will be sampled per year (equates to an average of one FRA/RGP a year for Medium Low Impact credit institutions). - Typical engagement covers: - Meeting with CRO/CCO/Head of Credit to discuss key credit risks/credit processes. - Review of firm MI quality and circulation/frequency. - Review of independence of Credit Risk Function organisation structure. - Credit Policy – approved by Board annually. - Desk top review of credit risk MI including asset quality/provision trends. - Loan file review (small sample). - Semi-annual meeting between credit specialists and supervisory team to review credit risk in Medium Low Impact banks. - Some Medium Low institutions required to submit an abridged QSFR providing overview of credit exposures. - Full review of credit risk conducted during an FRA; credit specialist support provided for on-site meetings and loan file inspections. EC1 assessment observations: - CRD requirements cover overall credit granting process but do not explicitly reference a comprehensive bank-wide view of credit risk exposures. - Routine supervisory activities for High Impact banks provide multiple inputs to assess credit risk against market and macroeconomic changes. - For Medium Low and Low Impact banks, variance analysis may not reveal weaknesses until risks begin to crystallize and trigger Central Bank supervisory attention. - The Central Bank does not rely on variance analysis alone to determine which Medium High/Medium Low institutions will be subject to FRAs in any given year; Board packs, Financial Analysis and meetings inform annual workplans. ### EC2 — Board and senior management responsibilities for credit risk - For High Impact institutions the Central Bank performs governance reviews at least every two years covering credit risk governance. - As part of SREP, annually the supervisor and credit specialist assess the role of the Board and senior management in respect of credit risk. - CBI assessment of credit governance evaluates: - The credit competence of the Board. - Whether the Board actively challenges and approves credit strategy annually. - Whether the Board approves and updates the credit risk appetite and credit risk policies. - The impact of the credit risk function at executive management level. - Whether the Board is provided with comprehensive credit information on a timely basis. - The bank’s credit model approval committee. Documentation reviewed to confirm Board approval and ongoing review of credit risk strategy includes: - Risk Appetite Statement (RAS). - Impairment Policy. - Credit Policy. - Business Unit Credit Policy Documents. - Collateral Valuation Policy. - Risk Framework. - Credit Review Procedures & Controls. - Collateral Security Procedures. - Credit Grading Management & Procedures. - Review of documentation is supported by on-site and off-site supervision to observe policy implementation; on-site activities may include meetings with Heads of Credit, observing Credit Risk Committee meetings, and other supervisory interactions. *Source: _cr14135 - Annex V of Directive 2006/49/EC as amended allows for the CBI to grant approval for banks* ### 1. Reviewing credit management information on a monthly or quarterly basis. ### 1. Reviewing credit management information on a monthly or quarterly basis. ### Supervisory activities and frequency - Central Bank performs annual review of a broad range of documentation and management information to determine that credit risk policies have been effectively implemented. - RGP (a full review of capital and risk) frequency: - Every two to four years for Medium High Impact banks. - On a sample basis for Medium Low Impact banks. - Meetings and engagement cadence by Impact classification: - High Impact banks: routine supervisory activities, onsite reviews, and at least annual review of credit risk policies; supervisors engage with Board to discuss credit risk. - Medium High Impact banks: annual meeting with the Chair of the Board and executive management (CEO & CFO). - Medium Low Impact banks: engagement with the Chair and senior management on an 18 month cycle. - Low Impact banks: engagement with Senior management is not prescribed in PRISM and, unless in exception, supervisory activity will not enable an accurate assessment of implementation. - Biennial meetings are scheduled, at minimum, to meet the Head of Credit and/or CRO to discuss developments within credit risk management. ### Governance and board/senior management assessment (by Impact level) - High Impact credit institutions: - RAS, Credit Policy and Credit Approval policy evaluated against best practice and aligned with stated risk appetite. - Onsite reviews enable assessment of whether senior management has implemented Board-approved credit risk strategy. - Supervisors review credit risk policies at least annually and engage with Board. - Medium High and Medium Low Impact credit institutions: - Evaluation largely completed on a desk-top basis with MI received as Board Packs and Credit and Risk Committee Minutes. - Requirement to have an up-to-date Risk Appetite Statement. - Credit management structures evaluated to ensure appropriate division between business line and credit risk divisions. - The Central Bank challenges banks on the frequency of internal review of policy documents; challenge frequency depends on PRISM engagement model and Impact classification. ### Core policy and process expectations (EC3 requirements) - Supervisor requires policies and processes to establish an appropriate, properly controlled credit risk environment, including: (a) a well documented and effectively implemented strategy and sound policies and processes for assuming credit risk, without undue reliance on external credit assessments; (b) well defined criteria and policies and processes for approving new exposures (including prudent underwriting standards) as well as for renewing and refinancing existing exposures, and identifying appropriate approval authority for size and complexity; (c) effective credit administration policies and processes, including continued analysis of borrower ability and willingness to repay, monitoring of documentation, legal covenants, contractual requirements, collateral and other credit risk mitigation, and an appropriate asset grading/classification system; (d) effective information systems for accurate and timely identification, aggregation and reporting of credit risk exposures to the Board and senior management on an ongoing basis; (e) prudent and appropriate credit limits, consistent with the bank’s risk appetite, risk profile and capital strength, understood by, and regularly communicated to, relevant staff; (f) exception tracking and reporting processes ensuring prompt action at appropriate senior management or Board level where necessary; (g) effective controls around the use of models to identify and measure credit risk and set limits (including quality, reliability and relevancy of data and validation procedures). ### Documentation and MI reviewed (items explicitly listed) - The Central Bank performs an annual review that includes (but is not limited to): 1. RAS [(a) and (e)] 2. Impairment Policy [(a) and (b)] 3. Credit Policy [(a) and (b)] 4. Business Unit Credit Policy Documents [(a) and (b)] 5. Collateral Valuation Policy [(a) and (b)] 6. Risk Framework [(a) and (e)] 7. Credit Review Procedures & Controls [(g) and (e)] 8. Collateral Security Procedures [(a)] 9. Credit Grading Management & Procedures [(a)] ### On-site and off-site supervisory techniques - Actions used to observe implementation of policy include: 1. Reviewing credit management information on a monthly or quarterly basis. [(d)] 2. Observing regularly at Risk and Credit Committees. [(f)] 3. Reviewing supporting documentation for Risk and Credit Committees. [(f)] 4. Sample testing loan files to ascertain compliance with policy documentation; analysis of borrower’s ability and willingness to repay; monitoring of documentation, legal covenants, contractual requirements, collateral and other credit risk mitigation; and assessment of asset grading or classification system. [(c)] - For lower risk institutions, evaluation is similar but generally without onsite file reviews; focus areas include: - Review of credit policies to ensure adherence with the RAS; adherence tested through the Exceptions Report. [(a)] - Review of credit approval policies for appropriateness, including assessment of individual discretions, domestic discretions and Parent/Group approval where relevant. [(e)] - Copies of Credit Approval documents can be requested to monitor depth of assessment provided to Credit Committee. [(e)] - Review of credit grading policy to assess appropriateness and granularity. [(g)] - Quality assurance of credit risk to ensure appropriate “4-eyes principle” review. [(g)] - Assessment of valuation policy against the CRD and best practice in a stressed environment. [(g)] - Review frequency and quality monitored against requirements and internal policies. [(g)] - Monitoring of regulatory returns, including Connected Clients, Large Exposures and Sector Reports, and review of the Exceptions Report to credit appetite. [(a)] ### Access to information and supervisory powers (EC7) - Licensed banks must comply with Article 74 of 2006/48/EC (transposed by Regulation 18 of S.I. No.661 of 2006) for minimum calculation and reporting requirements. - Section 18 of the Central Bank Act 1971 allows the Central Bank and the ECB to require additional information or returns deemed “necessary to have that information or return for the proper performance of the functions imposed, or the proper exercise of the powers conferred, on it by law.” - Part 3 of the Central Bank (Supervision and Enforcement) Act 2013 provides for extensive authorised officer powers. - Under PRISM, Central Bank monitors significant loan portfolio information (Drawn/Undrawn, Geography, Sectoral, Grades, Arrears, Impairment, Provisions, etc.) across all credit institutions, and credit analysts receive the banks’ Board/Executive/Credit/Risk/Policy Committee packs for regular review. - Supervisors meet regularly with Heads of Function in Credit, Risk, Credit Review, Asset Restructuring and Internal Audit, with engagement reflecting the institution’s Impact rating. ### Conflicts of interest and related-party lending (EC5) - Central Bank applies Paragraphs 12(1), 12(3) and 12(6) of EBA GL44 regarding management body independence, limits on mandates, disclosure and a written policy on managing conflicts of interest. - Central Bank reviews to determine credit decisions are free of conflicts and arm’s-length: - Credit Framework Document - KPIs set for credit functionaries as part of performance appraisals - Internal Audit and Quality Assurance Reports - Quarterly Related Party Lending returns submitted to the Central Bank - These reviews enable determination of whether: - the credit function is independent of the sales function; - the credit function remuneration is independent of sales volumes; and - there is an appropriate credit quality assurance/internal function. - Central Bank’s Code of Practice on Lending to Related Parties (2010): - Requires related-party lending to be on an arm’s length basis (Paragraph 6(a)), subject to management oversight and limits (Paragraphs 6(b) to (i)). - Credit institutions must submit quarterly reports and seek prior approval for certain loans greater than €1 million, as per the Code. - Code imposed pursuant to Section 117 of the Central Bank Act 1989. ### Major exposures and Board/senior management decision thresholds (EC6) - Requirement that credit policy prescribe that major credit risk exposures exceeding a certain amount or percentage of the bank’s capital be decided by Board or senior management was imposed under section 10 of the Central Bank Act 1971 in August 2013. ### Monitoring total indebtedness and Central Credit Register (EC4) - Banking Supervision Examination Teams and credit specialists assess High Impact policies and procedures for monitoring total indebtedness and risk factors leading to default (including un-hedged foreign exchange risk). - Credit specialists evaluate credit risk information to ensure sufficiency for loan management, timeliness of identifying overdue obligors and loan arrears, and quality of MI to Board and Risk Committee at portfolio and large exposure levels. - Credit inspections of sample loan files are undertaken to evaluate banks’ monitoring of total indebtedness; depth and frequency aligned with PRISM Impact rating and not performed for Medium Low and Low Impact banks. - Establishment of a Central Credit Register: - Legislation due to be enacted by end-2013. - Indicative implementation date of the Central Credit Register is 2015-2016. - Register intended to enhance banks’ capacity to monitor total indebtedness, especially for multi-banked customers. ### Stress testing and internal capital (EC8) - Central Bank requires credit institutions to have stress testing process and framework; applies EBA Guidelines on Stress Testing (GL32). - Risk Modeling Team assesses banks’ stress testing processes as part of SREP; shortcomings result in actions outlined in the RMP. - Relevant EBA Guidelines highlighted: - Guideline 6 (sensitivity analyses for specific portfolios or risks); - Guideline 7 (scenario analyses); - Guideline 14 (use of stress testing outputs); - Guideline 19 (supervisory use of stress testing outputs), supplementing Article 124 and Annex V of 2006/48/EC (transposed by Regulation 66 of S.I. 661 of 2006). - Regulation 65 of S.I. 661 of 2006 (transposing Article 123 of 2006/48/EC) requires forward-looking strategies and processes for internal capital: - Regulation 65(1) requires banks to have “sound, effective and complete strategies and processes to assess and maintain on an ongoing basis the amounts, types and distribution of internal capital that they consider adequate to cover the nature and level of the risks to which they are or might be exposed”, including credit risks. - Regulation 65(2) requires that these strategies and processes be subject to regular internal review to remain comprehensive and proportionate to nature, scale and complexity of activities. - Central Bank focused on improving banks’ forecasting of ‘expected’ credit losses and ‘adverse’ credit losses; banks’ outputs were sense-checked against each other and against independent Central Bank estimates produced as part of the PCAR. - 2011 PCAR outcome: - Covered banks required to raise €24bn in additional capital to cover 3 year stressed losses. - Central Bank participated in EBA stress tests. - For Medium High and Medium Low Impact banks, Central Bank analysis aims to ensure: 1. That scenarios (often set at Group level) are relevant to the local entity and that adequate governance is in place to ensure that risks specific to the subsidiary are appropriately evaluated. *Source: _cr14135 - 1. Reviewing credit management information on a monthly or quarterly basis.* ### 2. That the scenario translation methodology is adequately robust. ### 2. That the scenario translation methodology is adequately robust. ### Assessment of Principle 17 (credit risk supervision) - Overall assessment: Largely Compliant. - Resources and supervisory focus: - Resources are heavily weighted towards the High Impact banks where the overwhelming level of credit risk in the Irish banking system resides. - Routine supervisory activities for High Impact banks provide the supervisor with a variety of inputs to assess credit risk management processes against changes in market and macroeconomic conditions. - Supervisors are going beyond routine tasks and minimum activities prescribed by PRISM for High Impact banks. - Onsite reviews and loan file reviews: - Where an onsite review is conducted which includes loan file reviews, supervisors can assess whether senior management has implemented the Board-approved credit risk strategy and whether underwriting practices are consistent with policy and prudent for market conditions and the economic environment. - Medium High / Medium Low / Low Impact banks: - Frequency and depth of credit risk assessment for Medium High and Medium Low institutions is performed in accordance with the PRISM engagement model and informed by the amount of credit risk an institution is exposed to. - The frequency and depth of onsite credit risk reviews for lower risk institutions and the allocation of credit risk specialists to perform file reviews is not sufficient to maintain an accurate assessment of credit risk for these credit institutions (EC3). - For banks assigned PRISM Impact ratings below High (especially Medium Low and Low), the variance analysis might not provide insight into the application of credit risk management processes until after risks have begun to crystallize resulting in breaching Central Bank triggers for supervisory attention (EC1). - Engagement cycles: - Medium High Impact banks: annual meeting with the Chair of the Board and executive management (CEO & CFO). - Medium Low Impact banks: engagement with the Chair and senior management is on an 18 month cycle. - Low Impact banks: engagement with Board and Senior management is not prescribed in PRISM and, unless in exception, supervisory activity may not enable accurate assessment of implementation of the Board’s credit risk management strategy (EC2). ### Principle 18 overview (Problem assets, provisions and reserves) - Principle 18 scope: The supervisor determines that banks have adequate policies and processes for the early identification and management of problem assets, and the maintenance of adequate provisions and reserves. - Note: Principle 17 covers the evaluation of assets in greater detail; Principle 18 covers the management of problem assets. - Definition: Reserves are “below the line” non-distributable appropriations of profit required by a supervisor in addition to provisions (“above the line” charges to profit). ### EC1 — Laws/regulations and supervisory requirements for problem assets - Legal and guidance framework: - As per the CRD (Article 22 of 2006/48/EC), banks are required to have robust governance arrangements to manage risk. - All banks need to comply with the requirements contained within ‘Impairment Provisions for Credit Exposures’ published in October 2005. - The Central Bank issued updated guidance: December 2011 “Impairment Provisioning and Disclosure Guidelines” and a further update in May 2013. - While all credit institutions must comply with the 2005 requirements, only Covered banks are required to comply with the 2011 and 2013 requirements (supervisors advise institutions that the 2013 Guidelines are examples of better practice). - Board and management responsibilities: - Impairment Provisions Guidelines 2005 oblige the board and senior management to exercise effective oversight over all aspects of credit risk management including problem assets and provisioning. - The Impairment Provisions require the board of directors to be responsible for “reviewing the adequacy of provisions for impairment losses and amounts written off.” - Section 3.4 of the Impairment Provisions Guidelines 2005 obliges banks to review the impairment policy at least annually, including a “review and sign off on the processes and systems for credit risk, and the methodology used in determining the level of impairment provisions.” - Supervisory practice: - The Central Bank requires banks to have fit-for-purpose policies and processes for identifying and managing problem assets, with primary focus on High Impact banks under PRISM. - Focus areas: domestic mortgage and SME/Real Estate portfolios as the most distressed loan assets. - For Medium High and Medium Low Impact banks the Central Bank evaluates problem assets and provisions primarily on a desk-top basis, supplemented by thematic reviews; dedicated credit specialists are not assigned but can be made available when banks hold challenged assets. ### EC2 — Adequacy of banks’ grading/classification policies and provisioning processes - Proportional supervisory approach: Resources weighted to High Impact banks with the greatest risk-weighted assets (as determined by PRISM). - High Impact banks — documentation reviewed: 1. RAS 2. Impairment Policy 3. Credit Policy 4. Business Unit Credit Policy Documents 5. Collateral Valuation Policy 6. Risk Framework 7. Credit Review Procedures & Controls 8. Collateral Security Procedures 9. Credit Grading Management & Procedures - High Impact banks — supervisory implementation checks: - Reviewing Credit Management Information on a monthly or quarterly basis. - Observing regularly at Risk and Credit Committees. - Reviewing supporting documentation for Risk and Credit Committees. - Sample testing loan files to ascertain compliance with policy documentation. - Requiring Banks to undertake a third party review of their policy documentation and processes. - Regular meetings with Group and Divisional Heads of Credit. - Reviewing strategy documentation and implementation plans for Distressed Loan Portfolios (Mortgage, SME & Real Estate). - Peer analysis of asset quality trends across the banks where risk-based supervision is focused. - Medium High and Medium Low Impact banks — supervisory approach: - Desk-top analysis of relevant policies including: credit policy, impairment policy, valuation policy, risk management framework, credit grading policy, credit approval policy, and credit review policy. - Supervisors discuss provisions for impaired loans with bank management to assess adequacy; credit grading against collateral valuations is discussed. - On-site file review may be performed by the Central Bank’s credit team or an independent third party if required. - Engagement model for Medium Low Impact credit institutions: - FRA and RGP on a spot/random basis with a 10% sample of all ML Impact banks per year. - This equates to an average of one FRA/RGP a year for Medium Low Impact credit institutions. - Typical engagement covers: - Meeting with CRO/CCO/Head of Credit to discuss key credit risks / credit processes - Review of firm MI quality and who receives it/frequency - Review of independence of credit risk function organisation structure - Credit Policy – approved by Board annually - Desk-top review of credit risk MI including asset quality/provision trends - Loan file review (small sample) - Use of external experts and AQRs: - Central Bank engaged 3rd parties in 2011, 2012 and 2013 to conduct targeted reviews of bank’s credit grading systems through Asset Quality Reviews (AQR). - AQRs focused on quality of credit process, accuracy of internal credit grading, robustness of provision levels, classification of asset performance and identification of forbearance. - AQRs were completed by Blackrock Solutions in the covered banks across Real Estate, SME, Mortgage and Corporate loan portfolios. - Central Bank engaged a 3rd party accountancy firm to assess provisioning policies of retail banks in preparation for the development of the Impairment Provisioning and Disclosure Guidelines (December 2011). - Specific file reviews in the past eighteen months led, in several cases, to banks increasing their provisions as a direct result. - Mortgage arrears engagement timeline (High Impact banks; 8 high impact banks included): - Oct 2011: Central Bank requested mortgage lenders to submit distressed asset resolution strategies by end November - Dec 2011: Central Bank reviewed submissions - Feb 2012: - Deputy Governor met 7 main lenders to discuss common themes - Central Bank issued specific feedback to each lender on strategies submitted - Apr 2012: Central Bank undertook review of DCOR in the three main retail banks - May 2012: - Central Bank completed DCOR review & provided feedback to boards of the three main retail banks - Lenders were asked to submit board approved projected segmentation of book across treatment options - Jun 12: Central Bank reviewed board approved submissions & reverted with feedback - SME/Real Estate supervisory actions: - Blackrock Solutions (BRS) commissioned in 2012 to complete a SME DCOR exercise in two high impact banks; subsequent requests for strategy documents and implementation plans from all banks active in the Irish SME market and ongoing challenge of submissions. - Regulatory targets and powers: - Central Bank established targets for the resolution of cases >90 days past due for 6 specified licensed banks (by reference to Regulation 16 of the European Communities (Licensing and Supervision of Credit Institutions) Regulations 1992 through the Mortgage Arrears Resolution Targets paper). - Institutions reminded of regulatory powers in Regulation 65 of the European Communities (Capital Adequacy of Credit Institutions) Regulations 2006 and how these may be applied if targets are not met. - Provisioning guidance and IFRS: - Central Bank does not prescribe a methodology for calculating provisions (accounting policies are prescribed by Companies Law), but has actively encouraged more conservative provisioning under IFRS. - The mandatory effective date of IFRS 9 is anticipated to be 1 January 2015. - Onsite reviews and stress testing have been used to evaluate banks’ provisioning models. ### EC3 — Off-balance sheet exposures and provisioning - Guidance and reporting: - Section 3 of the Impairment Provisions for Credit Exposures (26 October 2005) applies to all credit exposures, but does not explicitly mandate responsibility for, or require documentation of, impairment provisioning of off-balance sheet exposures. - Part II of the guidance, which applies to IFRS/FRS 26 reporting banks, requires that impairment of off-balance sheet transactions should be made after the initial recognition of the asset. - Credit institutions report loan commitments, financial guarantees and other commitments to the Central Bank on a quarterly basis through their FINREP submissions. - Supervisors undertake a review of off-balance sheet exposures in the FINREP submissions periodically. - Supervisors of Medium Low Impact credit institutions monitor and investigate material movements in loan commitments, financial guarantees and other commitments via the BI Cube format. - Credit institutions include contingent liabilities in their annual report, which is reviewed by supervisory teams. - Credit Institutions report “Impairment Provisions” to the Central Bank on a quarterly basis through their online submissions; this return includes provisions for both on and off balance sheet exposures (e.g. provisions on committed but unfunded loans, or provisions on letters of credit). - Supervisory procedure: - Supervisory teams undertake a periodic review of “Impairment Provisions” submissions, monitoring and challenging aggregate movement in impairment provisions on both on- and off-balance sheet exposures. ### EC4 — Timeliness and realism of provisions and write-offs - High Impact banks: - Central Bank reviews a comprehensive suite of banks’ documents and challenges appropriateness through ongoing engagement and onsite reviews. - Loan-level file reviews assess provisioning process and realism of recovery expectations (such as “cure rates”) together with peer analysis of asset quality trends. - A significant number of specific file reviews completed in the past eighteen months by the Credit Team. - The 2011 Provisioning Guidelines for the covered banks encouraged banks to: 1. Recognise their incurred loan losses as early as possible within the context of IFRS; 2. Adopt a more conservative approach to the measurement of impairment provisions across all loan portfolios; and 3. Significantly improve the number and granularity of their asset quality and credit risk management disclosures. - Since 2012 the Central Bank has conducted regular on-site reviews of mortgage banks’ collections capability and operations, assessing mortgage Arrears Support Units including collection processes and procedures; focus has been on operational effectiveness rather than arrears units’ policies. - Medium High and Medium Low Impact banks: - Timeliness and conservatism of provisions evaluated through desk-top analysis of policies including impairment policy, credit grading policy, valuation policy, and credit review policy. - Discussions with senior credit management and senior risk management are undertaken to form a view of current provisioning practices. - Central Bank Impairment guidelines, while only explicitly applying to covered institutions, should be considered best practice and require early recognition of loss and general conservatism. - Provisioning methods and portfolio characteristics: - Under IFRS banks apply an incurred loss approach to loan loss provisioning. - For retail residential mortgage portfolios that are collectively managed (which account for approximately 50 percent bank total assets), nonperforming loans are collectively managed and utilize internal models for the calculation of provisions. - Model assumptions are based on historical loss data and include factors such as: emergence period, cure rates, and assumptions regarding valuation of collateral (peak to trough). - In the absence of prescription in Central Bank powers, the assumptions vary widely across banks. - Central Bank has placed considerable emphasis on influencing banks’ policies and assumptions; one High Impact bank imposed a provision overlay in their annual accounts following a Central Bank review. - Despite influence, there is a significant build-up of mortgage arrears in the system. ### EC5 — Early identification, oversight and collection processes - High Impact banks: - High risk banks have revised policies in the context of deteriorating market conditions; Central Bank has reviewed these documents for appropriateness for early identification of deteriorating assets and ongoing oversight. - Banks have enhanced MIS systems to classify asset quality into various cohorts to ensure transparency of asset quality. - Most banks have separated loan portfolios between distressed/non-distressed and core/non-core. - Documentation review is supported with intensive on-site and off-site supervision to observe policy implementation on the ground. *Source: _cr14135 - 2. That the scenario translation methodology is adequately robust.* ### 1. Reviewing Credit Management Information on a monthly or quarterly basis. ### 1. Reviewing Credit Management Information on a monthly or quarterly basis. ### Supervisory activities and ongoing focus - Regular supervisory actions: - Reviewing Credit Management Information on a monthly or quarterly basis. - Observing regularly at Risk and Credit Committees. - Reviewing supporting documentation for Risk and Credit Committees. - Sample testing loan files to ascertain compliance with policy documentation. - Requiring Banks to undertake a third party review of their policy documentation and processes. - Regular meetings with Group and Divisional Heads of Credit. - Reviewing strategy documentation and implementation plans for Distressed Loan Portfolios (Mortgage, SME & Real Estate). - Peer analysis of asset quality trends across the banks where risk-based supervision is focused. - Significant supervisory focus on adequacy of Distressed Credit Operations (homogenous retail books and non-retail books), including assessment of bank resources and operational capabilities for distressed credit operations and portfolio resolutions. - The Central Bank conducted thematic and bank specific onsite reviews to assess early identification of deteriorating assets and ongoing management of problem assets. - BlackRock Solutions was commissioned in 2012 to complete separate DCOR exercises in Mortgage and SME portfolios. - SME DCOR assessed two High Impact banks in terms of: - A. Organisational Structure and Resource Capacity - B. Skill and Experience of Staff as well as Quality of Training - C. Workout Strategy and Execution Ability - D. Relevant Documentation and Management Information Systems, including KPIs - E. Data and Reporting Related to Outsourced and/or Delegated Functions - F. Quality Assurance and Monitoring - Following the SME DCOR Review, the Central Bank requested strategy documents and implementation plans from all banks active in the Irish SME market; a third phase commenced in 2013 to see evidence of implementation. Loan file reviews were conducted throughout 2013 as implementation plans were rolled out. - In quarter 4, 2012, the Central Bank employed an arrears collections expert to lead credit institutions from short-term forbearance on mortgage arrears to more sustainable options; the expert assisted in on-site reviews of MARS implementation and arrears management and collection capability and implementation covering all retail credit institutions. - The Central Bank performed and continued to perform on-site reviews of Arrears Support Units (ASUs), evaluating capacity for inbound/outbound call activities and back-book arrears handling; continuous assessment of ASUs throughout 2013. ### Medium High Impact and Medium Low Impact banks - The Central Bank evaluates appropriateness of policies/procedures for early recognition of arrears using a desk-top approach. - PRISM prescribes a minimum frequency FRA of between 2-4 years for reviews. - A desk-top review of a bank’s arrears collections capabilities will be undertaken. - For Lower Impact banks, evaluation uses a combination of a desk-top approach and, where appropriate, onsite interview of the CRO (on a biennial basis at a minimum, as per the PRISM requirements). ### Testing High Impact banks’ treatment of assets and provisioning - The Central Bank has conducted onsite reviews and DCOR exercises to test appropriateness of provisioning standards and banks’ readiness. - The Central Bank required covered banks to improve policies/documentation through publication of Impairment Provisioning and Disclosure Guidelines in December 2011, resulting in updates to provisioning documentation/policies and processes (including treatment of forborne loans, widening of impairment triggers and increased disclosure). - Prudential Capital Assessment Review (PCAR) - 2011: - PCAR assessed capital requirements for covered banks arising from expected base and potential stressed loan losses over a three year time horizon (2011-2013). - As a result, covered banks’ provision projections were deemed inadequate and all were required to raise additional capital to cover projected loan losses under a stress case scenario. ### Information flows, documentation and reporting (EC6: supervisor obtains information) - The Central Bank’s primary focus on higher risk banks identified under PRISM. - Reviews related policy documents for higher risk banks on an annual basis, and monthly/quarterly management information on a regular basis; examines quality and appropriateness of information. - List of documentation obtained and reviewed: Annually - Impairment Policy - Credit Policy - Business Unit Credit Policy Documents - Collateral Valuation Policy - Credit Grading Management & Procedures - Year-end Impairment papers presented to Risk Committee - Loan loss projection reports Monthly/Quarterly - Interim impairment papers presented to Risk Committee - Credit information packs (classification of assets, provisioning & asset quality trends supported by management commentary) - Review quality of information furnished to risk committees and boards - Management information specific to distressed loans - Internal audit reports – quality assurance & controls - Quarterly Summary Financial Return – a quarterly return from High and Medium High impact institutions which details information on loan portfolios (Drawn/Undrawn; Geography; Sectoral; Grades; Arrears; Impairment; Provisions; etc.) - Market information sourced on each of SME, Residential Mortgages, Real Estate and Corporate - Regular meetings with Heads of Function in Credit, Risk, Credit Review, Asset Restructuring and Internal Audit - The Regulatory Document on Impairment Provisions for Credit Exposures (2005) requires quarterly reporting on provisioning levels as per the CRD asset classes - The Central Bank analyses asset quality trends across banks after reviewing documentation and management information, highlights areas of concern with follow-up action, and has on occasion highlighted concerns to banks’ external auditors. - Information on asset classification and provisioning is submitted as required regulatory returns on a quarterly basis and further information can be requested as part of thematic reviews or FRR/FRA; impairment policy, credit grading policy, valuation policy, and credit review policy documents can also be requested. - For Medium High Impact and Medium Low Impact credit institutions: on a quarterly basis, credit institutions submit impairment provisions, nonperforming loans and write-off information to the Central Bank; examination teams review for material movements and trends and query material movements with the institution. ### Assessment of adequacy of classifications and provisioning (EC7) - The Central Bank assesses asset classification and adequacy of provisioning in High Impact banks by reviewing related policy documents annually and monthly/quarterly management information regularly; reviews the quality and appropriateness of information. - Documentation obtained and reviewed includes: Annually 1. Impairment Policy 2. Credit Policy 3. Collateral Valuation Policy 4. Credit Grading Management & Procedures 5. Year-end Impairment papers presented to Risk Committee 6. Loan loss projection reports Monthly/Quarterly 1. Interim impairment papers presented to Risk Committee 2. Credit information packs (classification of assets, provisioning & asset quality trends supported by management commentary) 3. Review quality of information furnished to risk committees and boards 4. Management information specific to distressed loans 5. Internal audit reports – quality assurance & controls 6. Quarterly Summary Financial Return – a quarterly return details information on loan portfolios (Drawn/Undrawn; Geography; Sectoral; Grades; Arrears; Impairment; Provisions; etc.) 7. External market information relating to SME, Residential Mortgages, Real Estate and Corporate - Supervisors meet regularly with Heads of Function in Credit, Risk, Credit Review, Asset Restructuring and Internal Audit. - Where provisions are deemed inadequate to cover potential losses, the Central Bank highlights concerns and has prompted asset quality file reviews and raised concerns with external auditors. - The Central Bank has the power to require banks to increase capital where loan loss provisioning does not fully reflect losses expected to be incurred. - Deficiencies may be addressed through measures included in Article 136 of 2006/48/EC (as transposed by Regulation 70 of S.I. 661 of 2006), among others, as detailed in CP11. ### Valuation of risk mitigants and collateral (EC8) - Primary focus on valuation of real estate collateral; little reliance on un-collateralised guarantees given destruction of wealth in the downturn. - 2011 guidance paper: ‘Valuation Processes in the Banking Crisis – Lessons Learned – Guiding the Future’ provided industry enhanced guidance for provisioning applicable to all credit institutions; Central Bank scrutinises application of these guidelines as part of ongoing supervision. - On-site file reviews observed inconsistent assessment of collateral value across and within institutions; supervisors recommended banks review collateral valuation approach in context of guidance and develop/implement policies where absent. - Loan file reviews focus heavily on realism of recovery expectations and quality of collateral assessment; supervisors have challenged mechanisms for regularly assessing collateral in a number of High Impact banks. - Effectiveness of credit risk mitigants is extensively discussed with banks, including understanding of credit derivatives and assessment of guarantees and collateral. ### Identification and reclassification of problem assets (EC9) - Criteria and monitoring for problem asset identification in High Impact banks include: - Quality of the grading model inputs. - Frequency of loan reviews – e.g. are loans reviewed at least annually. - Level of overdue credit reviews. - Challenging credit assessment quality through loan file reviews (assessment of credit grade, collateral valuation, repayment capacity & debt analysis). - Assessing the loan review process and relevant controls. - Bank policies to identify emerging credit risk. - For Medium High Impact and Medium Low Impact banks: - Assessment of a particular exposure as a “problem asset” and reclassification as “performing” does not occur at granular individual loan level; high-level general assessment takes place regarding overall exposures (sovereign, sectoral, or specific credit exposure) with reference to trends in nonperforming loans, loan loss provisions, and credit write-downs, within context of overall capital sufficiency. - Desk-top reviews incorporate Credit Grade Policy, Credit Review Policy, Credit Policy, etc. - Business Model Analysis (including assessment of local knowledge of group models) can be carried out by support functions such as the Risk Analytics Unit. - Reclassification as Performing: - Central Bank increased focus during 2011/12 on movement from short term forbearance to medium/long term resolution options (Mortgage Arrears Resolution Strategy and SME Resolution Strategy). - Minimal reclassification of problem loans as performing in the current economic environment; Central Bank will monitor and challenge reclassifications in line with supervisory powers. - For IRB exposures previously designated as defaulted, Paragraph 47 of Part 4 of Annex VIII of 2006/48/EC requires re-rating as non-defaulted where no trigger of default continues to apply. - Central Bank guidance on restoration of exposure to unimpaired status for IFRS/FRS 26-reporting banks is contained in Section 7 of Part II of the Impairment Provisions for Credit Exposures (October 2005) and replicated for the covered banks in Section 5.9.6 of the Impairment Provisioning and Disclosure Guidelines 2011. - Problem Assets (Covered Banks): ongoing supervision and specific initiatives (e.g. AQR; DCOR; Income Recognition and Re-Aging; Data Integrity and Validation; Loan File Review Deep Dives; On-Site Reviews) have identified problems and devised mitigation plans. - Reclassified as Performing (Covered Banks): Assessments completed by the Central Bank in 2012, with assistance of Ernst and Young, in respect of interest recognition on impaired loans and arrears re-aging practices within the FMP banks. ### Board information, reporting and governance (EC10) - The Central Bank assesses Credit MIS presented to Boards of High Impact banks across headings including: - Asset quality of banks loans across each asset type. - More detailed analysis on problem sectors. - Loan loss performance versus projections – variances explained. - Trend analysis across portfolios. - Frequency of presentation of MIS to Board and delegated committees. - Central Bank completes peer analysis across high-risk institutions to identify gaps and may prompt risk mitigation actions. - Some banks provide excellent Board information; in other instances (two High Impact banks) Central Bank has pointed to gaps and captured risk mitigation actions for inclusion in the RMP. - Assessment of Board Packs for Medium High Impact and Medium Low Impact firms incorporates elements such as classification of assets, level of provisions and reserves, and major problem assets to some degree. - Under Section 3.1 of the Impairment Provisions for Credit Exposures (October 2005), senior management responsibilities include: - “evaluating the sensitivity and reasonableness of key assumptions used in the impairment provision assessment and measurement system, this may include the performance of stress tests to incorporate economic conditions that may affect credit exposures” - “providing the board with regular reports on the adequacy of impairment provisions and amounts written off” - Internal audit/independent credit review functions are required, under 3.3 of the same document, to conduct biennial reviews of the credit risk assessment process, including adequacy of provisioning and stress testing, and report to senior management and the board on findings; weaknesses identified must be addressed “on a timely basis.” - Central Bank Risk Governance Panel 2011 – for a High Impact institution: - Findings: Central Bank reported that the bank’s Board is not presented with bank specific key credit quality metrics such as book quality, provisions, grade migration and growth etc. for corporate markets division. The bank does not have a system of tracking SME forbearance. *Source: _cr14135 - 1. Reviewing Credit Management Information on a monthly or quarterly basis.* ### Conclusions: Central Bank directed, as an intended outcome, that the bank’s Board should ### Conclusions: Central Bank directed, as an intended outcome, that the bank’s Board should have sufficient data to perform its oversight role of credit risks and that the Board should be able to assess the quantum and type of forbearance on the SME book. ### Board reporting and SME forbearance - Intended outcome: the bank’s Board should have sufficient data to perform its oversight role of credit risks and to assess the quantum and type of forbearance on the SME book. - RMP actions implemented: - The bank is required to ensure that specific data of sufficient granularity is provided to the Board, including key credit metrics for the Global Restructuring Group portfolio. - The bank is required to devise a system to facilitate tracking, monitoring and reporting of SME forbearance. ### EC11 — Individual valuation, classification and provisioning for significant exposures - Requirement: supervisors require that valuation, classification and provisioning, at least for significant exposures, are conducted on an individual item basis; supervisors require banks to set an appropriate threshold for identifying significant exposures and to regularly review the level of the threshold. - Description and findings: - Individual assessment of Significant Exposures is mandated for all IFRS/FRS 26 reporting banks. These accounting standards apply to all credit institutions. - The Central Bank’s Impairment Provisions for Credit Exposures (October 2005) state: “Exposures should be assessed for objective evidence, measurement, and recognition of impairment on an individual basis for individually significant exposures.” - The Central Bank does not require banks to set specific thresholds for identifying significant exposures or to regularly review the level of this threshold. - As part of the process to review provision policy of High Impact firms, the Central Bank examines the threshold used by credit institutions for assessment of individual impairment provisions; thresholds used by firms have generally been deemed reasonable. - If the Central Bank believes a threshold limit is too high, the credit institution would be instructed to reduce the threshold. - Supervisors review impairment provision data and credit policies for lower impact banks in accordance with the Central Bank PRISM supervision engagement model. - Central Bank review scope for High Impact banks: - Annually: - 1. Impairment Policy - 2. Business Unit impairment Policy Documents - 3. Year-end Impairment papers presented to Risk Committee - 4. Loan loss projection reports - Monthly/Quarterly: - 1. Interim impairment papers presented to Risk Committee - 2. Credit information packs (classification of assets, provisioning & asset quality trends supported by management commentary) - 3. Management information specific to distressed loans - 4. Internal audit reports – quality assurance & controls - 5. Quarterly Summary Financial Return – a quarterly return from which details information on loan portfolios (Drawn/Undrawn; Geography; Sectoral; Grades; Arrears; Impairment; Provisions; etc.) - Specific case finding: - For one High Impact institution, individual/specific provisions were calculated on facilities greater than $10m under group policy. Central Bank advised the bank that the cut-off of $10m was too high. The bank subsequently amended its specific provision threshold to $0. ### EC12 — Assessment of trends and concentrations in risk - Requirement: the supervisor regularly assesses trends and concentrations in risk and risk build-up across the banking sector in relation to banks’ problem assets, considers observed concentrations in risk mitigation strategies and the adequacy of provisions and reserves at bank and system level. - Description and findings: - The Central Bank assesses concentration risk trends in covered institutions through analysis of their management information. - Concentration risk has increased for the covered institutions due to deleveraging with increasing geographic concentration to the Irish market. - The Central Bank’s focus is on the banks’ back books as there is little/no new business being written by these institutions. - The Central Bank regularly assesses trends and concentrations in risk and risk build-up across the High Impact credit institutions through the quarterly Credit Panel meetings attended by senior Banking Supervision executives; the Credit Panel evaluates detailed credit risk data and considers the adequacy of impairment provisions by individual bank and on a peer group basis. - Supervisory tools and actions: - To facilitate SREP analysis, the Central Bank collects data on the top 100 credit exposures and a sector breakdown across the portfolio. - An internal model, with generic correlations linked to probability of default, is used to estimate potential Pillar II requirements/add-ons for ‘name concentration’ (large exposures) and ‘sector concentration’. - This output is compared with banks’ ICAAP outputs; where a bank’s model is considered inadequate, a Pillar II add-on may be imposed until the bank addresses issues related to measurement of credit concentration risk. - Regulatory and legal basis cited: - CRD transposition references: Central Bank Act 1971, S.I. 661 of 2006, amended S.I. 395 of 1992 and S.I. 475 of 2009; Central Bank (Supervision and Enforcement) Act 2013; particular regard to regulation 66 and 70 of S.I. 661 of 2006; section 37(3) and section 40(2)(a) of the Central Bank (Supervision and Enforcement) Act 2013. - Section 5 of Annex V of Directive 2006/48/EC (as amended) requires banks to have written policies and procedures in relation to concentration risk. - Article 106 of 2006/48/EC (as amended), transposed by Regulation 52 of S.I. 661 of 2006, defines “exposures” for Large Exposures. - CEBS Guidelines (GL31) and EBA guidance on diversification and large exposures referenced. ### Forbearance, impairment, and provisioning guidance - Forbearance practices and timing: - Medium to long term forbearance measures are typically agreed at a later date subsequent to borrower compliance with short term forbearance measures and receipt of detailed borrower information. - Mortgage-specific frameworks and rules: - The Code of Conduct on Mortgage Arrears (CCMA), effective January 2011, includes the Mortgage Arrears Resolution Process (MARP) with 5 steps: communication; financial information; assessment; resolution and appeals. - IAS 39: interest accrued (not collected) enters the income statement while the loan is still performing and nonperforming; interest accrued (not collected) does not enter the income statement if a loan is deemed to be impaired. - Mortgage interest capitalization is not covered by a specific regulation; impairment and provisioning guidelines apply restrictions to the release of provisions based on 6 months subsequent performance; policies vary by bank. - Central Bank Impairment Provisioning and Disclosure Guidelines (December 2011) requirements when considering forbearance impact: - Loan pools subject to forbearance measures should be separated from remaining non-forborne loan pools. - Non-forborne loan pools may need further stratification based on similar risk characteristics. - When calculating collective impairment provisions, particularly for mortgage portfolios, certain model inputs based on historic data may require management judgment to adjust historic data to reflect current economic circumstances and the granting of forbearance measures. - Example: where a borrower is up to date with revised terms after forbearance, historic roll rates to default may appear lower than the underlying risk profile. - LGD could be higher on forborne loan pools than on non-forborne loan pools. - PD applied to forborne loan pools will be higher than non-forborne pools. - The Central Bank requires the history of PDs relating to forborne loan pools to be recorded and disclosed in the annual report over time. - Restoration to unimpaired status (Section 5.9.6): - An impaired exposure should only be restored to unimpaired status when the contractual amount of principal and interest is deemed fully collectible in accordance with the agreement and objective evidence exists subsequent to initial recognition of impairment. - Typical conditions for restoration: - The covered institution has received repayment of the loan’s past due principal and interest, none of the principal and interest is due and unpaid, and the covered institution expects repayment of remaining contractual principal and interest as scheduled. - The counterparty has resumed paying the full amount of scheduled contractual principal and interest payments for a reasonable period and all remaining contractual payments (including full compensation for overdue payments) are deemed collectible in a timely manner. - The exposure becomes well secured and is in the process of collection. - Determination of ultimate collectability should be supported by a current, well-documented credit evaluation of the counterparty’s financial condition and other factors. ### Auditor engagement, supervisory testing and onsite verification - Auditor interaction and documentation: - Sections 26 and 27 of the Central Bank Act 1997 require copies of banks’ audited financial statements to be provided to the Central Bank. - Supervisors typically receive and review annual post-audit reports and management letter reports prepared by external auditors, containing auditor comments on provisioning and loan quality. - External auditors do not review loan classification and processes for the Central Bank; however, they audit loan classification and processes as part of their annual audit. - The Central Bank’s Auditor Protocol 2011 provides a framework for annual bilateral and trilateral meetings between the Central Bank, the credit institution’s external auditor, and the credit institution; for High Impact institutions, supervisors will meet with external auditors before and after the annual financial statement audit to discuss loan classification and provisioning. - Thematic reviews and supervisory measures: - The Banking Supervision Credit Team performs thematic reviews on loan portfolios assessing impaired and non-impaired loans. - The Central Bank can take supervisory measures if dissatisfied with loan classifications. ### Assessment of Principle 18 — summary judgment and supervisory priorities - Assessment rating: Largely Compliant. - Commentary and findings: - The Central Bank has allocated considerable resources to encourage prudent provisioning practices, with significant focus on covered banks. - The Central Bank has updated and expanded guidance regarding provisioning and valuation practices and performed more frequent and in-depth onsite assessments; updated guidance goes beyond that of other IFRS-applying authorities in the region. - Problem assets, provisions and reserves have been integral to Central Bank engagement via on-site testing of compliance with revised Guidelines; externally led balance sheet exercises have been conducted. - The Central Bank does not have direct legislative power to reclassify assets and/or increase provisions, which limits direct influence on provisioning practices. - The Central Bank does not have legal power to overrule a bank’s external auditor decision; instead, it may rely on powers to increase capital where provisions are assessed as inadequate per Regulation 70 of SI 661. - Through the Auditor Protocol 2011, the Central Bank discusses and challenges loan loss provisioning with auditors. - Supervisory activity recommendations and observations: - Supervisors monitor and track changes in provisioning and asset quality through periodic analysis of regulatory returns and ad hoc data requests, supplemented by annual policy reviews. - Assessments of asset quality and provisioning are performed as part of an FRR or FRA. - Supervisory activities should place greater reliance on onsite verification of bank processes, particularly: - Assessing processes for early identification of problem assets. - Application of prudent valuations for collateral. - Testing assumptions that feed into provisioning models. - Evidence suggests increased onsite verification had commenced with High Impact banks but was yet to be extended across the sector (with proportionality). - For banks below High Impact, provisioning assessment is performed via desk-based review. - Greater frequency of onsite supervision would enable verification of bank provisioning practices by loan sampling and testing of assumptions to ensure consistency with actual experience and timely adjustment to market and economic changes, improving the supervisor’s ability to deem whether provisions are adequate for prudential purposes (EC7). - Given updated guidance applies only to High Impact banks, a greater onsite presence would allow supervisors to identify materially departing approaches that remain compliant with accounting standards. *Source: _cr14135 - Conclusions: Central Bank directed, as an intended outcome, that the bank’s Board should have sufficient data to perform its oversight role of credit risks and that the Board should be able to assess the quantum and type of forbearance on the SME book.* ### Section 5 of Annex V of Directive 2006/48/EC as amended requires banks to have written ### _cr14135 - Section 5 of Annex V of Directive 2006/48/EC as amended requires banks to have written ### Regulatory requirements and guidance on concentration risk - Section 5 of Annex V of Directive 2006/48/EC as amended requires banks to have written policies and procedures in relation to concentration risk. - Sections 3(5) and 10(18) of Annex V further elaborate requirements in relation to diversification of credit portfolios and funding. - CEBS/EBA Guidelines elaborate supervisory expectations, including: - Paragraph 34 of Guideline 3 (CEBS Guidelines on the management of concentration risk under the supervisory review process), endorsed by the CBI, requires banks to identify “risk drivers which could be a source of concentration risk,” covering “all risk concentrations which are significant to the institution [...], including on– and off- balance sheet positions and committed and uncommitted exposures, and extending across risk types, business lines and entities.” - Guideline 5 requires banks to “set top-down and group-wide concentration risk limit structures (including appropriate sub-limits across business units or entities and across risk types) for exposures to counterparties or groups of related counterparties, sectors or industries, as well as exposures to specific products or markets.” Limit structures should reflect the institution’s risk tolerance, consider interdependencies, cover on- and off-balance sheet positions, and be documented and communicated. ### Large exposures and definition of “exposures” - Article 106 of 2006/48/EC as amended (transposed by Regulation 52 of SI 661) defines “exposures” as “any asset or off-balance sheet item referred to in Section 3, Subsection 1 [standardized approach to credit risk which refers to “claims or contingent claims” on particular exposure classes], without application of the risk weights or degrees of risk there provided for.” - The EBA developed common reporting templates and guidelines in relation to large exposures reporting pursuant to EU directive 2009/111/EC (CRD II). - The revised large exposures regime has been applied since 31 December 2010. ### Supervisory review, Pillar 1/Pillar 2 interaction, and CBI SREP practices - CEBS Guidelines state that “concentration risk is not fully addressed in the context of Pillar 1” and banks must address “any resultant underestimation of risk...by allocating capital, where necessary, through the framework of Pillar 2.” - Through the SREP process, the Central Bank’s Risk Modeling Unit: - will examine the approach used by a bank to estimate the capital required in relation to credit concentration risk - can also perform an analysis of the level of capital required in relation to credit concentration risk - To facilitate SREP analysis, the CBI collects data on the top 100 credit exposures and a sector breakdown across the portfolio. These inputs are run through an internal model with generic correlations linked to PD to estimate potential Pillar II requirements/add-ons for ‘name concentration’ and ‘sector concentration’. - The CBI compares its model output with methods/models banks use within their ICAAP. Where a bank’s model is considered inadequate, Pillar II add-ons may be imposed in line with the output of the CBI model until the bank addresses measurement issues. ### Essential Criteria (EC) findings and supervisory practices - EC2: Supervisor determines that a bank’s information systems identify and aggregate on a timely basis, and facilitate active management of, exposures creating risk concentrations and large exposure to single counterparties or groups of connected counterparties. - CBI staff reviews bank internal reports and Board minutes to determine Board involvement and information provided. - The CBI achieves compliance with EC2 primarily through periodic submission of Large Exposure and concentration regulatory reports by licensed credit institutions and subsequent review by CBI supervision teams. - The CBI receives quarterly reports on concentration risk by sector, geography and industry; these reports are inputs for CBI analysis. - EC3: Supervisor determines that a bank’s risk management policies and processes establish thresholds for acceptable concentrations, reflecting risk appetite, risk profile and capital strength, and require regular review and Board reporting. - The CBI performs Large Exposure return reviews, reviews of risk appetite statements (for selected credit institutions), reviews of Board Management Information, and selected reviews of credit institutions’ risk policies and procedures. - The Credit Team and Examination Teams assess risk concentrations against risk appetite for High Impact credit institutions via Management Information and credit risk policies (including Risk Appetite Statements). - For Medium High Impact and Medium Low Impact institutions, Examination Teams assess concentration risk through large exposure regulatory returns and, less frequently, via FRAs, review of RAS and ICAAP portal submissions. - Article 124 of 2006/48/EC as amended (transposed by Regulation 66(1)-(3) of S.I. 661) provides the legal basis for supervisory review and assessment, supplemented by CEBS GL31. - The CBI’s Impairment Provisions for Credit Exposures paper (2005) requires credit institutions to consider credit concentration risk in portfolio provisions and to have effective internal policies, systems and controls to identify, measure, monitor, and control credit risk concentrations. The paper specifies that internal policies should include a definition of credit risk concentrations and how limits are calculated, and that management should conduct periodic stress tests of major concentrations and review against expectations. - EC4: Supervisor regularly obtains information enabling review of concentrations within a bank’s portfolio, including sectoral, geographical and currency exposures. - All licensed credit institutions are required to identify, aggregate and report single name credit concentrations and concentrations to connected counterparties to the CBI on a quarterly basis through the large exposures return. - These requirements are statutory and set out in Section 5 of CRD, Articles 106-119 and in the CBI paper of December 2010 “Large Exposures Return Notes on Compilation.” ### Reporting requirements for large exposures (selected specifics) - Credit institutions are required to: 1. Submit details of Group (G) and Unconnected (U) exposures. All large exposures (i.e. those exposures greater than 10% of own funds) should be reported up to a maximum of 70. This will be divided into a maximum of 30 to non-credit institutions, 20 to credit institutions and 20 to sovereigns. If there are less than 70 large exposures, sufficient exposures should be reported to bring the total number of exposures up to 30 to non-credit institutions, 20 to credit institutions and 20 to sovereigns. Where there are not sufficient exposures to bring the number reported up to 70 this must be indicated in the Notes section of the return. For institutions that report on a Group Consolidated basis, the number of exposures reported should be 50 for non-credit institutions, 30 for credit institutions and 30 for sovereigns. 2. Submit details of connected clients. ### Supervisory measurement guidance and cautions - Footnote guidance (as quoted): “The measure of credit exposure, in the context of large exposures to single counterparties and groups of connected counterparties, should reflect the maximum possible loss from their failure (i.e. it should encompass actual claims and potential claims as well as contingent liabilities). The risk weighting concept adopted in the Basel capital standards should not be used in measuring credit exposure for this purpose as the relevant risk weights were devised as a measure of credit risk on a basket basis and their use for measuring credit concentrations could significantly underestimate potential losses (see “Measuring and controlling large credit exposures, January 1991).” *International Monetary Fund — Section content from _cr14135 (PDF chapter/section) provided in the source content.* ### 3. Submit quarterly reports on credit exposures broken down by sectors, industry, ### _cr14135 - 3. Submit quarterly reports on credit exposures broken down by sectors, industry, ### Reporting requirements and formats - Reporting formats for Large Exposures, Related Party Lending and the Report on sectoral limits have been prescribed by the Central Bank under Section 117(3)(a) of the Central Bank Act 1989 in the case of Large Exposures pursuant to Article 110 of 2006/48/EC as amended (transposed by Regulation 56 of S.I. 661 of 2006). These reports are submitted quarterly. - Funding concentration risk reporting is required monthly from the higher risk banks, as identified by PRISM. - Reports are without prejudice to the rights and powers of the Central Bank to otherwise request specific information at any point in time. - The CBI regularly receives details on credit exposure by sector and geography for retail credit institutions via the QSFR. Outputs are analyzed by Credit Team and presented quarterly at the Credit Panel. ### Definition and treatment of connected counterparties (EC5) - The CBI has the discretion under the “EBA Guidelines on the Implementation of the Large Exposures Regime” to define an exposure as connected. - Article 4(45) of Directive 2006/48/EC as amended defines a “Group of Connected Clients,” referenced in S.I. 661 of 2006: - (a) two or more natural or legal persons, who, unless it is shown otherwise, constitute a single risk because one of them, directly or indirectly, has control over the other or others; or - (b) two or more natural or legal persons between whom there is no relationship of control as set out in point (a) but who are to be regarded as constituting a single risk because they are so interconnected that, if one of them were to experience financial problems, in particular funding or repayment difficulties, the other or all of the others would be likely to encounter funding or repayment difficulties. - The CBI requires banks to apply the CEBS Guidelines on the implementation of the revised large exposures regime (2009), Part I, which elaborates on “control” and “economic interconnectedness.” Paragraph 24 of the Guidelines clarifies that where institution and competent authority diverge, the competent authority decides whether a client must be regarded as part of a group of connected clients. ### Large exposures regime, limits and reporting (EC6, AC1) - The CBI has fully implemented the large exposures regime as set out in the CRD and transposed it into Irish law. - Definitions and limits: - Any exposure in excess of 10% is defined as a large exposure. - The limit for exposure to any individual client or group of connected clients is a maximum of 25% of own funds. - Regulation 54 of S.I. No 661 of 2006 (transposing Article 108 of 2006/48/EC as amended) states that a bank’s “exposure to a client or group of connected clients shall be considered a large exposure where its value is equal to or exceeds 10% of its Own Funds.” - Regulation 57(1) of S.I. 661 of 2006 (transposing Article 111 of 2006/48/EC as amended) states that “A credit institution shall not incur an exposure to a client or group of connected clients the value of which, after taking into account the effect of any credit risk mitigation in accordance with Regulations 52, 58, 59, 60 and 60A, exceeds 25 per cent of its own funds.” - Regulation 57(2) states: “If a client is an institution or a group of connected clients that includes one or more institutions, that value shall not exceed the higher of 25 per cent of the credit institution’s own funds or €150,000,000. However, the sum of the value of exposures, after taking into account the effect of any credit risk mitigation in accordance with Regulations 52, 58, 59, 60 and 60A, to all groups of connected clients that are not institutions shall not exceed 25 per cent of the credit institution’s own funds.” - The Regulation permits the €150,000,000 binding limit not to exceed a reasonable limit in terms of the credit institution’s own funds and not to be higher than 100 per cent, except if allowed by the Central Bank on a case-by-case basis. - Scope of “exposures”: - Article 106 of 2006/48/EC as amended (transposed by Regulation 52 of S.I. No.661 of 2006) defines “exposures” as “any asset or off-balance sheet item referred to in Section 3, Subsection 1 [standardized approach to credit risk which refers to “claims or contingent claims” on particular exposure classes], without application of the risk weights or degrees of risk there provided for.” - Derivative exposures may be calculated according to the Original Exposure Method, Market-to-Market Method or Internal Model Method. - All elements entirely covered by Own Funds may, with the agreement of the Central Bank, be excluded from the determination of “exposures,” provided such Own Funds are not included in the bank’s Own Funds for capital adequacy ratio or other monitoring ratios. - Governance and controls: - Large Exposures and Related Party Lending Reports must be signed by a director before submission to the Central Bank. - Related party lending must be approved by the Board or a subcommittee reporting directly to the Board; loans to a related party exceeding €1m require the prior approval of the Central Bank. - The CBI checks compliance with large exposure limits on a quarterly basis. - The general principle is that all banks on an individual basis must comply with the Large Exposures requirements of the CRD, unless waived under Article 69 of 2006/48/EC as transposed (Regulation 14 of S.I. No.661 of 2006); where waived, measures must ensure the “satisfactory allocation of risks within the group.” - Exemptions: - In line with the CRD, the Central Bank has partially or fully exempted some exposures (e.g. high credit quality exposures) from the limits above. - The CBI allows deviations from the limits for a limited period under Regulation 57(5) of S.I. No.661 of 2006 (transposing Article 111(4) of 2006/48/EC as amended) on an exceptional basis, provided the exposure is reported without delay to the Central Bank. ### Concentration risk and stress testing (EC7) - The supervisor requires banks to include the impact of significant risk concentrations into their stress testing programmes for risk management purposes. - The CBI has imposed EBA Guidelines on concentration risk and stress testing, and assesses compliance through periodic reviews of High Impact credit institutions’ stress testing programs during SREPs. Reviews are undertaken by the Risk Analytics Unit of Banking Supervision and typically feed into RGPs and, where necessary, RMPs. - For Medium High Impact credit institutions, the Risk Analytics Unit reviews stress testing programs (including impact of risk concentrations) as part of the FRA. - The CBI has adopted the CEBS Guidelines on the management of concentration risk under the supervisory review process (Guidelines 2, 4, 7, 12, 16 and 19) and the CEBS Guidelines on Stress Testing. - Supervisory assessments consider scenarios that test ability to withstand impacts on entities with high concentration (e.g., withdrawal of funding from parent, default of top exposures, operational events around key systems). - Example supervisory action: - In the 2011 SREP, weaknesses were identified in a High Impact credit institution’s stress testing framework, including the ability to detect risk concentrations. The related RMP required the institution to “introduce scenarios that will assist in the identification of interdependencies between exposures which may only become apparent during stressed conditions. This is to assist in identification of 'hidden' concentrations. This should include impact of breakdowns in correlations and significant shocks to specific sectors.” ### Transactions with related parties and the RPL Code (Principle 20, EC1) - The CBI introduced a Code of Practice on Lending to Related Parties (RPL Code) imposed on all credit institutions on a legislative basis; the RPL Code came into force on 1 January 2011. - The RPL Code was imposed pursuant to Section 117 of the Central Bank Act 1989 on banks licensed under Section 9 of the Central Bank Act 1971, building societies authorized under the Building Societies Act 1989, and applies to designated credit institutions registered under the Asset Covered Securities Act 2001. Reporting requirements in Section 7 of the RPL Code were imposed pursuant to Section 117(3)(a) of the Central Bank Act 1989. - Definition of Related Party under the RPL Code: - Related Party: a director; a senior manager; a significant shareholder of the credit institution; an entity in which the credit institution has a significant shareholding; and a connected person of any of the aforementioned persons. - Senior Management: Members of management of the institution or persons who report directly to the Board of Directors or the chief executive (howsoever described) of the credit institution. - Significant Shareholder: A person who holds, either themselves or in aggregate with their connected persons, a significant shareholding. Governments are excluded. - Significant Shareholding: 10% or more of the shares or voting rights in the credit institution or business. - Connected Persons and Clients: - (a) a spouse, domestic partner or child (whether natural or adopted) of a person; - (b) two or more natural or legal persons who, unless it is shown otherwise, constitute a single risk because one of them, directly or indirectly, has control over the other or others; or - (c) two or more natural or legal persons between whom there is no relationship of control as set out in point (b) but who are to be regarded as constituting a single risk because they are so interconnected that, if one of them were to experience financial problems, the other or all of the others would be likely to encounter repayment difficulties. - Scope and limitations of the RPL Code: - The RPL Code applies only to lending (loans, quasi-loans or credit transactions which result in an exposure or potential exposure, including guarantees), and thus aims to capture credit risk. It includes lease agreements, derivatives and write-offs. - The RPL Code does not cover service contracts. - The RPL Code does not specifically cover asset purchases and sales (although it captures Repos) or construction contracts. - The RPL Code does not address claims or borrowings. - The CBI considers that the RPL Code captures the vast majority of Related Party lending and related transactions in the Irish banking sector, though other laws (e.g., Companies Acts, accounting standards) address transactions other than lending but are not enforceable by the CBI. - Examples from other laws: - The Companies Act rules on Substantial Property Transactions: - Thresholds: - €63,487 (IR£50,000); or - 10% of the value of the net assets per the latest set of financial statements or if there are no financial statements prepared the called-up share capital of the company. - If the asset is valued at less than €1,270 (IR£1,000) then it is exempt from the terms of this section altogether. - Governance expectations and controls included in the RPL Code: - The RPL Code prescribes extensive lists of connected persons and clients and imposes qualitative and quantitative requirements on credit institutions (the text includes further qualitative requirements following the supplied excerpt). *Source: _cr14135 - 3. Submit quarterly reports on credit exposures broken down by sectors, industry,* ### 1. A credit institution cannot grant a loan to a related party on more favourable ### _cr14135 - 1. A credit institution cannot grant a loan to a related party on more favourable ### Requirements of the Related Party Lending (RPL) Code - A credit institution cannot grant a loan to a related party on more favourable terms than a loan to a non-related party. - A loan to a related party, or a variation in the terms of such a loan, requires the prior approval of the Board or a sub-committee of the Board established specifically to deal with related party lending. - Any loan in excess of €1m requires the prior approval of the Central Bank; the assessment of such requests includes an assessment of the terms and conditions of the loan. - Policies and processes must be established to prevent (i) members of staff of the credit institution benefitting from lending to a related party and (ii) persons related to the borrower from being part of the process of granting and managing a loan to such a borrower. - Senior management must report at least quarterly to the Board of any deviations from a policy, process or limit requirement of the code. Any such deviations must also be reported to the Central Bank within five business days of the deviation being identified. - The credit institution shall not (i) engage in a practice, (ii) enter into an arrangement, (iii) execute a document, or (iv) structure or restructure a loan in order to avoid its obligations under the code. ### Quantitative limits on related‑party exposures - Exposures to any one of the credit institution’s directors or senior management, and persons connected to them, including exposures to any business in which the director or senior manager has a significant shareholding: 0.5% of Own Funds. The aggregate of such exposures shall not exceed 5.0% of Own Funds. - Exposure to one of its significant shareholders including exposures to businesses in which the significant shareholder has a significant shareholding: 5.0% of Own funds, aggregate not to exceed 15% of Own Funds. - Exposures to a client or group of connected clients in which the credit institution has a significant shareholding: 5.0% of Own funds, aggregate not to exceed 15% of Own Funds. ### Oversight and supervisory requirements by the Central Bank of Ireland (CBI) - The Central Bank assesses all loans in excess of €1m prior to a credit institution being in a position to grant the loan. - All credit institutions must report all related party exposures to the Central Bank on a quarterly basis. - The CBI conducts desktop analysis of RPL reports to ensure policies and processes comply with the code and supplements this with on‑site testing to ensure that loans to related parties have followed the policies and processes. - The CBI issued a detailed template for RPL reporting within its ‘Related Party Lending Return Notes on Compilation’, required on a quarterly basis. - Supervisors track compliance with limits in Requirement 6(i) and monitor movements in RPL by category of related party from quarter to quarter. Breaches (if any) are reported to the Deputy Heads and Heads of Banking Supervision Divisions, including a NIL Return if there are no breaches. - A reporting matrix is being developed to standardize management reporting and tailor it to impact ratings under PRISM. ### Board governance and approvals - Loans to related parties or any variation of the terms require prior Board approval, or approval by a Subcommittee of the Board established specifically to deal with related party lending. That Subcommittee is required to report directly to the Board. Board members with conflicts of interest shall be excluded from the approval process (Requirement 6(b)). - Actions in respect of the management of such loans (for example, grace periods, interest roll-ups, loan write-offs) require prior Board approval or approval by the specified Subcommittee (Requirement 6(c)). - Approval is required from the Central Bank prior to extending loans to a related party that exceeds €1million (Requirement 6(d)). - The Board is obliged to put policies and procedures in place over related party lending, ensure adherence, monitor and report on such loans (Requirements 6(e), (f), (g), and (h)). - Limits are imposed on lending to related parties, both on an individual level and on an aggregated basis (Requirement 6(i)). - Detailed quarterly reporting requirements to the Central Bank and requirement to report deviations within 5 business days are set out (section 7 of the RPL Code). ### Monitoring, reporting, and audit processes - The CBI’s monitoring of compliance is primarily through quarterly RPL reports reviewed by supervision teams, supplemented by themed on‑site reviews (e.g., Loans to Directors). - Supervisors compare disclosures of Related Party Transactions in annual audited financial statements with quarter‑end RPL reports coinciding with year‑end for High Impact banks. - Supervisors check public disclosure of Loans to Directors and to Connected Persons (conditions/directions imposed in August 2009) and the maintenance of Registers (conditions imposed in May 2010). - Supervisors review annual financial statements for public disclosures on Related Party Transactions. ### Identified gaps, limitations, and assessment - Assessment of Principle 20: Materially Noncompliant. - Primary risk: abuse by related parties in borrowing with preferential rates or terms or receiving higher interest on deposits with the bank. The reports collected by the CBI do not contain information to monitor this risk. - Onsite reviews are infrequent and do not offset the lack of offsite information which is the primary focus of CBI supervision to monitor compliance with RPL requirements. - The RPL Code became effective on January 1, 2011 and was revised in 2013. It focuses on lending and aims to capture credit risk; it includes lease agreements, derivatives and write-offs. - The RPL Code does not: - Cover service contracts. - Specifically cover asset purchases and sales (although it captures Repos) or construction contracts. - Address claims or borrowings (i.e. deposits). - Compliance is primarily monitored through reports filed by banks supplemented with onsite testing; however, the reports do not contain sufficient information to monitor terms and conditions of the loans, to determine compliance that transactions are at arms’ length or received Board approval. - Requirement 6(d) requires prior Central Bank approval for loans over €1million; the Questionnaire for applications for approval contains details of the terms and conditions and must be accompanied by relevant minutes and a confirmation that the loan will be transacted on an arm’s length basis. - The limited extent of onsite testing does not sufficiently offset the reporting deficiency. ### Country and transfer risk (Principle 21) — supervisory approach and expectations - The Country Risk Policy was imposed on all credit institutions as a license condition on 23 August 2013 in accordance with Section 10(3) of the Central Bank Act, 1971 and Section 17 of the Building Societies, Act 1989. A breach of a license condition is enforceable through the Administrative Sanctions Process. - The Policy (section 2, “Supervisory Approach”) states the CBI will: - Have regard to the Basel Committee’s Core Principles for Effective Banking Supervision. - Consider the size and complexity of a credit institution’s international lending and investment activities when determining whether systems to control Country Risk and provisions are appropriate. - Determine whether policies and processes give due regard to identification, measurement, evaluation, monitoring, reporting and control or mitigation of Country Risk, are consistent with the risk profile and risk appetite, and provide a comprehensive bank‑wide view of Country Risk exposure. - Determine whether strategies, policies and processes for Country Risk management have been approved by the Board on an annual basis and that the Board oversees management to ensure effective implementation and integration into overall risk management. - Determine whether information systems, risk management systems and internal control systems accurately aggregate, monitor and report country exposures on a timely basis and ensure adherence to established country exposure limits. - Review the adequacy of provisioning against Country Risk. - Require credit institutions to conduct stress test scenarios and include appropriate Country Risk scenarios into stress testing programs. - Regularly obtain and review management information on Country Risk and obtain additional information as needed (e.g., in crisis situations). - Determination by the CBI of compliance by credit institutions is underway. *Source: _cr14135 - 1. A credit institution cannot grant a loan to a related party on more favourable* ### 3.1 of the Policy. ### _cr14135 - 3.1 of the Policy. ### Country risk oversight (Principle 21) — Summary of essential criteria and findings - EC3: The supervisor determines that banks have information systems, risk management systems and internal control systems that accurately aggregate, monitor and report country exposures on a timely basis; and ensure adherence to established country exposure limits. - Description and findings re EC3: - The Policy (section 2, “Supervisory Approach”) provides that the CBI, in reviewing the effectiveness of a credit institution’s management of country risk and the adequacy of provisions made, will determine that banks have information systems, risk management systems and internal control systems that accurately aggregate, monitor and report country exposures on a timely basis; and ensure adherence to established country exposure limits. - The Central Bank currently requires reporting on credit exposures by geographical region in the Quarterly Summary Financial Return covering ROI, UK, USA & ‘Other’ which provides aggregate data on sector exposure by region. - EC4: There is supervisory oversight of the setting of appropriate provisions against country risk and transfer risk. Different international practices are acceptable as long as they lead to risk-based results. These include options (a), (b), and (c) as described in the Policy. - Description and findings re EC4: - The Policy (section 3.11) provides for each institution to determine the appropriate level of provisions in relation to Country Risk (option (c) of the essential criterion). - The Policy sets out general guidelines in relation to the setting of provisions which must be adhered to by credit institutions. - The adequacy of provisioning is subject to review by the CBI. - Determination by the CBI of compliance by credit institutions with these requirements has commenced following the imposition of the Policy on credit institutions. - EC5: The supervisor requires banks to include appropriate scenarios into their stress testing programmes to reflect country and transfer risk analysis for risk management purposes. - Description and findings re EC5: - The Policy (section 3.9) provides that credit institutions should conduct stress testing analysis of their Country Risk exposures in order to monitor actual and potential risks. - EC6: The supervisor regularly obtains and reviews sufficient information on a timely basis on the country risk and transfer risk of banks. The supervisor also has the power to obtain additional information, as needed (e.g. in crisis situations). - Description and findings re EC6: - The Policy (section 5) provides for regular reporting to the CBI by credit institutions of their Country Risk exposures and provisions. - The Central Bank currently receives quarterly data on lending stock by sector and by country. - Assessment of Principle 21: - Largely Compliant - Comments and supervisory actions: - The country risk policy, which has the enforceability of a regulation, was imposed on banks at the end of August, 2013. - Testing of compliance with the Country Risk Policy commenced in Q3 2013 (one inspection to test adherence to the policy has been completed with a further inspection ongoing) and further reviews will form part of the Credit Team’s Engagement Plan for 2014. - The CBI has been conducting reviews for some time in relation to Sovereign Risk (a subset of Country risk) as part of its concentration risk assessments. - In two cases issues were identified which resulted in Pillar II capital add-ons amounting to more than €1.5bn. ### Market risk oversight (Principle 22) — Summary of essential criteria and findings - Principle 22: The supervisor determines that banks have an adequate market risk management process that takes into account their risk appetite, risk profile, and market and macroeconomic conditions and the risk of a significant deterioration in market liquidity. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate market risks on a timely basis. - EC1: Laws, regulations or the supervisor require banks to have appropriate market risk management processes that provide a comprehensive bank-wide view of market risk exposure. The supervisor determines that these processes are consistent with the risk appetite, risk profile, systemic importance and capital strength of the bank; take into account market and macroeconomic conditions and the risk of a significant deterioration in market liquidity; and clearly articulate the roles and responsibilities for identification, measuring, monitoring and control of market risk. - Description and findings re EC1: - Supervisory and specialist engagement with respect to market risk is dependent on the impact rating of an institution (as described in CPs 8 &9). - For M/H or M/L impact banks with high or complex market risk, the treasury team provides additional support beyond usual supervision. - The top seven institutions by impact score are supervised by a market risk specialist supporting the supervision team; remaining banks are supervised by individually assigned supervision teams with the risk specialist within the Treasury Team providing oversight. - The risk specialist deploys an individual bank and peer analysis of inherent, control and concentration of market risk by a bottom up methodology. - Twice-yearly meetings are held between the Treasury Team and examination teams to promote use of materials and best practices. - For High Impact banks the treasury team will allocate a treasury analyst (one analyst to 1 or 2 banks) who conducts all aspects of market risk monitoring and analysis throughout the year. - For M/H and M/L impact banks, a treasury analyst provides support at the time of the FRA and for other ad hoc reviews; supervision teams monitor risks otherwise with support from the treasury team’s risk dashboard, risk assessment framework and twice yearly meetings with the head of the treasury team. - The Quantitative Risk teams provide additional specialist support in the form of validation and evaluation of risk models. - At the upper end of the scale (High Impact banks), there is ongoing onsite and offsite regulatory supervision: regular ALCO attendance; monthly meetings with Head of Treasury/Asset Liability Management (ALM); and weekly Treasury calls. - For Medium High Impact and Medium Low Impact, periodic onsite and offsite work and analysis is conducted in accordance with PRISM guidelines. - For lower risk impact firms, the Treasury Team provides resources to assess market risk aspects of the FRA, involving both onsite and offsite work. - Findings of risk reviews for high impact firms are shared with examination teams for lower impact firms to help identify common issues. - Quarterly risk dashboards are submitted by the lower impact banks which aid risk monitoring. Evidence of this was provided during the mission. - Market risk is also assessed by way of periodic thematic/risk reviews (examples: 2012 review of 7 High Impact banks’ ALCO role and effectiveness; structural market risk review concluded in May 2013). - Directive 2006/49/EC provides the basis for the regulation of market risk and banks are required to apply all EBA (formerly CEBS) market risk guideline documents and bulletins. - Directive 2006/48 and Directive 2006/49 have been largely transposed into Irish law by the Central Bank Act 1971, S.I. 661 of 2006, the amended S.I. 395 of 1992 and S.I. 475 of 2009 in relation to banks. Particular regard should be given to Regulations 66 and 70 of S.I. 661 of 2006. - Regulation 66 allows the Central Bank to review the arrangements, strategies, processes and mechanisms implemented by credit institutions to comply with Directive 2006/49/EC (S.I. 661/2006) and evaluate the risks to which credit institutions are or might be exposed. - Regulation 70 enables the Central Bank to require any credit institution “that does not meet the requirements of [any law of the State giving effect to the [Recast Credit Institutions Directive]] to take the necessary actions or steps at an early stage to address the situation”. - Supervisory guidance documents used include: - EBA “High level principles for Risk Management” – February 2010 - EBA “Guidelines on stress testing” – August 2010 - BCBS “Principles for sound stress testing and supervision” – May 2009 - BCBS “Principles for the Management and Supervision of Interest Rate Risk” – July 2004 - BCBS “Revisions to the Basle II Market Risk Framework” – February 2011 - Market risk is analysed under three broad headings: - Inherent Market Risk - Quality of Control and Market Risk Processes - Concentration of Market Risk - Components and supervisory focus areas for Market Risk analysis: - Inherent Market Risk: - Risk Tolerance - Product type - Market Risk Strategy - Balance Sheet Structure - Identification of all Market Risk - Quality of Control and Market Risk Processes: - Governance - Risk/ Capital Model Validation - Skill and Knowledge - Limits – Risk Tolerance - Limits – Monitoring - Policy and Procedure - MIS Reporting - Stress Testing - New Product Process - Internal Audit Process - Concentration of Market Risk: - Diversification - Illiquid Financial Products - Illiquid and Volatile Financial Products - Supervisory tools and monitoring: - The Treasury Team has developed a risk dashboard which captures risk metrics for market risk (traded and non-traded) and liquidity for the High Impact banks. - The dashboard is populated by banks on a monthly or quarterly basis depending on impact and forms the basis of enhanced supervisory attention for this cohort of banks. - The dashboard allows peer group comparison. - Key statistic reported: - Of the banks supervised, only 24 had a pillar 1 market risk capital requirement at 30 June *Italic: IMF staff summary of findings and assessments as presented in _cr14135 - 3.1 of the Policy.* ### 2013. Of these only 11 exceeded €1m and only 2 exceeded €100m. In terms of onsite ### _cr14135 - 2013. Of these only 11 exceeded €1m and only 2 exceeded €100m. In terms of onsite ### Market risk supervisory activity and scope - The Treasury Team conducted two full risk reviews in 2012 for High Impact banks and has either performed or advised on the market risk assessment of three lower impact banks. - The Treasury Team assesses, on a quarterly basis, all high impact banks’ market risk against a number of sub-component criteria, involving both onsite and offsite work. - Given current market and macroeconomic conditions, High Impact banks received an elevated amount of attention by risk specialists in the Treasury Team, supporting offsite analysis and attending meetings with bank senior management. - Analysis of market risk through onsite reviews is generally performed by the supervision team supported by the Treasury Team. - External consultants had previously been engaged to conduct balance sheet analysis of the major banks which included an evaluation of market risk. - Banks have managed down their inherent market risk profile with a scaling back in exposure; trading books were relatively benign with few exotic instruments and trading strategies typically supporting customer flow and hedging. ### EC2 — Board-approved market risk strategies, policies and processes; supervisor assessment methods - Supervisors determine banks’ market risk management processes are approved by Boards and integrated into overall risk management through multiple assessment channels for the 7 credit institutions covered by the Treasury Team: - preparatory work for the quarterly Treasury Probability Risk rating review exercise; - internal reviews of returns received from credit institutions; - engagement with the Treasurer at regular scheduled meetings; - thematic reviews (e.g., ALCO Thematic Review, Market Risk Thematic Review, Risk Review on individual institutions); - ad hoc information requests arising from other institutions. - For remaining institutions, supervision teams: - determine whether a Trading Book exists; - call upon Treasury Team support for Full Risk Assessments; - organize meetings with the credit institution with either direct or indirect Treasury Team involvement and follow up on items. - Frequency of risk assessments: - Medium High Impact banks: every 2 to 4 years; - Medium Low Impact banks: performed on a sample basis with c.10% reviewed annually. - Examination teams use PRISM guidance and Market Risk Treasury RAG status; teams revert to Treasury Team for queries. - In 2011, two High Impact banks had thematic Market Risk Reviews examining consistency with Risk Appetite Statement, risk strategy, risk profile and capital, and roles/responsibilities for market risk identification, measurement, monitoring and control. - Structural Market Risk Review underway on the 7 banks where Treasury Analysts are assigned; currently being finalized. - Legal/regulatory basis: Directive 2006/49/EC, S.I. 661 of 2006, amended S.I. 395 of 1992 and S.I. 475 of 2009. ### EC3 — Market risk environment: information systems, limits, exception reporting, models, trading book allocation - Supervisory approaches for the 7 Treasury-covered institutions: - onsite visits to examine governance and information systems capabilities for Market Risk reporting via Risk Reviews; - refer to CP15 EC7 for Central Bank’s IT assessment framework; - consider limit sizes set out in the RAS during scheduled engagements, themed reviews, or annual RGP exercise; RGPs and Market Risk Themed Reviews reference this aspect; - monitor exception tracking and reporting via ALCO pack details, ALCO attendance, meetings with Market Risk and Internal Audit teams; - risk modeling team assesses appropriateness and robustness of risk-measurement models, including capture of sufficient risk factors, nonlinearities risk, correlation risk and basis risk; assess product type, market risk strategy, risk tolerance, and model validation; - supervisors review trading book allocation policies via ad-hoc review of trading book policy statements and RAS; assessment against EBA guidance documents. - The Financial Risk Review (FRR/FRA) is the principal activity to assess whether policies and procedures establish an appropriately controlled market risk environment and engages bank Chair and senior management. ### EC4 — Marked-to-market revaluation, transaction capture, valuation practices, independent validation - CRD minimum requirement: MTMs on trading portfolios are carried out daily. - Confirmation of daily MTM is obtained at bilateral meetings between CRO or Head of Market Risk in preparation for annual RGP for High Impact banks. - Treasury Market Risk RAG status is reviewed quarterly and contributes to Market Risk Probability Risk. - Market Risk RAG status asks about availability of daily limit monitoring systems for Market Risk Management; BIS principles for Market Risk Management set expected standards. - Main supervisory activities: RAG status reviews, Themed Reviews, ALCO attendance, Policy reviews; daily Mark to Market reporting is preferred standard. - Treasury team directly involved in assessing market risk of 8 of the 11 banks with Pillar I market risk capital requirements greater than €1 million, including all of the top 7. - For lower impact banks, main assessment is through FRA which is less intensive but typically attended by risk specialists. - Of the banks supervised, only 24 had a pillar 1 market risk capital requirement at 30 June 2013. Of these only 11 exceeded €1m and only 2 exceeded €100m. - Where reviews, prior knowledge and risk dashboards confirm lack of traded market risk, fewer resources are directed to this area; monitoring is in place to identify changes timely. - CRD establishes minimum expectations for validation of internal models by an independent unit within the bank. ### EC5 — Capital and valuation adjustments - Credit institutions must hold a precise minimum level of capital and report compliance monthly as prescribed by the Central Bank Act 1971, S.I. 661 of 2006, the amended S.I. 395 of 1992 and S.I. 475 of 2009. - The Central Bank places primary reliance on internal and external auditor work to ensure valuation adjustments are applied as required. - Supervisors review findings of internal/external auditors, make enquiries if significant adjustments are made, and exercise judgment on further action. ### EC6 — Inclusion of market risk in stress testing - Market risk exposures are required to be included within a bank’s stress testing programme under CRD Annex V point 10. - EBA Guidelines on Stress Testing (GL32) covers trading book risk as well as other main risk types. ### Assessment of Principle 22 (Market risk) - Overall assessment: Largely Compliant. - Supervisory intensity for High Impact banks: - supervisors meet Treasurers monthly, often perform monitoring calls weekly, and attend ALCO meetings periodically; - preparation includes receipt and analysis of ALCO packs and MI submitted to the Board; - enhanced monitoring through risk dashboard populated monthly and reviewed by risk specialists and supervisors. - Treasury team involved directly in assessing market risk of 8 of the 11 banks with Pillar I market risk capital requirements greater than €1 million, including all top 7; in all but one case this involved an element of onsite examination. - Control environment assessment for majority of banks performed within Full Risk Assessment process, less frequent than FRR. - Identified weaknesses: - reliance on exception reporting to identify risk given very limited market risk in Irish licensed banks; - insufficient onsite testing of implementation of policies and procedures to accurately assess effective implementation of controls, especially verifying that marked-to-market positions are prudently valued and revalued frequently; - CBI’s oversight of internal models on an ongoing basis is inadequate to ensure models are fit for purpose and calculating capital accurately (EC4); ongoing oversight of models in terms of validation and stability of model outcomes not performed on an ongoing basis, unless triggered by an event. ### Principle 23 — Interest rate risk in the banking book (EC1) - Legal/regulatory framework and supervisory approach: - Central Bank imposes regulations and guidelines on Irish licensed banks for IRRBB; banks required to apply all EBA IRRBB guideline documents and bulletins. - Particular regard to Regulations 66 and 70 of S.I. 661 of 2006; Directive 2006/48/EC treats IRRBB under ICAAP/SREP framework. - SREP comprises qualitative reviews of documented processes and management reports plus on-site assessments of technical and senior management. - Pillar II ICAAP reviews focus on identification of sources of IRRBB and adequacy of processes to manage risk; include quantitative assessments such as structural basis risk, pre-payment risk, yield curve risk, re-pricing risk; quantitative reviews documented in RGP reports. - As part of ICAAP, Central Bank conducts a high level, independent quantitative assessment to assess adequacy of banks’ estimated IRRBB capital. - Focus and types of IRRBB: - Volatility of earnings is a focal point due to reduced earnings threatening capital adequacy. - Types of IR risks: re-pricing-maturity risk, yield curve risk, basis risk, option risk, prepayment risk, pipeline risk. - Pressure on net interest margins is a domestic bank concern, and mortgage tracker products limit banks’ ability to re-price portfolios. - Two types of IRRBB limits adopted by banks (Risk perspective): 1. Group treasury limit (e.g., overall portfolio VaR limit, Probable Maximum Loss limit, etc.); 2. Instrument type limit (e.g., Interest rate limit, FX limit, derivative limits, such as delta and/or vega limits, etc.); 3. Nominal (Cash) based Limits. *Source: IMF country report text provided in the content unit* ### 2. Financial perspective (i.e. limits the potential for earnings volatility): ### 2. Financial perspective (i.e. limits the potential for earnings volatility) ### Reporting, risk appetite and ICAAP submissions - IR risk measures and limits are reported through a bank’s ICAAP portal/report submission. - For banks that do not submit an ICAAP (Medium Low), a Self-Assessment Questionnaire is submitted. - Submissions report: a bank’s risk appetite, risk profile, macroeconomic conditions & the risk of a significant deterioration in market access, management of risk and quantification of risk to supervisors. ### Supervisory framework and engagement (PRISM) - The Central Bank’s supervisory risk framework (PRISM) prescribes engagement with banks and guides assessment of IR and effectiveness of IR management and control systems. - PRISM is graduated according to the impact assessment of each individual bank; the prescribed level of engagement is applied accordingly. - Supervisors assess adequacy of risk management based on whether the bank’s framework is in accordance with BCBS principles. - Ongoing engagement: - High Impact banks: enhanced supervision, attendance at ALCOs, monthly conference/onsite meetings, quarterly risk dashboards, twice yearly meeting between examination team and head of Treasury Team. - Medium High / Medium Low Impact: less intensive process, reliance on self-assessment; FRAs (Full Risk Assessments) follow PRISM engagement cycle and can call in Treasury support for IRRBB. ### Onsite supervision, thematic reviews and Treasury support - Onsite supervision includes thematic reviews (e.g. ALCO Thematic Review, Risk Review on an individual credit institution) and regular scheduled meetings with Treasurer and Risk Management. - For Medium High and Medium Low Impact institutions, when a Full Risk Assessment is carried out, examination teams call in support of Treasury in respect of IRRBB. - Examination teams use PRISM guidance material and, in some cases, the Market Risk Treasury RAG status; they revert to the Treasury Team with queries or seeking advice if necessary. - Guidance materials used by supervisors include: - BCBS108: Principles for Measuring Interest Rate Risk - CEBS guidelines on Technical aspects of the management of interest rate risk arising from non-trading activities under the supervisory review process - CEBS CP32: CEBS guidelines on stress testing ### EC2 — Board and senior management oversight (description and findings) - Supervisor determines bank’s strategy, policies and processes for management of interest rate risk have been approved and are regularly reviewed by the bank’s Board; senior management ensures effective development and implementation. - For High Impact institutions covered by the Treasury team: - Supervisors follow policy/process reviews via attendance at ALCOs or analysis of ALCO packs. - Supervisory plan includes attendance at ALCO meetings of 7 High Impact banks. - Monthly conference/onsite meeting to discuss month-to-month change in risk profile; ALCO agenda items include important policies to be reviewed. - Face-to-face meetings or scheduled conference calls with Treasurer; supervisors obtain and review Board-approved policies and ALCO packs in preparation for engagements and FRAs. - For Medium High and Medium Low institutions: - Assessment of IRRBB forms part of supervision team’s work; FRA can call in Treasury support if material. - Themed risk reviews conducted for high impact banks: 12 reviews in total (2012 ALCO/ALM; 2013 Structural Market Risk) covering main aspects of strategy, policies and processes. ### EC3 — Risk management environment and controls (description and findings) - EC3 criteria: comprehensive measurement systems; regular review/independent validation of models; appropriate limits approved by Board and senior management; effective exception tracking and reporting; effective information systems for identification, aggregation, monitoring and reporting of IR exposure. - Findings for High Impact credit institutions: - Interest rate systems reviewed for appropriateness and detail; supervisors go onsite to understand governance and information systems capabilities for IRRBB reporting. - Risk Reviews are agreed by Treasury Team and inserted in year planning. - Supervisors review model assumptions and periodic reviews by internal and external audit. - Risk Appetite Statement and attached IRRBB policy document assessed for appropriateness and Board-approved limits formation and utilisation. - Monitoring of “exception tracking and reporting” via ALCO packs, attendance at ALCO, meetings with Market Risk or Internal Audit teams. - Supervisors review operational risk logs and examine effectiveness of risk controls under EBA guidelines. - Minutes and submissions in ALCO pack are under constant review for accurate and timely identification, aggregation, monitoring and reporting of IR exposure. - Central Bank’s IT assessment framework is set out at CP15 EC7. - For Medium High and Medium Low institutions: - Assessment of IRRBB forms part of examination team work; FRA follow PRISM engagement model; examination teams use PRISM guidance and Market Risk Treasury RAG status; they may seek Treasury Team advice. ### EC4 — Stress testing requirements (description and findings) - Supervisor requires banks to include appropriate scenarios into stress testing programmes to measure vulnerability to loss under adverse interest rate movements. - Central Bank requires banks to test the effect of a 200bps shift (this is compared with the Central Bank estimate to ensure accuracy) in the yield curve. - Banks with more complex exposures are expected to test effects of more varied tilts and twists in the yield curve. - Stress testing of market risk in the banking book is assessed by supervisor: - Criterion adhered to for High Impact banks. - For remaining banks, assessment performed as part of ICAAP review process. - Quantitative Models team within Banking Supervision assesses IRRBB stress tests through collection of data on the banking book profile for banks with a Treasury Analyst assigned. - Requirement for more sophisticated scenarios for more complex banks is not mandated; however, where necessary, banks are required to perform sensitivity tests examining various yield curve movements (parallel, tilt and twist), basis risk and behaviour assumptions. ### AC1 — Standardised interest rate shock and measurement (description and findings) - Supervisor obtains from banks results of internal interest rate risk measurement systems, expressed in terms of threat to economic value, including using a standardized interest rate shock. - Minimum ICAAP expectation: assess impact of the standardised interest rate shock, i.e. impact on NPV of assets and liabilities from 200bps parallel shift. - Larger banks expected to run more sophisticated models including VaR models considering various interest rate curves and optionality; larger banks expected to monitor exposure to shifts/twists on an ongoing basis (proportionality principle). - Central Bank runs an independent test of the standardised calculation, and assesses effect of observed extreme 1-year movements at each re-pricing bucket. - Where assessed as a material risk, banks expected to hold Pillar 2 capital to cover IRRBB. ### Additional criteria, questionnaires and information collection - Risk Analytics sent a detailed questionnaire covering: - a) Risk Appetite and Tolerance - b) Risk Management Framework - c) Interest Risk Exposure Profile - d) Data Sources - e) Quantification of IRRBB - f) Mitigation of IRRBB - g) Controlling Exposure to IRRBB - h) Stress Testing - i) Monitoring and Reporting of IRRBB - j) Capital Allocation to IRRBB ### AC2 — Internal capital measurement systems (description and findings) - Central Bank periodically issues an IRRBB questionnaire to update on internal capital measurement systems, providing qualitative and quantitative background. - Central Bank gathers information on internal approach, assesses for reasonableness, and compares with internal Central Bank estimate. - Where material/relevant, Central Bank may engage in onsite discussion with those responsible for IRRBB to assess internal understanding, processes and controls. ### Assessment of Principle 23 (Interest rate risk in the banking book) - Assessment: Largely Compliant - Comments: - Central Bank determines adequacy of IRRBB management under Pillar II SREP process. - Methodology involves use of benchmarks (200 bps parallel shift and a 99% historical shift) when performing an ICAAP review. - In past 12 months, SREP assessed IRRBB across banks in all impact categories (including medium low impact) via on-site and off-site reviews. - Evidence provided of capital add-ons imposed when deficiencies identified. - Ongoing engagement with High Impact banks has allowed supervisor to assess mitigation strategies as market conditions change. - Ongoing monitoring of changes in a bank’s IRR profile not well developed in offsite analysis: - KRIs within PRISM did not contain metrics related to IRRBB and data is only submitted once per year. - Less frequent engagement model for lower Impact banks may not allow supervisors to assess regular review of strategies and risk profile in context of market developments. - Some mitigation via risk dashboards and dialogue with treasury team; inclusion of IRRBB metrics in risk dashboards submitted monthly or quarterly depending on impact rating. - Treasury team has operated a market risk assessment framework over the last two years assessing banks’ market risk (including IRRBB) through risk monitoring, risk reviews and compliance assessment. ### Principle 24 — Liquidity risk and essential criteria EC1 (description and findings) - Principle: Supervisor sets prudent and appropriate liquidity requirements reflecting liquidity needs; strategy must enable prudent management and compliance with liquidity requirements; at least for internationally active banks, requirements not lower than applicable Basel standards. - Description and findings re EC1: - Central Bank has prescribed liquidity requirements under Regulatory Document “Requirements for the Management of Liquidity Risk” (“Liquidity Requirements”). - Prudential liquidity requirements apply to every credit institution licenced by the Central Bank on a consolidated basis, except limited exemptions. - Liquidity Requirements impose quantitative and qualitative prudential requirements; Quantitative Ratios submitted as part of maturity mismatch calculation report. - Mismatch broken into seven time buckets: - Sight to 8 days; - Over 8 days to 1 month; - Over 1 month to 3 months; - Over 3 months to 6 months; - Over 6 months to one year; - 1 to 2 years; and - 2 + years. - Quantitative limits only apply to the first two ratios: - The first ratio (sight to 8 days) needs to be 100%. - The second ratio (8 days to 1 month) needs to be 90%. - For High Impact and Medium High Impact institutions, liquidity risk matrix determining liquidity RAG status compiled using Basel standards. - Impact rating prescribes level of supervision (ongoing/high to less intensive/medium low); Medium Low Impact firms looked at when metrics uploaded to PRISM show significant movement or triggers arise. - Offsite supervision: only High & Medium-High Impact firms have regulatory returns analysis performed; Medium-Low & Low Impact firms not actively subject to offsite supervision unless returns trigger a red flag. - Responsibility for liquidity supervision aligned with PRISM engagement model: - Certain High Impact Institutions assigned a dedicated analyst from Treasury Team. - Other High Impact institutions receive part-time assigned treasury analyst. - Medium High Impact institutions receive part-time assigned analyst if necessary. - Analysis for other institutions performed by supervision teams with Treasury Team support available. - Both quantitative and qualitative liquidity requirements must be adhered to by all authorised credit institutions (local and international) in Ireland; requirements set out in: - Annex XI of CRD, implemented via Reg. 66 of S.I. 661 of 2006 - Annex V of CRD, implemented via Reg. 66 of S.I. 661 of 2006 - Central Bank Regulatory Document for Credit Institutions, “Requirements for the Management of Liquidity Risk”, 29 June 2009 - Central Bank Corporate Governance Code for Credit Institutions and Insurance Undertakings. Section 12.3 - Treasury team analyses Liquidity Risk under eight broad headings formulated using principles from ‘Basel III: International framework for liquidity risk measurement, standards and monitoring, (Dec 2010)’. - Guidance documents used include: - EBA ‘Guidelines on Liquidity Cost Benefit Allocation, (Oct 2010)’ - EBA ‘Guidelines on Liquidity Buffers and Survival Periods, (Dec 2009)’ - BCBS ‘Principles for Sound Liquidity Risk Management and Supervision, Sept 2008’ ### Frequency of liquidity reporting and returns - All licenced credit institutions submit via Viewpoint IT system: - Liquidity Return/Maturity Mismatch (weekly/monthly) - Deposit Protection Return (monthly) - FINREP (monthly/quarterly) - Funding Composition Report (monthly for Medium High Impact or higher/Quarterly for Medium Low Impact or lower) - All covered credit institutions submit in addition: - Guaranteed Liabilities Return (monthly) - Liquidity Forecasting Analysis (quarterly) - All High Impact or Medium High Impact credit institutions required to submit the ICAAP portal yearly (includes identification, measurement, monitoring, control and reporting of Pillar 2 risks, i.e. liquidity). - All Medium Low Impact credit institutions required to submit a Self-Assessment Questionnaire yearly; an ICAAP submitted only if requested by supervisor. - Firms involved in Asset Covered Securities required to submit Asset Covered Securities Return (quarterly). *Source: _cr14135 - 2. Financial perspective (i.e. limits the potential for earnings volatility).* ### Section 1.4.3 of the liquidity Requirements sets out the instances where branches of EEA ### _cr14135 - Section 1.4.3 of the liquidity Requirements sets out the instances where branches of EEA ### Overview - Section 1.4.3 allows branches of EEA and non-EEA credit institutions to be exempted from the liquidity requirements subject to undertakings by the branch’s head-office and confirmations from the Home Supervisor. - Section 1.4.1 permits, on “an exceptional bilateral basis” an exemption from the quantitative requirements only to be given to a credit institution. To date, only one Irish licensed bank has been granted such an exemption. - The prescribed liquidity requirements reflect on- and off-balance sheet liquidity risk in the context of market and macroeconomic conditions. ### Legal and regulatory basis - Legal requirements on credit institutions to submit information to the Central Bank are stipulated by: 1) Central Bank Act, 1971 – Section 23, “Regulation of ratios between assets and liabilities of holders of licences” 2) ‘Requirements for the Management of Liquidity Risk (June 2009)’, Central Bank. “Qualitative and Quantitative Requirements” 3) European Communities (Deposit Guarantee Scheme) Regulations 1995 (S.I. 168 of 1995) 4) Credit Institutions (Eligible Liabilities Guarantee) Scheme 2009 5) Memorandum Of Understanding – European Commission, International Monetary Fund and European Central Bank 6) Basel III/CRD IV – introduction for the first time of international liquidity standards of minimum liquidity requirements LCR & NSFR ratios, with additional liquidity monitoring metrics focused on maturity mismatch, concentration of funding and available unencumbered assets. Currently not a legal requirement; will be in the future 7) Directive 2006/48/EC, implemented via Regulation 66 of S.I. 661 of 2006, Annex XI of CRD and Annex V of CRD EC2 - Additional legal/regulatory references used in supervision: - Regulation 66 and 70 of S.I. 661 of 2006. - “Requirements for the Management of Liquidity Risk (29 June 2009).” - Basel Committee “Principles for Sound Liquidity Risk Management and Supervision” – September 2008 - Basel Committee “Principles for sound stress testing and supervision” – May 2009 - BCBS ‘Basel III: International framework for liquidity risk measurement, standards and monitoring, (December 2010)’. ### Treasury Team framework, scope, and impact-based supervision - The impact rating of a credit institution on the Irish economy prescribes the level of supervision (EC2, EC3). - The Treasury Team’s approach to analysing liquidity is shared with supervision teams for lower impact banks to ensure consistency. - For banks analysed by the Treasury Team under the liquidity matrix (8 credit institutions in total), banks are analysed in the context of market (on- and off-balance sheet) and macroeconomic conditions. - The Treasury Team developed a risk rating framework (risk dashboard) to evaluate liquidity risk under 8 broad headings; Liquidity Risk is analysed under 8 broad headings (market and macroeconomic conditions taken into account). - Under the Treasury Team risk rating framework a bank’s liquidity risk framework is analysed under the following categories: 1) Governance and Culture 2) Measurement and Forecasting 3) Liquidity Management 4) Liquidity Contingency Planning - Certain institutions rated High Impact receive a dedicated analyst from the Treasury Team. Other High Impact institutions receive part of the time of an assigned treasury analyst. Medium High Impact institutions receive part of the time of an assigned analyst if deemed necessary. Responsibility for other institutions is performed by supervision teams, with Treasury Team support as required. ### Liquidity policy, governance, and Board responsibilities (EC3, EC4) - Section 3 of the Liquidity Requirements requires each credit institution to establish a liquidity policy, to be reviewed on an ongoing basis. - The liquidity policy must include: - “strategy for the ongoing management of liquidity risk that is consistent with the risk tolerance of the credit institution” (3.1) - Scenario analysis including institution specific and market factors and assumptions about the behaviour of assets, liabilities and off-balance sheet activities under stress (3.6) - Market access considerations to ensure sufficient access to funding from a range of sources (3.8) - Boards’ responsibilities and supervisory expectations: - Boards are responsible for liquidity risk management, developing strategy for ongoing management, and establishing an ALCO structure (Section 3.1). - Liquidity policy must be reviewed and approved at least annually by the Board (Section 3.1). - Section 3.4 sets minimum expectations for management information to be provided to the Board with appropriate and timely information. - Section 3.3 (Internal Controls) expects reporting of limit breaches to be immediately brought to the attention of ALCO and the Board. - EC4 expectations for bank liquidity frameworks include articulation of liquidity risk appetite; sound day-to-day and intraday liquidity practices; effective information systems; adequate Board oversight; and regular Board review at least annually. - Assessment and supervisory contacts for High Impact banks: - Monthly meeting with Head of Treasury / ALM; weekly liquidity risk calls; scheduled Risk Reviews. - Treasury Team onsite work includes monthly meeting with Head of ALM to discuss ALCO agenda items and ALCO MI. - Four Risk Reviews scheduled during 2013: Funds Transfer Pricing; Structural Market Risk; Contingency Funding Plan; Funding strategy and Liquidity Stress Testing. ### Stress testing, scenarios, and reporting requirements (Sections 3.6; EC7) - Procedures required regarding scenario analysis, stress tests and assumptions must include: - Procedures for the performance and analysis of a range of stress and “what-if” scenarios, considering institution-specific and market factors, including the frequency of performance; - Procedures for the action to be taken by management in the event of certain stress results; - A timetable for the performance of stress testing and scenario analysis is to be prepared at the commencement of each financial year and the outcome of these examinations are to be reported to the Board on an annual basis; - Assumptions about the behaviour of a credit institution’s assets, liabilities and off-balance sheet activities under stress should be reviewed regularly to ensure their continued appropriateness. - Quantitative stress testing requirements to be adopted by credit institutions: - Stress testing must be completed on a quarterly basis by all institutions for both a bank-specific and industry-wide liquidity stress situation. - Each institution should consider further whether it is appropriate to perform both a moderate and severe entity-specific stress test, in addition to the minimum criteria prescribed above. - Institutions are to document: (i) an acceptable mismatch between inflows and outflows under each scenario and (ii) the strategic responses which would be required and available to the credit institution in cases where these acceptable mismatches are breached. Examples of strategic responses include: - Sell appropriate assets or repo assets; - Requisition the marginal lending facility; or - Draw down committed lines. - Credit institutions are required to submit the results of three types of stress scenarios: 1) idiosyncratic, 2) market wide and 3) combination of both. - Submission frequency: monthly for High Impact and Medium High Impact institutions, and Quarterly for Medium Low or Low Impact credit institutions. - The Central Bank both requires banks to conduct a variety of stress tests and also assesses whether the results are used by banks to inform Contingency Funding Plans and setting of Risk Appetite (EC7). ### Contingency Funding Plans (CFP) requirements and supervisory practice (EC6) - The Central Bank requires each credit institution to establish a Contingency Funding Plan (section 3.9), developed by management and approved by the Board as part of the liquidity policy. - Minimum CFP content: - Identify triggers used as signs of an approaching crisis and who is responsible for monitoring and reporting on these triggers (examples: a predetermined drop in deposits, a predetermined decline in the value of shares, or a higher cost of funding vis-à-vis other credit institutions); - Outline individual responsibilities in the event of liquidity problems, including the person responsible for liaison with the media, shareholders and the Central Bank; - Outline procedures for timely and relevant information flows to senior management in the event of a crisis; - Outline procedures for making up cash flow shortfalls, e.g. selling assets, establishing new lines of funding, in both normal and stressed conditions; - Identify and quantify all sources of funding by preference of use in various scenarios extending from normal circumstances to a severe industry stress; - Address strategy with respect to altering the behaviour of assets and liabilities; - Address circumstances when the plan should be utilised; - Outline names, contact details and geographical location of personnel responsible for contingency planning. - CFP review approach: - Extent of review depends on the impact rating of the credit institution. - Treasury Team has scheduled a Risk Review of CFPs as one of four reviews for the 8 banks assessed in 2013; prior CFP reviews formed part of probability risk scoring. - CFPs are covered by PRISM guidance on liquidity risk and form part of material reviewed during FRA, with frequency determined by impact rating. - Treasury Team’s Liquidity Risk Assessment Framework includes specific metrics on CFP. ### Funding strategy, high quality liquid assets (HQLA), and concentration (EC5) - EC5 supervisory expectations: banks must establish and regularly review funding strategies and policies covering analysis of funding requirements under alternative scenarios; maintenance of a cushion of high quality, unencumbered, liquid assets; diversification of funding sources and tenor; regular efforts to maintain liability-holder relationships; and regular assessment of capacity to sell assets. - Requirements are set out in Sections 3 and 8 of the Liquidity Requirements; liquidity policy to be reviewed as part of ongoing regulation. - While HQLA can be used in the calculation of the liquidity mismatch ratio, there is no stipulation in the rules for a minimum HQLA as long as there are sufficient net inflows to meet the minimum ratio requirements. - Section 5.2 sets out overriding criteria for determining characteristics of marketable assets including concentration and depth of market. Section 3.8 sets out requirements for market access. - Legal/regulatory basis cited for EC5 includes: - Regulation 66 and 70 of S.I. 661 of 2006. - Central Bank Requirements for the Management of Liquidity Risk (June 2009). - Quantitative Requirements: Central Bank Act 1971, Section 23; Building Societies Act 1989, Section 39; Trustee Savings Bank 1989, Section 31. - Qualitative Requirements: EC (Licensing and Supervision of Credit Institutions) Regulation 1992 (Regulation 16 S.I. 395 of 1992). - Quantitative & Qualitative Requirements also imposed as conditions via Central Bank Act 1971 Section 10; Building Societies Act 1989 Section 17; Trustee Savings Bank 1989 Section 12; Asset cover securities Act 2001 Section 16. - Directive 2006/48/EC, implemented via Regulation 66 of S.I. 661 of 2006, Annex XI, Section 1(e) and Annex V, Section 10. ### Supervisory reviews, thematic work, and consistency - As part of SREP (ICAAP), reviews of liquidity policy and contingency plans are carried out yearly. - Recent thematic reviews: - A thematic review to assess liquidity contingency planning covering a sample of 7 credit institutions (local and international). - A review of banks’ ALCOs’ role and effectiveness including governance across liquidity risk, stress testing, and the quality and discussion of management information circulated to ALCO and Board members. - The Treasury Team’s assessment methodology emphasizes consistency and peer comparison to identify best practices or emerging trends. - For Medium High Impact and lower impact banks, liquidity strategy, processes and policies assessment is done as part of the FRA, with frequency/duration as per PRISM guidance. *Source: _cr14135 - Section 1.4.3 of the liquidity Requirements sets out the instances where branches of EEA (extracted content).* ### Section 8 of the Liquidity Requirements stipulates the frequency and nature of stress tests ### Section 8 of the Liquidity Requirements stipulates the frequency and nature of stress tests ### Stress testing frequency and scenarios - Stress tests must be completed on a quarterly basis for both bank specific and industry-wide stress situations. - Moderate and severe scenario is considered where appropriate. - The assumptions need to be documented. - Section 3.8 details the various parameters a bank needs to consider. - The Central Bank assesses whether the results of these stress tests are used by banks to inform Contingency Funding Planning and setting of Risk Appetite. ### Risk reviews, reporting cadence, and monitoring - A series of Risk Reviews is scheduled by the Treasury Team for 2013 onwards and includes CFP, Liquidity Stress Testing and Funding Strategy; these will inform assessments of Medium High Impact and lower impact banks. - Each institution is required to submit: - a monthly liquidity return; and - a Treasury Funding Report. - Information analysed includes: - funding composition; - behavioural assumptions on cash flow of both assets and liabilities; - monitoring of liquidity ratios; and - EBA stress test results (idiosyncratic, systematic and combined). ### Foreign currency liquidity (EC8) — requirements and findings - Supervisor actions: - The supervisor identifies those banks carrying out significant foreign currency liquidity transformation. - Where a bank’s foreign currency business is significant, or the bank has significant exposure in a given currency, the supervisor requires the bank to undertake separate analysis of its strategy and monitor its liquidity needs separately for each such significant currency. - This includes the use of stress testing to determine the appropriateness of mismatches in that currency and, where appropriate, the setting and regular review of limits on the size of its cash flow mismatches for foreign currencies in aggregate and for each significant currency individually. - The supervisor also monitors the bank’s liquidity needs in each significant currency, and evaluates the bank’s ability to transfer liquidity from one currency to another across jurisdictions and legal entities. - Description and findings re EC8: - FMP banks (3 High Impact institutions) with any sizable foreign currency transformation requirements are either deleveraging that part of the portfolio or have matched that part of the balance sheet. - The FMP banks are monitoring and reporting foreign currency exposure quarterly to the Troika and Central Bank. - None of the non-FMP banks have significant foreign currency transformation requirements. - The COREP return requires banks to submit their Foreign Exchange Risk Total Positions in Non-Reporting Currencies to the Central Bank and shows the net position per currency. - Foreign currency is not regarded as significant (“significant” being >5%). - The banks’ ability to transfer liquidity from one currency to another across legal entities is only analysed for covered institutions. - Policy change under CRDIV/CRR: - From Q1 2014, credit institutions will be required to submit separate liquidity returns on a significant currency basis, i.e. where the institution has aggregate liabilities in a foreign currency amounting to or exceeding 5% of the institutions total liabilities, or has a significant branch as defined in CRDIV in a host Member State using a foreign currency. - The credit institutions shall monitor their liquidity needs separately for each currency. This analysis and reporting requirement will be completed under a stressed scenario. - Maturity mismatches for significant foreign currencies will be analysed as part of the Central Bank’s analysis of the CRR Maturity Ladder reporting template, due to be submitted by institutions in 2014. - Practical note: - Each quarter, the Irish covered banks (3 High Impact banks) submit comprehensive liquidity forecasting analysis as part of the EU-IMF Financial Support programme for Ireland, including balance sheet and FX funding gap (USD/GBP) forecasting out to end of 2014. ### Encumbered assets monitoring and AC1 findings - Supervisor objective (AC1): determine that banks’ levels of encumbered balance-sheet assets are managed within acceptable limits and require banks to commit to adequate disclosure and set appropriate limits to mitigate identified risks. - Description and findings re AC1: - The Central Bank does not impose specific limits on asset encumbrance. - Levels of encumbrance are monitored via the risk dashboards and discussed with the banks. - Acceptable levels of asset encumbrance vary case by case (e.g., covered bond bank funding model or temporary reliance on secured central bank funding during deleverage). - Banks report the level of asset encumbrance monthly — this information is contained in the “Dashboard” received from the High Impact banks. - The topic of “Asset Encumbrance” has been raised in ESRB papers which propose increased reporting and regulation but fall short of requiring limits; implementation dates to be set by National Supervisory Authorities in the future. - One High Impact bank was given an RMP for delivery by end March 2013 to improve management and internal reporting of asset encumbrance; they have completed this RMP to the satisfaction of Banking Supervision. - Treatment and reporting: - Section 5.4 “Encumbered Assets” of the Central Bank regulatory document lists encumbered assets to include: - securities pledged as collateral and not available to the institution for the period that they constitute collateral; - securities transferred by the reporting credit institution as part of a sale and repurchase agreement for the duration of the agreement; - receivables that are currently nonperforming /impaired and on which impairment has been identified on individual loans; - low grade securities; and - shares in affiliated companies. - The Central Bank requires credit institutions to report liquidity ratios across various time bands each week/month/quarter depending on the impact (High Impact credit institutions submit weekly and monthly liquidity returns online). - Unencumbered liquid assets are submitted weekly/monthly via the liquidity return online. - A “Use of Collateral” report is received from the Central Bank Organisational Risk division weekly; this report details the collateral used in the ECB. - As stated, there is no system-wide Banking Supervision process that requires maintaining encumbrance within prescribed limits, but banks report encumbrance monthly via the Dashboard from High Impact banks. ### Liquidity ratios, maturity mismatch approach, and contingency monitoring - Banking Supervision applies a maturity mismatch approach as outlined in Central Bank – ‘Requirements for the Management of Liquidity Risk (June 2009)’: - Credit institutions must analyse cash flows under various categories and place them in predetermined time bands depending on when cash is received and paid out. - Prudential liquidity ratios focus on the first two time bands, 0-8 days and over 8 days to 1 month, and the composition of available liquid assets to cover expected outflows including behavioral assumptions. - These statutory Liquidity Ratios are set at 100% and 90% respectively. - The Central Bank has discretion on a case-by-case basis to impose maturity mismatch ratios different from the standard limits. - Contingency and monitoring: - The Bank requires each credit institution to establish a contingency funding plan, developed by management and approved by the Board. - Supervisors closely monitor liquidity mismatches and forecasting in covered institutions, and the possible necessity for Emergency Liquidity Assistance. - Each quarter, the Irish covered banks which have existing drawings from the Central Bank, or have had such drawings in the past six months, are deemed High Liquidity Risk probability. - Banking Supervision, working with the Financial Markets Division, monitors the availability of each credit institution’s collateral for ECB monetary operations such as the MRO and LTRO. - Treasury Team risk rating: - The Treasury Team risk rating framework evaluates the unencumbered assets under “8. Funding Composition and Stability” for High Impact and Medium High Impact banks; not performed for Medium Low Impact banks where supervision is reactive. ### Legal and regulatory basis - Requirements for the Management of Liquidity Risk (June 2009), Central Bank document – Section 4.2 “Limits and Monitoring Ratios”. - Basel III/CRD IV — introduction for the first time of international liquidity standards of minimum liquidity requirements LCR & NSFR ratios, with additional liquidity monitoring metrics focused on maturity mismatch, concentration of funding and available unencumbered assets. - Directive 2006/48/EC, Annex V and Annex XI, implemented via Regulation 66 of S.I. 661 of 2006. - Annex V, Section 10, of Directive 2006/48/2006: “Credit institutions shall distinguish between pledged and unencumbered assets that are available at all times, in particular during emergency situations. They shall also take into account the legal entity in which assets reside, the country where assets are legally recorded either in a register or in an account as well as their eligibility and shall monitor how assets can be mobilised in a timely manner.” ### Practical examples and thematic work - Thematic Review on Funds Transfer Pricing was completed in early 2013. - Weekly/monthly submission of unencumbered liquid assets via the liquidity return online. - Weekly “Use of Collateral” report detailing collateral used in the ECB. ### Assessment summary - Assessment of Principle 24: Compliant. - Comments: - The Central Bank has prescribed liquidity requirements for authorized credit institutions which are not lower than Basel standards. - Supervision of liquidity risk is in line with the PRISM engagement model. - The Bank requires each credit institution to establish and maintain a liquidity strategy and liquidity policy. - Frequency of reports submitted to the Central Bank is dependent on the impact of the credit institution. - The Central Bank requires banks to conduct a variety of stress tests and also assesses whether the results are used to inform Contingency Funding Planning and Risk Appetite. _Section 8 of the Liquidity Requirements stipulates the frequency and nature of stress tests — extracted from the provided IMF content unit._ ### 4. Capital Adequacy: The methodology includes guidance and tools to enable ### 4. Capital Adequacy: The methodology includes guidance and tools to enable ### Assessment framework and purpose - Enables supervisors to: - Assess and challenge the adequacy of Operational Risk capital levels. - Determine when a Pillar 2 capital add-on may be appropriate (training has been provided to Supervisors in relation to same). - The assessment framework has been rolled-out and is embedded in the PRISM framework. - The methodology: - Recognizes differences in the scale and structure of institutions. - Provides guidance on priority areas of assessment where particular types of operational risk are deemed prevalent across the industry. - Is refreshed annually. - Expects any full assessment to address those priority areas (exact scope decided by individual supervisors and management). ### Implementation timeline and frequency of on-site assessment - The Assessment Methodology was implemented in mid-2012. - A revision was released in Q1 2013 and the document will be reviewed and revised annually. - Frequency of operational risk on-site reviews: - Ongoing basis for High Impact institutions. - Every two to four years for Medium High Impact institutions. - Spot basis for Medium Low Impact institutions. ### Legal and regulatory basis - CRD (2006/48/EC) - Title V, Chapter 2, Section 4: “Minimum Own Funds Requirements for Operational Risk” and related Annex V and Annex X set scope of review and evaluation in line with Recast Credit Institutions Directive. - Regulation 70 allows the Central Bank to require a bank to take necessary actions to reduce the risk inherent in activities, products and systems of credit institutions. - The CBI has applied an Operational Risk Assessment Methodology derived from regulatory guidance and best practice sources including: - CRD (2006/48/EC) – Title V, Chapter 2, Section 4 and Annex V and Annex X. - GL10 Guidelines on the implementation, validation and assessment of Advanced Measurement &Internal Ratings Based Approaches. - GL21 Compendium of Supplementary Guidelines on implementation issues of operational risk. - GL25 Guidelines on operational risk mitigation techniques. - GL32 Guidelines on Stress Testing. - GL35 Guidelines on the management of operational risks in market-related activities. - GL45 EBA Guidelines on AMA extensions and changes. - BCBS Principles for the Sound Management of Operational Risk. - BCBS Operational Risk - Supervisory Guidelines for the Advanced Measurement Approaches. ### Board oversight and corporate governance (EC2) - Supervisor requires banks’ strategies, policies and processes for management of operational risk (including banks’ risk appetite for operational risk) to be approved and regularly reviewed by the banks’ Boards. - Board required to oversee management implementation of these policies and processes. - Corporate Governance Code requirements: - The Board shall establish a documented risk appetite for the institution, expressed qualitatively and including quantitative metrics; subject to annual review by the Board. - The Board shall ensure the risk management framework and internal controls reflect the risk appetite and that there is regular reporting to the Board on compliance. - The (Board) Risk Committee shall oversee the risk management function and ensure development and maintenance of an effective risk management system proportionate to the nature, scale and complexity of risks. - Supervisors assess compliance with the Corporate Governance Code and use the Operational Risk Assessment Methodology to assess the role of the Board and management in defining, reviewing and monitoring operational risk policies, procedures and risk appetite. - Supervisors are provided guidance to assess completeness, quality and practical effectiveness of frameworks, policies and processes; criteria for specific assessment of the role of the Board and management are defined. ### Implementation effectiveness (EC3) - Operational Risk Assessment Methodology assesses both practical substance and design quality of a firm’s Operational Risk Framework. - Supervisors are guided to assess consistency, robustness and effectiveness of implementation across all components of the Methodology. ### Business continuity and disaster recovery (EC4) - Methodology defines taxonomy of operational risk types in line with Basel II categories. - For each risk type supervisors assess inherent risk exposure, quality and effectiveness of controls and mitigants, and residual exposure using a common mechanism for rating from inherent to residual risk. - Business Continuity Management and Disaster Recovery risks identified (e.g., IT/Communications failure; damage to physical assets; industrial relations disputes). - Guidance covers organization, contingency planning and testing; developed in line with best practice and industry standards. - Specific provisions for payment and settlements systems assessment included in the revised Q1 2013 methodology. ### Information technology risk and capability (EC5) - CBI engaged a third party provider to assist development of an assessment methodology and framework for reviewing IT capability of Irish licensed credit institutions. - Risk Taxonomy identifies IT-related risks: robustness of IT systems, data integrity, disaster recovery, information security. - Robustness of the firm's IT infrastructure is identified as a ‘priority risk’ and should form part of any full assessment. - Emphasis on analyzing system complexity and potential fragilities. ### Management information systems and reporting (EC6 & EC7) - Assessment Methodology enables supervisors to assess robustness of a firm’s Operational Risk MI and supporting systems across dimensions: - Adequacy and robustness of technology supporting bottom-up risk processes. - Ability to monitor operational risk levels across key exposure areas. - Ability to capture loss events and near miss events. - Quality of internal MI for management, Operational Risk/Risk Committees and the Board. - Key assessment areas: - Risk and Control Self-Assessment toolset. - Loss Capture Database. - Operational risk MI and metrics: completeness, quality, and appropriate use (effectiveness). - Supervisors use firm information to support assessment of operational risk profile and management effectiveness. - Assessments are carried out as part of the annual FRR, Financial Risk Assessments cycle, and as bank/external factors dictate. - Firms required to report Operational Risk Capital levels and underlying analyses to the Central Bank. - A new operational risk reporting framework requiring both quarterly and semi-annual reporting to the CBI has been implemented. - Reporting will provide structured information enabling supervisors to cross-compare and benchmark banks. - First reports are to be filed as of September 30, 2013. ### Outsourcing and third-party risk (EC8) - Supervisor determines banks must have appropriate policies and processes to assess, manage and monitor outsourced activities covering: - Due diligence for selecting service providers. - Structuring outsourcing arrangements. - Managing and monitoring outsourcing risks. - Ensuring effective control environment. - Establishing viable contingency planning. - Outsourcing policies require comprehensive contracts/service level agreements with clear allocation of responsibilities. - CBI has standalone guidelines to assess new outsourcing arrangements and provider selection in line with EBA guidelines. - Methodology provides guidance on expected measures (Service Level Agreements, etc.) for ongoing management and monitoring. ### Identification of common exposures and priority risks (AC1) - Supervisor regularly identifies common points of exposure or potential vulnerability (e.g., outsourcing key operations to common service providers or disruption to outsourcing providers of payment and settlement activities). - Assessment Methodology specifies priority risk types to consider in full assessments; list intended to be reviewed and revised at least annually (including Q1 2013 revision). ### Assessment outcomes and compliance - Assessment of Principle 25: Largely Compliant. - Comments: A detailed operational risk policy implemented and a number of onsite reviews conducted. A report to be filed by banks has been implemented and the first reports are to be filed as of September 30, 2013. Effectiveness and adequacy of monitoring cannot be fully assessed at this review due to the recent implementation of the report that will play an important role in monitoring compliance. ### Internal control and audit (Principle 26 / EC1) - Principle summary: Supervisor determines banks have adequate internal control frameworks to establish and maintain a properly controlled operating environment taking into account risk profile, including delegation of authority, separation of functions, reconciliations, safeguarding assets, and appropriate independent internal audit and compliance functions. - Legal requirements: - CRD and Article 22 of EU Directive 2006/4/EC require transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report risk, and adequate internal control mechanisms including sound administrative and accounting procedures. - Section 16 of S.I.395 of 1992 requires credit institutions to manage business in accordance with sound administrative and accounting principles and maintain internal control and reporting arrangements and procedures; robust governance arrangements; and that arrangements be comprehensive and proportionate to nature, scale and complexity of activities. - Central Bank’s Corporate Governance Code requires adequate internal control mechanisms, sound administrative and accounting procedures, IT systems and controls, and remuneration policies consistent with sound risk management (Section 6.3). - Through interaction of the Code and regulations, the Central Bank requires banks to have internal control frameworks adequate for the operating environment. *Source: IMF staff summary of the Operational Risk Assessment Methodology and supervisory findings as presented in the chapter.* ### Section 12.1 of the Code is the most specific requirement in relation to the role of the ### Section 12.1 of the Code is the most specific requirement in relation to the role of the Board ### Board responsibilities and regulatory context - Section 12.1 of the Code states that the board of each institution is responsible for: - the effective, prudent and ethical oversight of the entity; - setting the business strategy for the institutions; and - ensuring that risk and compliance are properly managed in the institution. - The Code and Regulations do not necessarily specify the full responsibilities of the Board in relation to all aspects of EC (a)–(c); nonetheless, the Regulations require controls to be in place and, in conjunction with the Code, require the Board to be generally responsible for the prudential oversight of the institution. - Where the Central Bank considers that a credit institution does not have an appropriate balance of skills and resources of back office, control and operational management, it has the power to require credit institutions to comply with deficiencies in its compliance with the CRD via Regulation 70 of S.I.661 of 2006. - Through the Central Bank’s power to place conditions on specific banking licenses (Section 10 of the Central Bank Act 1971), it can require a credit institution to provide a greater balance in the skills and resources of the back office, control functions and operational management relative to the business origination units. ### EC2 — balance of back office/control vs. business origination units - The supervisor determines that there is an appropriate balance in the skills and resources of the back office, control functions and operational management relative to the business origination units. - The supervisor determines that the staff of the back office and control functions have sufficient expertise and authority within the organization (and, where appropriate, in the case of control functions, sufficient access to the bank’s Board) to be an effective check and balance to the business origination units. - Description and findings re EC2: - The Corporate Governance Code (section 14.5) requires Boards to ensure key control functions such as risk management are independent of business units and have adequate resources and authority. - Credit Institutions submit a compliance statement to the Central Bank annually identifying any deviation from the Code. - Supervisors assess compliance with Section 14.5 through day-to-day supervision, receipt and review of the ICAAP portals followed by a SREP full risk assessment, and via the review of credit institutions’ annual compliance statements. - The Central Bank has developed guidance for supervisors to assist in assessing the balance between back office/control and front office/business functions; this guidance has assisted supervisors in assessing staff in control functions. - Supervisors typically receive and review Post-Audit Reports and Management Letter Reports written by external auditors annually; these reports highlight internal control and management reporting observations used to identify weaknesses. - As per PRISM requirements, supervisors meet with credit institutions’ CFO (at a minimum annually for High Impact firms, and every 18 months for Medium High Impact firms) to discuss, inter alia, the finance function, its access to the board, and its expertise and authority. - PRISM requires supervisors to periodically meet with the Head of Internal Audit, external auditors and a senior non-executive director, all of which would discuss bank controls and operational management. - Supervisors for High Impact and Medium High Impact credit institutions review Board and governance forum packs and minutes on a monthly or quarterly basis; review frequency for Medium Low Impact credit institutions ranges from monthly to bi-annually depending on Board meeting frequency and business activity. - In addition to reporting of breaches, supervisors perform onsite reviews with minimum frequency determined by PRISM; onsite reviews such as a Full Risk Assessment (FRA) or a Financial Risk Review (FRR) allow comprehensive assessment of skills, resourcing and authority of back office relative to front office. - The Central Bank uses an appropriate mix of offsite and onsite activities to evaluate effectiveness of internal control functions. - For Medium Low impact banks supervisors make judgments based on interactions with firms including meetings with Senior Management Team – CRO and CFO at a minimum every 18 months and ongoing interaction with finance and compliance functions; supervisors also review internal audit reports on liquidity and ICAAP on an annual basis. - For banks rated below Medium High, supervisors typically rely upon self identification mechanisms, exception reporting and adverse triggers of non-compliance with the Code or Regulations; engagement with CRO, CFO, Head of Internal Audit will not typically be undertaken unless risks have been identified. - For lower impact rated institutions the Central Bank deploys a significantly reduced range of supervisory activities (e.g., desk top review of self annual compliance statement). - The Central Bank does not require a bank to have an Internal Audit function; for lower Impact banks there is the option to utilise the services of a Group IA function. All Irish licensed banks either have a local internal audit function or are explicitly covered by the group internal audit function. ### EC3 — compliance function requirements and supervisory assessment - The supervisor determines that banks have an adequately staffed, permanent and independent compliance function that assists senior management in managing effectively the compliance risks faced by the bank; staff are suitably trained, have relevant experience and sufficient authority; the bank’s Board exercises oversight of the management of the compliance function. - Description and findings re EC3: - There is no specific requirement within the Corporate Governance Code or Regulations for banks to maintain a permanent compliance function; however, the Central Bank applies the EBA Guidelines on Internal Governance (GL44) in which Section 28 requires credit institutions to establish a compliance function and implement a compliance policy communicated to all staff. - GL44 states that “in smaller and less complex institutions this function may be combined with or assisted by the risk control or support functions.” It requires that the “compliance function should ensure that the compliance policy is observed and reported to the management body.” It also states that “the compliance function should verify that new products and new procedures comply with the current legal environment and any forthcoming changes.” - GL44 is not binding in Irish law but the Central Bank has communicated to credit institutions that it requires full compliance. The Central Bank is currently codifying GL44, with a due date of 2013 (dependent on binding technical standards). - Through ongoing engagement, the Central Bank determines whether banks have an adequately staffed, permanent and independent compliance function. - Irish licensed, High Impact and Medium High Impact banks have compliance functions in place; Medium Low Impact banks typically have a compliance officer in place. - The Corporate Governance Code (section 14.5) requires the Board to ensure compliance is independent of business units and has adequate resources and authority. - Credit Institutions are required to submit a compliance statement annually identifying any deviation from the Code which is reviewed by supervisors. - The Central Bank assesses the fitness and probity of incoming Heads of Compliance through the Fitness and Probity Standards 2011 and the Central Bank Reform Act 2010. Under the Code, the Head of Compliance is deemed to be “Pre-approval Control Function” (PCF12), requiring pre-approval by the Central Bank prior to appointment. - Approval/non-approval involves a desk-top review of CV, education and experience, previous regulatory/criminal history; applicants may be interviewed by the Central Bank. This is carried out by the Central Bank’s Regulatory Transactions Division in conjunction with Banking Supervision. - Suitability assessment of a compliance function is typically performed during a FRR/FRA, with review of documents including the compliance policy, terms of reference, compliance plan, organisational charts, resourcing analyses, and compliance updates to senior management and the board. - Supervisory teams for High Impact banks have regular engagement, typically quarterly, with the Head of Compliance; engagements are described as frequent, intrusive and challenging. - Lower Impact banks receive periodic assessment, desk review and exception reporting rather than ongoing engagement. ### EC4 — internal audit function requirements and supervisory assessment - The supervisor determines that banks have an independent, permanent and effective internal audit function charged with: - (a) assessing whether existing policies, processes and internal controls (including risk management, compliance and corporate governance processes) are effective, appropriate and remain sufficient for the bank’s business; and - (b) ensuring that policies and processes are complied with. - Description and findings re EC4: - Through ongoing engagement and themed inspections, the Central Bank determines if banks have an adequately staffed, permanent and independent internal audit function. - Supervisors assess compliance with audit requirements of the Corporate Governance Code through day-to-day supervision, receipt and review of the ICAAP portal followed by a FRR/FRA, and via the review of credit institutions’ annual compliance statements. - There is not an explicit legal requirement that banks must have an internal audit function or appoint a Head of Internal Audit. The Central Bank can require compliance via Regulation 70 of S.I. 661 of 2006 and can place conditions on licences under Section 10 of the Central Bank Act 1971 to require an independent, permanent and effective internal audit function. - All High Impact licenced banks in Ireland have a local internal audit function in place. Medium High Impact and Medium Low Impact banks are permitted to rely on the internal audit function of their parent. In High Impact banks, the Head of Internal Audit is a permanent and independent position. - High Impact credit institutions are required to establish an audit committee (Section 18.1 of the Corporate Governance Code). Medium High Impact and Medium Low Impact credit institutions may in certain circumstances rely on the board to act as an audit committee, or rely on a group audit committee. - The Corporate Governance Code (Section 19) stipulates audit committee requirements including: - the circulation of meeting agendas; - detailed minutes of meetings; - the appointment of audit committee members; - the attendance at audit committee meetings; - the review of audit committee membership; and - the reporting of the audit committee to the board. - The Central Bank applies EBA Guidelines on Internal Governance (GL44): - Section 29 requires the internal audit function “shall assess whether the quality of an institution’s control framework is both effective and efficient.” It states that “the internal audit function should have unfettered access to relevant document and information in all operational and control units.” It adds that “the internal audit function should evaluate the compliance of all activities and units of an institution with its policies and procedures.” - Section 29 requires that internal audit is not combined with any other function, and that it “should assess whether existing policies and procedures remain adequate and comply with legal and regulatory requirements.” It states that “internal audit work should be performed with an audit plan and detailed audit programs following a risk based approach. The audit plan should be approved by the audit committee or the management body.” It adds that “internal audit should report directly to the management body and or its audit committee its findings and suggestions for material improvements to internal controls.” - “All audit recommendations should be subject to a formal follow-up procedure by the respective levels of management to ensure and report their resolution.” - For High Impact and Medium High Impact banks, supervisors are required to meet with internal audit at least annually. PRISM requires supervisors of High Impact and Medium High Impact firms to meet with a senior non-executive director every year. Medium Low Impact firm supervisors are required to meet with a senior non-executive director every 18 months. - If a risk is identified, or a supervisor determines the need, internal audit will be more actively assessed. - The Central Bank carried out a review of the Effectiveness of Internal Audit Functions in 2011 with objectives to: 1. Assess whether the internal audit function was fulfilling its pivotal role as the so-called “third line of defence” within a credit institution in carrying out independent evaluation and validation of the system of internal controls through risk-based audit procedures; and whether, in turn, the Central Bank is able to place reliance on this function; and 2. Provide feedback/observations in the form of a letter to the industry on findings from the review based on conclusions drawn from the examination of the institutions selected for inclusion in the review and to issue a press release. *Source: _cr14135 - Section 12.1 of the Code is the most specific requirement in relation to the role of the* ### 3. To inform the development of the Central Bank’s supervisory framework in ### 3. To inform the development of the Central Bank’s supervisory framework in relation to internal governance. ### Review scope and high-level finding - Review covered 11 credit institutions and 11 insurance undertakings. - Overall finding: institutions were broadly in line with Good Practice Standards. - In 9 of the 11 credit institutions covered within the scope of the review, it was concluded that the Central Bank can place reliance on the Internal Audit Function to fulfil adequately its pivotal role as a “third line of defence”. ### EC5 — Internal audit function (essential criteria a–g) - EC5 lists that the supervisor determines the internal audit function: - (a) has sufficient resources, and staff that are suitably trained and have relevant experience to understand and evaluate the business they are auditing; - (b) has appropriate independence with reporting lines to the bank’s Board or to an audit committee of the Board, and has status within the bank to ensure that senior management reacts to and acts upon its recommendations; - (c) is kept informed in a timely manner of any material changes made to the bank’s risk management strategy, policies or processes; - (d) has full access to and communication with any member of staff as well as full access to records, files or data of the bank and its affiliates, whenever relevant to the performance of its duties; - (e) employs a methodology that identifies the material risks run by the bank; - (f) prepares an audit plan, which is reviewed regularly, based on its own risk assessment and allocates its resources accordingly; and - (g) has the authority to assess any outsourced functions. ### Description and supervisory practices for EC5 - Assessment mechanisms used by the Central Bank: - Financial Risk Reviews carried out annually for High Impact banks. - Full Review Assessments once every two years for Medium High Impact banks. - Desk-top reviews of staffing levels at internal audit functions, reviews of internal audit reports, and interviews with the head of internal audit. - Supervisors meet with head of internal audit annually (for High Impact) and biennially (for Medium High Impact); internal audit staffing is discussed. - Review of banks’ annual audit plans and completion (or not) of the plan. - Full Review Assessments include assessment of EC5(b) and governance and reporting lines; supervisors require internal audit functions to report directly to the board and not to line of business heads. - Compliance with EC5(c) assessed through periodic meetings with the Head of Internal Audit (High and Medium High Impact banks); supervisors typically require internal audit to periodically review the bank’s risk management strategy, policies and processes and report to the Internal Audit Committee and/or Board. - Compliance with EC5(d) assessed through desktop review of internal audit terms of reference to ensure full access to staff and records. - Compliance with EC5(e) assessed through periodic meetings with Head of Internal Audit; supervisors typically require an annual audit plan based on assessment of material risks and controls. - For High Impact and Medium High Impact banks, compliance with EC5(f) is assessed through desktop reviews of annual audit plans, sufficiency of resources to complete the audit plan, and assessments of how much of audit plans are actually completed; for High Impact banks, supervisors periodically meet with the Head of Internal Audit to discuss the audit plan. - Supervisory teams covering High Impact and Medium High Impact credit institutions (except one High Impact bank which only receives audits which receive a “non-satisfactory” rating) require banks to provide all internal audit reports and will follow up, particularly where weaknesses are identified. - For Medium Low Impact credit institutions, there is no requirement to meet with the Head of Internal Audit; meetings can be arranged as and when SREP/FRAs are completed. The quality of internal audit arrangements is considered within the firm’s Governance Risk rating and supervisors must consider the quality of a bank’s group Internal Audit structures where these are relied upon. - Supervisors also review Audit Committee packs periodically. - The Central Bank demonstrated several examples of onsite and offsite activities (routine and ad hoc) to assess effectiveness of internal audit and where necessary take action. ### Assessment of Principle 26 (internal controls / internal audit) - Assessment: Largely compliant - Comments: - The Central Bank determines whether banks have adequate internal control mechanisms and robust governance arrangements through a range of routine and ad hoc activities. - For High Impact banks (which represent the bulk of retail assets), supervisors maintain awareness of activities in each key business unit, assess inherent risk profile, and undertake assessments of the control environment. - Examples of onsite and offsite activities evidenced the supervisor’s ability to ensure banks had adequate control functions commensurate with the risk profile and to take action when necessary. - For banks with an Impact rating below Medium High, supervisory activities rely upon periodic assessment (Full Risk Assessment), desk-based review of exception reporting. - There is no explicit legal/regulatory requirement for banks to establish an internal audit function or appoint a head of internal audit; the Central Bank can require a function or head of Internal Audit be put in place by means of a license condition. - In practice, all Irish licensed banks either have a local Internal Audit function or are covered by a group Internal Audit function. ### Principle 27 — Financial reporting and external audit (overview) - Principle 27: The supervisor determines that banks and banking groups maintain adequate and reliable records, prepare financial statements in accordance with accounting policies and practices that are widely accepted internationally and annually publish information that fairly reflects their financial condition and performance and bears an independent external auditor’s opinion. The supervisor also determines that banks and parent companies of banking groups have adequate governance and oversight of the external audit function. ### EC1 — Board/management responsibility for financial statements - EC1: The supervisor holds the bank’s Board and management responsible for ensuring that financial statements are prepared in accordance with accounting policies and practices that are widely accepted internationally and that these are supported by recordkeeping systems to produce adequate and reliable data. - Description and findings: - Credit institutions in Ireland are subject to the Companies Acts 1963 to 2012 for financial reporting; banks required to prepare financial statements in accordance with accounting policies and practices as per the Companies Act (Section 202). - The Central Bank, through Section 21.6(d) of the Corporate Governance Code, holds the bank’s Board responsible for preparation of financial statements; Audit Committee responsible for reviewing financial announcements and recommending approval of annual accounts. - All publicly quoted EU incorporated companies must prepare consolidated financial statements in accordance with IFRS as endorsed by the European Commission; relevant legislation S.I. 116 of 2005. - Companies have a choice in some instances between IFRS or Irish GAAP; relevant legislation is Part V of the Companies Act 1963 (sections 148 to 150C inclusive). - Section 202 of the Companies Act 1990: management is responsible for the preparation of the Books of Account. Books of Account must: - Correctly record and explain the transactions of the company; - Enable the financial position of the company to be determined with reasonable accuracy at any time; - Enable the directors to ensure that the annual financial statements comply with the requirements of the Companies Acts 1963 to 2012, and relevant accounting standards; - Enable the annual financial statements of the company to be readily and properly audited; - Be kept on a continuous and consistent basis and entries should be made in a timely manner and should be consistent from one year to the next; - Give a true and fair view of the state of affairs of the company and explain its transactions; and - Be kept in written form or in other form that may be readily accessible and convertible into written form. - Books of Account must contain: - Entries of all monies received and expended by the company and the matters in respect of which the receipts and expenditure takes place; - A record of all assets and liabilities of the company; and - Further specific information depending on whether the company’s business involves dealing with goods or the provision of services. - Companies within Ireland may prepare “Companies Act Individual Accounts” (section 149 of the Companies Act, 1963) or financial accounts under the requirements of the IFRS (section 149A of the Companies Act, 1963). - Companies Act Individual Accounts may use Generally Accepted Accounting Standards in UK and Ireland issued by the Financial Reporting Council (FRC), which have largely converged with IFRS. - Section 5(1) of S.I. 294 of 1992 European Communities (Credit Institutions: Accounts) Regulations (CI Accounts Regulations) requires credit institutions prepare financial statements under section 149 of the Companies Act 1963 as modified by the CI Accounts Regulations or IFRS. - Under Section 205A of the Companies Act 1990 companies must include a statement whether financial statements have been prepared in accordance with applicable accounting standards and note any material departure; failure to comply is an offence. - Banking Supervision correspond with all credit institutions (generally during Q2) seeking information, including copies of audited financial statements. - Financial statements are not reviewed to determine compliance with IFRS/local GAAP (assumed from external auditors’ sign-off); IAASA is competent authority for enforcing accounting standards in Ireland under the Transparency Directive regulations. - The Central Bank will hold banks to standards established in the Companies Act through its supervision. ### EC2 — External auditor’s opinion and auditing standards - EC2: The supervisor holds the board and management responsible for ensuring financial statements issued annually to the public bear an independent external auditor’s opinion from an audit conducted in accordance with internationally accepted auditing practices and standards. - Description and findings: - This requirement is set out in the Companies Act 1963 rather than by the Central Bank. - Section 148(1) of the Companies Act 1963: directors must prepare accounts at least once in every calendar year. - Sections 193(1) and (2) of the Companies Act 1990: auditor shall make a report to members on individual and group accounts; report to be read at AGM and open to inspection. - Section 13 of S.I. 294 of 1992 (CI Accounts Regulations) requires auditor to make a report in accordance with section 193 of the Companies Act 1990 and that a bank shall not be subject to an exemption from obtaining an audit. - Regulation 54(1) of The European Communities (Statutory Audits) (Directive 2006/43/EC) Regulations 2010 (S.I. 220 of 2010) requires all statutory audits be carried out in accordance with international auditing standards. - The Financial Reporting Council (FRC) issues auditing standards based on the IAASB standards, referred to as International Standards on Auditing (UK and Ireland) and are comparable to International Standards on Auditing in all material respects. - International Standard on Auditing (UK and Ireland) 700, “The Auditors Report On Financial Statements” (as revised in June 2013), requires the auditor to include a statement as to whether the audit has been conducted in accordance with International Standards on Auditing (UK and Ireland). ### EC3 — Valuation practices and reconciliations - EC3: Supervisor determines banks use valuation practices consistent with accounting standards widely accepted internationally; framework for fair value estimation subject to independent verification and validation; banks document significant differences between valuations for financial reporting and regulatory purposes. - Description and findings: - Central Bank assesses, during on-site and off-site reviews, whether valuations used for regulatory purposes are reliable and prudent; where not sufficiently prudent, the Central Bank requires adjustments to reporting for capital adequacy or regulatory reporting. - Differences between financial statements and prudential reporting are identified as part of the annual reconciliation process whereby credit institutions are required to reconcile annual financial statements with key COREP and FINREP templates. - Central Bank expects listed credit institutions to apply IFRS while non-listed entities expected to apply a recognised standard (GAAP or IFRS). - Credit institutions using the standardised approach to calculate credit risk will use valuations based on accounting standards; those on the IRBA will use their internal valuations to calculate credit risk. - Valuation requirements are consistent under both reporting regimes and are subject to external audit. - Credit institutions are required to file prudential returns based on: - EBA guidelines on supervisory reporting (COREP – solvency; FINREP – financial information; Large Exposures). - The Central Bank of Ireland guidelines on supervisory reporting (Liquidity, Impairment return, QSFR, Sectoral Return, Related Party Lending Return, etc.). - The FINREP return is based on the accounting standards used in the annual audited financial statements; classification of securities portfolios for FINREP follows same criteria and valuation rules as annual financial statements (IFRS/local GAAP). - When IFRS were introduced in Ireland in 2005, the Central Bank required ‘prudential filters’ be applied for regulatory reporting purposes (COREP returns incorporate these). Prudential filters must also be applied to local GAAP based figures as local GAAP have converged with IFRS. - Central Bank issued letters to credit institutions on 24 December 2004, 21 July 2005 and 29 September 2005 advising of Central Bank requirements for prudential filters. Letters also issued on 18 February 2009 regarding pensions and on 22 December 2006, 22 and 23 February 2007 regarding dividends. ### EC4 — Scope and standards for external audits - EC4: Laws or regulations set, or the supervisor has the power to establish, the scope of external audits of banks and the standards to be followed, requiring a risk and materiality based approach in planning and performing the external audit. - Description and findings re EC4: (section header present; detailed findings not included in supplied excerpt) *International Monetary Fund — Ireland chapter excerpt (content unit: 3. To inform the development of the Central Bank’s supervisory framework in relation to internal governance).* ### Section 193 of the Companies Act, 1990 sets out the scope of the external audit. Regulation ### Section 193 of the Companies Act, 1990 sets out the scope of the external audit. Regulation ### Scope and applicable auditing standards - Regulation 54(1) of The European Communities (Statutory Audits) (Directive 2006/43/EC) Regulations 2010 (SI220 of 2010) requires that all statutory audits are carried out in accordance with international auditing standards. - The Financial Reporting Council (FRC) issues auditing standards, based on those standards issued by the International Auditing and Assurance Standards Board, modified to take into account legislative requirements within the UK and Ireland. - These standards are referred to as International Standards on Auditing (UK and Ireland) and are comparable to International Standards on Auditing in all material respects. - The FRC issued Practice Note 19(I) The Audit of Banks in the Republic of Ireland in June 2008. - Practice Notes are persuasive rather than prescriptive, supplementary to International Standards on Auditing (UK and Ireland), and considered indicative of good auditing practice. ### Central Bank legal powers and practical influence over external audits - The Central Bank currently does not have the power to formally establish the scope of an external audit of a bank or to establish the standards to be followed in performing such audits. - In practice, the Central Bank has relied upon its supervisory efforts to influence the scope of external audit with good effect. - If the CBI has a specific area of concern it can undertake one of the following: - Carry out an on-site examination in the area of concern; - Issue an RMP to the bank to rectify the situation. Such RMPs can also include the requirement for the firm to initiate an independent assessment of the area of concern; and/or - Implement a skilled persons’ review of the area of concern. ### Statutory provisions allowing the Central Bank to commission reports - Section 27E of CBA 1997 allows the Central Bank to commission a report from an auditor of any regulated entity, or an affiliate of the auditor, on all or any of the following: - a) the regulated firm’s accounting or other records; - b) the systems (if any) that the regulated firm has in place to ensure that the firm acts prudently in the interests of its members and the interests of those to whom the firm provides financial services; - c) any other matter in respect of which the Central Bank requires information about the firm, or the firm’s activities, to enable the Central Bank to perform a function imposed on it by or under an Act. - Under Section 47(2) of the Central Bank Act, 1989 the auditor of a bank may be requested to furnish a report on whether the bank has or has not complied with a specified obligation of a financial nature under the Central Bank Acts. ### Skilled Persons’ Reports and the Central Bank (Supervision and Enforcement) Act 2013 - Part 2 of the Central Bank (Supervision and Enforcement) Act 2013 provides the Central Bank with the right, for the purposes of the proper and effective regulation of a financial service provider, to request a report on any matter as required by the Central Bank. - The person preparing the report must be sufficiently skilled to prepare such reports and must be nominated or approved by the Central Bank, and therefore the Central Bank is not limited to only using the External Auditor to provide the report. ### Auditor assurance on internal governance: working group and guidance - In June 2011 the Central Bank communicated with the Irish Banking Federation (IBF), Irish Insurance Federation (IIF) and Dublin International Insurance and Management Association (DIMA) setting out a proposed response in relation the recommendation by the Comptroller & Auditor General (C&AG). - The Risk, Governance and Accounting Policy Division established a working group with relevant audit bodies and IAASA. The working group has focused on setting out a proposed framework for how auditors should provide assurance on the internal governance arrangements of regulated entities. - Output to date includes the production of initial drafts of internal governance guidance, guidance for auditors and an initial draft of the auditor’s assurance report. - Powers to implement a generally applicable standing requirement on auditors in respect of assurance over internal governance were included in the Central Bank (Supervision & Enforcement) Act 2013. - The Central Bank will, together with the working group, develop specific guidance for Auditors in relation to the provision of assurance over internal governance. At a minimum this guidance will set out: - the scope and required form of reporting; - the nature and extent of testing to be performed by the auditor; and - communication protocols between the auditor and Central Bank in relation to findings. ### Supervisory expectations and audit coverage (EC5) - Supervisory guidelines or local auditing standards determine that audits cover areas such as the loan portfolio, loan loss provisions, nonperforming assets, asset valuations, trading and other securities activities, derivatives, asset securitizations, consolidation of and other involvement with off-balance sheet vehicles and the adequacy of internal controls over financial reporting. - Local auditing standards and Practice Notes determine that audits cover the areas listed in EC5. - The Irish Practice Notes relevant to regulated entities were developed by the Accountancy Bodies in Ireland, with advice and assistance from the Central Bank, under the auspices of the Institute of Chartered Accountants in Ireland (ICAI), and then issued by the FRC. ### Engagement with auditing bodies and internal coordination - The Central Bank engages with the Consultative Committee of Accountancy Bodies – Ireland (‘CCAB-I’) regarding issues of mutual interest and to assist auditors in the development of guidance (Practice Notes, Miscellaneous Technical Statements, Information Notes) to assist auditors of regulated entities. - CCAB-I comprises the Association of Chartered Certified Accountants, the Chartered Institute of Management Accountants, the Institute of Certified Public Accountants and the Institute of Chartered Accountants in Ireland. - The Head of Risk, Governance and Accounting Policy Division is a member of the APB’s Irish Stakeholders Group established by the FRC. - The Head of the Risk, Governance and Accounting Policy Division of the Central Bank is a member of the Board of IAASA. - Risk, Governance and Accounting Policy Division seeks to: - assess the implications of new auditing standards and legislation impacting on the supervision of financial institutions and financial stability; - influence debate during the course of the development of these standards and legislation; - monitor developments within Europe and internationally through participation at EBA and IOSCO standing committees and working groups and provide briefings as required on same; - prepare discussion and consultation papers on key issues arising; - proactively seek to develop policy initiatives which will result in more effective and efficient regulation e.g. auditor assurance project; - produce and maintain “Frequently Asked Questions” documents in order to provide clarity in relation to key issues for the Central Bank; and - provide technical advice, training and interpretation of issues to the supervision teams within the Central Bank. - Supervisors, as part of the Auditor Protocol meetings, would give their opinion with respect to the adequacy of impairment provisioning levels or otherwise and request auditors to take this into account. ### Power to reject or rescind appointment of an auditor (EC6) - The Central Bank does not have the power to remove an auditor. This power is reserved for shareholders under company law. - The Central Bank requested that it be granted a power to remove an auditor of a regulated firm within the Central Bank (Supervision and Enforcement) Bill 2011 but this was rejected by the Department of Finance. - While the Central Bank does not have the power to remove an auditor from office immediately, the Central Bank is able to prevent an auditor from being put in office and prevent the auditor from being reappointed in the next report period. - The Central Bank has a power to veto the appointment or re-appointment of an auditor of a bank or the filling of a casual vacancy of auditor. Section 46(2) of the Central Bank Act, 1989 provides that, where the Central Bank is of the opinion that it would not be in the interest of depositors or of the ‘orderly and proper’ regulation of banking, the Central Bank has the power to issue a Direction to the bank not to appoint or not to reappoint a named person to the office of auditor, or the directors not to fill a casual vacancy with a named person as auditor. - A credit institution is required to provide the Central Bank with at least 15 days’ notice prior to filling the post of the auditor of the firm (Section 46(1) of the Central Bank Act 1989). This power enables the Central Bank to direct the bank not to appoint the proposed auditor. - Per Section 160(1) of the Companies Act, 1963, every company is required to appoint an auditor or auditors to hold office from the conclusion of the AGM of the Company until the conclusion of the next AGM of the Company. The Central Bank is entitled to prevent the auditor from being reappointed for the next reporting period. - The Central Bank is the central competent authority for the purposes of the Transparency Directive, but IAASA has been designated as the competent authority for the purposes of the financial reporting monitoring and enforcement role (i.e. Article 24(4)(h) of the Directive). IAASA – through its Financial Reporting Supervision Unit – is responsible for monitoring whether the periodic financial reporting (annual and half yearly reports) of Issuers comply with framework requirements set out in the Directive as transposed into Irish law and for taking appropriate action where non-compliance is identified. - If the Central Bank suspects that poor quality audits have been performed on a regulated entity, there is a legal ‘gateway’ under which a complaint can be made to the relevant Recognised Accountancy Body and to IAASA. - Section 33AK(5)(w) of the Central Bank Act, 1942 provides the Central Bank with a legal ‘gateway’ to disclose confidential information to the auditor of an individual supervised entity, subject to subsection 33(1), in accordance with the Supervisory Directives. *Source: _cr14135 - Section 193 of the Companies Act, 1990 sets out the scope of the external audit. Regulation* ### Section 33AK(5)(x) of the Central Bank Act, 1942 provides the Central Bank with a similar ### _cr14135 - Section 33AK(5)(x) of the Central Bank Act, 1942 provides the Central Bank with a similar ### Legal gateway and oversight of auditors - Section 33AK(5)(x) of the Central Bank Act, 1942 provides the Central Bank with a legal ‘gateway’ to disclose confidential information concerning auditors to ‘Oversight Bodies’ (the ‘Recognised Accountancy Bodies’ and IAASA). - The provision does not extend to the ‘accountant’ members of the ‘Prescribed Accountancy Bodies’. - The gateway has been used to lodge complaints regarding auditors to the Recognised Accountancy Bodies, which then assess complaints using their own monitoring and disciplinary procedures. - IAASA current role and powers: - IAASA currently carries out an oversight role over the Prescribed Accountancy Bodies. - Under Section 23 of the Companies (Auditing and Accounting) Act 2003, IAASA may conduct its own enquiries following receipt of a complaint or on its own initiative. - Under Section 24 of the Companies (Auditing and Accounting) Act 2003, IAASA may conduct its own investigations if, in its opinion, it is appropriate or in the public interest. - IAASA has carried out enquiries in the past but there is no public information available on any Investigations that may be in progress. - Central Bank legal actions and powers: - There is no evidence the Central Bank has used its power to veto the appointment of an auditor in the past. - The Central Bank has not taken legal action against external auditors for negligence relating to a poor quality audit, because the Central Bank has no jurisdiction regarding the oversight of auditors. - If there is a suspicion of a poor quality audit the Central Bank has a legal gateway (Section 33AK(5)(x)) to disclose confidential information to the Recognised Accountancy Body and to IAASA. ### External auditor rotation (EC7) - Regulatory requirements: - Regulation 77 of the European Communities (Statutory Audits) (Directive 2006/43/EC) Regulations 2010 (S.I. 220 of 2010) requires the partner responsible for carrying out the engagement to rotate after having completed 7 years on the engagement. - The partner is prohibited from involvement with the client for 2 years after the date of rotation. - Definition of “key audit partner” or “key audit partners”: - a) the one or more statutory auditors designated by a statutory audit firm for a particular audit engagement as being primarily responsible for carrying out the statutory audit on behalf of the audit firm, or - b) in the case of a group audit, at least the one or more statutory auditors designated by a statutory audit firm as being primarily responsible for carrying out the statutory audit at the level of the group and the one or more statutory auditors designated as being primarily responsible at the level of material subsidiaries, or - c) the one or more statutory auditors who sign the audit report. - Ethical Standards and stricter rotation: - Auditors are required to apply the Ethical Standards for Auditors as issued by the FRC based on the Code of Ethics for Professional Accountants developed by the International Ethics Standards Board for Accountants. - APB Ethical Standard 1 “Integrity, Objectivity and Independence” requires the audit engagement partner to identify and assess circumstances which could adversely affect objectivity (‘threats’) and to apply procedures (‘safeguards’) to eliminate or reduce the threat to an acceptable level. - APB Ethical Standard 3 (ES3) “Long association with the audit engagement” provides requirements and guidance on long association and gives examples of safeguards; where safeguards are not possible, the auditor does not accept or withdraws from the audit engagement. - ES3 requires partner rotation after 5 years and prohibits involvement with the firm for a further 5 years in the case of a listed entity. - In practice the audit partner of a public interest entity would adhere to the stricter 5 year rotation period under ES3 rather than the 7 year rotation period required by Regulation 77. - Supervisory practice: - Supervisors of banks rated High Impact generally seek information on the rotation of engagement partners. - This is generally not the case for Medium High Impact and Medium Low Impact credit institutions. ### Meetings between supervisor and external audit firms (EC8) - Required meeting frequency by PRISM impact category: - High: At least annual - Medium-High: At least annual - Medium-Low: Every 18 months - Low: Not required - (Branches are not separate legal entities requiring an audit) - Auditor Protocol expectations: - Auditor Protocol (Paragraph 9) expects at least two formal meetings per year, to take place at the pre-audit stage and the post-audit stage. - The Auditor Protocol applies in the first instance to High Impact firms under PRISM. - Central Bank engagement and working group: - Since October 2011 the Central Bank established a working group including: - the IAASA - the Big 4 Accounting Firms (PWC, Deloitte, KPMG and Ernst & Young) - the Institute of Chartered Accountants Ireland - ACCA Ireland - The Central Bank also engages with the Consultative Committee of Accountancy Bodies – Ireland (‘CCAB-I’) on issues of mutual interest and to assist auditors in development of guidance (Practice Notes, Miscellaneous Technical Statements, Information Notes) for auditors of regulated entities. ### Auditor reporting duties to the supervisor (EC9) - Circumstances triggering duty to report: - The auditor has a duty to report to the Central Bank under prescribed enactments when the auditor becomes aware while carrying out the audit and has reason to believe that: - There are matters affecting the continuous functioning of the firm or that the firm may not be able to fulfill its obligations to repay customers; - There are indications of a material breach of financial services law or regulations or of any related condition, requirement, code, guideline, notice or direction issued under such law/regulations; - There are material defects in the accounting records, or in the systems of control; - There are material inaccuracies in or omissions from any returns of a financial nature made by the regulated firm to the Central Bank; - The auditor intends to issue a qualified audit opinion or to resign and not seek re-election as auditor. - Legal protection for auditors: - Auditors are provided with legal protection from liability under Section 47(6) of the Central Bank, 1989 where such reports are made. - International Standard of Auditing (UK and Ireland) 250 Section B – “The Auditor’s Right And Duty To Report To The Regulators In The Financial Sector” addresses the auditor’s ‘right’ and ‘duty’ to report to regulators. - Legal protection: auditors do not contravene the duty of confidentiality owed to their clients in fulfilling the duty to report to regulators (provided they act in good faith). - Statutory provisions and Central Bank Act 1997 specific duties: - Sections 47 and 47A of the Central Bank Act, 1989 and Regulations 7, 8 and 9 of the Supervision of Credit Institutions, Stock Exchange Member Firms and Investment Business Firms Regulations set out obligations (including application to ‘closely linked’ entities and amendments to include electronic money institutions and UCITS). - Central Bank Act 1997 provisions: - 27B: mandatory annual requirement on the auditor to report whether circumstances have arisen which would require the auditor to report to the Central Bank under a prescribed enactment and whether the financial service provider has complied with the requirement to provide a compliance statement. - 27C: auditor required to provide copies of any reports provided to the Board or Management or a ‘Nil Return’ to the Central Bank. - 27D: when an auditor provides the Director of Corporate Enforcement with a report or document the auditor must also provide the Central Bank with a copy at the same time or as soon as practicable; the auditor is only required to report to the Director of Corporate Enforcement ‘indictable offences’ which come to their attention during the course of the audit. - 27E: Central Bank may commission the auditor to report on a number of matters. - 27F: Central Bank may request a copy of any record or document provided to or obtained by the auditor during the course of their audit. - 27H: provides auditors and affiliates with certain immunities from liability and legal protection regarding duty of confidentiality so long as they do not act in bad faith. ### Access to auditor working papers (AC1) - The Central Bank has the power to access external auditors’ working papers. - Section 27F of the CBA 1997 provides authority: - The Central Bank may “by notice in writing, require an auditor of a regulated financial service provider, or an affiliate of the auditor, to provide the Bank with a copy of any record or information provided or obtained by the auditor or affiliate in connection with an audit of the financial service provider’s accounts that is in the possession of the auditor or affiliate.” - The intention behind Section 27F is to enable the Central Bank to seek access to the working papers of the auditor in relation to such information. ### Assessment and supervisory limitations - Assessment of Principle 27: Largely Compliant - Comments and limitations: - Responsibilities for preparation of financial statements reside within the Companies Act; there is no specific provision in the Central Bank’s powers assigning those responsibilities. - The Central Bank, through Section 21.6(d) of the Corporate Governance Code, holds the bank’s Board responsible for preparation of financial statements; the Audit Committee is responsible to review financial announcements and reports and recommend approval of annual accounts. - The Central Bank does not have the power to reject and rescind the external auditor as required by EC6; this power is reserved for shareholders under company law. - Enforcement of Company Law is a matter for the Director of Corporate Enforcement while IAASA is the ultimate oversight body responsible for enforcing auditing standards. - The Central Bank cannot remove an auditor from office immediately, but can prevent an auditor from being put in office and prevent reappointment in the next report period. - Banks consult widely with the Central Bank regarding audit arrangements and appoint well recognized audit firms. - Existing legislation does not provide the Central Bank with the power to influence the scope of the external audit or establish the standards for such an audit. - Supervisors have had reasonable success in influencing the scope of external audits through engagement with auditors and banks. - The Central Bank seeks to influence accounting and auditing standards through its activities within the European Supervisory Authorities (EBA, EIOPA, ESMA) and inputs into audit Practice Notes. ### Disclosure and transparency (Principle 28) — Essential Criterion EC1 - Two types of disclosures affecting credit institutions: - (i) disclosures required in the financial statements of the entity; - (ii) disclosures required under Pillar III of the CRD. - Financial statements requirements: - Section 202 Companies Act 1990 (as Amended) requires directors to keep proper books of accounts and that these accounts should give a true and fair view. - Similar requirements are in Section 76 of the Building Societies Act, 1989 (as amended). - Credit institutions produce financial statements in accordance with either: - (i) IFRS as issued by the IASB and endorsed by the European Commission; or - (ii) Local (UK & Ireland) (Local GAAP) issued by the FRC and promulgated by the Institute of Chartered Accountants in Ireland. - All publicly quoted EU incorporated companies must prepare consolidated financial statements in accordance with IFRS as endorsed by the European Commission. - Relevant legislation governing ‘Accounts and Audit’ is Part V of the Companies Act 1963. - Financial statements of credit institutions are required to be audited. - IAASA is the independent competent authority with statutory responsibility for examining whether annual and half-yearly financial reports of Issuers within the Transparency Directive are drawn up in accordance with the relevant reporting framework; IAASA does not undertake this role for any other set of financial statements. The Central Bank has no role in this area. - The Central Bank monitors that credit institutions have issued financial statements under IFRS/Local GAAP and that these financial statements have an auditor’s opinion expressing whether they give a true and fair view. Banking Supervision requests copies of annual accounts signed off by external auditors, generally during Q2 each year. - Pillar III (CRD) disclosures: - Annex XII of the CRD requires banks to make certain disclosures (Pillar 3 disclosures) regarding capital and risk management. - The CRD was transposed into Irish law via S.I. 660 and 661 of 2006 European Communities (Capital Adequacy of Credit Institutions) Regulations, 2006. - Part 11 of S.I. 661 of 2006 sets out the Pillar 3 disclosure obligations applicable to credit institutions. - Central Bank Act 1971: - Section 17 requires holders of banking licenses to maintain any records as may be specified by the Central Bank from time to time. *International Monetary Fund — Selected Section of Report (excerpts).* ### Section 18 requires the holders of banking licenses to provide the Central Bank with ### _cr14135 - Section 18 requires the holders of banking licenses to provide the Central Bank with ### Section 18 reporting requirement - Section 18 requires the holders of banking licenses to provide the Central Bank with information and returns concerning the relevant business carried on by the credit institution as the Central Bank specifies from time to time. ### Role of the Central Bank in financial disclosures and Pillar 3 - The Central Bank does not play a role in assessing whether the financial statements of credit institutions are compliant with accounting standards. - The Central Bank has a procedure in place with an operational checklist to review compliance for Pillar III disclosures. - Ireland adopts a non-prescriptive approach to practical aspects of Pillar 3 publication (timelines, presentation formats, verification of disclosures) due to the market-discipline nature of Pillar 3. - Regulation 16 of S.I. 661 of 2006: EU based parents of credit institutions must comply with Part 11 on the basis of their consolidated financial situation; significant subsidiaries need only disclose certain more limited information. - The Central Bank considers subsidiaries that represent 5% or more of group assets and/or have a market share in any sector or group of connected sectors greater than or equal to 20% to constitute a significant subsidiary. - The Central Bank monitors Pillar III disclosures by checking for disclosures of key solvency and risk information against its own checklist. ### EC2 — scope of required disclosures and supervisory checks - Required disclosures include both qualitative and quantitative information on: - financial performance, financial position, risk management strategies and practices, risk exposures, aggregate exposures to related parties, transactions with related parties, accounting policies, and basic business, management, governance and remuneration. - Scope, content, level of disaggregation and detail are commensurate with the risk profile and systemic importance of the bank. - The Central Bank monitors whether credit institutions have issued financial statements under IFRS/Local GAAP and whether these have an auditor’s opinion expressing that they give a true and fair view. - Banking Supervision requests copies of annual accounts signed off by external auditors, generally during Q2 each year. - Related party transaction disclosures in financial statements are compared with reports submitted under the Central Bank’s Code on Lending to Related parties (see CP20). - Pillar 3 disclosures are compared with quantitative information submitted in regular supervisory returns, which provide an ongoing reflection of the firm’s business activities. - The Central Bank’s operational checklist for Pillar 3 relates to quantitative information available from other sources (e.g., supervisory returns) and does not include qualitative information. - If credit institutions fail to provide adequate Pillar III disclosures, the Central Bank may take enforcement procedures based on non-compliance with CRD requirements; to date, there has been no requirement to undertake enforcement procedures. ### Related party disclosures and legal framework - Credit institutions are required to make public disclosures of related party transactions. - Conditions imposed on banks and directions on building societies by the Central Bank in August 2009 required public disclosure of lending to connected persons in annual financial statements. - Companies Acts 1963 to 2012 require disclosures in respect of related party lending under sections relating to Directors’ remuneration and transactions (including details of lending on ‘favourable’ terms to connected persons). - Building Societies Act 1989 requires building societies to make certain disclosures regarding transactions with Directors. - Disclosures are required regarding related party transactions that are material and not conducted under normal market conditions by Directive 2006/46/EC; implemented in Ireland by S.I. 450 of 2009 and amendments to S.I. 294 of 1992 for credit institutions. - Accounting standards (IAS 24 / FRS 8) contain disclosure requirements on Related Party Disclosures. - Regulation 7 of S.I. 294 of 1992 / European Communities (Credit Institutions: Accounts) Regulations 1992 requires credit institutions to disclose information on related parties, remuneration and details of group undertakings. - Disclosures by the covered banks included significant disclosure of material in relation to impairment and provisions broken down into considerable detail. ### EC3 — group structure disclosures and consolidation scope - IAS 27, IAS 28 and IAS 31 (for IFRS) and FRS 2 and FRS 9 (for Local GAAP) require disclosure of material entities in group structure in financial statements. - Regulation 7 of S.I. 294 of 1992 requires credit institutions to disclose information of group undertakings. - For supervisory purposes, the scope of consolidation is the CRD rather than IAS/IFRS consolidation; group structure relates to the scope under CRD consolidation. - Credit institutions submit high-level information on subsidiaries under the CRD scope of consolidation as part of regular supervisory returns; these can be crosschecked against organisation charts on record. - The CBI can crosscheck the list of subsidiaries in Pillar 3 disclosures against high-level CRD consolidation information in supervisory returns. ### EC4 — enforcement of disclosure standards and roles of authorities - IAASA is the independent competent authority in Ireland with statutory responsibility for examining whether annual and half-yearly financial reports of Issuers within the Transparency Directive remit are drawn up in accordance with the relevant reporting framework (S.I. No. 277 of 2007). - IAASA’s remit applies to entities whose securities have been admitted to trading on a regulated market within the EEA; IAASA does not undertake this role for any other set of financial statements. - The Central Bank has no role in assessing compliance with accounting/reporting frameworks under IAASA’s remit. - All financial statements of credit institutions licensed by the Central Bank are audited by “Big 4” audit firms required to provide an opinion as to whether the financial statements give a true and fair view. - The Central Bank’s Pillar III compliance checklist relates to quantitative information only available from other sources (e.g., supervisory returns) and does not include qualitative information. - The Central Bank may take enforcement procedures for inadequate Pillar III disclosures based on non-compliance with CRD requirements; to date, no enforcement procedures have been required. ### EC5 — public publications and aggregate banking system information - The Central Bank regularly publishes information on the banking system via its own publications and by providing data for third party publications. - Publications and data include: - Monthly Statistics - a quarterly report on sectoral developments in private sector credit - investment funds - securities issues - quarterly financial accounts - an aggregated balance sheet of the covered banks providing details of liabilities covered by the government guarantee - mortgage arrears data - Macro Financial Review - Money and Banking Statistics - Securities Issues of Irish Resident Entities - Quarterly Financial Accounts for Ireland - Irish Locational Banking Statistics - Trends in Business Credit and Deposits Q4 2012 - The Central Bank contributes to IMF publications on Financial Soundness Indicators for deposit takers. - The Central Bank contributes to an ECB publication of indicators of financial and solvency/risk parameters as part of its annual assessment of financial stability within the EU; data covers aggregate consolidated profitability, balance sheets and solvency of EU banks, divided into three size groups: small, medium-sized and large, and provides information on foreign-controlled institutions active in EU countries. ### Additional Criteria AC1 — disclosures on exposures during reporting period - To produce financial statements giving a true and fair view, a credit institution would need to provide: - an income statement and statement of financial position under IAS 1 for IFRS reporters; or - a profit and loss account under FRS 3 and balance sheet under various FRSs for Local GAAP reporters. - Credit institutions must comply with IFRS 7 (same as FRS 29 (Local GAAP)) — Financial Instruments: Disclosure — whose objective is to require entities to provide disclosures enabling users to evaluate: a) the significance of financial instruments for the entity’s financial position and performance; and b) the nature and extent of risks arising from financial instruments to which the entity is exposed during the period and at the end of the reporting period, and how the entity manages those risks. ### Assessment of Principle 28 - Assessment: Compliant - Comments: - Credit Institutions licensed by the Central Bank of Ireland produce financial statements in accordance with either IFRS or Local GAAP. - IAASA is the independent competent authority in Ireland with statutory responsibility for examining whether annual and half-yearly financial reports of Issuers within the Transparency Directive remit are drawn up in accordance with the relevant reporting framework (S.I. No. 277 of 2007). - Pillar 3 disclosures are typically included in banks’ annual reports and include both qualitative and quantitative disclosures including approaches to risk management and portfolio composition. - Supervisors assess annual financial disclosures as part of routine supervisory framework via desk-top reviews to evaluate transparency, accuracy and consistency with regulatory returns. - The Central Bank ensures financial statements have an auditor’s opinion as to whether they give a true and fair view. - The Central Bank regularly publishes information on the banking system via its own publications and by providing data to third party publications. ### Principle 29 — Abuse of financial services (AML/CFT and financial sanctions) - EC1 — legal duties, responsibilities and powers of the supervisor: - The CBI was appointed competent authority under the CJA2010 for supervision and enforcement of compliance by credit and financial institutions with obligations imposed by the CJA2010. - The CBI is responsible for securing compliance by c.10, 000 regulated financial services firms with AML/CFT obligations. - CBI powers include: a. pursue administrative sanction or criminal action in respect of: i. A breach of CJA2010 or ii. A failure to execute a direction b. give directions under S. 71 of the CJA2010 to discontinue or take certain actions - The CBI is the competent authority for the purposes of EU Financial Sanctions in Ireland; Ireland designates the CBI as competent authority by identifying it in the relevant annex to each EU Financial Sanctions Regulation. - The legislation governing financial sanctions consists of statutory instruments and directly effective EU Regulations imposing obligations to apply freezing, prohibitive and reporting measures. - Identified deficiencies: the manner in which obligations under EU Regulations have been given effect within the State does not: (a) provide an appropriate sanctions regime for non-compliance with obligations imposed by the EU Regulations and the domestic statutory instruments; or (b) impose obligations to put in place the infrastructure (policies, processes, systems, records etc.) necessary to identify, prevent and detect financial assets owned by, or financial transactions involving, sanctioned parties. - These deficiencies have been raised up to Minister for Finance; work is ongoing between the CBI and the Department of Finance to identify statutory and regulatory resolution in the near term. - All EU persons and entities are obliged to inform competent authorities of information facilitating freezing requirements under EU Financial Sanctions Regulations; failure to comply is a criminal offence enforced by An Garda Síochána in collaboration with the Director of Public Prosecutions. - Other criminal activities: - Criminal activities are primarily matters for An Garda Síochána; the CBI can refer such matters and engagement by banking supervisors on criminal activities is limited, high level and largely reactive. - The CBI has summary prosecution powers under certain legislation where it is the competent authority. - Under section 33AK of the Central Bank Act 1942 (as amended) the CBI is obliged to make a report to An Garda Síochána (and other law enforcement agencies where appropriate) where it suspects a criminal offence may have been committed by a supervised entity. - EC2 — policies and processes to prevent abuse: - As part of AML/CFT Risk Assessment, Prudential Supervisors request confirmation from firms that policies and procedures have been put in place to achieve compliance with their obligations under the CJA2010, evidencing same through confirmation of the name of official/committee approving and date approved. - The AML/CFT team reviews the appropriateness and adequacy of policies and procedures in relation to AML/CFT risk as part of in-depth inspection work program. *Source: _cr14135 - Section 18 requires the holders of banking licenses to provide the Central Bank with* ### Chapter 6, Part 4 of CJA2010 imposes obligations on designated persons (definition of ### _cr14135 - Chapter 6, Part 4 of CJA2010 imposes obligations on designated persons (definition of ### Overview and legal framework - Part 4 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (CJA2010) sets core obligations for designated persons (including credit and financial institutions) on Customer Due Diligence (CDD), reporting, policies and procedures, and special provisions for credit and financial institutions. - The CJA2010 came into force on 15 July 2010 to transpose the EU’s Third Money Laundering Directive and implementing directive into Irish law. - The Criminal Justice Act 2013, passed into law on 14th June 2013, amends the CJA2010 to align with FATF recommendations in specified areas (see list below). - Section 60(2) of the CJA2010 appoints the Central Bank as Competent Authority for supervision of credit and financial institutions regarding compliance with CJA2010. ### Key obligations under Part 4 (summary) - Chapter 3 Customer Due Diligence: - Obligations to identify and verify customers, identify beneficial ownership, and apply enhanced due diligence requirements to higher risk relationships. - Chapter 4 Reporting of suspicious transactions: - Obligations to identify and report suspicious transactions. - Chapter 6 Policies and Procedures: - Obligations to have policies and procedures for prevention and detection of ML/TF, including assessment of ML/TF risk, internal controls, monitoring compliance, record maintenance, and staff instruction. - Chapter 7 Special provisions applying to credit and financial institutions: - Miscellaneous obligations (e.g., prevention of anonymous accounts). - Core Guidelines: - Published by the Department of Finance; the Central Bank will have regard to them when assessing compliance. ### Criminal Justice Act 2013 amendments to CJA2010 (selected) - application of enhanced CDD measures in higher risk situations; - application of a minimum level of due diligence rather than no measures in low risk situations where simplified CDD applies; - making of Suspicious Transaction reports on grounds of “reasonable suspicion” rather than “real risk” of money laundering; - keeping of CDD records up to date; - completion of CDD on existing customers; - reduction in the occasional transaction threshold for occasional wire transfers; - allocation of responsibility for the registration and monitoring of Trust & Company Service Providers-subsidiaries of credit and financial institutions. ### CDD programme essential elements (as described) - (a) a customer acceptance policy that identifies business relationships that the bank will not accept based on identified risks; - (b) a customer identification, verification and due diligence programme on an ongoing basis; this encompasses verification of beneficial ownership, understanding the purpose and nature of the business relationship, and risk-based reviews to ensure that records are updated and relevant; - (c) policies and processes to monitor and recognize unusual or potentially suspicious transactions; - (d) enhanced due diligence on high-risk accounts (e.g. escalation to the bank’s senior management level of decisions on entering into business relationships with these accounts or maintaining such relationships when an existing relationship becomes high-risk); - (e) enhanced due diligence on politically exposed persons (including, among other things, escalation to the bank’s senior management level of decisions on entering into business relationships with these persons); - (f) clear rules on what records must be kept on CDD and individual transactions and their retention period. Such records have at least a five year retention period. ### Supervisory approach and activity (Central Bank of Ireland — CBI) - The CBI adopted a risk-based supervisory approach integrated into its PRISM prudential supervisory engagement model; the approach and engagement model were formally approved within the CBI on 4 February 2013. - A compliance monitoring program under CJA2010 has been in place since July 2010 and was further developed in 2012 to integrate into PRISM; the current program was formally approved on 4th February 2013 and implemented immediately. - Overview of activity since September 2010 (by PRISM impact rating): - High impact firms: - Full onsite inspection: 2013 – 3 firms - Thematic onsite inspection: 2012 – 1 firm - Desktop inspection – 2011 – 1 firm, 2012 – 1 firm - Offsite review through risk assessment questionnaire: 2013 – 3 firms - Medium High impact firms: - Full onsite inspection: 2010 – 1 firm - Thematic onsite inspection: 2011 – 1 firm, 2012 – 1 firm - Desktop inspection – 2011 – 1 firm - Offsite review through risk assessment questionnaire: 2013 – 9 firms - Since September 2010: - The CBI has conducted 8 onsite inspections. - In-depth inspections were conducted on 4 banks (combined balance sheet representing c.40% of gross sector assets). - Offsite reviews through risk assessment questionnaires covered 21 banks. - Branches of foreign banks have not been reviewed. - Where inspections/assessments identified gaps, remediation plans have been put in place; as yet no enforcement action in terms of ASP or criminal prosecution has been taken against the sector. - Total staff dedicated to CJA2010 compliance numbers seven and is supported by other supervisory staff. - The CBI has not issued policy guidance to banks on implementation of CJA2010; the Department of Finance published the “Core Guidelines” on its website. The CBI was centrally involved in development of the Core Guidelines and stated it “will have regard to these guidelines in assessing compliance by designated persons with the Act.” - The CBI intends to issue a communication to the banking sector detailing any recurring themes and/or best practice from recent inspections. ### Findings and descriptions by Effectiveness Criteria (EC3–EC9) - EC3: - Chapter 6, Part 4 of CJA2010 imposes obligations on designated persons to have policies and procedures for detection and prevention of ML/TF. - Banks report suspicious activities and incidents of fraud to the banking supervisor when such activities/incidents are material to the safety, soundness or reputation of the bank; reporting to the financial intelligence unit or other designated authorities is also required. - EC4: - Section 38 of the Supervision and Enforcement Act of 2013 requires persons appointed to perform pre-approval controlled functions to disclose to the CBI, as soon as practicable, information relating to an offense under any provision of financial services legislation that they believe will be of material assistance to the CBI. - If the supervisor becomes aware of additional suspicious transactions, it informs the financial intelligence unit and, if applicable, other designated authorities and shares information related to suspected or actual criminal activities with relevant authorities. - AML/CFT: S63 (2) & (4) of the CJA2010 imposes an obligation on competent authorities (including the CBI) to report to An Garda Síochána or the Revenue Commissioners knowledge or suspicion of a designated person’s or other person’s involvement in money laundering or terrorist financing. - Section 33AK(3) of the Central Bank Act 1942 (as inserted by Section 26 of Central Bank and Financial Services Authority Act 2003) obliges the supervisor to report to relevant authorities any information that leads the Central Bank to suspect (A) a criminal offence may have been committed by a supervised entity, or (B) a supervised entity may have contravened a provision of company law or competition law. A report is not required where the supervised entity has already made the necessary disclosures. - EC5: - The supervisor determines that banks establish well-documented CDD policies and processes communicated to all relevant staff and integrated into overall risk management to identify, assess, monitor, manage and mitigate ML/TF risks across customers, countries/regions, products, services, transactions and delivery channels on an ongoing basis. - The CDD management programme, on a group-wide basis, includes the essential elements (a) through (f) listed above. - As part of 4 in-depth inspections since 2010, CDD was reviewed, including assessment of appropriateness and adequacy of firms’ approaches to CDD (risk assessment, governance, risk management and control). - Prudential Supervisors request confirmation from firms that they can demonstrate compliance with CJA2010 in relation to CDD including: - i. Assessment of AML/CFT risk presented by the firm’s business model - ii. Policies and procedures that reflect risk based approach to CDD - iii. Independent testing of application of policies and procedures - iv. Provision of MI to senior management on AML/CFT KPIs - v. Testing of outsourcing and third party reliance arrangements - vi. Ongoing monitoring of accounts, evidencing same through confirmation of the name of official/committee approving and frequency of reporting and latest date approved. - Chapter 3 of Part 4 of the CJA2010 addresses the essential elements (a) through (f). - Chapter 6 imposes obligations on internal policies, procedures, training and record retention; Section 54(2) imposes an obligation “to assess and manage the risks of money laundering or terrorist financing.” - Additional guidance on S54(2) is in Section III of the Core Guidelines on the Department of Finance website. - EC6: - Supervisor determines banks have specific policies/processes regarding correspondent banking, including: - (a) gathering sufficient information about respondent banks to understand nature of their business, customer base, and supervision; and - (b) not establishing/continuing correspondent relationships with respondent banks lacking adequate controls, effective supervision, or those considered shell banks. - CBI’s in-depth inspections reviewed appropriateness and adequacy of approaches to correspondent banking with on-site sample testing of key controls. - Prudential Supervisors request confirmation from firms evidencing approval of correspondent relationships through name of official/committee approving and date approved. - Section 38, Chapter 3 of Part 4 of the CJA2010 requires enhanced CDD for correspondent banking relationships; there is no specific obligation to terminate existing relationships, but Section 54 requires adoption of policies/procedures to prevent ML/TF. - EC7: - Supervisor determines banks have sufficient controls and systems to prevent, identify and report potential abuses including ML/TF. - In-depth inspections review appropriateness and adequacy of identification and reporting of suspicious transactions, governance, risk management and control, with on-site sample testing of key controls. - Prudential Supervisors request confirmation from firms that they demonstrate compliance with obligations in relation to identification and reporting of suspicious transactions including governance, processes and procedures, and management information; firms must provide approval evidence (name of official/committee and date). - Chapter 4 of Part 4 places obligations on designated persons to identify and report suspicious transactions. - Section 19 of the Criminal Justice Act 2011 (CJA2011) makes it an offence not to report to An Garda Síochána information which a person knows or believes might be of material assistance in preventing certain offences or securing convictions; the schedule includes offences related to banking, theft, fraud and money laundering and terrorist offences. - EC8: - Within CJA2010, failure to comply with relevant sections is defined as a criminal offence. - CBI enforcement powers include: - a. pursue administrative sanction* or criminal action in respect of: - i. A breach of CJA2010 or - ii. A failure to execute a direction - b. give directions under S. 71 of the CJA2010 to discontinue or take certain actions - *Section 33AN of the Central Bank Act, 1942 provides for certain prescribed contraventions to be subject to civil enforcement powers of the CBI (Administrative Sanctions Procedure (ASP)). S114(4) of the CJA 2010 amends the Central Bank Act 1942 to include contraventions of Part 4 of the CJA2010 as prescribed contraventions under Section 33AN. - EC9: - The supervisor determines that banks have: - (a) requirements for internal audit and/or external experts to independently evaluate relevant risk management policies, processes and controls, with supervisor access to their reports; - (b) established policies and processes to designate compliance officers at management level and appoint a relevant dedicated officer to whom potential abuses (including suspicious transactions) are reported; - (c) adequate screening policies and processes to ensure high ethical and professional standards when hiring staff or entering into agency/outsourcing relationships; and - (d) ongoing training programmes for staff, including on CDD and methods to monitor and detect criminal and suspicious activities. - Descriptive findings: - The CBI does not have a specific requirement to require banks to establish an internal audit function or to appoint a head of internal audit, but banks must put in place adequate internal control mechanisms and robust governance arrangements (see CP26); this requirement emanates from the Corporate Governance Code 2010 as a condition on bank licenses. - The CBI could impose obligations to have such functions using regulation 70 of S.I. 661 of 2006. - Internal audit is expected to independently evaluate relevant risk management policies/processes/controls, though the extent regarding criminal activities is not prescribed. - Supervisors have access to internal audit reports. - The EBA Guidelines on Internal Governance (GL44) require banks to establish a compliance function and are applicable to all Irish licensed banks; the CBI is working on codifying GL44 in 2013. - The Fit & Proper Standards 2011 and the Central Bank Reform Act 2010 provide CBI power to reject appointment or remove heads of compliance if necessary. - There is no statutory requirement to appoint a dedicated officer to whom potential abuses are reported; in absence, the compliance officer would be expected to fulfill this role. - Chapter 6 and the Core Guidelines provide specific guidance aligning with elements (b) through (d) of EC9, but CJA2010/guidance does not specifically require internal audit or other expert evaluation of a designated person’s AML/CFT control framework; reliance is expected on general obligations applicable to credit institutions. *Italic source attribution:* _Content from the provided IMF source document._ ### 1. General ### 1. General ### Governance and Internal Controls - All High Impact Irish licensed banks have appointed a local internal audit head and function. - Medium High Impact and Medium Low Impact banks are permitted to rely on the internal audit function of their parent. - All banks have either a compliance officer or a compliance function (see CP26). - Material outsourcing relationships are assessed by Banking Supervision in relation to the extent of adherence to the EBA Guidelines. - Certain key functions (PCFs) require compliance with fitness and probity requirements of the Central Bank. ### AML/CFT Inspection Program and Scope - The AML/CFT in-depth inspection program reviews the appropriateness and adequacy of the firm’s overall framework for management of AML/CFT risk addressing elements (a) through (d) of the essential criteria. - The program assesses and tests implementation of an appropriate governance structure for management of AML/CFT risk, including: - (a) clear definition of the roles and responsibilities of each line of defense - (b) clear definition of escalation and signoff processes for key risks (e.g. high-risk customers take-on; transaction screening criteria; suspicious transaction reporting) - (c) implementation of comprehensive training program tailored to the role being fulfilled - (d) adherence to legislative requirements relating to outsourcing or third party reliance, including ongoing testing of those relationships - As part of AML/CFT Risk Assessment, Prudential Supervisors request confirmation from firms that they can demonstrate compliance with their obligations under the CJA2010 in relation to establishment of an effective governance structure for management of AML/CFT risk in relation to: - i. Implementation of effective organizational structure - ii. Implementation of training re CJA2010 - iii. Implementation of plan for ongoing training - iv. Implementation of program of testing of key controls - v. Provision of MI to senior management on AML/CFT KPIs - vi. Testing of outsourcing and third party reliance arrangements - Firms must provide evidence through confirmation of the name of official/committee approving and frequency of reporting and latest date approved. EC10 ### Reporting and Staff Protections (EC10–EC11) - The supervisor determines banks have clear policies and processes for staff to report abuse of financial services to local management or the relevant dedicated officer, and that adequate MI systems provide Boards, management and dedicated officers timely and appropriate information. - Description and findings re EC10: - Adequacy of reporting reviewed in AML inspections by the CBI in the past three years. - Deficiencies noted were communicated to banks’ management. - The CBI will adjust its monitoring program based on current review findings. - Revised program/strategy will include an additional in-depth inspection in 2014 and onsite thematic inspections in 2015. - The CBI intends to issue a communication to the banking sector detailing recurring themes and/or best practice from recent inspections. - Laws provide that a member of a bank’s staff who reports suspicious activity in good faith either internally or directly to the relevant authority cannot be held liable. - Description and findings re EC11: - The Supervision and Enforcement Act 2013 sets the requirement. - Chapter 4 of Part 4 of the CJA2010 sets out obligations in relation to reporting of suspicious transactions. S47 provides an exemption from liability to persons making reports in accordance with these obligations. - Section 19 of the CJA2011 makes it an offence not to report to An Garda Síochána information which he knows or believes might be of material assistance in preventing certain offences; employees are protected from penalization for disclosing certain information. ### Cooperation and Resources (EC12–EC13) - The supervisor cooperates with domestic and foreign financial sector supervisory authorities or shares information related to suspected or actual criminal activities for supervisory purposes. - Description and findings re EC12: - Domestic: The CBI is a member of the Money Laundering Steering Committee, chaired by the Department of Finance, coordinating national AML/CFT initiatives. - International: The CBI is a member of the EBA’s AML Committee contributing to EU supervisory policy and intra-agency collaboration. - The CBI was significantly involved in drafting and finalizing a home-host protocol for colleges of supervisors collaborating on AML/CFT supervision of cross-border payment institutions and is working with several EU regulators on an implementation framework for this protocol. - EC13: Unless done by another authority, the supervisor should have in-house specialist expertise for addressing criminal activities and regularly provide information on ML/TF risks to banks. - Description and findings re EC13: - This role does not currently fall within the responsibilities of the Central Bank. ### Assessment of Principle 29 - Assessment: Materially Noncompliant - Comments: - Anti-Money Laundering legislation strengthened in 2010 via the CJA 2010 and further amended in 2013. The scope of the legislation is comprehensive. - The CBI has conducted 8 onsite inspections, including 4 in-depth onsite inspections. - Offsite reviews conducted on 21 banks through a risk assessment questionnaire facilitating analysis of AML/CFT risk via evaluation of: - (i) inherent risk posed by the bank’s business model, - (ii) the firm’s AML/CFT control framework, - (iii) the track record of the firm in managing operational risk. - Work remains for the CBI in monitoring compliance: - a) The CJA 2010 framework (Section 107) envisages approval of guidelines to guide designated persons on application of Part 4; such guidelines would clarify expectations regarding “reasonable measures” and “due diligence.” The CBI should work with Justice to provide guidance to banks and issue communications after inspections setting out principal findings and expectations on demonstrating compliance with the CJA 2010. - b) Branches of foreign banks have not been inspected or reviewed for compliance with the CJA 2010. - c) Review whether the balance of onsite and offsite reviews is adequate to verify compliance. ### Recommended Actions (Selected) - Principle (2) - Amend existing legislation to detail the framework for Central Bank independence. Also address reasons for removal of Commission members to be similar to Governor. - Take steps to fill vacancies in BSD. - Principle (5) - Consider options for improving the CBI’s ability to conduct fit and proper reviews during licensing of banks owned by unregulated parents. - Study enforceability of special conditions to the license that must be accepted by parent company at time of approval to enhance CBI enforcement authority. - Principle (9) - Consider the distribution of resources and supervisory tasks across Medium Low and Low Impact ratings. - Consider expanding KRIs in PRISM to include a broader suite of risk metrics i.e. operational risk and IRRBB. - Principle (15) - For banks accredited to use internal models, annual assessment that banks comply with supervisory standards (e.g. validation). - Implementation of framework to assess IT across regulated banks. - Principle (17) - Increase frequency and loan sample size for Medium Low banks. - Principle (18) - Greater frequency and depth of onsite reviews of loan loss provisioning practices (e.g. testing of assumptions against experience, recognition of default, prudent valuations). - Principle (20) - Amend the RPL code to include asset sales, deposits and other areas addressed in CP. Also expand information in RPL regulatory reports so that a more complete offsite compliance assessment may be made. - Principle (27) - Enact legislation giving the Central Bank the power to reject or rescind external auditors. - Principle (29) - Expand supervisory scope to include branches of foreign banks. - Statutory guidelines, approved as envisaged by Section 107 of the CJA 2010, should be issued. Review the current balance between onsite and offsite reviews; currently emphasis is heavily weighted on offsite. ### Authorities' Response Highlights - Recognition of IMF assessment and appreciation for detailed assessment of compliance with the Basel Core Principles. - Noted strengthening of supervision through a risk-based supervisory approach implemented in 2011, accompanied by a substantial increase in resources and a more intrusive approach. - Specific comments on IMF Materially Non-Compliant ratings: - CP 2 Independence: - Authorities note no observed political interference and emphasize Central Bank independence as a core pillar; will consider recommendation for more detailed independence framework in future statutory reviews. - CP 9 Supervisory Techniques and Tools: - Emphasize proportional, risk-based supervision; note Medium Low Impact cohort characteristics (10 non-retail institutions, comprises 3% of total Irish banking system assets, does not take retail deposits, comprises 2% of all Irish corporate deposits). - Central Bank will follow IMF recommendations relating to CP 9 and will review distribution of resources as the Single Supervisory Mechanism (“SSM”) enters into force. - CP 20 Related Party Transactions: - Related party transactions predominantly lending; supervisory approach includes a Code of Practice, detailed reporting framework, on-site testing, lending limits and requirement for prior approval for transactions over €1m. - Central Bank will evaluate related party transactions and amend the Code as appropriate. - CP 29 Abuse of Financial Services: - Authorities will follow IMF recommendations. Central Bank will request Minister for Justice issues guidelines envisaged by Section 107 of the CJA 2010 and will communicate principal findings to the banking sector following 2013 AML reviews. - Branch inspections will be performed; authorities will review balance between onsite and offsite reviews. - Concluding comments: - Authorities acknowledge importance of continued monitoring and improvements to regulatory and supervisory practices. - Will evaluate IMF recommendations in context of IMF endorsement of Ireland’s supervisory approach and prepare to implement SSM requirements from 4 November 2014, noting SSM will fundamentally alter supervision of credit institutions in the euro area and change how the Central Bank supervises credit institutions in Ireland. *Source: _cr14135 - 1. General* --- _Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr14135.pdf_