## 1. Recommended Action Plan to Improve Compliance with the Basel Core Principles (Denmark) — _cr14352

## Source details

**Canonical URL:** [1. Recommended Action Plan to Improve Compliance with the Basel Core Principles (Denmark) — _cr14352](https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr14352.pdf)

## Other formats

- [Markdown version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr14352.pdf.md)
- [Structured JSON version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr14352.pdf.json)

---

### Executive summary: system structure, evolution, and supervisory posture
- Banking system size and role:
  - Banks and MCIs account together for 425 percent of the GDP.
  - The covered bonds market is described as one of the largest in the World.
- Sector evolution and stress:
  - Number of banks decreased from 132 to 88 since 2008.
  - Total banking assets dropped by 10 percent since 2008.
  - From 2008–2011 banks recorded write downs of DKK 147 billion.
  - Large commercial banks returned to profitability starting in 2012 with RoE at 3.6 percent.
  - Mortgage banks maintained a better RoE (around 4 percent).
- Regulatory and supervisory framework:
  - DFSA is an integrated supervisor covering banks, MCIs, insurance companies, pension funds, issuers of securities, and investors on the securities markets.
  - EU legislation transposing Basel III (CRR/CRDIV) will be fully implemented on April 1, 2014.
  - Political agreement October 2013 established Danish framework for D-SIBs with enhanced capital and liquidity standards.
- Supervisory posture:
  - DFSA employs a risk-based, hands-on, proactive approach.
  - Credit-risk related principles compliance uniformly high; provisioning policies strengthened.
  - Resource constraints produce an extended supervisory cycle; some risk areas receive insufficient attention.
- Governance concerns:
  - Significant decision-making currently requires approval of the Financial Council (industry appointees).
  - Replacement of Financial Council with Board of Directors scheduled July 2014; Board appointees: two-year terms.
  - Recommendation: Director General should establish supervisory imperatives wholly within his authority; seek law changes to lengthen Board members’ terms and establish formal vetting.

### Capitalization, risk-weights, funding and systemic banks
- Capitalization and risk-weights:
  - System-wide capital adequacy ratio (CAR) increased to 23 percent compared to 12 percent before the crisis.
  - Tier 1 ratio improved from 9 percent in 2007 to about 20 percent in 2013.
  - Several banks raised capital through share issuance: Danske Bank, Jyske Bank, Spar Nord Bank and Vestjysk Bank.
  - Risk-weights in Danish banks are among some of the lowest in the EU.
  - Basel III/CRD IV implementation will require adjustments in quality of capital (increased deductions and phase out of hybrids).
  - 2013 central bank stress tests: systemic banks can withstand substantial shocks; several non-systemic banks need to strengthen capitalization or seek consolidation.
- Funding structure and liquidity:
  - Pre-crisis loan-to-deposit ratio: 135 percent; post-crisis decreased to 104 percent.
  - Short term debt now accounts for approximately 11 percent of banks’ overall debt issuance (less than 2 percent of total assets); in 2007 short term issuance was almost half of total debt issuance.
  - Almost all government-guaranteed bonds issued in 2009–10 have been redeemed.
- Cross-border / systemic banks:
  - Six largest commercial banks designated D-SIBs: Danske Bank, Nykredit, Nordea Bank Denmark, Jyske Bank, BRF-Kredit and Sydbank.
  - Enhanced capital requirements ranging from 1 to 3 percent of risk weighted assets depending on systemic importance.
  - Danske Bank operates in Finland, Sweden, Norway, Lithuania, Estonia, Latvia, and Ireland; Denmark is home supervisor to several D-SIBs and host supervisor to one G-SIB (Nordea).

### Supervisory tools, practices, reporting and resourcing
- Supervisory Diamond:
  - Introduced 2010 with five criteria: (i) credit concentration risk; (ii) funding risk; (iii) liquidity risk; (iv) exposures to commercial real estate; and (v) excessive loan growth.
  - Breaches are published on DFSA website.
  - Proposed separate Supervisory Diamond for MCIs: lending growth, loans with short term funding, borrower’s interest-rate risk, interest-only loans, and large exposures.
- Onsite inspection cycle:
  - Inspection cycles range between one and six years (six-year used only for small low-risk banks).
  - Very extended schedules limit immediacy of issue detection; smaller banks particularly affected.
  - Onsite inspection conclusions submitted within 35 days in written report to BoD, BoM, external auditor, and chief internal auditor.
  - Full DFSA reports typically made public; DFSA can withhold reports in limited cases.
- Offsite supervision and data gaps:
  - Most banks submit standardized regulatory returns quarterly; liquidity information monthly (very small banks quarterly).
  - Systemic banks subject to reporting LCR and NSFR on a monthly/quarterly basis.
  - Reporting omissions identified:
    - Operational risk loss and related party lending not routinely reported.
    - No routine supervisory reporting to track related party exposures.
    - Traded market risk reporting could be expanded; exotic instruments may not be captured.
  - Recommendation: expand data suite for offsite supervision to better monitor market, operational risks and risk profile changes.
- Resources and budgetary constraints:
  - DFSA budget must be approved by MoBG and Ministry of Finance; cannot readily expand onsite supervision during budget year without approval; cannot carry over funds without MoBG approval.
  - Current DFSA staffing insufficient to expand onsite supervision readily; limited flexibility to reallocate resources between annual budget approvals.
  - Recommendation: seek approval for additional resources to reduce time between examinations and enhance flexibility for additional onsite work.

### Governance, fit & proper, and supervisory independence
- Governance structure and appointments:
  - Financial Council (current): 14 representatives, including four nominated by industry groups; voting on significant matters.
  - Board of Directors (expected from July 1, 2014): seven person Board; members appointed by MoBG for two-year terms; MoBG observer; no formal vetting process expected.
- Independence assessment:
  - Principle 2 graded MNC — structures have potential to interfere with DFSA operational independence.
  - Concerns: low decision threshold for Financial Council; absence of fit and proper requirements for Board/Council members; short two-year Board terms may increase turnover and affect policy consistency.
- Fit & proper and governance oversight:
  - Section 64 FBA requires DFSA approval for BoD and BoM members; applicants must provide records of current/former board memberships (10 years for management, 5 years for directors), criminal records, insolvency history.
  - No authority to conduct ongoing fit and proper reviews of owners and senior management of non-financial parent companies.
  - Recommendations:
    - Seek legislative change to lengthen Board terms and establish formal vetting of nominees.
    - Establish supervisory imperatives for Director General within his authority (inspection schedule, impairments/provisioning approach).

### Licensing, transfers of significant ownership, and major acquisitions
- Licensing (Principle 5):
  - Minimum capital for banks: EUR 8 million (share capital); alternative minimum capital references: 8 percent of RWAs and EUR 5 million minimum capital requirement mentioned in section 124(2) and (3).
  - Average period for license assessment approximately one year.
  - DFSA may impose prudential restrictions on newly established banks; newly licensed banks subject to intensified supervision in first two years.
- Transfer of significant ownership (Principle 6):
  - Definition: "qualifying interest" triggers at 10 percent and includes scenarios of significant/controlling influence per section 5b.
  - Triggers for notification/approval: 10 percent, 20 percent, 33 percent, 50 percent.
  - DFSA powers:
    - Section 61(3): DFSA may refuse an application for approval if acquirer will hinder sensible and proper management based on s.61a criteria (reputation, management, financial soundness, compliance continuation, AML/CFT connection).
    - DFSA can withdraw voting rights under section 62(1) but cannot reverse a change in control.
  - Identified weaknesses:
    - No definition of ultimate beneficial owners (UBOs) in FBA.
    - No written demand on banks to notify DFSA about material information that may negatively affect suitability of major shareholder or controlling party.
  - Assessment of Principle 6: Largely compliant.
- Major acquisitions and cross-border (Principle 7):
  - For domestic major acquisitions DFSA approval required; for cross-border acquisitions by Danish banks in foreign undertakings prior notification under section 63(1) suffices (no prior approval).
  - Limitation: DFSA’s ability to reject potential foreign acquisition is constrained by notification-only regime; remedies available after acquisition include section 350 orders, capital adjustments, dismissals.
  - Assessment of Principle 7: Largely compliant; gap: lack of legislative power to impose prudential conditions formally when approving acquisitions.

### Recovery, resolution, deposit protection and crisis management
- Resolution history and framework:
  - From summer 2008 to mid-2010 significant losses/liquidity shortages led to government “Bank Packages” with guarantees and capital injections.
  - A total of 62 banks ceased operating during 2008 to August 2013; main interventions in non-systemic bank segment (Group 2 and 3 banks) accounting for approximately 12 percent of total banking assets.
  - Financial Stability Company (FSC) used to wind up distressed banks; Danmarks Nationalbank provided extraordinary liquidity support.
- Bail-in and resolution tools:
  - Denmark implemented a bail-in regime early in the crisis; DFSA determines trigger for resolution and consults MoBG; controlled resolutions handled by FSC.
  - Bank Package 3 (2010) provides a takeover weekend mechanism via FSC with provisional haircuts and subsequent due diligence; examples: Amagerbanken A/S (provisional haircut 41 percent later 16 percent), Fjordbank Mors (provisional 26 percent later 14 percent).
  - Political agreement October 2013: SIFIs must draw up resolution plans no later than January 1, 2016.
- Deposit protection:
  - Danish Guarantee Fund (DGF) covers deposits up to 100,000 euro per depositor; certain special categories covered in full.
  - DGF migrated in 2012 to ex-ante financing scheme based on annual contributions from banks.

### Liquidity regime, covered bonds, and encumbrance risks
- Liquidity regime and metrics:
  - FBA prescribes two quantitative liquidity requirements: 15 percent of debt exposures payable on demand or ≤ one month; 10 percent of total debt and guarantee exposures (less subordinated debt).
  - Supervisory Diamond includes two additional metrics: excess coverage of the s.152 requirement of 50 percent and funding ratio (loans / (working capital less bond issuance with remaining maturity less than one year)) must be below 1.
  - Reporting frequency: liquidity monthly for banks with working capital above DKK250mn (groups 1–3); quarterly for smaller banks.
  - Five largest credit institutions have reported monthly LCR and quarterly NSFR-equivalent data since September 2011.
- Covered bonds and refinancing risk:
  - Stock of covered bonds is equivalent to almost twice GDP.
  - Covered bond market more than four times as large as in any other country.
  - Many covered bond issuances had short maturities (many of one year) pre-crisis, creating refinancing risk.
  - Legislation passed March 2014 seeks to address refinancing risk by extending maturities of bonds in certain stress scenarios; new law imposes soft bullet structure with automatic 12 month term extension in case of refinancing failure for some bonds.
- Asset encumbrance:
  - As of December 2012, 29 out of 92 banks had asset encumbrance; main sources: repo transactions, three year LTRO, secured central bank financing, and covered bonds.
  - DFSA does not systematically assess encumbrance levels within acceptable limits; AC1 not met.
- Shortcomings noted:
  - Definitions of eligible HQLA broadly defined; DFSA approval not required; no haircuts applied; no current limit on own-issued mortgage covered bonds counting in HQLA; assets in HQLA must be unencumbered but no restrictions on inclusion of repo/re-used repo collateral.
  - Section 152 allows eight days to remediate a shortfall without mandatory DFSA notification (unless vital) — considered too long.

### Risk management, internal models, market, interest rate and operational risk
- Governance, risk management and internal models:
  - EO on Management and Control (EO‑MC) and EO‑CAG set detailed requirements on Board responsibilities, risk policies, ICAAP, stress testing and model governance.
  - Recommendation: update regulations on internal models to require sound governance and independent validation; clarify independence requirements for validators.
- Market risk (Principle 22):
  - DFSA market risk regime comprehensive; typical traded instruments: Danish mortgage bonds, equities, FX derivatives, commodities.
  - Onsite market risk inspections: larger banks once every four years; D‑SIBs to be subject to annual market risk inspections beginning in 2014.
  - Supervisory reporting of traded market risk could be expanded; exotic instruments not always captured offsite.
  - Assessment: Largely Compliant.
- Interest rate risk in banking book (IRRBB, Principle 23):
  - Banks report quarterly krone durations; default shock: 200 bps (parallel shift), other scenarios accepted if justified.
  - DFSA assesses IRRBB via offsite reporting and onsite inspections; SIFI banks to be inspected annually beginning 2014.
  - Assessment: Compliant.
- Operational risk (Principle 25):
  - Assessment: Materially Non-compliant.
  - Key issues:
    - Supervisory reporting not sufficiently frequent/detailed to identify operational risk profile changes.
    - No formal regulatory requirement to notify DFSA of material changes in operational risk absent an actual incident.
    - Onsite operational risk exams performed as subsets of credit/market risk reviews; no stand‑alone comprehensive program.
    - Routine reporting should be expanded to include loss event types; BIA/SA banks report Basel event type/category for Q1 2014 in accordance with new COREP deadlines: May 30 (company level) and June 30 (group level).
  - Outsourcing:
    - EO on Outsourcing Significant Areas requires service providers to provide DFSA, outsourcing undertaking, and auditors with necessary information (Section 5(7)); DFSA monitors concentrations in datacenters/service providers.

### Credit risk, problem assets, large exposures, related parties
- Credit risk (Principle 17):
  - DFSA places very strong focus on credit risk; ten largest exposures reviewed annually by Board, external auditors, and examiners.
  - Sampling of credit files extensive; conservative approach to impairment/provisioning commended.
  - Assessment: Compliant.
- Problem assets, provisioning (Principle 18):
  - DFSA issues guidance (Annex 10 to EO‑FR); requires individual assessment for significant loans; systematic borrower matrix of 7,000 borrowers for rating consistency.
  - Reversals criteria should be detailed; overall approach conservative.
  - Assessment: Compliant.
- Concentration and large exposures (Principle 19):
  - Supervisory Diamond includes aggregate large exposure benchmark sum = 125 percent of capital base; DFSA requires reporting of exposures ≥ 10 percent of capital base; statutory upper limit for individual exposure = 25 percent of eligible capital.
  - Notification for large exposures currently at end of quarter — recommendation to tighten.
  - Assessment: Largely Compliant.
- Related-party transactions (Principle 20):
  - Legal framework focuses on BoD, BoM and intra-group transactions (sections 78, 179–182); EO on Intra-Group Transactions requires written agreements and market-based terms.
  - Gaps:
    - Definition of related parties narrow; does not extend to minority shareholders and key risk takers.
    - No powers to deduct related party transactions from capital.
    - Offsite reporting for related party exposures not routine; supervisory detection limited by long inspection cycles.
    - No specific requirements on write-off of related party transactions.
  - Assessment: Materially Non‑Compliant.

### External audit, financial reporting, disclosure and market discipline
- External audit and financial reporting (Principle 27):
  - Auditors required to use ISAs; DFSA receives audit book comments; signing auditors for banks required to be certified by DFSA from January 1, 2014 (certification criteria detailed).
  - Gaps: no requirement that fair value estimates be subject to independent verification and validation; DFSA lacks power to access external auditors’ work papers.
  - Assessment: Largely Compliant.
- Disclosure and transparency (Pillar III / Principle 28):
  - Pillar III disclosure requirements exist (EO‑CAG Annex 20); DFSA does not systematically review whether disclosure requirements are met.
  - Only larger banks (Group 1 and 2) have disclosures reviewed in detail and not for completeness/accuracy.
  - Enforcement powers exist but have not been used.
  - Assessment: Materially Non‑Compliant.
  - Recommendation: DFSA change internal policies to ensure systematic review of Pillar III disclosures to assess completeness and accuracy.

### AML/CFT supervision (Principle 29)
- Framework and supervisory activity:
  - AML/CFT Act (no. 1022 of August 13, 2013) implements Directive 2005/60/EC; DFSA supervises compliance under section 25(1).
  - DFSA developed risk-based onsite AML/CFT examination program; onsite inspections 2010–2013: 16 large and medium banks (cumulative share > 80 percent of working capital).
  - Self-assessment scheme includes 20 medium/small banks.
- Resourcing and monitoring gaps:
  - Dedicated DFSA AML/CFT team: 3.5 FTEs supervising approximately 971 organizations — capacity stretched.
  - DFSA does not have adequate resources to supervise effective implementation of banks’ internal AML/CFT controls across all banks.
  - Offsite surveillance does not routinely include AML/CFT reporting; DFSA does not monitor adequacy of banks’ AML/CFT policies/procedures through routine offsite surveillance sufficiently.
  - DFSA lacks adequate powers regarding AML/CFT sanctions; enforcement powers rest with the FIU and prosecution.
- Reporting and STRs:
  - Banks report STRs to FIU (not DFSA); FIU submits quarterly reports to DFSA on STR volumes by institution.
  - STR reporting increased from 753 in 2009 to approximately 3,000 in 2012; quality and scope concerns remain.
- Assessment: Largely Compliant.
- Recommendations:
  - Expand self-assessment and onsite program to include more banks as part of annual offsite surveillance.
  - Expand DFSA resources for AML/CFT supervision and increase routine AML/CFT offsite reporting.

### Key numeric thresholds and implementation dates (selected)
- DFSA supervisory cycle: onsite inspections range between one and six years; very small banks up to six years.
- Capital metrics and timelines:
  - CAR system-wide: 23 percent (post-crisis) vs 12 percent pre-crisis.
  - Tier 1 ratio: 9 percent in 2007 to about 20 percent in 2013.
  - General capital requirement: 8 percent of risk-weighted items (section 124(2)).
  - Banks must have share capital no less than EUR 8 million for licensing (section 7(8)); section 124(2) also references EUR 5 million minimum capital requirement in another provision.
  - CRR/CRD IV implementation date: April 1, 2014 (EU regulation transposition).
  - Risk committees required: April 1, 2014.
  - BoD concurrence for CRO dismissal implemented as of March 31, 2014.
  - Financial Council replaced by BoD: July 2014.
  - SIFI resolution plans due no later than January 1, 2016.
  - Pillar III and COREP Q1 2014 reporting deadlines: May 30 (company level) and June 30 (group level).
- Liquidity quantitative minima under FBA s.152:
  - 15 percent of debt exposures payable on demand or at notice of no more than one month.
  - 10 percent of total debt and guarantee exposures (less subordinated debt).
- Large exposure thresholds:
  - Reporting exposures ≥ 10 percent of capital base.
  - Aggregate sum benchmark: 125 percent of capital base in Supervisory Diamond.
  - Individual large exposure limit: 25 percent of eligible capital.
- Deposit guarantee:
  - DGF covers deposits up to 100,000 euro per depositor.

### Summarized recommended action plan (selected recommendations by Principle)
- Principle 2
  - Seek increased operational independence by revisiting threshold of significance for Council/Board decision‑making; establish supervisory imperatives wholly within Director General authority.
  - Seek legislative change to lengthen Board members’ terms and institute formal vetting for nominees.
- Principle 6
  - Expand powers to reverse a change of control; explicitly define “ultimate beneficial owners” in FBA; require banks to notify DFSA in writing of material information affecting suitability of major shareholders.
- Principle 8 & 9
  - Secure budgetary approval to significantly shorten time between examinations.
  - Use onsite exams more flexibly to respond to offsite findings and external events; require submission of audit and risk management reports on a flow basis.
  - Require submission of comprehensive recovery and resolution plans for all banks.
- Principle 12
  - Apply prudential rules more generally to financial holding companies; seek authority for ongoing fit & proper reviews of owners and senior management of non-financial parents.
- Principle 14–15
  - Require establishment of risk committees, codes of conduct and conflicts-of-interest policies; modify regulations to ensure independence in model validation.
  - Ensure liquidity and other risks factored into internal pricing and new product approval.
- Principle 18–20
  - Broaden database of larger exposures for rating consistency checks.
  - Revise definition of related parties and enhance routine disclosures to include related party exposures with detailed information for offsite analysis.
- Principle 22–27
  - Expand suite of data used in routine offsite supervision; expand onsite market risk examinations in risk-based manner.
  - Formalize netting procedures.
  - Expand routine reporting to include operational loss event types and establish stand-alone operational risk onsite program.
  - Require fair value estimates be subject to independent verification and validation; seek DFSA access to external auditors’ work papers.
- Principle 28–29
  - Change DFSA internal policies to systematically review Pillar III disclosures for completeness and accuracy.
  - Expand self-assessment and onsite AML/CFT program to include all banks as part of annual offsite surveillance; expand DFSA AML/CFT supervisory resources and powers.

*Italic: International Monetary Fund — Recommended Action Plan to Improve Compliance with the Basel Core Principles (Denmark), FSAP Update assessment material (content unit: _cr14352).*

### 1. Recommended Action Plan to Improve Compliance with the Basel Core Principles ___________  33

### _cr14352 - 1. Recommended Action Plan to Improve Compliance with the Basel Core Principles ___________  33

### Executive Summary: system structure and supervisory posture
- Banking system size and role:
  - Banks and MCIs account together for 425 percent of the GDP.
  - The covered bonds market is described as one of the largest in the World.
- Sector evolution and stress:
  - Number of banks decreased from 132 to 88 since 2008.
  - Total banking assets dropped by 10 percent since 2008.
  - From 2008–2011 banks recorded write downs of DKK 147 billion.
  - Large commercial banks returned to profitability starting in 2012 with RoE at 3.6 percent.
  - Mortgage banks maintained a better RoE (around 4 percent).
- Regulatory and supervisory framework:
  - The Danish Financial Supervisory Authority (DFSA) is an integrated supervisor covering banks, MCIs, insurance companies, pension funds, issuers of securities, and investors on the securities markets.
  - EU legislation transposing Basel III (CRR/CRDIV) will be fully implemented on April 1, 2014.
  - A political agreement in October 2013 established a Danish framework for domestic systemically important banks (D-SIBs) with better capital and higher liquidity standards.
- DFSA approach and performance:
  - DFSA employs a risk-based approach and is characterized as a hands-on and proactive supervisor.
  - Compliance with credit-risk related principles is uniformly high; provisioning policies have been enhanced.
  - Overall supervision is considered sound but resource constraints result in an extended supervisory cycle and some risk areas receive insufficient attention.
- Operational independence and governance concerns:
  - Decision-making on significant matters currently requires approval of the Financial Council, which includes industry appointees.
  - Replacement of the Financial Council with a Board of Directors (BoD) is scheduled for July 2014.
  - New BoD members will have shorter two-year terms and will act on policy, individual institution matters, and strategic direction.
  - Recommendation: Director General should establish supervisory imperatives wholly within his authority; law changes should be sought to lengthen Board members’ terms and establish a formal vetting process for nominees.

### Supervisory tools, practices, and resourcing
- Supervisory Diamond:
  - Introduced in 2010 with five criteria: (i) credit concentration risk; (ii) funding risk; (iii) liquidity risk; (iv) exposures to commercial real estate; and (v) excessive loan growth.
  - Breaches of the Diamond are published on the DFSA website.
  - DFSA proposed a separate Supervisory Diamond for MCIs covering lending growth, loans with short term funding, borrower’s interest-rate risk, interest-only loans, and large exposures.
- Onsite inspection cycle and constraints:
  - Supervisory cycle for onsite inspections ranges between one and six years (the six-year cycle is used only for small banks with low risks and a simple business model).
  - Extended examination schedule limits immediacy of issue detection and timeliness of addressing concerns; smaller banks are particularly affected.
  - Recommendation: DFSA should seek approval for additional resources to significantly reduce time between examinations and enhance flexibility for additional onsite work.
- Offsite supervision and data:
  - DFSA should expand the depth and breadth of data used in offsite supervision to better monitor market risk and operational risk and to track changes in risk profile.

### Governance, risk management, and internal models
- Board responsibilities and supervisory focus:
  - Regulatory framework places strong responsibilities on Boards of Directors to ensure appropriateness of business models and enforce risk limits.
  - DFSA uses onsite supervision to critically evaluate governance and risk management and has conducted a horizontal review to ensure financial expertise on Boards.
- Internal models:
  - Recommendation: Regulations regarding internal models should be updated to stipulate the need for sound governance and independent validation.

### Cross-border cooperation and crisis management
- Supervisory cooperation:
  - DFSA has hosted supervisory college meetings for Danske Bank since February 2009 and actively participates in supervisory colleges for Nordic-Baltic banks.
  - Nordic Baltic Macroprudential Forum used for benchmarking in offsite supervision.
  - A cooperation agreement exists on cross-border financial stability, crisis management and resolution among Denmark, Estonia, Finland, Iceland, Latvia, Lithuania, Norway and Sweden.
- Resolution history:
  - From summer 2008 to mid-2010 significant losses and liquidity shortages led to government “Bank Packages” with guarantees and capital injections.
  - A total of 62 banks ceased operating during 2008 to August 2013.
  - The Financial Stability Company (FSC) was used to wind up distressed banks; Danmarks Nationalbank (DN) provided extraordinary liquidity support.
  - Main source of intervention was in the non-systemic bank segment (Group 2 and 3 banks) which account for approximately 12 percent of total banking assets.
  - Number of MCIs remained unchanged at seven while MCI lending volumes outpaced banking sector lending.

### Key vulnerabilities and system risks
- Household sector:
  - Household debt-to-disposable income is over 300 percent of disposable income, about twice the average of six OECD peers.
  - Large share of household assets are illiquid (housing and pension savings) and subject to price risk.
  - Adjustable interest rate loans (introduced in 1996) and interest-only loans (offered since 2003) have increased household credit risk.
- Covered bonds and refinancing risk:
  - Stock of covered bonds is equivalent to almost twice GDP.
  - Covered bond market is more than four times as large as in any other country.
  - Many covered bond issuances had short maturities (many of one year) prior to the crisis, generating refinancing risk.
  - Legislation passed in March 2014 seeks to address refinancing risk by extending maturities of bonds in certain stress scenarios.

### Assessment methodology and context
- Assessment specifics:
  - Assessment of Basel Core Principles (BCPs) is part of the 2014 FSAP Update for Denmark; mission visited Denmark from March 4–21, 2014.
  - Denmark assessed against the BCP methodology issued by BCBS in September 2012, including both essential and additional criteria.
  - Revised BCPs contain 247 separate essential and additional criteria.
  - Ratings categories used: compliant; largely compliant; materially noncompliant; noncompliant; non-applicable.
  - The assessment team comprised Christopher Wilson (IMF) and William Rutledge (Consultant).
- Approach and limitations:
  - Assessments adopt a proportionate approach, taking into account complexity, interconnectedness, size, risk profile, and cross-border operations of banks.
  - Judgement is required; ratings under the 2012 methodology are not directly comparable to prior assessments.

*International Monetary Fund — Recommended Action Plan to Improve Compliance with the Basel Core Principles (Denmark), FSAP Update assessment material.*

### 21.      Capitalization has been improving since the early phases of the crisis, but risk-

### 21.      Capitalization has been improving since the early phases of the crisis, but risk-

### Capitalization and risk-weights
- System-wide capital adequacy ratio (CAR) increased to 23 percent compared to 12 percent before the crisis.
- Tier 1 ratio improved from 9 percent in 2007 to about 20 percent in 2013.
- Several banks raised capital through share issuance: Danske Bank, Jyske Bank, Spar Nord Bank and Vestjysk Bank.
- Risk-weights in Danish banks are among some of the lowest in the EU.
- DFSA corrective actions include a large increase in Danske Bank’s corporate risk weights and ongoing close monitoring.
- Basel III/CRD IV implementation will require adjustments in quality of capital (increased deductions and phase out of hybrids).
- 2013 central bank stress tests: systemic banks can withstand substantial shocks; several non-systemic banks need to strengthen capitalization or seek consolidation.

### Funding structure and liquidity
- Pre-crisis expansion was financed largely by short-term wholesale funding, creating a customer funding gap.
- Almost all government-guaranteed bonds issued in 2009–10 have been redeemed.
- Customer funding gap has narrowed; loan-to-deposit ratio decreased to 104 percent (from 135 percent before the crisis).
- Of wholesale funding, majority is long-term.
- Short term debt now accounts for approximately 11 percent of banks’ overall debt issuance (less than 2 percent of total assets).
- In 2007 short term issuance was almost half of total debt issuance.

### Cross-border operations and systemic banks
- Danish Domestic Systemically Important Banks (D-SIBs) have large operations across the Nordic region.
- Danske Bank operates in Finland, Sweden, Norway, Lithuania, Estonia, Latvia, and Ireland; Denmark is home supervisor to several D-SIBs and host supervisor to one G-SIB (Nordea).

### Macroeconomic preconditions for supervision
- Macroeconomic policies described as sound and sustainable; longstanding peg to the euro anchors inflation and minimizes exchange rate volatility.
- Fiscal policy supported the economy during the downturn and 2011–12; following fiscal consolidation in 2013, fiscal stance expected to return to roughly neutral in 2014.
- Government’s fiscal plans set a prudent medium-term path.
- Gross government debt is about 50 percent of GDP.
- Current account surplus at about 5 percent of GDP in 2013 and 2014.

### Framework for financial stability and macroprudential supervision
- DFSA oversees financial institutions and securities market regulation; responsibility for payment systems is shared with DN (Denmark’s central bank).
- DN’s authority derived from DN law of April 7, 1936 (Section 1).
- DFSA and DN cooperation strengthened after the crisis; formal agreement on access to confidential data from January 2010.
- Joint activities: regular bank stress testing, monitoring of liquidity and funding, data exchange, and legislative input.
- Development under the SRC secretariat of an analytical framework to assess macroprudential tools, in particular the countercyclical capital buffer.

### Systemic Risk Council (SRC)
- SRC composed of 10 members: three members from the economic ministries (Ministry of Business and Growth, Ministry of Economic Affairs and the Interior and the Ministry of Finance); two members from the DN; two members from the DFSA; and three independent experts.
- SRC in place since 2013 with a quarterly meeting calendar.
- SRC monitors and identifies systemic risks and issues observations, warnings and recommendations.
- SRC can recommend macroprudential tools, but choice and implementation lie with the MoBG; government decision role may create an inaction bias when policies need to “lean against the wind.”

### Enhanced requirements for D-SIBs
- Political agreement from October 2013 outlines enhanced requirements for D-SIBs; legislation expected to come into force by the end of March 2014.
- Six largest commercial banks designated D-SIBs: Danske Bank, Nykredit, Nordea Bank Denmark, Jyske Bank, BRF-Kredit and Sydbank.
- Enhanced capital requirements ranging from 1 to 3 percent of risk weighted assets depending on systemic importance.

### Cross-border cooperation and fora
- Denmark participates in Nordic-Baltic MoU on cross-border financial stability, crisis management and resolution with Estonia, Finland, Iceland, Latvia, Lithuania, Norway and Sweden.
- DN and DFSA are part of the European Systemic Risk Board (ESRB).

### Public and legislative infrastructure
- Well-established legal system with high legal certainty; comprehensive business laws covering insolvency, contractual and property rights.
- Title and land registration systems enable clear identification of ownership and encumbrances; compulsory sale procedure can complete as short as six months from default to forced sale.
- Banking laws, regulations and prudential standards regularly updated, aligned with EU “Single Rule Book” standards.
- Wide disclosure of economic, financial, and social statistics by Government Statistical Office, DN, DFSA and other public bodies.
- Financial disclosure requirements largely based on IFRS (IFRS 7); IFRS adopted for all listed companies and all financial enterprises effective January 2005.

### Auditing and accounting standards
- High degree of alignment between Danish accounting standards and IFRS.
- Auditors required by the Act on Approved Auditors and Audit Firms to use International Standards on Auditing (ISAs).
- Certification scheme implemented for undersigning auditors in financial institutions, MCIs and insurance companies to enhance DFSA oversight.

### Resolution framework and deposit protection
- Denmark implemented a bail-in regime early in the crisis; DFSA determines the trigger for resolution and consults with MoBG; controlled resolutions handled by the state-owned FSC.
- Further improvements to resolution regime pending adoption of EU Directive on Bank Recovery and Resolution; CRR/CRD IV regulation applicable from 2014 complements this work.
- Danish Guarantee Fund (DGF) covers deposits up to 100,000 euro per depositor; certain special categories covered in full.
- DGF membership compulsory for all credit institutions; supervised by DFSA and board appointed by MoBG.
- In 2012, DGF migrated to an ex-ante financing scheme based on annual contributions from banks.

### Market discipline, governance and consumer protection
- EO on Management and Control of Banks sets management and corporate governance rules; BoD and BoM must assess adequacy of skills and knowledge regularly.
- DFSA published July 2012 requirements for knowledge and experience of boards of financial undertakings; qualifications scale with business model complexity.
- Political agreement (Bank Package VI) establishes remuneration requirements broader and more restrictive than CRD, widening scope to all financial undertakings and financial holding companies.
- DFSA enforces consumer protection under Article 43 on good business practice and ministerial executive orders; Consumer Ombudsman supervises compliance with marketing law and may investigate complaints and bring civil or criminal actions.

### Main findings (CP 1–3)
- DFSA has an appropriate set of legal authorities to carry out supervision of the Danish banking system.
- Governance structures present potential to interfere with DFSA’s operational independence:
  - Current decision-making process on significant matters requires approval of the Financial Council, whose members are appointed for up to four-year terms by the MoBG and include financial industry representatives.
  - Replacement in July 2014 of the Financial Council with a Board of Directors will remove industry representatives’ voting on supervisory policy but will extend the range of issues short-term (two years) appointees can decide, including strategic direction of the DFSA’s operations.
- Current DFSA staffing insufficient to expand onsite supervision readily or meet additional overall demands; limited flexibility to reallocate resources between annual budget approvals.
- Well-designed structure for supervisory coordination within Denmark; MoUs with foreign supervisors in place.

### Main findings (CP 4–7)
- Banks have exclusive right to use "bank, "sparekasse" or "andelskasse" in their name; DFSA publishes list of licensed banks.
- DFSA issued guidance on crowd funding and peer-to-peer funding models to clarify licensing restrictions.
- DFSA has appropriate powers to set licensing criteria and reject applications; five new license applications received over last five years and processed with rigorous onsite examinations.
- Definition of qualifying interest in the Financial Business Act (FBA) is sufficiently broad; formal triggers for DFSA approval at 10, 33 and 50 percent share registry movements.
- Weaknesses in change-in-control powers:
  - DFSA can withdraw voting rights of a shareholder but cannot reverse a change in control.
  - No explicit power to impose prudential conditions (conditionality) when assessing qualifying interest; in practice DFSA rejects acquisitions unless satisfied and uses existing powers to require improvements before acceptance.

*Source: _cr14352 - 21.      Capitalization has been improving since the early phases of the crisis, but risk-*

### 48.      The DFSA uses prescribed criteria to assess major acquisitions clearly set out in

### _cr14352 - 48.      The DFSA uses prescribed criteria to assess major acquisitions clearly set out in

### Major acquisitions: legal criteria and powers
- Assessment criteria are prescribed in legislation and take into account:
  - the likely influence of the intended acquirer on the undertaking,
  - the suitability of the intended acquirer,
  - the financial soundness of the intended acquisition.
- The DFSA’s assessment process thoroughly assesses impact on the acquirer using a variety of scenarios.
- For major acquisitions of domestic banks, the power to approve or reject is embodied in the FBA and provides the DFSA with sufficient powers to assess risks based on a sufficiently broad set of criteria.
- If an acquisition exhibits excessive risk to the acquirer or system, the DFSA has the power to reject the application.
- Legislation requires prior notification and approval by the DFSA for a major acquisition; where a major acquisition involves a foreign undertaking, a lower threshold of prior notification is applied.

### Cross-border / qualifying interest limitations
- Qualifying interest rules distinguish cross-border operations: only prior notification is required as opposed to approval.
- Section 63 (1)–(4) in the FBA requires the DFSA to be notified prior to any direct or indirect acquisition by a financial undertaking or a financial holding company of a qualifying interest.
- Implication: when a bank supervised by the DFSA seeks to make an investment in a foreign asset, DFSA approval is not required under the FBA.
- Resulting limitation: DFSA’s ability to reject a potential foreign acquisition is constrained; DFSA can discourage but not formally approve/reject in such cases.

### Supervisory framework and onsite inspection frequency
- The DFSA has a good supervisory framework with notable strengths, including the Supervisory Diamond used to constrain overly risky bank business models.
- The very extended examination schedule limits immediacy of detecting issues from onsite work; this is a clear problem for smaller well-capitalized banks and relevant for larger banks given additional examinations beyond the annual focused inspection are infrequent.
- Recommendations / observations:
  - Onsite inspections need to be used more frequently and more flexibly to permit additional reviews when changes in risk profile or stress test results indicate need.
  - Onsite follow-up of detected problems is typically deferred to the next scheduled examination.
  - Making examination findings public increases transparency but can accelerate adverse effects on a bank; DFSA has some capacity to withhold reports and has used it.
  - Caution against substantial reliance on external auditors to verify that supervisory orders and risk information have been addressed, given challenges in external auditors fully understanding the supervisory perspective.

### Recovery and resolution planning
- Individual recovery and resolution plans have not generally been required or prepared to date.
- All banks are expected to prepare for resolution.
  - For small and medium sized banks, DFSA expects plans that allow resolution over a weekend period; this regime has functioned well.
  - For systemic banks, comprehensive recovery and resolution plans aligned with international standards remain a work in progress.
- Actions taken include requiring contingency plans and providing guidance on information availability for resolution.

### Reporting, data collection, and surveillance gaps
- FBA powers permit collection of a generally comprehensive set of financial and risk information from banks on routine and ad hoc bases.
- Reporting instructions are fit for purpose and regularly reviewed; most banks submit standardized regulatory returns quarterly (and more often for certain types of information).
- Quarterly returns support monitoring of bank performance and changes in business mix, especially credit risk.
- Data submitted is subject to statistical validations and analyzed via cohort comparisons to detect outliers and discriminate risk profile.
- Reporting omissions:
  - Instructions omit reporting operational risk loss and related party lending.
  - Supervisory reporting does not routinely require reporting of operational risk losses by Basel event type and category (until Q1 2014 COREP for certain banks).
  - No routine supervisory reporting to track and monitor related party exposures.
  - Supervisory reporting of traded market risk could be expanded to capture a broader suite of risk information and stress test results; exotic instruments may not be captured.
- Specific reporting frequencies and coverage:
  - Most banks report liquidity information monthly; very small banks are exempted to quarterly reporting.
  - Systemic banks are subject to reporting LCR and NSFR on a monthly/quarterly basis.
  - DFSA receives quarterly data regarding cross-border exposures on a legal entity basis to assess size of exposure as a percentage of total assets.

### Governance, risk management, and supervisory focus
- Governance:
  - DFSA has a good overall approach to governance; horizontal review of Boards of Directors (BoDs) composition is highlighted.
  - Gaps: not yet requiring the establishment of risk committees (to be required April 1, 2014); other elements to make more explicit include codes of conduct and independence in model validation.
- Risk management:
  - DFSA program is generally well designed, strongest for credit risk; operational risk requirements are in the process of being strengthened.
  - Improvements in train include updating Executive Order—Management and Control to require BoD concurrence for dismissal of Chief Risk Officer (implemented as of March 31, 2014), adding further requirements for SIFIs, and applying requirements more generally to financial holding companies (implemented as of March 31, 2014).
- Capital adequacy:
  - Supervisor sets prudent capital requirements on an individual basis, emphasizing quality of capital.
  - Pillar II arrangements applied through annual Individual Capital Adequacy Assessment Process (ICAAP) including stress testing.
  - Delay in Parliamentary process to transpose CRD into legislation meant Basel III capital requirements had not strictly met BCBS implementation schedule at time of mission.
- Credit risk:
  - Strong supervisory focus; ten largest exposures reviewed annually (by Board, external auditors, and examiners).
  - Conservative approach to impairment and provisioning commended.
  - Database of larger exposures used for rating consistency checks could be broadened.
  - Prudential limits on single counterparty/group exposures exist; banks typically have risk appetite for large exposures lower than the 25 percent LE limit; Supervisory Diamond encourages prudent aggregate credit concentration management.
  - Regulations for related party transactions cover BoD, BoM and intra-group transactions; definition of related party does not extend to minor shareholders and key risk takers (due to potential restrictive definition of BoM), limiting DFSA powers.
- Market risk:
  - Comprehensive market risk regulations require prudent management; typical traded instruments include Danish mortgage bonds, equities, FX derivatives, and commodities.
  - Requirements include Board-approved policies, segregation of duties, independent verification of valuations, and onsite reviews.
  - Offsite reporting covers currency, interest rate, commodity and equity product categories; increased exposures to specific products or exotic instruments may not be directly visible offsite and could build up undetected between onsite examinations.
  - Onsite market risk inspections: for larger banks once every four years; small banks as part of ordinary full inspections; D-SIBs to be subject to annual market risk inspections beginning in 2014.
  - Supervision cycle for sound and well-capitalized medium and smaller banks of once every four to six years is considered too long given limited offsite reporting.

### Liquidity regime observations
- FBA prescribes two quantitative liquidity requirements that banks must meet at all times; reported monthly for majority of banks (very small banks exempted to quarterly).
- Supervisory Diamond includes an additional two metrics acting as early warning indicators.
- Banks submit liquidity stress testing results and liquidity/funding positions regularly.
- Short-term liquidity buffer requirement similar in magnitude to the LCR is in place.
  - Definitions of eligible assets for HQLA portfolios are broadly defined; DFSA approval is not required.
  - Definitions are not sufficiently prescriptive (section 152 includes unlisted liquid securities); no haircuts applied to assets’ values.
  - No current limit on own-issued mortgage covered bonds counting in HQLA pool to meet the two quantitative liquidity requirements.
  - Banks are transferring out of own-issued mortgage covered bonds to meet Basel III LCR rules.

### Operational risk and external audit considerations
- Supervisory reporting is not sufficiently frequent and detailed to identify and monitor changes in operational risk profile.
  - Onsite operational risk examinations are performed as subsets of credit and market risk reviews.
  - Routine reporting should be expanded to include loss event type and changes in business environment and internal control factors.
  - Banks using the standardized method will report Basel event type and category for Q1 2014 in accordance with new COREP requirements; Q1 data reporting deadlines: May 30 for company level and June 30 for group level.
  - Banks using standardized method: Danske, Nordea, Jyske, Sydbank and FIH.
- External auditors:
  - Overall external auditor program appears sound; DFSA extracts value through requirements to review largest exposures.
  - Shortcomings include lack of requirements that fair value estimates be subject to independent verification and validation, and DFSA lacks access to external auditors’ work papers.
  - Gap in EO: not directing that internal auditors must review risk management, compliance and control functions; evidence suggests some reviews are performed (at least for largest banks) but EO should be updated.
  - Suggested EO revisions: provisions related to dual control/four eyes principle and protection of assets.

*Source: IMF mission text (excerpts provided in content unit).*

### 75.      While the Pillar III disclosure requirements look adequate on paper, from responses to

### _cr14352 - 75.      While the Pillar III disclosure requirements look adequate on paper, from responses to

### Pillar III disclosures and transparency
- Finding: While the Pillar III disclosure requirements look adequate on paper, the DFSA does not review whether any of these disclosure requirements are met.
- Practice described: Only the larger banks (Group 1 and 2) have such disclosures reviewed in detail. Reviews are typically performed for information purposes of the supervisors, not to assess completeness or accuracy of the filings.
- Enforcement: Provisions exist that could require republication or the imposition of a fine, but they have never come into play.
- Core Principle linkage: CP 29; graded MNC in summary tables for Disclosure and transparency.

### Anti‑Money Laundering / Countering Financing of Terrorism (AML/CFT) supervision
- Program developed: DFSA has developed a risk-based onsite examination program to assess banks’ compliance with obligations under the AML/CFT Act.
- Onsite inspections conducted: DFSA carried out comprehensive onsite inspections (including follow-ups) of 16 large and medium-size banks based on a risk-based selection between 2010–2013.
- Coverage: The 16 banks submitted to onsite inspections represent an accumulated share of more than 80 percent of the total working capital amongst Danish banks.
- Self-assessment scheme: The DFSA’s current self-assessment scheme includes 20 medium-size and small banks (risk-based selection).
- Guidance and outreach: DFSA has issued comprehensive guidance to financial institutions and meets regularly with the Danish Bank Association and the Danish Local Banks Association to discuss AML/CTF issues.
- Resource gap and monitoring shortfall:
  - The DFSA does not have adequate resources to supervise the effective implementation of banks’ internal AML/CFT controls.
  - The DFSA does not monitor that banks have adequate policies and procedures through routine offsite surveillance and onsite reviews to assess the adequacy and effectiveness of banks’ policies and procedures.
- Core Principle linkage: CP 29; graded LC in summary tables for Abuse of financial services; DFSA lacks adequate powers regarding AML/CFT to impose sanctions.

### Selected supervisory strengths and weaknesses (summary findings from Core Principles)
- Institutional powers and approach:
  - Core Principle 1 (Responsibilities, objectives and powers): Grade C — DFSA has an appropriate set of legal authorities to carry out supervision.
  - Core Principle 2 (Independence, accountability, resourcing and legal protection for supervisors): Grade MNC — Structures have the potential to interfere with DFSA operational independence; Financial Council (members appointed for up to four-year terms by the MoBG) currently required to approve significant matters; replacement in July 2014 by a Board of Directors with two-year terms raises other governance concerns.
  - Budgetary constraint: The budget process is not flexible enough to allow DFSA to expand onsite supervision readily.
- Supervisory tools and execution:
  - Core Principle 8 (Supervisory approach): Grade LC — Supervisory Diamond and framework are strengths, but the extended examination schedule limits immediacy; recovery and resolution plans not required on an individual basis to date; DFSA requires banks to assess resolution ability and systems for weekend resolution.
  - Core Principle 9 (Supervisory techniques and tools): Grade LC — Good set of tools post-crisis, but onsite examination schedule is too limited and audit/risk management reports are not received on a flow basis (to be addressed later for SIFIs).
  - Core Principle 11 (Corrective and sanctioning powers): Grade C — DFSA demonstrates ability and willingness to intervene early and exercise a range of tools for timely corrective actions.
- Risk coverage and reporting:
  - Core Principle 16 (Capital adequacy): Grade C — DFSA implemented BII capital standards effectively; Pillar 2 well developed through annual ICAAP; Basel III implementation pending.
  - Core Principle 17 (Credit risk): Grade C — Very strong focus on credit risk; ten largest exposures reviewed annually by Board, external auditors, and examiners.
  - Core Principle 24 (Liquidity risk): Grade LC — Eligible assets for HQLA broadly defined and approval by DFSA not required; DFSA has not implemented formal encumbrance limits.
  - Core Principle 25 (Operational risk): Grade MNC — Supervisory reporting not sufficiently frequent or detailed; notification regime has material shortcomings; onsite examinations not systematically performed across banks.
  - Core Principle 28 (Disclosure and transparency): Grade MNC — See Pillar III section above.
  - Core Principle 29 (Abuse of financial services): Grade LC — Insufficient powers for AML/CFT sanctions; onsite review program not systematic across sector.

- Specific numeric and policy thresholds noted:
  - General capital requirement of 8 percent; DFSA can ask for a recovery plan when a bank fulfills only the general capital requirement of 8 percent, but not the higher requirement applied to the specific institution.
  - Aggregate large exposure limit referenced: 25 percent limit (notification requirement for large exposures needs to be tightened; currently DFSA notified at the end of quarter).

- Governance and governance-timing details:
  - Dates and implementation: risk committees to be required April 1, 2014; requirement for concurrence of BoD on dismissal of CRO implemented as of March 31, 2014; Financial Council replaced in July 2014.
  - Terms of appointees: Financial Council members up to four-year terms; new Board appointees two-year terms.

### Recommended Action Plan (selected recommendations by Principle)
- Principle 2
  - Seek increased operational independence by revisiting the threshold of significance for Risk Council and Board decision-making, and by establishing supervisory imperatives wholly within the authority of the Director General (e.g., setting the inspection schedule and establishing the approach to impairments and provisioning).
  - Mitigate concerns with new Board structure by seeking legislative change on the currently very short terms of appointees and the absence of a formal vetting process for nominees.
- Principle 6
  - Expand powers in relation to significant ownership (qualifying ownership) to be able to reverse a change of control.
  - Explicitly define ‘ultimate beneficial owners’ in the FBA.
  - Amend FBA to require a written demand for banks to notify DFSA about any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest.
- Principle 8
  - Seek necessary budgetary approval to lessen significantly the length of time between examinations.
  - Require the submission of comprehensive recovery and resolution plans for all banks.
- Principle 9
  - With additional budgetary resources, use onsite exams more flexibly to respond to offsite findings and external events.
  - Require submission of audit and risk management reports on a flow basis.
- Principle 12
  - Apply prudential rules more generally to financial holding companies.
  - Seek authority to do fit and proper reviews on an ongoing basis of owners and senior management of non-financial parent companies.
- Principle 14
  - Require establishment of risk committees, issuance of codes of conduct, and overall conflicts of interest policies.
  - Modify regulations to ensure independence in the validation of models.
- Principle 15
  - Update requirements so dismissal of the CRO needs concurrence of the BoD (implemented as of March 31, 2014), add further requirements for SIFIs, and apply requirements to financial holding companies.
  - Ensure liquidity and other risks are factored into internal pricing of financial products, new product approval, and performance measurements.
  - Clarify rules/guidance on independence of units doing model validation.
- Principle 18
  - Broaden the database of larger exposures used to check consistency of ratings.
- Principle 20
  - Revise regulations to incorporate a broader definition of related parties.
  - Enhance routine disclosures to include related party exposures with detailed information for offsite analysis.
- Principle 22
  - Expand suite of data used in routine offsite supervision.
  - Expand onsite market risk examinations in a risk-based approach to include a broader set of banks.
- Principle 23
  - Formalize procedures for netting.
- Principle 25
  - Expand routine reporting to include a broader suite of risk information, i.e., by loss event type.
  - Establish a stand-alone onsite examination program for operational risk to achieve a comprehensive bank-wide view.
  - Agree formal mechanisms to allow supervisors to remain apprised of developments at a bank.
- Principle 26
  - Modify regulations to direct internal auditors of banks to review risk management, compliance and control functions.
  - Include provisions related to dual control (four eyes principle) and protection of assets.
- Principle 27
  - Require that fair value estimates are subject to independent verification and validation.
  - Seek authority for DFSA to have access to work papers of external auditors.
- Principle 28
  - Change internal policies of the DFSA to ensure there is a systematic review of Pillar III disclosures to assess completeness and accuracy of filings.
- Principle 29
  - Expand the self-assessment program to include all banks as part of annual offsite surveillance.
  - Expand the onsite examination program within the risk-based approach to a broader number of banks.

*International Monetary Fund — Denmark assessment (excerpt).*

### 78.      The Danish authorities welcome the assessment of the regulation and supervision of

### _cr14352 - 78.      The Danish authorities welcome the assessment of the regulation and supervision of

### Danish authorities’ overall response
- The Danish authorities welcome the assessment of the regulation and supervision of the Danish banking sector and intend to use the observations and recommendations to further improve regulation and supervision.
- The authorities generally share the views and the grading of most of the Basel Core Principles, considering them to reflect the complexity of the matter in a balanced and thoughtful manner.

### Operational independence and transparency of the DFSA
- Authorities note the assessors’ concerns regarding the operational independence of the DFSA and state:
  - They understand the underlying reasons for the concerns.
  - In practice, lack of operational independence "has not materialized as a problem" in the past.
- Regarding the DFSA’s high level of transparency:
  - The assessors’ concerns are understood.
  - The DFSA’s transparency "has however turned out to be more positive than negative."

### Intensity of the DFSA’s examination schedule (Basel Core Principle 8)
- Authorities’ remarks on examination intensity:
  - The intensity of inspections could be increased with shorter time periods between inspections, but the current examination schedule is driven by the DFSA’s ongoing risk assessment of banks.
  - Only small banks with low risks and a simple business model are covered by the extended examination schedule of six years.
  - The DFSA regularly adjusts the examination schedule to reflect changes in the risk assessment of individual banks. Sources of changes include:
    - Ongoing outlier surveillance based on regular reporting from banks and the results of the DFSA’s semi-annual stress-test model.
    - Solvency meetings with banks.
    - Written material such as the auditor’s protocol.
  - The purpose of the ongoing risk assessment is to prioritize banks deemed riskiest by the DFSA; consequently, low risk banks are visited significantly less often as a by-effect of a truly risk-based approach.

### Assessment grading framework (four-grade scale)
- The assessment uses a four-grade scale: (i) compliant; (ii) largely compliant; (iii) materially noncompliant; and (iv) noncompliant.
- Definitions and key points:
  - Compliant:
    - All essential criteria applicable for the country are met without any significant deficiencies.
    - Instances may exist where the Principle is achieved by other means; additional measures may be needed given specific country conditions.
  - Largely compliant:
    - Only minor shortcomings are observed that do not raise concerns about the authority’s ability and clear intent to achieve full compliance within a prescribed period.
    - Can be used when the system does not meet all essential criteria but overall effectiveness is sufficiently good and no material risks are left unaddressed.
  - Materially non-compliant:
    - Severe shortcomings exist despite formal rules; evidence that supervision has clearly not been effective or practical implementation is weak.
    - Shortcomings are sufficient to raise doubts about the authority’s ability to achieve compliance.
    - The gap between “largely compliant” and “materially non-compliant” is wide and assessors are forced to make a clear statement.
  - Non-compliant:
    - No substantive implementation of the Principle, several essential criteria are not complied with, or supervision is manifestly ineffective.
- Denmark voluntarily chose to be assessed and graded against the additional criteria, in addition to the essential criteria.

### Detailed assessment of compliance with Basel Core Principles — A. Supervisory Powers, Responsibilities and Functions
- Principle 1: Responsibilities, objectives and powers
  - Principle statement:
    - An effective system of banking supervision has clear responsibilities and objectives for each authority involved in the supervision of banks and banking groups.
    - A suitable legal framework provides each responsible authority with necessary legal powers to authorize banks, conduct ongoing supervision, address compliance with laws and undertake timely corrective actions to address safety and soundness concerns.
  - Essential criteria and findings (EC1–EC3):

  - EC1: The responsibilities and objectives of each of the authorities involved in banking supervision are clearly defined in legislation and publicly disclosed. A credible and publicly available framework exists where more than one authority is responsible to avoid regulatory and supervisory gaps.
    - Findings:
      - Responsibilities and objectives are clearly defined in legislation.
      - Section 344 (1) of the FBA authorizes the DFSA to supervise compliance with the FBA and regulations laid down pursuant to this Act (except for two sections not relevant to this analysis).
      - Under this authority, the DFSA supervises banks (and financial holding companies), MCIs, insurance companies, and pension funds through various divisions.
      - The DFSA also oversees payments work, a responsibility shared with the DN.
      - The DN monitors financial stability, produces financial statistics, manages the Government's debt, and works with the DFSA in developing and implementing stress testing.
      - Some peripheral matters fall under other bodies, e.g., the Danish Commerce and Companies Agency.

  - EC2: The primary objective of banking supervision is to promote the safety and soundness of banks and the banking system. Broader responsibilities must be subordinate to the primary objective and not conflict with it.
    - Findings:
      - The DFSA’s primary task is supervision of a wide range of financial undertakings, including banks and mortgage-credit institutions.
      - The principal focus is monitoring that undertakings have adequate own funds to cover their risks (supervision of solvency).
      - Senior DFSA officials are sensitive to the interplay of financial stability with micro-supervision; the risk-based supervision process gives particular weight to institutions whose financial condition is most important for preserving financial stability.
      - Other DFSA roles (e.g., securities market supervision, ensuring prospectuses meet statutory requirements, monitoring market abuse) are carried out in divisions separate from banking divisions and are complementary to the core function of ensuring safety and soundness.
      - The DFSA assists in drawing up financial legislation, prepares EOs for the financial sector, and collects and communicates statistics and key figures on the financial sector.

  - EC3: Laws and regulations provide a framework for the supervisor to set and enforce minimum prudential standards for banks and banking groups. The supervisor has the power to increase prudential requirements for individual banks and banking groups based on their risk profile and systemic importance.
    - Findings:
      - The DFSA has a good supporting legal framework for supervision.
      - Ensuring solvency has the highest priority.

*Source: IMF staff assessment and Danish authorities’ comments as presented in the provided content unit.*

### section 124 (1) and (2) of the FBA, the BoD and BoM of banks and MCIs must ensure that

### _cr14352 - section 124 (1) and (2) of the FBA, the BoD and BoM of banks and MCIs must ensure that

### Capital requirements and internal capital assessment
- Section 124 (1) and (2) of the FBA requires the BoD and BoM of banks and MCIs to ensure the institution:
  - has appropriate internal procedures for risk measurement and risk management for regular assessments and maintenance of a capital base of a size and composition appropriate to cover the risks of the institution.
- Minimum capital requirements:
  - 8 percent of the risk-weighted items (the solvency requirement).
  - EUR 5 million (minimum capital requirement).
- Supervisory discretion and Pillar II:
  - Under subsection (3) of section 124 of the FBA, the DFSA may lay down a higher individual solvency requirement than subsection (2).
  - Under section 225 (2), the DFSA may take a flexible approach allowing a bank to continue to operate if it meets the 8 percent requirement but not the Pillar II requirement.
  - Following the 2013 law change (creating the current 8 plus regime), the DFSA can ask the bank to take recovery actions to reach the Pillar II level, including capital injections, reductions in risk weighted assets, sale of businesses, or merger.
- Post-EU regulation:
  - In any event, currently and after the entry into force of the EU regulation, the solvency need will at least be the 8 percent specified under section 124 (2).

### Other prudential requirements and supervisory remit
- The DFSA, under the FBA, imposes prudential requirements including:
  - liquidity,
  - large exposures,
  - transactions with related parties.
- The DFSA’s powers include full access to banks’ and banking groups’ Boards, management, staff and records, and authority to obtain information per sections 347 (4) and 347 (1) of the FBA.
- Cross-border supervision and branches:
  - Section 346b of the FBA permits the DFSA to request competent authorities in another Member State or in an EU-agreement country to assist via supervision activities, on-the-spot checks or inspections.
  - Section 347 (1) applies correspondingly to foreign credit institutions, management companies and investment companies operating in Denmark via branches or offering financial services.
  - Currently DFSA reviews foreign banks’ branches mainly for liquidity issues and some broad consumer issues; forthcoming EU directives may shift responsibility for liquidity review of EU branches to the home supervisor.

### Enforcement, corrective actions and resolution cooperation
- Powers to act when a bank is non-compliant or engaged in unsafe or unsound practices (EC6):
  - DFSA can order timely corrective actions (section 350 (1) and (2) FBA), impose sanctions, revoke licenses where measures ordered have not been taken within specified time limits, and order removal/resignation of BoM/BoD members (section 351 (1); section 64 (2)).
  - DFSA cooperates with the FSC and consults with the MoBG before initiating resolution actions; DFSA requests a mandate from the MoBG to pursue alternatives.
- Support to resolution authorities (EC5 of Principle 3):
  - DFSA must obtain a mandate from the MoBG before participating in crisis management or initiating discussions with stakeholders to resolve a bank (Crisis Manual Section 5.1; two MoBG letters from 1998 referenced).
  - Section 354.6 (10) FBA permits DFSA to share information with interested parties involved in attempts to save a financial undertaking, provided DFSA has MoBG authorization and recipients need the information.
  - DFSA will inform and cooperate with the Financial Stability Company to enable valuation and resolution preparation.

### Governance, independence, resourcing and legal protection (Principle 2)
- Assessment: MNC
- Key structural features and concerns:
  - Budgetary process:
    - DFSA budget must be approved by the MoBG and ultimately by the Ministry of Finance; budget becomes part of the general government budget and is funded via assessments on supervised institutions based in significant part on the size of the institution.
    - The appropriation for the DFSA has more than doubled in the past decade, with most expansion since 2009.
    - DFSA cannot readily expand onsite supervision during the budget year without MoBG approval; cannot carry over funds without MoBG approval.
  - Appointment and dismissal:
    - MoBG appoints and can dismiss the Director General; no FBA provisions define dismissal grounds or require public disclosure of reasons.
    - MoBG appoints members of the Financial Council and, prospectively, the Board of Directors; MoBG will be an observer to the Board.
  - Oversight bodies:
    - Financial Council (current):
      - 14 representatives, including four nominated by industry groups.
      - Decisions on matters with policy implications or significant effects are made by majority vote following presentations by non-voting DFSA officials.
      - Industry participants vote on matters affecting their industry but recuse on matters involving their own firm; no formal vetting processes for members.
    - Board of Directors (expected from July 1, 2014):
      - Seven person Board; members appointed by MoBG for two-year terms; none can be current industry representatives.
      - Composition: three chosen for academic qualifications, two for previous financial industry experience, one for general business background, and one from the DNB.
      - No formal vetting process expected; Board will decide on strategic direction, organization, operations of the DFSA, and approve the annual supervision plan; Director General retains appointment/dismissal authority.
      - Shorter two-year terms could increase turnover and affect policy consistency.
  - Conflict of interest, governance and transparency issues:
    - Board and Council members have no fit and proper requirements specified.
    - Decision threshold for matters to go to Financial Council is relatively low, resulting in many consequential matters being decided by the Council.
  - Staff credibility and safeguards:
    - DFSA staff recognized as knowledgeable and committed.
    - Personnel policy contains internal guidelines on confidentiality, prohibition on acquisition of shares, and reporting of personal loans; noncompliance can lead to dismissal or potential prison sentence.
  - Resources:
    - DFSA’s budgetary resources constrain ready expansion of onsite supervision except where external developments justify increases.
    - Salary scales allow DFSA to attract and retain staff reasonably well in the current soft market; historical turnover has been as high as 28 percent in some years and currently about half of that.
    - Section 347b.-(1) FBA allows DFSA to order a financial undertaking to pay costs of an impartial investigation if DFSA lacks necessary specialized resources.
    - Assessors saw no evidence of internal budgets for regular training of staff; technology and travel budgets were not otherwise insufficient.
  - Legal protection:
    - Officials and agents in DFSA are subject to general liability and employer's vicarious liability under Danish law; employees are not personally liable for actions made during usual and proper exercise of duties, apart from criminal sanctions for actions beyond usual responsibilities.
- Comments:
  - Structures in place and anticipated changes have potential to create problems for DFSA independence.
  - Replacement of the Financial Council with a Board will remove current industry representatives’ voting role but may extend the range of issues decided by short-term political appointees.
  - Budgetary constraints and MoBG involvement in statutory amendments, EOs approval, and prior authorization for some resolution activities raise questions on independence.
  - Preservation of operational independence and integrity of decision-making, particularly on core supervisory matters (e.g., provisioning), should be prioritized.

### Cooperation and information sharing (Principle 3)
- Assessment: Compliant
- Domestic cooperation:
  - DFSA has good operational cooperation with the DN; they work closely on stress testing and share data.
  - DN and DFSA have regular quarterly senior-level meetings; cooperation processes are documented in a MoU (being updated but no substantial changes intended).
  - Section 354 (6) FBA allows DFSA to share confidential information with the DN and the European Central Bank when necessary to meet statutory obligations.
  - Broader cooperation exists among DN, MoF, MoBG, and DFSA on financial stability, documented in a MoU.
- Cross-border cooperation:
  - A Nordic-Baltic cooperation agreement exists on cross-border financial stability, crisis management and resolution among Denmark, Estonia, Finland, Iceland, Latvia, Lithuania, Norway and Sweden, in line with the EU-wide MoU of June 2008.
  - DFSA participates in supervisory colleges (see BCP 13).
- Confidentiality safeguards:
  - FBA section 354 (1) and Criminal Code sections 152 to 152e impose duties of confidentiality on DFSA employees, persons performing services, and experts; duty continues after termination of contract.
  - Subsection (6) of FBA 354 allows divulging confidential information only if:
    - recipients fall under the same duty of confidentiality;
    - information is divulged to a foreign supervisor on the basis of an international cooperation agreement;
    - foreign recipients are subject to statutory confidentiality corresponding to subsection (1) and require the information to perform duties.
  - Section 354 (12) restricts divulgence of EU or financial-area agreement country information to cases where submitting authorities grant express permission and specify permitted uses.
  - DFSA uses confidential information for supervisory duties, to impose sanctions, or in legal proceedings (section 354 (9)); assessors aware of one such appeal.

### Permissible activities and licensing (Principle 4)
- Definitions and use of term "bank":
  - The term "bank" is defined in section 7(1) of the FBA: undertakings licensed as "banks" carry out activities comprising receiving from the public deposits or other funds to be repaid and granting loans at the undertaking's own expense, except on the basis of issuing mortgage-credit bonds.
  - There are 90 licensed banks in Denmark.
  - Banks have the exclusive right and obligation to use the words "bank," "sparekasse" or "andelskasse" in their name (sections 7(5) and (6)).
- Institutions permitted to accept deposits (other than banks):
  - savings banks (sparekasser),
  - cooperative savings banks (andelskasser),
  - savings undertakings (sparevirksomheder).
  - Savings banks and cooperative savings banks are subject to the same regulation and supervision as banks but are not organized as public limited companies; savings banks are independent institutions and cooperative savings banks are cooperatives.
  - In addition to DFSA licensing, banks, savings banks and cooperative banks must be registered by the Danish Business Authority; new banks must be organized as public limited companies.
- Mortgage-credit institutions (MCIs):
  - MCIs are licensed under the Mortgage Credit and Covered Bond Act and are not allowed to use the term ‘bank.’
  - There are 8 licensed MCIs.
- Permissible banking activities:
  - Banks may only carry out activities customary for banks; section 7(1) refers to Annex 1 and sections 24–26 listing 14 separate traditional banking activities (e.g., acceptance of deposits and other repayable funds, lending, payment services, including electronic money transactions).

*International Monetary Fund — Extracted content from the provided section of the source PDF*

### Annex 1 defines "bank activities" as:

### _cr14352 - Annex 1 defines "bank activities" as:

### Definition of "bank activities" (Annex 1)
- 1) acceptance of deposits and other repayable funds;
- 2) lending, including:
  - consumer credit;
  - mortgage credit;
  - factoring and discounting;
  - commercial credits (including forfeiting); and
  - financial leasing.
- 3) payment services (money transmission services);
- 4) issue and administration of means of payment (e.g. credit cards, travelers’ cheques, and bankers' drafts);
- 5) guarantees and provision of collateral;
- 6) participation in issuing securities and provision of related services;
- 7) advice to undertakings on capital structure, industrial strategy and related questions and advice, and services relating to mergers and the acquisition of undertakings;
- 8) money broking;
- 9) credit reference service;
- 10) safe custody services;
- 11) business for own account relating to any of the instruments mentioned in annex 5;
- 12) safekeeping and administration in relation to one or more of the instruments mentioned in annex 5, and mortgages;
- 13) other activities in relation to trade in money and credit instruments; and
- 14) electronic money institutions.

### Permissible ancillary and temporary activities (s.24–s.26)
- Section 24:
  - Banks may carry out activities ancillary to the activities licensed through subsidiaries, other financial activities.
  - Purpose: to narrow permissible activities of banks to financial activities associated with banking.
  - DFSA has published guidance on interpretations of s.24 although an official list of ancillary activities has not been published.
- Section 25:
  - Banks may, temporarily, carry out other activities to secure or phase out exposures already entered into, or with regard to restructuring enterprises.
  - DFSA must be informed regarding the latter.
  - Purpose: to allow banks to work-out defaulted loans (in a potential debt for equity swap) to facilitate an orderly sale of impaired assets.
  - Notification to DFSA under s.25 will trigger supervisory actions to monitor and track the disposal of the asset in a prudent timeframe.
- Section 26 (cooperation restrictions):
  - Pursuant to section 26, banks may carry out other activities in cooperation subject to the following restrictions:
    - 1) the bank does not have direct or indirect controlling influence on the undertaking;
    - 2) the bank does not carry out the activities in cooperation with other financial undertakings which are part of a group with said financial undertaking, or with regard to insurance companies, in management cooperation with said insurance company, and
    - 3) the activities are carried on in another company than the bank.

### Mortgage-credit institutions and activities (Annex 3)
- Mortgage-credit institutions may only carry out:
  - activities mentioned in Annex 3 and activities under sections 24–26;
  - may be licensed as "securities dealers" to carry out defined activities as such.
- Annex 3 defines "mortgage-credit activities" as:
  - 1) Granting of loans against a registered mortgage on real property on the basis of the issue of mortgage-credit bonds or other securities;
  - 2) Granting of loans without a mortgage on real property to public authorities or with a guarantee for surety from a public authority;
  - 3) Business for own account relating to any of the instruments mentioned in Annex 5;
  - 4) Safekeeping and administration of own mortgage-credit bonds and own other securities.
- Note: What applies to banks pursuant to sections 24–26 applies similarly to mortgage-credit institutions.

### Instruments (Annex 5)
- Annex 5 describes "instruments" as:
  - 1) Negotiable securities (except for payment instruments) that can be traded on the capital market, including
    - a) shares in companies and other securities equivalent to shares in companies, partnerships and other businesses, and share certificates,
    - b) bonds and other debt instruments, including certificates for such securities, and
    - c) any other securities of which securities as mentioned in a) or b) can be acquired or sold, or give rise to a cash settlement, the amount of which is fixed with securities, currencies, interest rates or returns, commodities indexes and other indexes and targets as reference,
  - 2) money market instruments, including treasury bills, certificates of deposits and commercial papers, with the exception of payment instruments,
  - 3) units in collective investment schemes covered by the Investment Associations, etc. Act and units in other collective investment undertakings,
  - 4) options, futures, swaps, Forward Interest-Rate Agreements (FRAs), and any other derivative agreement concerning securities, currencies, interest rates or returns, or other derivatives, financial indexes or financial targets which can be subject to physical or cash settlements,
  - 5) options, futures, swaps, Forward Interest-Rate Agreements (FRAs), and any other derivative agreement concerning commodities for cash settlement, or which can be settled in cash if one of the parties so wishes (for other reasons than breach or other causes of termination),
  - 6) options, futures, swaps, and any other derivative agreement concerning commodities for physical settlement, if traded on a regulated market or a multilateral trading facility,
  - 7) options, futures, swaps, forward contracts or any other derivative agreement concerning commodities not covered by no. 6 and which can be physically settled, and have no commercial purpose, and which have characteristics similar to other derivative financial instruments, taking into consideration whether they are cleared and settled through acknowledged clearing institutions or are covered by regular determination of a margin,
  - 8) credit derivatives,
  - 9) financial contracts for difference (FCDs),
  - 10) options, futures, swaps, Forward Interest-Rate Agreements (FRAs) and any other derivative agreement regarding climatic variables, freight rates, emissions permits or inflation rates, or other official financial statistics for cash settlement, or which can be settled in cash if one of the parties so wish (for other reasons than breach or other causes of termination) and any other derivative agreement concerning assets, rights, obligations, indexes and targets not covered by the other numbers, and which have characteristics similar to other derivative financial instruments, taking into consideration whether they are traded on a regulated market or through a multilateral trading facility, cleared and settled through acknowledged clearing institutions or are covered by regular determination of a margin, and
  - 11) foreign-exchange spot transactions for investment purposes in order to secure a profit in connection with changes in the exchange rate.

### Use of the word "bank", deposit-taking, and public lists (EC3–EC5)
- EC3 (use of "bank" and derivations):
  - The use of the word “bank” and any derivations such as “banking” in a name, including domain names, is limited to licensed and supervised institutions in all circumstances where the general public might otherwise be misled.
  - Pursuant to section 7(5) of the FBA, banks have the exclusive right to use the words "bank", "sparekasse" or "andelskasse" in their name and banks are obliged to use the word "bank", "sparekasse" or "andelskasse" in their name (reference s. 7(6)).
  - Other undertakings, except for banks established by law, may not use names or expressions for their activities that create the impression that they are a bank.
  - The Danish Business Authority (DBA) registers new companies or changes in company names and will contact DFSA before registering a company that uses the word "bank" etc. in its name.
  - DFSA will, in accordance with section 344(1), make a decision stating that the use of the word "bank" etc. violates section 7(5) and that the undertaking must cease using the word "bank" etc. in its name. If not complied with, DFSA reports the violation to the police who, according to section 373(1), will prosecute; the sentence being either a fine or imprisonment.
- EC4 (deposit-taking reserved):
  - The taking of deposits from the public is reserved for institutions that are licensed and subject to supervision as banks.
  - Only institutions listed in section 7(3) of the FBA are permitted to take deposits from the public and a license from the DFSA is required which will be subject to supervision by the DFSA.
  - MCIs are not authorized to take deposits from the public. MCI’s operate an alternative funding structure mainly through the issuance of covered bonds (according to section 7(3)).
- EC5 (public list of licensed banks):
  - On its homepage, www.Finanstilsynet.dk there is a list of all companies under supervision of DFSA.
  - It is possible to download a complete list of companies under supervision, or to make a search after specific types of companies.

### Assessment and findings on Principle 4
- Assessment of Principle 4: Compliant
- Comments:
  - The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined in the regulations.
  - The use of the word “bank” in names is clearly defined in the regulations (FBA), and there was sufficient evidence to suggest close supervision by the DFSA of the use of the term “bank”.
  - Banks have the exclusive right to use the words "bank", "sparekasse" or "andelskasse" in their name and the list of banks licensed by the DFSA is published on their website.
  - DFSA has published guidance to industry and the public on crowd funding and peer-to-peer funding models to clarify licensing restrictions and to educate public decision making and behavior.

### Licensing criteria and process (Principle 5; EC1–EC2)
- EC1 (authority and process):
  - DFSA has the licensing as well as the supervisory authority for granting and withdrawing banking licenses in Denmark.
  - According to s.7 and s.14 of the FBA, DFSA is responsible for granting a bank license and sections 223 to 225 state that DFSA is responsible for withdrawing a bank license.
  - The Danish Business Authority (DBA) registers institutions; minimum capital requirement for banks is 8 million Euros, and only companies organized as public limited companies can apply the DFSA for a bank license.
  - DBA registers the company as a bank if DFSA issues a license.
  - DFSA can impose prudential restrictions or limitations on newly established banks (for example additions to the solvency requirement in the authorization letter).
  - Deficiencies in license applications are generally addressed at the time of licensing.
- EC2 (licensing criteria and assessment):
  - Before DFSA grants a banking license, applicants will be assessed against a defined set of criteria including: capital adequacy; thresholds and standards for fit & proper of board and senior management; and business model analysis.
  - The power to request information to assess a license application is prescribed in the FBA (s.14(1) of the FBA).
  - Examples of required information: articles of association; the size of the share capital (minimum EUR 8 million), and documentation for the payment of the share capital; an opening balance and budgets for the first 3 years; description of the basis for business activities; data systems and connection to a data processing center; standing orders for the BoD; and information for the assessment of the fitness & propriety of the members of the BoD and BoM.
  - According to section 14(1) and (2) of the FBA, the following criteria apply to license applications:
    - 1) the undertaking uses the term "bank," "sparekasse" or "andelskasse" in its name (section 7(5)), has a share capital of no less than EUR 8 million (section 7(8)), is organized as a limited company (section 12), and intangible assets are not used to pay for shares in the bank (section 13);
    - 2) members of the board of directors and board of management of the applicant are fit & proper;
    - 3) owners of qualifying interests will not oppose appropriate and reasonable management of the bank;
    - 4) there are no close links between the applicant and other undertakings or persons that could complicate performance of the tasks of DFSA;
    - 5) legislation in another country outside the EU with which the Community has not entered into an agreement for the financial area, regarding an undertaking or person with whom the applicant has close links will not complicate performance of the tasks of DFSA;
    - 6) the procedures and administrative conditions of the applicant are appropriate;
    - 7) the applicant has headquarters and registered office in Denmark; and
    - 8) the application contains all information necessary for the assessment by DFSA of whether the requirements in no. 1-7 have been fulfilled, including information on the size of the qualifying interests and the organization of the undertaking. The application shall also contain information about the nature of the business intended.
  - The powers in relation to licensing banks are equally applicable to mortgage credit banks with name-word modifications (section 8(5)).
  - During the application process DFSA examines whether the business plan is sustainable, rules of procedure, capital plan viability, and performs an assessment of risk management.
  - Applicants will provide three year projections for key financial data such as profitability and capital adequacy.
  - DFSA will stress budget forecasts and capital plans based on a downturn scenario.
  - A newly licensed bank will be subject to more intensive supervision in the first two years of business.
  - Competency for assessing license applications is contained within Banking Division 3 which is responsible for supervising small to medium sized banks.
  - The average period of assessment from the time of application to the time a license is granted is approximately one year.
  - The power to revoke a license may rest with the Director General of DFSA in accordance with s. 224(1) of the Act on grounds including:
    - 1) the bank or mortgage-credit institution willfully or repeatedly violates this Act or the Mortgage Credit Loans and Mortgage Credit Bonds, etc. Act, or regulations issued in pursuance of said Acts;
    - 2) the financial undertaking does not meet the requirements of Part 3, cf.

*Source: _cr14352 - Annex 1 defines "bank activities" as:*

### section 124(2), no. 2 and (3), and section 125(2), nos. 2-4;

### _cr14352 - section 124(2), no. 2 and (3), and section 125(2), nos. 2-4;

### EC3 — Consistency of licensing criteria with ongoing supervision
- There was sufficient evidence to suggest that the criteria for issuing licenses are consistent with those applied in ongoing supervision.
- Legal basis:
  - Section 14(1) and 3 of the FBA gives the DFSA the right to reject applications if the criteria are not fulfilled or if the information provided is inadequate.
  - Section 14(1) of the FBA requires the DFSA to determine suitability of major shareholders, transparency of ownership structure, and source of initial capital.
  - Pursuant to section 14(1) no. 3, the DFSA shall only grant a license when the owners of qualifying interests will not oppose appropriate and reasonable management of the bank or mortgage-credit institution.
- Procedural application:
  - Assessment of documentation is performed offsite and then in further detail onsite if the license is issued.
  - DFSA evaluates quality of policies and procedures and written procedures as required by the EO-MC (including BoD instructions to BoM, written procedures for significant areas of business, and a viable business plan).
  - Licensing criteria are articulated in DFSA licensing procedures maintained by DFSA within a specialist division and are explained to potential applicants during initial engagement.
  - DFSA will actively engage with applicants at initial stages to clarify minimum expectations and provide guidance regarding application procedure and information necessary to assess the application.
- Capital requirements (exception noted):
  - According to section 124.-(2) in the Danish FBA, the capital base of banks and mortgage-credit institutions shall constitute no less than 8 percent of the risk-weighted items (the solvency requirement), and EUR 5 million (minimum capital requirement).
  - Undertakings seeking a license as a bank shall have a share capital of an amount corresponding to no less than EUR 8 million according to section 7(8).
- Enforcement link to supervision:
  - Pursuant to section 224(1), no. 2, of the FBA, DFSA can withdraw a license if a bank or mortgage-credit institution does not adhere to the criteria applied when issuing the license.
  - DFSA may discover such deficiencies during ongoing supervision which, according to section 346(1), is based on reviews of regular reports and inspections of individual undertakings.

### EC4 — Assessment of legal, managerial, operational and ownership structures
- Legal basis and scope:
  - The DFSA has the power to determine whether ownership structure can hinder effective supervision or implementation of corrective measures in the future (section 14(1) of the FBA).
- Common ownership models in Denmark:
  - (i) a licensed bank as the holding company at the top of the structure;
  - (ii) a bank is owned by a financial holding company (holding company only holds shares in financial institutions);
  - (iii) a non-financial holding company holding shares in a bank.
  - The most common model is (i); there is only one example of a non-financial holding company owning a bank.
- Information required during licensing:
  - Business plan, management information, ownership and legal structure details.
  - Based on submitted information DFSA estimates whether structures will hinder effective supervision or implementation of corrective measures.
- Conditions under section 14(1), nos. 3–5, for granting a license:
  1) owners of qualifying interests will not oppose appropriate and reasonable management of the bank or mortgage-credit institution;
  2) there are no close links between the applicant and other undertakings or persons that could complicate performance of the tasks of DFSA;
  3) legislation in another country outside the EU with which the Community has not entered into an agreement for the financial area, regarding an undertaking or person with whom the applicant has close links will not complicate performance of the tasks of DFSA.

### EC5 — Identification and assessment of major shareholders and UBOs
- DFSA performs the same assessments for prospective qualifying interest acquirers as for other qualifying interest cases, requiring:
  - Annual reports from any company planning directly or indirectly to acquire a qualifying interest.
  - A description or chart of the entire ownership chain and any group or conglomerate before and after the acquisition.
  - Information about the management of the company.
- Notification and thresholds:
  - Section 61(1) of the FBA: any natural or legal person planning directly or indirectly to acquire a qualifying interest of 10 percent or more in a bank or mortgage-credit institution shall notify DFSA in advance, and DFSA shall assess the planned acquisition.
  - Same notification applies to increases resulting in interests equaling or exceeding 20 percent, 33 percent or 50 percent of the share capital or voting rights, or resulting in the bank becoming a subsidiary undertaking.
  - Section 63: DFSA must be notified prior to any direct or indirect acquisition by a bank or mortgage-credit institution of a qualifying interest in a foreign financial undertaking and comparable threshold increases.
- Assessment criteria (s.61a(1)):
  1) The reputation of the intended acquirer.
  2) The reputation and experience of the person(s) who will manage the financial undertaking or the financial holding company after the acquisition.
  3) The financial situation of the intended acquirer, particularly with respect to the nature of the business to be operated or intended to be operated.
  4) Whether the undertaking can continue to comply with supervision requirements, including group structure enabling effective supervision and exchange of information and delineation of responsibilities between competent authorities.
  5) Whether there are grounds to suspect that money laundering or terrorist financing will occur (sections 4 and 5 of the Act on Measures to Prevent Money Laundering and Terrorist Financing).
- Ultimate beneficial owners (UBOs) and transparency:
  - DFSA makes all efforts to identify UBOs and assess their suitability; there is no prescribed minimum ownership of UBOs in the transaction.
  - DFSA investigates corporate structures to ascertain interested parties; trust structures are given particular attention.
  - DFSA assesses transparency in terms of organizational structure, lines of business, number of non-operating holding companies and beneficial interests in related companies.
  - DFSA examines potential related shareholders, existence of executive management on related party boards, and any side letters or agreements related to exercise of voting rights.
- Capital support and initial capital conditions:
  - The FSA performs in-depth analysis of capital strength of owners and UBOs.
  - Initial capital cannot be borrowed; funds need to be unencumbered as required in Article 124 of the FBA where banks need to have adequate capital base of a size, type and distribution to cover the risks of the bank.
  - The FSA assesses that the bank has sufficient capital over the business cycle based on analysis of the business model.
  - Assessors viewed evidence that focus on assessing shareholder capacity to support the bank in change of ownership or qualifying interest was conducted.

### EC6 — Minimum initial capital
- Statutory minimums:
  - According to sections 7(8) and 8(7) of the FBA, all banks and mortgage-credit institutions must have an initial share capital of at least EUR 8 million paid up.
  - In addition to minimum capital requirements, DFSA emphasizes adequacy of resources for newly licensed banks and assesses business model to determine sufficiency of capitalization.
  - Verification of paid up capital included independent confirmation of documentation.
- Transitional and special provisions:
  - For banks whose capital base was less than EUR 5 million on December 18, 1989, the minimum capital requirement constitutes the capital base on December 18, 1989.
  - The total capital base of a bank arising in connection with a merger of two or more banks covered by the 1st clause shall be no less than the total capital base of the merged banks at the time of the merger, if the merged bank does not fulfill the minimum capital requirement under subsection (2), no. 2. Subsection (2), no. 2 states the minimum capital requirement of EUR 5 million.
  - A lesser initial share capital is sufficient for savings institutions which pursuant to section 334(2) must have an initial share capital of an amount corresponding to no less than EUR 1 million.

### EC7 — Fit and proper evaluation of Board and senior management
- Legal and procedural basis:
  - Section 14(1), no. 2, of the FBA requires members of the BoD and BoM of the applicant to fulfill requirements in section 64 for DFSA to issue a license, implying a fit and proper evaluation conducted by DFSA.
  - DFSA’s "Guidelines on requirements in financial legislation for fitness and propriety of members of boards of management and boards of directors" are enforceable by the FSA and the evaluation is carried out simultaneously with processing of the application for a license.
- Scope of fit & proper:
  - Section 64 applies to members of the board of directors and the board of management. The DFSA cannot extend the F&P procedures to a broader group of staff (roles such as CFO, CRO, CIO etc) under current rules.
  - Coming regulation will establish more stringent requirements on SIFI’s regarding corporate governance, and the fit and proper assessment will hereafter include key managerial positions such as CRO and CIO.
- Section 64(1) and subsection 2 conditions:
  - Section 64(1): a member of the board of directors and the board of management shall have adequate experience in carrying out the duties and responsibilities of such a position.
  - Subsection 2: a person may not occupy a board position if:
    1. the person is held criminally liable for violation of the Criminal Code or financial legislation, and this violation entails a risk that the duties are not carried out adequately;
    2. the person has filed for suspension of payments, is administered in bankruptcy, has filed for debt restructuring, or negotiations have been initiated with regard to compulsory composition for said person;
    3. the financial situation of the person or companies owned by the person or companies where the person participates in their operation have caused losses or risks of losses for the bank or mortgage-credit institution.

*Source: section 124(2), no. 2 and (3), and section 125(2), nos. 2-4;*

### 4. the person in question has behaved such that there is reason to assume that said person

### 4. the person in question has behaved such that there is reason to assume that said person cannot perform the duties and responsibilities of such position adequately

### Fit and Proper Requirements for Board Members and Management
- Members of the board of directors and board of management of banks and mortgage-credit institutions must submit information on former and current memberships of boards of directors and boards of management within the last 10 years, both within and outside the financial sector, and other duties within the financial sector. For members of boards of directors, the information period is five years.
- Information submitted is used by DFSA to assess the relevant experience of the members and to determine whether, by behavior or duties, the person has previously "behaved in such a way that there is reason to assume that the person cannot perform the duties and responsibilities of such position adequately."
- Applicants must provide information on whether undertakings where the member participates or has participated in management are or have been in suspension of payments or bankruptcy proceedings, and whether such undertakings currently or previously instituted negotiations for a compulsory composition.
- Applicants must disclose close links between the member and the undertaking for which the information form has been submitted, or between the member and other undertakings or persons with close links to the undertaking.
- In assessing fitness and propriety, DFSA determines whether the board of directors (BOD) collectively has adequate knowledge and experience regarding the risks associated with running a bank to ensure sound management. The collective skills must be commensurate with the business model and risk profile of the bank (example: large commercial real estate portfolio requires demonstrated expertise).

### Licensing: Corporate Governance, Risk Management, and Operational Plans (EC8–EC11)
- EC8: The licensing authority reviews proposed strategic and operating plans, including systems of corporate governance, risk management, internal controls (including detection and prevention of criminal activities), and oversight of proposed outsourced functions. Operational structure must reflect scope and sophistication of proposed activities.
- When applying for a license, applicants must demonstrate written procedures for significant areas of business. The EO on Management and Control requires banks to have written procedures for all material key areas (paragraph 9(1)–9(7)) and policies and procedures for corporate governance, risk management and internal control.
- DFSA assesses corporate governance, internal control and risk management of applicants for banks and mortgage-credit institutions in the licensing process.
- Under Guidelines on banks under intensified supervision, DFSA must perform at least one extra and relevant supervision activity within the first two years in newly licensed banks. The newly licensed bank cannot be removed from intensified supervision until after this activity. The newly licensed bank shall at least be under intensified supervision in one year.
- License application requirements (section 14(2)): contain all information necessary for DFSA to assess whether section 14(1) requirements are fulfilled, including size of qualifying interests, organization of the undertaking, and nature of intended business (lines of business, customer profile, funding structures).
- DFSA may demand and examine: articles of association, description of basis for business activities, standing orders for the board of directors, instruction from the board of directors to the board of management, written procedures for significant areas of business, size of share capital and documentation of payment. DFSA considers whether the bank has an appropriate system of corporate governance and ensures the bank or mortgage-credit institution is a viable business based on sound strategic and operating plans.
- EC9: DFSA requires a budget for a three-year period (section 14 FBA). DFSA examines the budget to ensure adequate financial resources, critically evaluates realism of assumptions (customer acquisition and net interest revenue) in a competitive environment, and requires stressed versions of the budget to test sustainability under adverse scenarios. Macroeconomic conditions are taken into account (currently banks experience low RoE and NIM compression due to competition for deposits and low interest rates).
- Under section 14(1), no. 3 of the Act, DFSA will only issue a license if owners of qualifying interests will not oppose appropriate and reasonable management of the bank or mortgage-credit institution, cf. section 61. DFSA will refuse applications if owners have proved incapable of running a financial undertaking in an economically reasonable fashion.
- DFSA will obtain and review documentation for the size and payment of the share capital, the opening balance and a three year budget for the applicant before issuing a license. Under section 61a (1) DFSA will assess the adequacy of the financial strength of the principal shareholders of the bank to ensure financial stability.
- EC10: For foreign banks from the EU or countries with a Community agreement, pursuant to section 30(1) of the FBA, a foreign undertaking may begin activities in Denmark through a branch two months after DFSA has received notification from the home supervisory authorities. It is not necessary for such foreign banks to obtain a Danish license; DFSA does not issue such a license nor obtain a statement of no objection from the home supervisor, but there is extended communication regarding intended activities, business plan, capital requirements, and management.
- For credit institutions outside the EU where no agreement exists, EO no. 1183 (December 6, 2004) provides that such foreign credit institutions, if supervised by home authorities, can with DFSA license carry out activities through a branch in Denmark; in this situation normal rules regarding issuing a license apply.
- EC11: DFSA has procedures to monitor progress of new entrants. According to procedures on institutions under intensified supervision ("skærpet tilsyn") all new entrants shall be under extra supervision; DFSA will carry out at least one extra relevant supervisory activity during the first two years, and the new entrant cannot be removed from extra supervision before this activity has been carried out. All new entrants must be under extra supervision for at least one year. DFSA demonstrated adherence to this process.
- Assessment of Principle 5: Compliant. Comments note DFSA has appropriate powers to set licensing criteria and reject applications. Licensing process typically undertaken over the course of one year from first meeting to license grant. DFSA critically evaluates all aspects of the proposed business model and performs multiple offsite examinations to test preparedness of the applicant.

### Transfer of Significant Ownership (Principle 6: EC1–EC3)
- Principle: The supervisor has the power to review, reject and impose prudential conditions on proposals to transfer significant ownership or controlling interests directly or indirectly in existing banks.
- EC1: Definitions
  - FBA uses the term "qualifying interest" to refer to "significant ownership" and "controlling interest".
  - Section 5(3) FBA defines "qualifying interest" as direct or indirect ownership of 10 percent or more of the capital or voting rights or ownership of an interest which provides the opportunity for exercising significant influence on management.
  - Significant influence defined in section 5b(1) as authority to control financial and operating decisions of a subsidiary undertaking.
  - Controlling influence (section 5b(2)) exists when a parent owns more than one-half of voting rights, unless exceptional circumstances demonstrate otherwise.
  - Section 5b(3) lists circumstances where controlling influence exists even if parent holds no more than one-half of voting rights: power to exercise more than one-half of voting rights via agreement with other investors; power to control financial and operating policies by articles or agreement; power to appoint or remove majority of members of supreme management body (and this body has controlling influence); power to exercise actual majority of votes at general meeting.
  - Section 5b(4) requires potential voting rights (exercisable or convertible) be taken into account. Section 5b(5) disregards voting rights attached to equity investments owned by the subsidiary itself or its subsidiaries. Shares aggregated where natural or legal persons act in understanding with each other.
  - Conclusion: Definition includes quantitative threshold of 10 percent and scenarios of effective control; sufficiently broad for DFSA to capture range of scenarios.
- EC2: Notification and Approval Requirements
  - Domestic change in ownership: approval of DFSA is required. Foreign undertaking: prior notification required; acquisition by a bank or mortgage-credit institution of a qualifying interest in a foreign financial undertaking does not require approval.
  - FBA defines qualifying interest as trigger for prior notification and approval. Thresholds: 10 percent, 20 percent, 33 percent and 50 percent; and the subjective characteristics under Section 5b(3).
  - There is no definition of ultimate beneficiary owners in the FBA.
  - FBA does not contain the power to apply formal conditions when approving a change in qualifying interest; in practice DFSA will negotiate changes to application features and will not approve unless satisfied.
  - Section 61(1) FBA: any person planning to acquire a qualifying interest must apply to DFSA in advance for approval. Applies also to increases that result in interest equaling or exceeding 20 percent, 33 percent or 50 percent or resulting in the undertaking becoming a subsidiary.
  - Section 61(2): acquisition or increase shall only be approved when approval is not contrary to ensuring appropriate operation of the bank or mortgage-credit institution.
  - Owners holding at least 10 percent who intend to reduce interest below one of the specified limits must notify DFSA and state the size of intended future interest (subsection 6).
  - Section 61(7): banks or mortgage-credit institutions that learn of acquisitions or sales as specified must immediately notify DFSA. Similar obligations for holdings in foreign financial undertakings.
  - Guidelines on requirements for approval of owners of qualifying interests state DFSA will focus on whether planned acquisition is contrary to ensuring appropriate operation.
  - Applicants must deliver documents mentioned in the publicly available template; documentation amount varies with size of interest and complexity of bank.
  - In practice DFSA engages with interested parties and a dedicated team in Banking Division 3 assesses all applications for change in qualifying interest; recommendation can be submitted to the Director General for approval. Delegated authority to approve rests with DFSA.
- EC3: Powers to Reject or Reverse Changes
  - The text provided begins the Description and findings re EC3 but the supplied content ends before the subsection's findings are detailed.

*Source: _cr14352 - 4. the person in question has behaved such that there is reason to assume that said person*

### Section 61(3) of the FBA provides DFSA with the power to approve or refuse a projected

### _cr14352 - Section 61(3) of the FBA provides DFSA with the power to approve or refuse a projected acquisition

### DFSA powers under Section 61(3) and related provisions
- Section 61(3) of the FBA: “The DFSA may refuse an application for approval of an intended acquisition, if, on the basis of the criteria mentioned in s.61a (i)–(v) there are reasonable grounds to believe that the intended acquirer will hinder sensible and proper management of the undertaking.”
- Section 61.a criteria (five criteria):
  - (i) the reputation of the intended acquirer,
  - (ii) reputation of the management planning the change in qualifying interest,
  - (iii) the financial soundness of the bank;
  - (iv) continued compliance with the FBA; and
  - (v) connection with AML/CFT.
- Section 61(1) obligation: any natural or legal person, or natural or legal persons acting in understanding with each other, planning directly or indirectly to acquire a qualifying interest, cf. section 5(3), in a financial undertaking or a financial holding company shall apply to the DFSA in advance for approval of the acquisition planned.
- Triggers for prior approval / notification:
  - prior approval/notification required where the acquisition or increase results in the interest equaling or exceeding limits of 20 percent, 33 percent or 50 percent respectively of the share capital or voting rights, or results in the financial undertaking or the financial holding company becoming a subsidiary undertaking.
- DFSA remedies and powers where owners act contrary to appropriate operation:
  - pursuant to section 62(1), DFSA may order the undertaking to follow specific guidelines made by DFSA and withdraw the voting rights associated with the holdings of the relevant owners.
  - section 62(2) allows DFSA to withdraw voting rights for holdings owned by natural or legal persons who do not comply with the duty to submit DFSA prior notification under section 61(1).
- Limitation: DFSA does not have the power to reverse a change in control; it can withdraw voting rights but cannot reverse the change in significant ownership.

### Procedures for indirect ownership, applications, and evidence
- Indirect ownership applications:
  - When a company applies for approval to buy a qualifying interest, DFSA will receive information about the applying company via prints from the Danish Business Authority stating the members of the board directors and board of management of the company.
  - Application form requirement: an application form must be filled out. The application form requires a description of, or a chart of, the entire ownership chain and any group or conglomerate before and after the acquisition to be attached to the application.
  - Separate form exists for natural persons.

### Empirical record of approvals and withdrawals
- DFSA approvals and withdrawals in the past five years:
  - DFSA has approved ten transfers of significant ownership in the past five years (over 50 pct.).
  - In the past five years there have not been any denials for requests for transfer of significant ownership.
  - There have been two cases where the applicant withdrew the application after DFSA had sent the DFSA’s draft of decision that was to be submitted to the Financial Council; DFSA’s recommendation to the Financial Council in these cases was to deny the application.

### Ownership reporting, identification of significant shareholders (EC4)
- Section 61c(2) requirement: banks or mortgage-credit institutions shall, no later than February each year, submit information to DFSA of the names of the owners of capital who own qualifying interests in the bank or mortgage-credit institution as well as information on the sizes of said interests.
- Supervisor actions:
  - The supervisor compares the shareholder list to the previous year to identify potential changes in qualifying interests.
  - If new names appear, the supervisor investigates with the bank and through other sources.
  - Onsite examinations include analysis of a bank’s share register; there is an ongoing obligation under section 61(c) for the bank to inform DFSA of changes in its share registry of significant shareholders.
- Practice note: It is unusual in Denmark for custodians, trusts or nominees to have ownership of Danish banks.

### Change of control powers and limitations (EC5)
- DFSA’s powers regarding change of control:
  - DFSA can refuse a change of control in the first instance.
  - If a change of control takes place without DFSA approval, DFSA can withdraw the voting rights of the shareholder through section 62(1).
  - DFSA cannot reverse the change in significant ownership; withdrawal of voting rights mitigates potential influence but does not reverse the change.
- Section 62 powers reiterated: withdraw voting rights for owners acting contrary to appropriate operation or for failure to notify under section 61(1).

### Notification obligations and gaps (EC6)
- Section 61c(1): Banks are required to inform DFSA about changes in the ownership structure of the bank as soon as the bank has the knowledge.
- Gap identified: There is no written demand for banks to notify DFSA about any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest.

### Assessment, findings, and identified weaknesses
- Assessment of principle 6: Largely compliant.
- Positive findings:
  - Definition of qualifying interest in the FBA is sufficiently broad to capture a range of scenarios where influence over a bank may arise.
  - Supervisors use the rules consistently and assessment processes are robust.
  - Significant ownership is clearly defined in legislation with formal triggers at 10, 33 and 50 percent.
- Identified weaknesses:
  - DFSA does not have the power to reverse a change in control; it can withdraw voting rights but cannot reverse the change in control. This restricts DFSA flexibility to respond if a shareholder acquires a shareholding without approval.
  - There is no definition of ultimate beneficial owners (UBO) in the FBA; implication for exercise of powers if there is no definition whether DFSA could enforce its powers to a change in a UBO.
  - While banks must inform DFSA about changes in ownership structure as soon as they have knowledge, there is no written demand for banks to notify DFSA about any material information that may negatively affect the suitability of a major shareholder or controlling party.
  - The ability to successfully apply DFSA’s powers regarding a change of control in a financial holding company (under Section 63 of the FBA because DFSA only receives notifications) is uncertain and remains untested.

### Major acquisitions and cross-border investment rules (Principle 7, EC1 and EC2)
- EC1 description and findings:
  - Prior notification and prior approval required by DFSA for major acquisitions according to FBA sections 61 and 63, for changes in a qualifying interest (i.e. 10 percent) up to 20, 33 and 50 percent.
  - For cross-border operations: the qualifying interest rules distinguish cross-border operations which only require prior notification as opposed to approval. Section 63(1)–(4) requires DFSA to be notified prior to any direct or indirect acquisition by a financial undertaking or a financial holding company of a qualifying interest (10 percent) in a foreign financial undertaking and of increases to 20 percent, 33 percent and 50 percent or where the foreign undertaking becomes a subsidiary undertaking.
  - Implication: where a bank supervised by DFSA seeks to invest in a foreign asset, approval by DFSA is not required under the FBA; this limits DFSA’s ability to intervene prior to a potentially large investment that could change the acquiring bank’s risk profile.
  - Remedies DFSA can use when concerned about a foreign acquisition:
    - apply Section 350 of the FBA to instruct the bank to restructure;
    - adjust capital requirements;
    - dismiss the BoD.
  - Notification requirements where a foreign financial undertaking becomes a subsidiary undertaking must include:
    1) the country in which the subsidiary undertaking is to be established,
    2) a description of the business to be carried on by the subsidiary undertaking, including information on its organization and planned activities,
    3) the address of the subsidiary undertaking, and
    4) the names of the management of the subsidiary undertaking.
- EC2 description and findings:
  - Section 61a(1) assessment criteria for acquisitions of 10 percent or more require DFSA to take account of sensible and proper management, likely influence of the intended acquirer, suitability of the intended acquirer, and financial soundness relative to:
    1) The reputation of the intended acquirer.
    2) The reputation and experience of the person(s) who will manage the financial undertaking or the financial holding company after the acquisition.
    3) The financial situation of the intended acquirer, particularly with respect to the nature of the business to be operated or intended to be operated in the financial undertaking, or the financial holding company in which the acquisition is intended.
    4) Whether the undertaking can continue to comply with the supervision requirements in the legislation, in particular whether the group of which the undertaking may become a part has a structure which makes it possible to perform effective supervision and effective exchange of information between the competent authorities as well as to determine how responsibilities are to be divided between the competent authorities.
    5) Whether, in connection with the intended acquisition, there are grounds to suspect that money laundering or terrorist financing, cf. sections 4 and 5 of the Act on Measures to Prevent Money Laundering and Terrorist Financing, will occur.
  - The criteria in the FBA are sufficiently broad for DFSA to consider a cross section of potential risks associated with a major acquisition.
- Cross-border approval limitation reiterated: any direct or indirect acquisition by a financial undertaking or a financial holding company of a qualifying interest in a foreign financial undertaking requires notification but not approval under the FBA, limiting DFSA’s pre-transaction intervention capability.

*Source: IMF staff report excerpt on Denmark (content unit: _cr14352 - Section 61(3) of the FBA provides DFSA with the power to approve or refuse a projected acquisition).*

### section 63 (1) is subject only to prior notification, no approval procedure takes place

### _cr14352 - section 63 (1) is subject only to prior notification, no approval procedure takes place

### Section 63 notification regime and DFSA remedial powers
- Section 63 (1) in the Financial Business Act (FBA) requires prior notification for any direct or indirect acquisition by a financial undertaking or a financial holding company of a qualifying interest in a foreign financial undertaking; no prior approval by the Danish FSA (DFSA) is required under section 63 (1).
- Despite the absence of prior approval under section 63 (1), the DFSA may order financial institutions to undertake measures to comply with the FBA in its entirety.
- Under section 350 (1) the DFSA may order a financial undertaking to take necessary measures within a time limit if:
  - 1) the financial position of the undertaking has deteriorated to such a degree that the interests of depositors, the insured parties, the bond owners, the investment associations, the special-purpose associations, the approved restricted associations, the hedge associations, other collective investment schemes or other investors are at risk; or
  - 2) there is a not insignificant risk that, because of internal or external conditions, the financial position of the undertaking will develop so that the undertaking loses its license.
- Under section 350 (2), if the ordered measures have not been taken within the specified time limit, the DFSA may withdraw the undertaking’s license.

### EC3 — Licensing, acquisitions and cross-border limitations
- Objective supervisory criteria include ensuring new acquisitions and investments do not expose the bank to undue risks or hinder effective supervision, and that they will not hinder effective implementation of corrective measures in the future.
- The supervisor can prohibit banks from making major acquisitions/investments (including establishment of cross-border banking operations) in countries with laws or regulations prohibiting information flows necessary for adequate consolidated supervision.
- Description and findings:
  - No direct or indirect acquisition by a financial undertaking or financial holding company of a qualifying interest under section 63 (1) is subject to DFSA prior approval; DFSA retains powers to order compliance measures (see EC2).
  - For any natural or legal person planning directly or indirectly to acquire a qualifying interest of 10 percent or more in a bank or mortgage-credit institution, see section 61(1) (see also EC2).
  - Two separate powers are needed: a power prior to a proposal for a change in significant ownership and a power after if information was false. Section 61(3) provides DFSA the power to refuse an acquisition.
  - DFSA performs a comprehensive assessment, including a detailed assessment of the host country, taking into consideration the effectiveness of supervision in the host country and DFSA’s ability to exercise consolidated supervision.
  - When a bank supervised by DFSA makes a foreign acquisition, approval by DFSA is not required under the FBA, which can limit DFSA’s ability to reject a foreign acquisition — a deficiency relevant to fully satisfying this criterion.

### EC4 — Assessment of acquirer resources and organizational capacity
- DFSA assesses whether the bank has adequate financial, managerial and organizational resources to handle the acquisition under section 61a (1) of the FBA.
- In major acquisition assessments DFSA emphasizes sustainability of the business model and collects detailed financial information including projections and budgets, critically evaluating assumptions and applying stress scenarios.
- DFSA evaluates management expertise, experience, and governance structure. Assessment teams are cross-disciplinary, led by a Director General, and use base case and stretch case reviews of resource projections.
- The application assessment includes meetings with management and risk personnel and evaluates the nature of operations to be acquired to understand management stretch and oversight responsibilities.

### EC5 — Nonbanking activities and group risk mitigation
- Responsibility for supervising insurance, pension and markets activities rests with dedicated DFSA teams; banking supervisors liaise regularly with these teams on group risks.
- Where banks have material cross-border operations and supervisory colleges, nonbank risks are discussed.
- Banks must advise DFSA if undertaking activities ancillary to banking; DFSA assesses and acts accordingly.
- FBA section 147 (1) sets a maximum threshold of direct property of 20 percent:
  - Banks, mortgage-credit institutions, investment firms and investment management companies may not own real property or hold equity investments in property companies amounting to more than 20 percent of the capital base.
  - Real property includes loans and guarantees to subsidiary companies that are property companies; properties acquired to carry out main or ancillary activities are excluded from these provisions.
- DFSA does not approve establishment of bank subsidiaries unless the subsidiary applies for a banking or other DFSA-issued license.

### Assessment of Principle 7 — Largely Compliant
- For major acquisitions of domestic banks, DFSA’s approval/rejection power is embodied in the FBA and provides sufficient powers to assess risks based on broad criteria; DFSA can reject applications posing excessive risk to the acquirer or system.
- Gap: legislative power to impose prudential conditions on an acquisition is not contained in the legislation, limiting this Core Principle.
- DFSA uses prescribed legislative criteria to assess major acquisitions: influence of acquirer, suitability of acquirer, and financial soundness. Thorough scenario analysis is applied.
- Distinction in qualifying interest rules: cross-border operations require only prior notification (section 63 (1)–(4)), limiting DFSA’s ability to reject foreign acquisitions and restricting its powers compared to domestic major acquisitions.

### Supervisory framework — Principle 8 (Largely Compliant)
- DFSA maintains a forward-looking supervisory framework using a Supervisory Diamond to constrain firms within prudential parameters: large exposures, lending growth, commercial property exposure, a funding ratio, and excess liquidity coverage.
- Supervisory organization:
  - Bank Division I—largest five banking organizations
  - Bank Division II—medium sized banks
  - Bank Division III—small banks
  - Operational Risk Division—including market risk specialists (e.g., Saxo Bank)
  - Mortgage Credit Division—mortgage credit institutions
  - Banking Analysis Division—regulatory reports and analyses
  - SIFI-analysis unit—horizontal analysis of Danish SIFIs
- Risk assessment process:
  - Annual risk assessments largely during spring prior to inspection schedule running July 1 to June 30.
  - Mechanical slotting into one of five categories by Banking Analysis Division, then adjusted by relevant banking division.
  - Inputs include inspection reports, regulatory and annual reports, ICAAP, audit books, and Joint Risk Assessment Decisions (JRAD) if applicable.
- Stress testing:
  - DFSA conducts stress tests with three scenarios: expected base-line, a mild stress, and a hard stress with considerably more negative macroeconomic assumptions.
- Systemic monitoring:
  - Systemic Risk Council established June 2012 to monitor and identify systemic financial risks and issue observations, warnings and recommendations.
  - Regular dialogue with Danmarks Nationalbank (DB) on financial stability.
- Resolvability and resolution planning:
  - DFSA has extensive experience resolving failing banks and issued an EO under section 245 a of the FBA requiring banks to be able to produce necessary statements and information within 24 hours when DFSA stipulates a time limit in context of withdrawal of licenses.
  - External auditors must annually review and state banks’ fulfillment of these requirements.
  - Individual resolution plans for large banks have not yet been implemented; for small and medium banks the resolution plan in Denmark is the functioning resolution regime. Individual resolution plans will be established with implementation of the BRRD.
- Recovery plans:
  - DFSA has required contingency/recovery plans in some cases; DFSA has asked certain banks to prepare a recovery plan when the bank fulfills the capital requirement of 8 pct. but not its own solvency need.
  - A recovery plan requirement for larger banks is coming into force April 1, 2014.
- Operational limitations and weaknesses:
  - Extended onsite examination cycles: at least one targeted multi-week review annually for major institutions with all significant risk areas reviewed at least once every four years; medium and small banks subject to cycles up to four years (medium) and up to six (or occasionally more) years for smallest and most well-capitalized banks.
  - Example file review showed some small banks had not been examined since 2005 and 2006.
  - Individual resolution plans have not been required/prepared to date for larger banks.

### Supervisory techniques and tools — Principle 9 (selected findings)
- DFSA employs a mix of onsite and offsite supervision; Supervisory Diamond is a key tool with periodic breaches prompting immediate DFSA engagement.
- Banking Analysis Division receives quarterly, semi-annual, and annual reports; produces a mechanical five-level risk assessment shared with banking divisions.
- Governance and coordination:
  - Supervision Committee (fortnightly) and a SIFI-risk committee (established 2013) support coordination and horizontal issue discussion.
- Onsite/offsite scheduling and resource constraints:
  - Largest banks and mortgage credit institutions subject to annual review of designated risk areas, with all significant risk areas covered at least every four years.
  - Very small banks (10–15 out of 90 total banks) may be on a six-year or longer cycle if no problems evident.
  - Banks under intensive supervision account for about 15 percent of total number of banks, but less than 3 percent of total assets; these receive much more frequent examinations.
- Information sources and reliance:
  - DFSA uses prudential reports, annual reports, external sources (e.g., rating agencies), onsite inspection findings, internal and external auditors’ reports.
  - DFSA evaluates internal audit work and meets with auditors during onsite inspections; smaller banks may rely solely on external auditors.
- Tools used to assess safety and soundness:
  - Analysis of financial statements, business model analysis, horizontal peer reviews, review of stress test outcomes, and corporate governance and internal control assessments.
  - Much of items (a)–(d) performed offsite; corporate governance and internal control assessment heavily reliant on onsite examiners.
- Stress testing program:
  - Top-down stress tests are conducted twice a year for all banks and mortgage credit institutions.
  - Bottom-up stress tests are generated/requested annually for IRB banks.
  - Stress test results are evaluated, communicated to DFSA management, discussed across divisions and with individual banks; linkage of stress test outcomes to specific follow-up examination work was not always clear.
- Communication and engagement:
  - DFSA communicates on- and offsite findings timely via written reports and meetings; beginning and end-of-inspection meetings involve Board of Management, senior management, and auditors.
  - For largest banks annual top-level meetings include the Director General.

*Italic: Content derived from the IMF source document _cr14352 - section 63 (1) is subject only to prior notification, no approval procedure takes place*

### conclusions then are submitted within 35 days in the form of a written report to the

### _cr14352 - conclusions then are submitted within 35 days in the form of a written report to the

### Follow-up, publication of reports, and use of external auditors (EC9)
- Onsite inspection conclusions are submitted within 35 days in the form of a written report to the undertaking’s BoD, BoM, the external auditor, and the chief internal auditor.
- Responses are received from the bank and reviewed by the DFSA; follow-up is expected to be done by the External Auditors and by the DFSA at the next scheduled examination.
- Full DFSA reports are typically made public, although risk ratings are not shared publicly or with the bank.
  - Benefit: transparency informs the marketplace of issues seen by the DFSA.
  - Risk: public reports may accelerate adverse effects on a bank; DFSA has some capacity to hold back reports and used that authority in at least one instance.
- Onsite follow-up is typically deferred to the next scheduled examination.
- Assessors found limitations in relying on external auditors for follow-up:
  - Audit book descriptions of external auditors’ confirmation of progress were generally very limited.
  - In some instances, external auditor work appeared limited to confirming that “if” management had done what it asserted, then the order could be considered addressed, with no apparent review of whether such work by management was in fact done.
- DFSA has regulatory tools to intervene, including early intervention if a business model is deemed unsustainable (cf. §64, §71, §344 and §350 of the FBA).

### Use of independent third parties (EC11)
- Following a 2010 amendment to the FBA, DFSA can request independent third parties to carry out investigations provided:
  - There is a clear and detailed mandate for the work.
  - The DFSA does not have the necessary competencies itself.
  - Investigations are at the expense of the entity under supervision.
- DFSA has not outsourced supervisory work on auditing, accounting, impairments, or solvency needs.
- DFSA used external third parties in two specific cases:
  - 2010: Saxo Bank A/S — investigation under section 347b of the FBA into execution of manually executed orders in Saxo Trader.
  - 2012: Danske Bank A/S — investigation under section 347b of the FBA into the bank’s market risk area, risk assumptions, market risk calculations, and operational risk relative to earnings.

### Information systems, reporting cycles, and tracking (EC12, AC1)
- DFSA has an adequate information system of reporting, supervisory tools, and regular meetings between high-ranking staff in different divisions; assessors viewed relevant tracking forms.
- DFSA tracks whether examinations meet the schedule; changes require approval of the Director General.
- DFSA does not have a periodic independent review framework (internal audit or third party) as standard practice.
  - An independent review was conducted in 2013 by Oliver Wyman as a benchmark with 17 participating supervisory regulators.

### Assessment and recommendations for Principle 9 (Assessment: Largely Compliant)
- Positive:
  - DFSA implemented tools post-crisis and has knowledgeable committed supervisors and inspectors.
- Areas for improvement:
  - Onsite examination schedule is too limited; onsite tool needs more frequent and flexible use to respond to changes in risk profile or stress test results.
  - Onsite follow-up of detected problems is typically deferred to next scheduled examination.
  - Additional resources are needed to allow more flexible and frequent onsite work (see BCP 2).
  - Receiving audit and risk management reports on a flow basis and potentially requiring banks to advise DFSA of material adverse developments would aid staying on top of developments between inspections.
- Cautions:
  - Public release of examination findings can create adverse market effects that may offset transparency benefits.
  - Placing substantial reliance on external auditors to assess progress in compliance is misplaced given limitations observed in external auditor work; DFSA treats external auditors’ work as only an input.

### Supervisory reporting framework and findings (Principle 10 — Assessment: Largely Compliant)
- Legal powers and reporting architecture (EC1, EC6, EC7):
  - DFSA can require banks to submit supervisory data under section 198 of the FBA.
  - DFSA has authority to request ad-hoc reports from all financial firms and can request information under section 347 of the FBA from wider group entities, data centers, suppliers and sub-suppliers.
- Routine reporting and templates (EC1, EC4, EC5):
  - Banks file financial reports each quarter; year-end report contains greater depth.
  - From the beginning of 2012, banks semi-annually reported exposures as a separate reporting to the FSA.
  - Mandatory data templates collected quarterly include: Capital adequacy; Liquidity; Pillar 1 risks—credit, market and operational risk; Balance sheet and P&L; Large exposures; Intra-group exposures; Derivatives; Off-balance sheet exposures and contingent liabilities.
  - Data are reported on both solo and consolidated basis; consolidated data may be provided at banking group level and at holding level; unregulated parts of group are included if significant.
  - Heightened focus on credit exposures: Groups 1 and 2 report exposures above 2 percent of the capital base after deductions; Group 3 report exposures over 5 percent; Group 4 report exposures exceeding 10 percent.
  - Reporting templates are reviewed annually and updated to reflect supervisory concerns.
- Frequency and differentiation (EC4):
  - Normal supervisory reporting frequency is quarterly; liquidity returns monthly; full balance sheet annually.
  - Less systemic banks face less onerous frequency.
  - D-SIBs under the framework to be implemented May 2014 will be required to report on an ad hoc basis for thematic reviews and specific events.
  - Outliers (e.g., breach of Supervisory Diamond) are subject to more regular and granular reporting.
- Reporting instructions and accounting standards (EC2, EC3):
  - DFSA provides comprehensive reporting instructions and manuals (available on DFSA website; manuals only in Danish).
  - Accounting standards for regulatory reporting are issued by DFSA; largely aligned with IFRS and ensure impairments are made in a timely and adequate manner.
  - Requirements for supervisory reporting are consistent across banks and mortgage credit institutions with exemptions for smallest banks in Group 4 in Q1 and Q3.
  - No specific requirement for independent collateral valuations when determining loan loss provisioning.
- Data quality, validation, and verification (EC8, EC9, EC12):
  - No explicit requirement for senior management sign-off of regulatory reporting; industry practice holds senior personnel responsible.
  - Quarterly regulatory returns required no later than 20 business days after the quarter; annual reporting 45 business days after end of financial year (mid March).
  - DFSA issues reminders for late reporting; after two reminders, DFSA may request immediate reporting and may issue fines or onsite inspections; DFSA has not issued fines for accounting reporting but has issued fines in about 20 cases for failure to report stock exchange information under MIFID.
  - Initial validation is performed by a statistics division; data then passed to Banking Analysis Division for analysis; onsite inspections often reveal data quality issues and banks can be requested to revise and resubmit data for specified periods (e.g., last 2-4 quarters).
  - Banking Analysis Division reviews annually whether collected information satisfies supervisory needs and updates templates as needed.
- Limitations noted by assessors (reasons for downgrade to Largely Compliant):
  - Reporting instructions do not include instructions for reporting operational risk loss and related party lending (EC1).
  - Greater attention needed for requirements on prudent valuations in reporting instructions and processes for independent verification of collateral valuation when submitted in supervisory reporting.

### Corrective and sanctioning powers (Principle 11)
- Early warning and escalation (EC1):
  - Supervisory Diamond provides early warning based on five key risk criteria; non-compliance is published on DFSA’s website and triggered issues are escalated to BoM/BoD.
  - Communication tools include: Risk Information, Orders, Immediate Orders, Reports (with Risk Assessment), Risk Warnings (addressed to BoD), and Public Reports (publicly available result of onsite examinations with general risk assessment).
  - When significant corrective actions required, DFSA addresses them in written documents to the bank’s Board and may require regular written progress reports.
- Range of supervisory tools and enforcement (EC2):
  - DFSA may: provide guidance; take action against violations; order that errors be corrected and violations remedied; issue fines (s.350 FBA).
  - DFSA strengthened powers include: requirement to assess business model sustainability over a two to three year outlook; enhanced fit and proper powers.
  - Supervisory Ladder includes: Intensified surveillance and disclosure of risk information; Inspection, management statement FBA s.349 statement; Order corrective actions under FBA s.350 (e.g., closing branches).
  - DFSA uses modulated approach to give banks time to rectify situations; s.350 powers apply if (1) depositors’ interests are at risk or (2) there is a not insignificant risk the bank will lose its license.
  - DFSA has used section 350(1) on several occasions to intervene early (example: ordered a bank to stop granting new loans from a certain customer category; case ended with a merger; DFSA demanded change of whole management of the bank including BOD and BOM).
  - DFSA has used supervisory tools extensively during recent stress to impose sanctions, require increases in provisioning, encourage mergers, and in extreme cases withdraw licenses.
- Legal sanction framework:
  - In accordance with section 373 in the FBA, any person violating the sections mentioned in... (text continues in original source).

*Source: _cr14352 - conclusions then are submitted within 35 days in the form of a written report to the (PDF).*

### section 373 (1) will be liable to fines or imprisonment of up to four months unless more

### _cr14352 - section 373 (1) will be liable to fines or imprisonment of up to four months unless more

### Enforcement powers, sanctions, and legal basis
- Section 373 (1): "will be liable to fines or imprisonment of up to four months unless more severe punishment is incurred under other legislation."
- Section 373 (2): "any person violating section 70(1)-(4) and section 71(1) will be liable to a fine."
- Section 373 (6): "a member of the board of directors or board of management of a financial undertaking or a financial holding company who omits to take the steps necessary in the event of losses or imminent danger of material losses shall be liable to a fine or imprisonment for up to four months unless a more severe penalty is incurred under other legislation." Applies correspondingly to members of the board of directors or the board of management in a savings undertaking or electronic money institution or administrators of an estate under administration established pursuant to section 247(a) of the FBA.
- Section 374 (1): BOD, BOM, external auditor, chief internal auditor, responsible actuary, liquidator, general agent, branch manager or shareholder committee failing to comply within the proper time with duties and obligations under this Act or under regulations may be subject to daily or weekly fines imposed by the DFSA or the Danish Commerce and Companies Agency as coercive measures.
- No provision leads to automatic imposition of civil and penal sanctions; "Every case is judged individually."

### Early intervention powers and supervisory judgment (EC3)
- The DFSA may act where a bank falls below regulatory threshold requirements, including prescribed regulatory ratios or measurements, and may intervene at an early stage to require remedial action.
- The DFSA can require a recovery plan when the bank fulfills the capital requirement of 8 percent.
- If the bank does not fulfill the capital requirement of 8 percent, the DFSA "shall withdraw the license (as per section 351 of the FBA)."
- Section 351 (1): The DFSA may order that a financial undertaking remove a member of the board of management within a time limit if, pursuant to section 64(2), said person may not occupy the position; the DFSA withdraws the license of the undertaking (see section 224(1), no. 2) if the undertaking does not remove the member before expiry of the time limit (see also section 351 (7)).
- Section 225 (1): If a bank, mortgage-credit institution, investment firm or investment management company does not meet the capital requirements mentioned in section 124(2), (3), (5), (7) and (8), section 125(2)-(5) and (8), and section 125a, and has not raised the capital required prior to the time limit set by the DFSA, the DFSA withdraws the license.
- "Every violation of the FBA is subject to individual evaluation on a case to case basis. Therefore no mandatory sanctions or fines are issued for certain violation."
- "The calibration of the Supervisory Diamond is such that it includes conservative settings over and above regulatory minimums contained in the FBA which promotes early intervention."
- Example exercised power: DFSA used section 350(1) number 2 to order a bank to stop granting new loans from a certain category of customers.

### Range of remedial measures and actions available (EC4)
- Measures the DFSA can require or impose include:
  - restricting current activities of the bank, including "cease lending";
  - imposing more stringent prudential limits and requirements;
  - withholding approval of new activities or acquisitions;
  - restricting or suspending payments to shareholders or share repurchases;
  - restricting asset transfers;
  - barring individuals from the banking sector;
  - replacing or restricting powers of managers, Board members or controlling owners;
  - facilitating a takeover by or merger with a healthier institution;
  - providing for interim management of the bank;
  - revoking or recommending revocation of the banking license.
- Section 124 (1): BOD and BOM must ensure the bank has an adequate capital base.
- Section 124 (2): "requires the bank to fulfill a capital requirement of 8 pct. of the risk weighted items."
- Section 124 (4): Banks must calculate an "individual solvency need" expressed as adequate capital base as a percentage of the risk-weighted items; "The solvency need cannot be less than the solvency requirement after section 124 (2)."
- If a bank fulfills the 8 percent capital requirement but not the individual solvency need, section 225 (2) allows a flexible approach: the DFSA can ask the bank to take recovery actions and "the bank will in most cases be asked to draw up a recovery plan."
- Recovery plan components to be considered include "different kind of capital injections, reduction of risk weighted items, sale of business, merger etc."

### Resolution framework: Bank Package 3 and Bank Package IV
- Denmark established a resolution regime for distressed banks taking effect in October 2010 ("Bank Package 3"), offering an alternative to ordinary liquidation and allowing voluntary winding up under the special resolution regime.
- Finansiel Stabilitet A/S (FSC): state owned winding up company established in 2008 to implement the resolution framework.
- Key steps in the Bank Package 3 resolution tool:
  1. If a bank fails to meet capital requirements the DFSA sets a deadline (often by a Friday evening); the bank must then (within 6 hours) declare to FSC whether, by the deadline, it wishes to transfer its activities to FSC or enter liquidation according to standard bankruptcy procedures, if the bank fails to meet the requirements.
  2. If transferring to FSC, a subsidiary bank ("New Bank") is created at FSC at the deadline, which takes over assets of the distressed bank ("Old Bank"). New Bank purchases all assets in Old Bank at realization value. As payment, a proportional share of the unsubordinated liabilities is transferred pro rata from Old Bank to New Bank, with a provisional proportional share set conservatively (a haircut is applied). Valuation and transfer occur over the takeover weekend so New Bank can open the following Monday.
  3. Shareholders, subordinated debt holders and unsecured deposits exceeding the proportionate share are left with claims on Old Bank. Other creditors are transferred to New Bank with the provisional haircut applied to unsecured debt. Secured debt is transferred at par.
  4. For a large depositor (with deposits above the limit of EUR 100.000 of the deposit guarantee scheme) a proportionate share of deposits in excess of the deposit guarantee limit will be transferred pro rata to New Bank. Unsecured deposits exceeding the proportionate share remain as claims on Old Bank. The Danish Deposit Guarantee Scheme (DGS) becomes a creditor against Old Bank on equal terms with other claims in accordance with normal insolvency order.
  5. A due diligence procedure by two independent auditors is carried out in the months following takeover; if they determine a higher pro rata value percentage, more liabilities are transferred pro rata to New Bank. If due diligence determines a lower asset value, liabilities are not withdrawn from New Bank; Danish banks must jointly cover the shortfall through a loss guarantee issued by the Winding-up Fund from the Danish Guarantee Fund for Depositors and Investors.
  6. Excess liabilities remain as claims against Old Bank and may be granted an earn-out if subsequent winding up of New Bank leads to a surplus.
- Timeline for valuation of assets:
  1) First valuation of all assets and provisional hair cut (in the weekend of the takeover by FSC of the distressed bank)
  2) Valuation report by auditors and a second estimate of haircut (in practice up to six months after the takeover)
  3) Final result when all assets have been wound up (probably after several years)
- Applications and examples:
  - Amagerbanken A/S (February 2011): balance sheet approximately DKK 33.3 bn., amounting to 0.66 percent of the Danish banking sector as a whole. Provisional haircut to large depositors and other unsecured creditors set at 41 percent; due diligence brought the haircut to large depositors down to now 16 percent.
  - Fjordbank Mors (June 2011): balance sheet approximately DKK 12.7 bn., amounting to 0.31 percent of the Danish banking sector as a whole. Provisional haircut set at 26 percent; due diligence brought the haircut down to now 14 percent.
  - Max Bank (October 2011, Bank Package IV model II): balance sheet approximately DKK 9.4 bn., amounting to 0.24 percent of the Danish banking sector as a whole.
  - Spar Salling (April 2012, Bank Package IV): balance sheet approximately DKK 1.6 bn., amounting to 0.04 percent of the Danish banking sector as a whole; sold to Den Jyske Sparekasse.
  - Sparekassen Østjylland (April 2012, Bank Package IV): balance sheet approximately DKK 6.3 bn., amounting to 14 percent of the Danish banking sector as a whole; taken over by FSC and sound assets sold to Sparekassen Kronjylland.
- Forced redemption and sale:
  - Special rule on forced redemption in the FBA if the bank does not fulfill capital requirements and DFSA has set a time limit.
  - Section 246: When DFSA has set a time limit to fulfill capital requirements (section 225) the bank’s board may inform the general assembly that it will sell the bank; the general assembly can recapitalize the bank to remove conditions for forced sale.
  - Section 247: The BOD can sell the bank if the bank is insolvent or likely to become insolvent; in that situation the general assembly has no power to prevent the sale and is only informed.
- Denmark delayed implementation of a framework geared for resolving systemically important firms pending adoption of new EU legislation; "According to the political agreement reached in October 2013, SIFIs must draw up resolution plans no later than January 2016."

### Application of sanctions to management and boards (EC5) and supervisory tools
- The DFSA has applied sanctions to banks and also to management and/or the Board when necessary.
- Powers exercised include:
  - Use of section 350 to require a bank to stop granting loans to new customers.
  - Use of section 349 to order management to prepare an account of financial circumstances and future prospects.
  - Use of fit and proper rules to change management and the board in several cases.
  - Use of section 351 to compel a bank to remove senior managers or board members within a time limit if they are not fit and proper pursuant to section 64 (2).
- Organizational powers:
  - EO on Management and Control of banks (section 10) requires banks to be organized and structured so employees have clear powers and areas of responsibility, departments manned with employees having relevant competences and numbers; "The DFSA can compel the bank to change the organizational structure; however this power has not been used to date."

*Source: IMF staff report extract in PDF _cr14352 (sections cited include FBA sections 64, 70, 71, 124, 125, 125a, 224, 225, 246, 247, 350, 351, 373, 374; Danish resolution frameworks Bank Package 3 and Bank Package IV).*

### Section 179 of the FBA gives the DFSA powers to order a parent undertaking (which owns

### _cr14352 - Section 179 of the FBA gives the DFSA powers to order a parent undertaking (which owns

### DFSA statutory powers under Section 179 and 180 (FBA)
- Section 179 permits the DFSA to order a parent undertaking (which owns equity investments in financial undertakings) to separate such financial undertakings and finance institutions in a subgroup under a financial holding company when:
  - 1) the group is structured in a manner which entails that the parent undertaking need not meet the solvency requirement in section 170,
  - 2) a member of the board of directors or the board of management of the parent undertaking falls within the scope of section 64(2), nos. 1, 2 and 4, or
  - 3) the structure renders performance of the tasks of the DFSA difficult in other ways.
- Section 180 gives the DFSA power to order a financial holding company to dispose of equity investments in a financial undertaking.
- Operational note: Section 179 and 180 have not been used to date.

### Ring-fencing, corrective actions, and license withdrawal (EC6)
- The DFSA does not have an explicit statutory power to ring-fence a bank within a group of companies.
- The DFSA can achieve isolation of a bank via other powers, for example:
  - ordering a FHC to dispose of an equity investment in a financial undertaking (Section 180(1));
  - ordering a parent undertaking to separate subsidiaries in a subgroup (Section 179).
- The DFSA can withdraw a bank’s license if the bank does not fulfill the capital requirement.
- If the bank has not taken any legal action (for example a decision to be resolved under the Financial Stability Act), the DFSA can withdraw the license and will file a bankruptcy procedure in accordance with section 234 in the FBA.
- Bank bankruptcy framework: certain provisions in the FBA and the Act on Financial Stability add to the legal framework of bankruptcy of banks, but the general Bankruptcy Law applies to the bankruptcy of banks.

### Cooperation in resolution (EC7)
- The DFSA determines when a bank is failing or likely to fail.
- Once that determination is made, the DFSA cooperates and collaborates with the FSC about resolution of the problem bank (which could include closure, assisting in restructuring, or merger with a stronger institution).

### Corrective action governance and transparency (AC1, AC2, Assessment re principle 11)
- No specific provision within the FBA guards against the supervisor unduly delaying appropriate actions (AC1).
- When taking formal corrective action, the DFSA informs other domestic agencies where necessary (e.g., Danish Business Authority, MoBG and FSC).
- Public disclosure obligations:
  - Section 354b (1): The DFSA shall inform the public about cases it has dealt with, the prosecution service or the courts, and which are of public interest or of significance for interpretation.
  - Section 354a (1): Decisions made pursuant to section 345(1), 3rd clause and section 345(2), no. 1 shall be made public and published on the DFSA website.
- Assessment: Compliant. Comments note:
  - DFSA demonstrates ability and willingness to intervene at an early stage and to use a range of supervisory tools, including recommendations to revoke a banking license.
  - The number of banks closed as part of problem bank resolution in the recent financial crisis in Denmark is 19.
  - A framework geared for resolving SIFIs, including preparation of recovery and resolution plans, is still a missing element.
  - Pending adoption of the EU Bank Recovery and Resolution Directive should expedite reinforcement of the Danish resolution framework.
  - While DFSA lacks explicit ring-fencing powers, it has used complementary powers to achieve similar outcomes.

### Consolidated supervision framework (Principle 12 — EC1–EC7)
- Structures in Denmark (as evaluated):
  - 1) Bank at the top with possible subsidiary financial companies (most common).
  - 2) Financial Holding Companies (FHCs): a handful of banks held by a company whose only function is holding shares of a bank and potentially sister financial companies.
  - 3) Two instances: bank directly held by a mortgage credit institution, which itself is held by a financial holding company.
  - 4) Cases where a controlling interest in a bank is held by a non-financial company (e.g., grocery store company or demutualized savings institution held by a foundation).
  - 5) Several cases where a pension company owns shares of a bank and is subject to insurance regulation on a consolidated basis.
- Applicable prudential provisions:
  - Sections 78, 80 and sections 170–182 of the FBA apply prudential requirements to consolidated bank-led groups; EO-MC generally applies.
  - For non-financial holding companies, these consolidated requirements do not automatically apply.
  - After commencement of CRR, group regulation will be moved to the regulation where applicable (article 11, subsection 1 and 2 in the CRR).
  - Some adjustments to apply explicit requirements to FHCs beginning Marts 31, 2014.
- Contagion and reputation risks addressed in FBA sections 179 and 182, particularly exposures to related parties.

EC2 — Prudential standards and reporting on a consolidated basis
- Sections 170–182 of the FBA address consolidated supervision; after CRR commencement group regulation will be moved to the regulation (article 11, subsection 1 and 2 in the CRR).
- FHCs: only certain requirements apply (solvency, reporting of large exposures and exposures to related parties); non-financial company ultimate parents are not subject on a consolidated basis.
- Financial reports required on bank consolidated and solo-bank basis; FHCs must file reports; non-financial holding companies are not required to file.

EC3 — Oversight of foreign operations
- Most foreign operations are in the EEA; only three banks have foreign operations outside the EEA (one in Switzerland, one in Russia, Saxo with specialized trading platforms).
- DFSA assesses how parent bank management oversees foreign operations and whether reporting and managerial competence are adequate; assessments often occur in onsite examinations.
- For EEA operations, no hindrance for parent bank access to all material information. For non-EEA operations, DFSA ensures access to material information and that host supervisor conducts effective supervision before permission to start operations.
- DFSA expects banks to assess competence of local management; onsite meetings assess local management expertise; to date no orders for dismissal of local managers resulted from these assessments.
- Supervision of parent bank and EEA foreign operations discussed in supervisory colleges.

EC4 — Onsite visits and host supervisor interaction
- Need for onsite examination of foreign operations is determined by risk-based supervision.
- Host supervisors may attend examinations and are informed of findings.
- DFSA prepares a statement on findings for foreign branches/subsidiaries; the parent bank must publish the statement on its website.
- Annual examination planning allocates necessary resources to foreign examinations.

EC5 — Review of parent and affiliated companies’ activities
- Division responsible for solo supervision of a parent financial undertaking is also responsible for consolidated supervision, coordinating inspections and assessing group-wide risk profile.
- DFSA can require access to and information from a financial undertaking, an FHC and a non-financial company pursuant to FBA section 347.
- If group fails capital requirements on consolidated level, DFSA may withdraw the license of a financial undertaking within the group (section 225(4) in the FBA).
- DFSA has used broad interpretations of its authorities to review limited nonbank subsidiaries.

EC6 — Limiting activities and locations
- Consolidated supervisor coordinates inspections and shares knowledge across divisions; solo-level onsite findings must be reported to consolidating supervisor.
- Financial undertakings may only carry out activities permitted under sections 7–11 and ancillary activities under sections 24–26 and section 29 in the FBA; generally they may not engage in activities not associated with their permission.
- Section 179 allows DFSA to order restructuring (e.g., placing all financial companies in a common holding company) if the group structure makes supervision difficult.
- If foreign operations compromise safety or soundness, DFSA can order necessary measures including closing foreign operations or limiting operations abroad (section 350(1)); noncompliance can lead to license withdrawal (section 350(2)).
- Operational note: The DFSA has not ordered any banks to close or limit operations abroad.

EC7 — Solo supervision within groups
- Solo supervision is a core element; requirements apply at both solo and group levels.
- Acquiring a significant holding requires DFSA approval; intragroup exposures also require DFSA approval.
- The solo-division of a parent is also responsible for consolidated supervision; relevant knowledge from solo inspections must be reported to consolidating supervisor and shared across divisions.

Additional criterion AC1 — Fit and proper standards for owners and senior management
- DFSA has substantial capacity to review owners and senior management of companies seeking to acquire a bank or FHC.
- No authority exists to conduct ongoing fit and proper reviews of owners and senior management of non-financial holding companies.
- Some acquisition-time information is provided even when a non-financial company acquires a bank.

*Content unit: _cr14352 - Section 179 of the FBA gives the DFSA powers to order a parent undertaking (which owns*

### Section 61, 61 a-c, 62 and 63 in the FBA regulates personal and corporate ownership of

### _cr14352 - Section 61, 61 a-c, 62 and 63 in the FBA regulates personal and corporate ownership of

### Scope of Sections 61, 61 a-c, 62 and 63 (FBA)
- DFSA must, under section 61 of the FBA, ensure account is taken of sensible and proper management of the undertaking in which the acquisition is intended.
- Assessment criteria to be considered by DFSA for an application to acquire a qualifying interest in a financial undertaking or FHC include:
  - 1) The reputation of the intended acquirer.
  - 2) The reputation and experience of the person(s) who will manage the financial undertaking or the FHC after the acquisition.
  - 3) The financial situation of the intended acquirer, particularly with respect to the nature of the business to be operated or intended to be operated in the financial undertaking, or the FHC in which the acquisition is intended.
  - 4) Whether the undertaking can continue to comply with the supervision requirements in the legislation, in particular whether the group of which the undertaking may become a part has a structure which makes it possible to perform effective supervision and effective exchange of information between the competent authorities as well as to determine how responsibilities are to be divided between the competent authorities.
  - 5) Whether, in connection with the intended acquisition, there are grounds to suspect that money laundering or terrorist financing, cf. sections 4 and 5 of the Act on Measures to Prevent Money Laundering and Terrorist Financing, will occur.

### Assessment: Principle 12 (Consolidated Supervision of Groups)
- Assessment: Largely Compliant
- Key findings:
  - Consolidated supervision of groups with a bank as ultimate parent appears sound.
  - Such groups are subject to regulations regarding capital adequacy, liquidity, large exposures, exposures to related parties, lending limits and group structure (and related reporting to the DFSA).
  - Only certain requirements apply to FHCs with other than a bank as ultimate parent (solvency, reporting of large exposures and exposures to related parties).
  - These prudential requirements are not applied, even to a limited consolidated extent, to groups where a non-financial company is the ultimate parent.
  - Some adjustments are being made to make explicit requirements to FHCs, as currently a number of prudential requirements do not clearly apply.
  - No authority exists to do fit and proper reviews on an ongoing basis of owners and senior management of non-financial parent companies.

### Assessment: Principle 13 (Home-host relationships)
- Assessment: Compliant
- Summary of ECs and findings:

  - EC1: Supervisory colleges
    - DFSA (consolidated supervisor for the Danske Bank Group) has established a supervisory college in accordance with revised CRD 2009/111/EC art. 42, 42a and 131a and CEBS’ guidelines (GL 34).
    - Core college: 8 countries; General college: 12 countries.
    - DFSA participates in 4 colleges where foreign banking groups have relevant subsidiaries or significant branches in Denmark (Nordea, Svenska Handelsbanken, SEB, and DnB).
    - CEBS GL 34 will be replaced by CRD IV and supplementary binding technical standards for colleges of supervisors.

  - EC2: Information sharing
    - DFSA is very open in sharing information with other supervisors and makes most supervisory decisions public.
    - DFSA shares appropriate information on a timely basis as home and host supervisor in accordance with revised CRD 2009/111/EC art. 44-52 and art. 131a, art. 132 and CEBS GL 34.
    - Types of information customarily shared include:
      - Material from the bank, e.g., capital plans, risk reports;
      - Proposed supervisory measures regarding the bank, provided they have been fully vetted internally;
      - Results from inspections;
      - National reports and analysis relevant to the supervisors e.g. political agreement on SIFIs, report on the financial crisis in Denmark;
      - News from the Danish financial sector with potential relevance to the Group, e.g., acquisitions.
    - DFSA produces a Joint Risk Assessment report (JRAD) for Danske Bank once a year in cooperation with supervisors of subsidiaries and significant branches; JRAD underpins the Joint Decision on adequate capital levels.
    - Memoranda of understanding are established in all colleges DFSA participates in, most importantly the Nordic-Baltic MoU.

  - EC3: Coordinated supervisory activities
    - DFSA monitors supervisory activities through the Joint activities plan in accordance with CEBS GL 34, chapter 7.
    - Joint activities plan is updated and discussed at college meetings twice a year.
    - Examples of joint inspections for Danske Bank: joint liquidity inspection and joint IRB follow-up meeting in 2013.

  - EC4: Communication strategy
    - MoUs form the basis of communication between supervisors; colleges are well functioning.
    - Following joint activities there is a consultation procedure where views and outcomes are agreed.

  - EC5: Cross-border crisis cooperation
    - DFSA has developed a framework for planning and coordination in emergency situations in accordance with art. 131a of CRD and CEBS GL 34, chapter 8.
    - The document addresses information sharing in the Danske Bank college in a crisis, including:
      - Preparation before a crisis (contact information, means of communication and crisis scenarios);
      - Check list for communication during a crisis;
      - Predefined set of information to be exchanged and other preparatory arrangements.

  - EC6: Group resolution planning
    - DFSA has not established a general resolution planning regime but has extensive experience dealing with failing banks.
    - Denmark introduced a national resolution regime—Bank Package 3 in 2010 (Act no. 721 of June 25, 2010 and Executive Order no. 1135 of September 29, 2010).
    - Bank Package 3 allows for controlled winding-up of a distressed bank through the Financial Stability Company.
    - If DFSA sets a deadline for a bank to meet Danish capital adequacy requirements, the bank must inform DFSA whether it will use controlled winding-up procedures or traditional bankruptcy procedures.
    - Bank Package 3 will transition into harmonized EU regulations (e.g., upcoming Bank Recovery and Resolution Directive) once these come into force.
    - Political agreement concerning regulation of SIFIs (October 2013) decided that crisis-management regulations for SIFIs and other banks/mortgage-credit institutions will await common EU crisis-management regulations.
    - Resolution plans must be drawn up for all Danish SIFIs by no later than January 1, 2016, by the national resolution authority in close dialogue with the SIFIs and with involvement of the DFSA and the DN.
    - If no EU agreement is reached, political parties will discuss revising Denmark’s resolution scheme.

  - EC7: National treatment of foreign banks
    - National treatment is in place: Danish subsidiaries of foreign banks must follow the same rules as other Danish banks.
    - All FBO branches in Denmark are those of EEA banks and follow EU regulation (CRD articles 23–28).

  - EC8: Home supervisor onsite access
    - Section 345a of the FBA allows supervisory authorities of foreign branches to perform inspections in Denmark after notifying the DFSA.
    - DFSA has performed onsite inspections in foreign jurisdictions of subsidiaries and branches.
    - Standard practice: host supervisor shares findings with the home supervisor upon completion.

  - EC9: Booking offices and shell banks
    - DFSA does not permit shell banks or booking offices.

  - EC10: Consultation before consequential action
    - DFSA generally consults with the originating supervisor before taking consequential action based on information received from that supervisor.

- Comments:
  - DFSA works closely with national supervisors in well-designed and implemented colleges.
  - DFSA has not established a general resolution planning regime for the largest banks but has extensive experience in dealing with failing banks.

### Prudential Regulations and Requirements: Corporate Governance (Principle 14)
- Principle 14 focus: supervisor ensures banks/banking groups have robust corporate governance policies and processes commensurate with risk profile and systemic importance.

- EC1: Legal responsibilities and guidance
  - The Executive Order on Management and Control of Banks (“EO-MC”) regulates responsibilities of the Board of Directors (BoD) and Board of Management (BoM) and division of responsibility between them.
  - Section 6 of EO-MC: BoD must establish written guidelines for BoM with clear descriptions of their range of authorities; guidelines based on BoD risk assessment required by Section 4(1) and policies under Section 5 of EO-MC.
  - Section 2: ongoing BoD responsibility to assess appropriateness of guidelines for senior management relative to business activities, organization and resources; monitor senior management performance and ensure sufficient reporting and effective corporate governance.
  - EO-MC provides guidance on managing a financial company from a corporate governance perspective.
  - DFSA inspections focus on compliance with EO-MC; interaction with the Chairman of the BoD and review of BoD documents are key elements.

- EC2: Supervisor assessments and corrective action
  - DFSA reviews BoD rules of procedure, minutes, and BoD self-assessment; interviews the Chairman of the BoD during inspections.
  - DFSA reviews bank policies and implementation, and compliance with EO-MC during inspections.
  - DFSA requires banks to correct deficiencies in a timely manner, issuing orders or risk information with short timeframes and requiring reporting back when corrections are made.

- EC3: Board nomination, composition, and committees
  - DFSA established requirements to ensure appropriate BoD skills; examiners regularly review such assessments through inspections and a special horizontal review done in 2012.
  - DFSA has not yet provided guidance on the nomination process nor established requirements for risk committees (though it has for audit and remuneration committees at least for larger banks); these shortcomings will be significantly addressed with CRD-IV adoption.
  - Section 3 of EO-MC: financial companies must at least once a year assess whether their BoD has adequate skills and knowledge given business model and risks.
  - DFSA Guidelines on Self-Assessment require that a BoD of a large or medium-sized bank (banks belonging to groups 1 and 2) must have at least one board member with management-level experience from a relevant financial company.
  - Denmark is implementing CRD IV (Directive 2013/36/EU) including provisions on nomination committees; until then Danish legislation does not specifically regulate nomination/appointment processes beyond general adequacy requirements.
  - Review of board qualifications is a main element of DFSA onsite inspections; BoD self-assessment must be recorded in board meeting minutes per DFSA Guidelines on Self-Assessment.
  - DFSA conducted a horizontal review in 2012 regarding BoD self-assessments.
  - Committees: Denmark implemented Capital Requirements Directive 3 including requirements to set up an audit committee and a remuneration committee.
  - Section 77c of the FBA requires financial undertakings and financial holding companies that are listed or have on average 1,000 or more full-time employees in two consecutive financial years to set up a remuneration committee consisting entirely of independent board members; composition and tasks further regulated in Section 77c; members should have necessary skills to advise the BoD on remuneration issues.

*Source: Excerpt from IMF assessment chapter on Denmark (sections quoted above).*

### Section 2 of the Executive Order on Audit Committees in Companies and Groups under

### Section 2 of the Executive Order on Audit Committees in Companies and Groups under Supervision of the DFSA

### Audit committee requirements and related governance rules
- Listed companies and companies that have a balance sheet total of DKK 500 million or more in two consecutive financial years are required to set up an audit committee (Section 2 of the Executive Order).
- The audit committee:
  - Is made up entirely of board members.
  - Must contain at least one member who is independent and who has qualifications in regards to accounting, the level of which depends on the size and complexity of the company.
- The BoD of all remaining financial companies must at least once a year evaluate the need to establish an audit committee, taking into account the complexity of the company.
- Danish legislation does not at present include requirements to set up a risk committee; requirements will be introduced when Denmark implements CRD IV, which includes provisions on risk committees for companies that are listed or have an average 1,000 or more full-time employees in two consecutive financial years.
- Assessors reviewed Annual Reports of two of the largest banks; both have already established risk committees.

### Board fitness, duty of care and fit-and-proper processes (EC4)
- Section 64(1) of the FBA requires members of the BoD or BoM of a financial company to be approved by the DFSA as fit and proper.
- Required submission for fit and proper assessment must include:
  - Whether previously assessed as fit and proper by the DFSA or in another EU/EEA country.
  - Previous employment (10 years back) and current and previous board memberships (10 years back).
  - Information regarding any suspensions of payments or bankruptcies.
  - Copy of the individual’s judicial record attesting to not having been convicted of a crime in the past five years.
  - The prospective BoD or BoM member is obligated to inform the DFSA of any additional information important to the fitness and propriety assessment.
- Following approval, members must inform the DFSA of any changes that may materially adversely affect the assessment of their fitness and propriety.
- Section 64 requires that the board member must not have behaved or behave in such a manner that there is reason to assume the person will not perform duties and responsibilities adequately.
- Approval can be made by the Director General of the DFSA; denials can generally be made by the Financial Council. The Financial Council has delegated authority to deny to the Director General in clear baseline-fitness cases.

### DFSA supervisory verification of Board oversight and risk governance (EC5)
- The DFSA requires many objectives of EC5 to be met but does not specifically require issuance of codes of conduct or overall conflicts of interest policies.
- DFSA guidance on core elements of a risk appetite statement focuses primarily on credit risk-taking and setting appropriate limits.
- EO-MC Section 2 requires the BoD to decide on the business model, monitor BoM performance in accordance with the risk profile, policies and guidelines, and monitor effective forms of corporate governance.
- EO on organizational requirements for investment firms (including banks with IF license) section 16 requires identifying and mitigating conflicts of interest.
- EO-MC Section 26 requires a strong overall control environment ensuring control systems for all tasks and duties that may cause risk, including control of compliance with delegated authorities and limits for risk taking.
- Pre-onsite inspection documentation banks must submit to the DFSA includes organization description, risk policy, guidelines, written procedures, and management reporting including reporting from the chief risk officer and the chief compliance officer; DFSA reviews documentation to plan onsite inspection details.
- Onsite inspections verify BoD approval of the bank’s risk profile, implementation in risk policy, issuance of written guidelines for risk taking consistent with the risk profile, review of guidelines from BoD to BoM and to divisions, review of how duties are carried out, and review of reporting to BoD to evaluate oversight.

### Senior management selection, staffing and succession oversight (EC6)
- The DFSA does not require banks to have specific standards for the BoD selection of senior management.
- EO-MC Section 10(2) requires each organizational entity be staffed by employees with relevant competences on a sufficient level.
- DFSA inspections evaluate whether employees at different management levels have relevant competences; interviews during onsite inspections include heads of business lines and the chief risk officer.
- BoM members are subject to DFSA fit and proper review; other members of senior management are not.

### Compensation governance and supervisory oversight (EC7)
- Section 77(a) of the FBA establishes compensation principles for BoD, BoM and material risk takers:
  - Maximum levels of variable compensations to base salary: 50 percent.
  - Minimum proportions of stock to overall variable compensation: 50 percent.
  - Use of deferred payments: 40 percent—60 percent over three year periods, depending on the size of the grant.
- DFSA oversight:
  - A corporate governance and remuneration team of five to six employees specializes in corporate governance and remuneration.
  - The team conducts risk-based inspections of remuneration for BoD, BoM and material risk takers in all financial companies.
  - The DFSA collects comprehensive remuneration data from all financial institutions and financial holding companies on an annual basis and discloses a national remuneration benchmark report by the end of each year.
  - If inconsistencies with Danish remuneration regulation are discovered, the DFSA asks institutions to verify data and/or explain inconsistencies and carries out offsite and onsite remuneration inspections as required.
  - Prior to onsite remuneration inspections, banks are asked to submit: remuneration policy for BoD, BoM and material risk takers; remuneration policy for subsidiaries; documentation for BoD’s yearly review of remuneration policy; Chairman of the Board’s report on remuneration included in his annual statement for previous years; list of persons identified as material risk takers with explanation; description of types of instruments granted as variable remuneration per Section 77 (1)(3) of the FBA; any audit or compliance report on remuneration from previous years.
  - The DFSA oversees rectification of discovered deficiencies.

### Board and management understanding of operational structure and skills (EC8)
- DFSA evaluates suitability of BoD and BoM regarding skills and knowledge for their positions.
- DFSA issued guidance in 2010 on Board composition and more detailed guidance in 2012 (“Guidelines on Self-Assessment of the Required Skills and Knowledge of the BoD of Credit Institutions”) as a prelude to a horizontal review.
- Expectations set in guidance:
  - The largest banks (group 1 and group 2) were expected to have a director with senior management experience at another financial institution.
  - All banks were expected to have directors with knowledge in the risk areas of the bank’s business models.
- Horizontal review process and results:
  - DFSA sent new guidance to all banks on July 4, 2012 and asked BoDs to carry out a self-assessment exercise in accordance with the guidelines and report results back by November 1, 2012.
  - All Danish banks carried out the self-assessment and reported back to the DFSA; the DFSA evaluated results and reported findings back to the banks.
  - Review findings: nearly half (7 of 15) of the largest and medium sized banks did not have on their board a person with necessary senior experience; over one-quarter of the overall set of banks (25 of the then 94) lacked directors with necessary background in the specific or general risks faced by the bank.
  - The DFSA ensured gaps were promptly addressed.

### Supervisory powers to require Board changes (EC9)
- The DFSA can require changes in composition of a bank’s BoD and BoM where individuals are not fulfilling duties or where BoD/BoM as a whole do not meet collective qualification requirements.
- If a member no longer fulfills Section 64 requirements and is no longer fit and proper:
  - DFSA may, under Section 351(2) of the FBA, order a director to resign within a time limit specified by the DFSA.
  - For members of the BoM, DFSA may, under Section 351(1) of the FBA, order a financial undertaking to dismiss a member of the BoM within a time limit specified by the DFSA.
- Procedural protections:
  - DFSA consults involved parties by submitting a draft decision for examination and comments, in accordance with the Danish Public Administration Act where facts disadvantageous to an individual must be disclosed and commented upon.
  - After consultation, the draft decision is submitted to the Financial Council; matters of principle including fitness and propriety where DFSA intends to order resignation are decided by the Financial Council.
  - Parties involved may speak before the Financial Council; based on the Financial Council decision the DFSA implements the final decision.
- The DFSA may issue other supervisory reactions (e.g., risk statements or remedial orders) where BoD or BoM do not meet collective qualification requirements.

### Notification obligations and assessment of governance (AC1 and Principle 14 assessment)
- Section 64(3) of the FBA requires members of the BoD or BoM to submit information to the DFSA on circumstances mentioned in Section 64(2) when applying for fit and proper approval and following approval if circumstances subsequently change.
- There is no specific legal requirement on banks (as entities) to report material changes in information concerning the fitness and propriety of a Board member or member of senior management.
- Assessment of Principle 14: Largely Compliant.
- Commentary on gaps and strengths:
  - DFSA’s horizontal review and follow-up on Board composition is a strong example of supervisory oversight.
  - Gaps include not yet requiring establishment of risk committees even for firms whose risk profile and systemic importance would indicate they should be in place (to be required April 1, 2014).
  - Other elements that could be more explicit: codes of conduct, overall conflicts of interest policies to ensure independence in validation of models; requiring banks to report material changes concerning fitness and propriety of Board members or BoM members to the DFSA (to supplement current personal obligation).

### Risk management process overview and EC1 findings (Principle 15 and EC1)
- Principle 15 summary: Supervisor determines banks have a comprehensive risk management process (including effective Board and senior management oversight) to identify, measure, evaluate, monitor, report and control or mitigate all material risks timely and to assess adequacy of capital and liquidity relative to risk profile and market and macroeconomic conditions; includes development and review of contingency arrangements and recovery plans where warranted; process commensurate with risk profile and systemic importance.
- EC1 requirements (board-approved risk management strategies and suitable risk appetite) include ensuring:
  - (a) sound risk management culture established throughout the bank;
  - (b) policies and processes for risk-taking consistent with risk management strategy and established risk appetite;
  - (c) recognition of uncertainties attached to risk measurement;
  - (d) appropriate limits consistent with risk appetite, risk profile and capital strength, communicated to relevant staff;
  - (e) senior management monitors and controls all material risks consistent with approved strategies and risk appetite.
- DFSA actions and findings for EC1:
  - Through the FBA and EO-MC provisions, DFSA provides detailed requirements on key elements of the risk management framework banks must implement.
  - Requirements are appropriately extensive and well spelled out, though areas for refinement remain, such as application of the framework to financial holding companies (in train).

*IMF staff summary based on Section 2 of the Executive Order on Audit Committees in Companies and Groups under Supervision of the DFSA.*

### Section 70.1 of the FBA sets forth the overall requirements on the BoD of a bank to identify

### _cr14352 - Section 70.1 of the FBA sets forth the overall requirements on the BoD of a bank to identify

### Board of Directors (BoD) responsibilities and legal framework
- Section 70.1 of the FBA requires the BoD of a bank to identify and quantify significant risks and determine the bank’s risk profile, including which types of large risks the bank may accept and to what extent.
- The BoD shall lay down policies for how the bank is to manage all significant activities of the bank and associated risks.
- EO-MC section 2: DFSA rules clarify that a key BoD responsibility is assessing whether the risk profile and policies of the bank, and guidelines for the BoD, are appropriate in relation to the business activities, organization and resources of the bank.
- EO-MC section 4: the BoD shall carry out an assessment of the risks of the bank.
- EO-MC section 5: on the basis of the risk assessment the Board shall adopt relevant policies on credit, market risk, operational risk, liquidity risk, etc.
- EO-MC section 6–7: the Board shall provide senior management with guidelines, including controllable limits for the size of risks senior management is authorized to take on behalf of the bank.
- The Board shall decide which information and reports it requires to have a full picture of the risks in the bank.

### DFSA supervisory process and onsite inspections
- DFSA scrutinizes and evaluates material requested from the bank ahead of onsite inspection and interviews relevant staff during onsite inspection.
- Pre-onsite review of policies and processes (e.g., credit activities, market risk activities) is used to assess whether the risk profile and policies are consistent with management strategy and established risk appetite.
- DFSA assesses whether a sound risk management culture is established throughout the bank based on quality of material and interview results.
- DFSA uses ICAAP process and stress testing reviews to assess preparedness for potential vulnerabilities and external developments.
- DFSA will conclude whether the conditions listed in EC1 (a)–(e) are met based on material and interviews.
- Under BCP 11 and EO-MC/EOs, if a bank does not comply DFSA may order compliance or issue supervisory information.

### Application to financial holding companies and legislative amendments
- DFSA is amending the EO-MC to explicitly apply these requirements to financial holding companies, in line with proposed amendments to sections 70 and 71 of the FBA and CRD IV in general.
- The amendments will go into force on March 31, 2014.
- Revised EO-MC entering into force on March 31, 2014 will establish a commission to consider substantive changes; the work of the commission is expected to be done by June 30, 2014.
- Banks designated as systemically important must, in future legislation, meet enhanced CRD IV risk management requirements.
- There are 10 Danish domestic SIFIs—five largest banks, two largest mortgage credit institutions, two banks in the Faroe Islands, and one in Greenland.

### EC2 — Bank-wide comprehensive risk management (Description and findings)
- EC2 expectations:
  - (a) processes provide a comprehensive “bank-wide” view of risk across all material risk types;
  - (b) processes adequate for the risk profile and systemic importance of the bank; and
  - (c) processes assess risks arising from the macroeconomic environment and incorporate such assessments into the bank’s risk management process.
- DFSA ensures compliance by examining banks’ financial reporting and conducting onsite inspections; assessment of risk management is a substantial part of onsite inspections.
- EO-MC: the CRO and the risk management function are responsible for ensuring appropriate risk management and that an overview is established of the bank’s risks and overall risk profile (inclusive of subsidiaries).
- EO-MC annexes contain detailed regulations of different risk types and how these need to be managed.
- Pre-onsite: DFSA will request material on the bank’s risk management policies and processes and scrutinize whether material provides a comprehensive bank-wide view across all material risk types, is relevant for the chosen risk profile, sufficient according to systemic importance, and adequate to assess macroeconomic risks.
- Onsite: DFSA interviews staff to determine whether processes provide a comprehensive view of different risk types, are adequate for the bank’s risk profile and systemic importance, and adequate for risks from the markets in which the bank operates.

### EC3 — Documentation, review, communication, and exceptions (Description and findings)
- EC3 expectations:
  - (a) risk management strategies, policies, processes and limits properly documented;
  - (b) regularly reviewed and appropriately adjusted to reflect changing risk appetites, risk profiles and market and macroeconomic conditions; and
  - (c) communicated within the bank;
  - exceptions to established policies, processes and limits receive prompt attention and authorization at appropriate management/Board level.
- EO-MC sections 15, 17 and 18 require banks to have properly documented and updated policies, limits, procedures etc. reflecting the bank’s risk profile.
- Banks must be organized so risk management strategies, policies etc. are clearly communicated within the bank.
- EO-MC section 4: BoD must carry out an ongoing assessment of risks in the bank.
- EO-MC section 26: reports to all relevant management levels are required for exceptions to established policies and limits.
- DFSA pre-inspection: receives and scrutinizes material covering risk management strategies, policies, processes and risk limits to verify documentation, review cadence (they should be dated), appropriateness of adjustments, accessibility and internal communication.
- Onsite: DFSA checks Board Minutes to assess whether requested material has been submitted to the Board according to EO-MC annex 6 regarding BoD business procedures.

### EC4 — Board and senior management understanding of risks, capital and liquidity (Description and findings)
- EC4 expectations:
  - BoD and senior management obtain sufficient information on, and understand the nature and level of risk being taken and how this risk relates to adequate levels of capital and liquidity;
  - BoD and senior management regularly review and understand implications and limitations (including risk measurement uncertainties) of the risk management information they receive.
- DFSA regulations detail requirements that the BoD has capacity to understand risks and, with senior management, ensure risks are appropriately addressed and that BoD and BoM receive necessary reports; these elements are reviewed onsite.
- EO-MC section 3: BoD must regularly assess whether its members collectively possess necessary knowledge and experience regarding the risks of the bank to ensure appropriate operation; this applies in particular to use of models for risk calculation, new products, and initiatives that could significantly influence risk calculation and reporting.
- EO section 9.5: senior management has day-to-day responsibility to ensure the undertaking only accepts risks to the extent necessary for its business model.
- EO section 26: regular written reports shall be issued at all relevant management levels on compliance and utilization of all limits for risk assumptions contained in guidelines pursuant to EO section 6 or in the authority transferred, cf. section 5.2.
- Onsite DFSA supervisors review BoD work by reading BoD minutes, reviewing reporting to the Board, and meeting with the Chairman of the Board to establish how the BoD works, how it is informed and whether the CEO is challenged by the BoD.
- DFSA examines the Board’s compliance with the requirement to evaluate competence and experience of the Board.
- DFSA may request reporting to the BoD before the onsite inspection.

### EC5 — Internal capital and liquidity adequacy assessment (Description and findings)
- EC5 expectations:
  - Banks have an appropriate internal process for assessing overall capital and liquidity adequacy in relation to risk appetite and risk profile;
  - Supervisor reviews and evaluates banks’ internal capital and liquidity adequacy assessments and strategies.
- EO-MC section 2, section 4.1 and section 5: based on the business model set by the BoD, the Board determines the individual solvency need of the bank (ICAAP), reflected in section 6.3.
- DFSA assesses the bank's ICAAP annually, or more often if needed.
- The bank must report its ICAAP to DFSA under the EO on Capital Adequacy Guidelines (EO-CAG).

* _cr14352 - Section 70.1 of the FBA sets forth the overall requirements on the BoD of a bank to identify_

### 2013. Also at most onsite inspections DFSA assesses the bank's solvency requirement, as a

### _cr14352 - 2013. Also at most onsite inspections DFSA assesses the bank's solvency requirement, as a

### EC6 — Internal models: use, validation and reasonableness
- Supervisor determinations:
  - (a) banks comply with supervisory standards on their use;
  - (b) the banks’ Boards and senior management understand the limitations and uncertainties relating to the output of the models and the risk inherent in their use; and
  - (c) banks perform regular and independent validation and testing of the models.
- DFSA requirements and practices:
  - Banks must obtain DFSA approval before using their own models for capital adequacy purposes.
  - Banks must maintain continuous validation and stress tests of models and report results to the DFSA under the EO-CAG.
  - DFSA monitors compliance via annual IRB status meetings, IRB inspections, and applications for model changes.
  - DFSA assesses whether model outputs appear reasonable; if not, it requests further information and data.
  - For internal credit-risk models, reasonableness is assessed as part of credit inspections: DFSA credit experts review specific customers to assess assigned ratings and allocated capital against expert judgment.
  - Benchmarking across IRB institutions is used and expected to grow in importance, cf. Article 78 in CRD.
  - VaR-models: banks must undertake a model validation every year, which the DFSA reviews.
    - The extent of independent validation varies across banks; DFSA lacks clear guidance on the independence requirement and is reviewing cases where validation is performed by the same group responsible for model development.
    - DFSA assesses back-tests of VaR-models quarterly; banks provide information on back-test exceptions. Quarterly review focuses on the number of exceptions and a general analysis of the P/L vs. the upper and lower limits. Material on back-tests is reviewed for accuracy and completeness.

### EC7 — Information systems for risk measurement and reporting
- Supervisor determination:
  - Banks must have information systems adequate under normal and stress conditions for measuring, assessing and reporting exposures on a bank-wide basis across all risk types, products and counterparties; reports must reflect the bank’s risk profile and capital and liquidity needs and be timely and suitable for Board and senior management use.
- DFSA practices:
  - During onsite inspections DFSA evaluates adequacy of banks’ information systems for measuring, assessing and reporting all risks, and whether risk measurement and reports reflect actual risk profiles, including liquidity risk and capital requirements.
  - DFSA has powers to impose additional requirements on risk management, liquidity and capital if risks are not adequately addressed.

### EC8 — New products, material modifications and management initiatives
- Supervisor determination:
  - Banks must have policies and processes ensuring Boards and senior management understand risks from new products, material modifications, and major initiatives; major activities require Board or committee approval.
- DFSA requirements and practices:
  - EO-MC sections 9.3 and 9.8: senior management must ensure BoD policies and guidelines are implemented in day-to-day operations.
  - CEO must approve guidelines for development and approval of new products, new counterparties/customers, and changes to existing products that significantly change risk profile, cf. section 28.
  - DFSA practice: all bank functions must sign off that they can manage a new product before launch.
  - Section 28 requires internal guidelines to analyze and document general conditions including nature, size and calculation of risks, effects on costs and revenues, market-operating capability, effects on solvency, accounting treatment, and provisions for submission to the Board when new products may involve significant new risks or changes to policies under sections 5–7.
  - Onsite inspections assess compliance with EO-MC, Board awareness of assumed risks, and that major activities/decisions of unusual nature are taken at the appropriate management level (interviews with Chairman, review of Board Minutes, assessment of Board self-evaluation).

### EC9 — Risk management functions: resources, independence and reporting
- Supervisor determination:
  - Banks must have risk management functions covering all material risks with sufficient resources, independence, authority and access to Boards; duties must be segregated from risk-taking and reported directly to Board and senior management; internal audit must regularly review risk management.
- DFSA requirements and practices:
  - EO-MC sections 12–14 require segregation of duties to prevent reporting lines that mix disposal decision-makers with settlement, return, risk calculation, internal control or reporting responsibilities; clarified in EO annexes.
  - EO-MC section 10.2: organisational entities must be staffed by employees with relevant competences at a suitable level; number and competences must ensure adequate task performance.
  - Risk exposures should be reported directly to the BoD and senior management per sections 7.6, 7.7, 26 and annexes 1–5.
  - DFSA issues provisions on audit processes; Executive Order on Auditing Financial Undertakings etc. no.1024 of 21 August 2013; internal audit regulation in EO-AFU section 45.2.
  - Onsite inspections: DFSA assesses compliance with EOs on segregation of duties, staffing, procedures and reporting; reviews relevant entities’ human resources and IT systems per EO section 10.2 and annex 5; risk management reporting is scrutinized and challenged with the CRO.
  - Assessment of staffing is judgmental and outcome-focused: the question is “does the staff carry out its responsibilities effectively”.
  - Specific functions/entities are examined via management interviews to establish sufficient staffing.

### EC10 — Chief Risk Officer (CRO) and dedicated risk units
- Supervisor determination:
  - Larger and more complex banks should have a dedicated risk management unit overseen by a CRO or equivalent; removal of the CRO should be approved by the Board, generally disclosed publicly, and discussed with the supervisor.
- DFSA approach and practices:
  - DFSA uses proportionality with increased expectations for largest banks, though most rules apply equally.
  - EO-MC sections 19, 20 and 21 define CRO and risk management requirements for all banks.
  - A clarification that CRO removal requires Board approval is included in the new draft of the EO.
  - Onsite inspections examine organization and function of the dedicated risk management entity and evaluate CRO/department compliance with EO-MC requirements.
  - For smaller banks, CRO may be part-time and possibly combined with other responsibilities, including CEO.

### EC11 — Issuing risk standards
- Supervisor determination:
  - Supervisor issues standards related to credit risk, market risk, liquidity risk, interest rate risk in the banking book and operational risk.
- DFSA materials and timing:
  - DFSA has detailed annexes to EO-MC regarding credit risk (annex 1), market risks (annex 2), liquidity risk (annex 4) and operational risk (annex 3). EO-MC is being updated.
  - The order was approved by the Financial Council on February 19 2014 and will enter into force as soon as the CRD IV amendment to the FCA has been adopted by the Danish Parliament in Spring 2014.
  - Annex 3 regarding market risks is supplemented by DFSA-guidance of October 11, 2013 on interest rate risk.
  - Operational Risk program is less developed than for other risk categories; operational risk is a core focus on market risk and inspections.

### EC12 — Contingency arrangements and recovery planning
- Supervisor determination:
  - Banks must have contingency arrangements, including robust and credible recovery plans when warranted by risk profile and systemic importance; supervisor assesses adequacy and feasibility and seeks improvements.
- DFSA requirements and practices:
  - Based on EO-MC section 4.1., BoD must adopt relevant policies and contingency plans, including EO-CAG provisions relevant to adequate capital and solvency requirements (paragraphs 18 and 99).
  - Onsite inspections evaluate whether banks have appropriate contingency arrangements and recovery plans given risk profile and systemic importance by reviewing plans with senior executives.
  - DFSA has not yet required general submission of recovery and resolution plans (see BCP 8).

### EC13 — Forward-looking stress testing programmes
- Supervisor determination:
  - Banks must have forward-looking stress testing programmes commensurate with risk profile and systemic importance; supervisor regularly assesses programmes, scenarios and integration of results into decision-making and contingency arrangements; corrective action required for material deficiencies.
- DFSA assessment framework and practices:
  - Supervisory assessment occurs through annual ICAAP review and technical assessment (see EC5 in CP9 for technical detail).
  - Annual ICAAP review focuses on:
    - outcome of macroeconomic stress-tests given assessment criteria such as scope, relevance and severity of the scenarios and assumptions;
    - results given the levels of capital and liquidity in different scenarios; and
    - eventual contingency plans in different scenarios (incl. reverse stress test).
  - Ex-ante requirement: stress testing programmes must cover all risks relevant to specific business model and risk profile, including risks not specified in Pillar 2 guidance.
  - Sophisticated forward-looking stress testing programmes are more relevant for large and complex banks; large commercial banks have comprehensive programmes and design adverse scenarios; stress testing is key in capital and liquidity planning.
  - EO-CAG legally requires integration of stress testing into management framework; DFSA challenges BoD and BoM involvement via dialogue; stress test results are explicitly discussed with management during annual meetings.
  - Stress test documentation (internal handbooks and guidelines) must be submitted as part of annual supervisory stress test exercise; ad hoc document submissions requested at times.
  - Deficiencies are reported to the institution at technical level and/or to the Board; DFSA requires corrective actions depending on severity.
  - Supervisor will review bank’s stress testing programs and its “solvency need assessment” at least once a year and in connection with onsite inspections to examine if satisfactory and reasonable.

### EC14 — Accounting for risks in pricing, performance measurement and product approval
- Supervisor determination:
  - Supervisor assesses whether banks appropriately account for risks (including liquidity impacts) in internal pricing, performance measurement and new product approval processes.
- DFSA findings:
  - DFSA does not explicitly require banks to take into account liquidity impacts in reviews of internal pricing, performance measurement, or new product approvals.
  - DFSA has issued more general guidance regarding these areas.
  - EO-MC sections 28 and 29 require approval of new products and services by relevant management (BoD or BoM) before use; approval procedures clarified in EO sections 28 and 29.

*Source: IMF staff summary of DFSA supervisory requirements and practices as presented in the provided content.*

### annex 1, # 7, and annex 4, # 11 in the EO.

### _cr14352 - annex 1, # 7, and annex 4, # 11 in the EO

### DFSA oversight of pricing, valuations, benchmarking, and model validation
- DFSA evaluates, on a risk based approach during onsite inspections, the internal pricing, performance measurement and approval of new products in the bank.
- If the bank obtains calculations of risks and gains/losses as well as values of financial instruments and other items with market risks from external parties, DFSA will evaluate whether the bank ensures that the external parties perform the task appropriately.
- DFSA assesses whether the bank regularly evaluates whether the prices, parameters etc. received from, and applied by, the external parties are correct and thereby ensure a fair presentation of the risks of the undertaking as well as correctly calculating items presented in the financial statements.
- DFSA’s assessment of the bank is made in part on an interview based approach with relevant staff in the bank’s entities.
- According to the updating of the EO-MC, cf. EC1, the bank may benchmark itself to comparable banks; the benchmarking should be reported to the BoD at least once a year.
- The BoD should on this basis evaluate if the bank is a “well run bank” compared with other comparable banks.
- Improvement opportunities noted: ensuring that liquidity and other risks are factored in internal pricing of financial products, and performance measurements; and clarifying the rules/guidance on independence of the units doing validation models.

### Additional criteria (AC1) — reputational and strategic risk
- The supervisor requires banks to have appropriate policies and processes for assessing other material risks not directly addressed in the subsequent Principles, such as reputational and strategic risks.
- Description and findings re AC1:
  - DFSA requires banks to have appropriate policies and processes for assessing reputational and strategic risks pursuant to Executive Order on Capital Adequacy no. 1399 of 16 December 2011, Annex 1 paragraphs 72, 73 and 83.
  - During onsite inspections DFSA evaluates, based on requested material and interviews with relevant staff in different entities, whether the bank has appropriate policies and processes for assessing reputational and strategic risks.
  - As part of the requested material DFSA asks the bank to evaluate itself regarding strategic and reputational risk, in a template; DFSA then makes an assessment based upon the bank’s self-evaluation.
- Assessment of Principle 15: Largely compliant
- Comments:
  - DFSA has a generally well designed program for risk management, with detailed requirements in regulation and good review during inspections (though frequency is sometimes suboptimal).
  - Program strongest in credit risk and least developed in operational risk.
  - Framework improvements in train: updating EO-MC to require BoD concurrence for CRO dismissal, adding further requirements for SIFIs, applying requirements to financial holding companies.

### Capital adequacy framework (Principle 16) — overview and legal implementation
- Principle 16: The supervisor sets prudent and appropriate capital adequacy requirements for banks that reflect the risks undertaken by a bank in its market and macroeconomic context; for internationally active banks, capital requirements are not less than the applicable Basel standards.
- EC1 — laws, definitions and thresholds:
  - Denmark is subject to the legislative framework implementing Basel III in the EU, adopted in June 2013 (CRR and CRD IV).
  - Denmark had not yet aligned its supervisory framework with the implementation of EU-Basel III at the time of the mission; the Bill to implement CRD IV was put before the Danish Parliament by the MoBG on 7 February 2014 with a proposed date of entry into force of March 31, 2014.
  - Delay in transposition meant implementation could not be completed by the transposition deadline of 1 January 2014; DFSA continued to supervise banks based on the Basel II capital requirements until the Bill is passed, although preparations for implementation have been made.
  - Existing regulations impose requirements on capital, risk management and governance (FBA, section 71(1), no. 4; EO on Management and Control of Banks; FBA, section 124(1)).
  - Requirements on calculation of capital are set out in Article 93 section of the CRR, where general own funds shall be met at all times:
    - (a) CET1 4.5 percent;
    - (b) Tier 1 capital ratio of 6.0 percent; and
    - (c) A total capital ratio of 8 percent.
  - The CRR requirements to be implemented as of 1 April, 2014 place a greater proportion of the overall capital base to absorb loss on a going concern basis.
  - Article 93 of CRR sets the initial capital requirement on going concern. On top of the own funds requirements, the credit institution shall compute based on its risk exposure an ICAAP.
  - DFSA are mandated to define the qualifying components of capital, to cover the imposed capital charge (FBA, section 124(3)). Requirements on eligible capital elements are set in CRR Part Two; Article 26 defines CET1 items; Article 51/52 define Additional Tier 1; Article 62 defines Tier 2 items.
  - Capital instruments issued before end of 2011 and disqualified by CRR can under certain conditions be grandfathered according to CRR; DFSA will apply the full grandfathering available under the CRR to 2022.
  - Average subordinated debt as a percentage of total capital for banks in Groups 1-4 is approximately 23.7 percent.
  - Section 124(3) provides DFSA the ability to impose a specific Pillar 2 capital charge; DFSA will generally require the capital charge to be covered with CET1 capital or capital with a corresponding absorption capacity when necessary. In practice Pillar II add-ons can be applied at each of the CET1, T1 and TC.
  - The Pillar 2 process occurs at least annually (approximately in the period between March to May) and uses inputs including supervisory activities, ICAAP, annual accounts, external auditor report, DFSA stress testing, and supervisory reporting; the SREP evaluates all inputs and places reliance upon ICAAP and the bank’s calculation of required capital.
  - In case of non-compliance with own funds requirements DFSA sets a time limit for the bank to meet the requirements, otherwise authorization can be withdrawn (section 225(1) FBA); DFSA can grant an extension (section 225(5)) and typically sets very short time limits (a matter of days depending on circumstances).
  - In case of non-compliance with imposed capital charge the credit institution shall take necessary measures within a time limit; sanctions may be imposed, e.g. restrictions on distributions, restrictions on (new) lending, reporting requirements, etc. (FBA, section 225(2)).
- CRD IV buffers and timing:
  - CRD IV buffer types:
    - Capital conservation buffer, section 125a(3)
    - Countercyclical capital buffer, section 125a(4)
    - G-SIFI-buffer, section 125a(5)
    - Systemic risk buffer, section 125h
  - The capital conservation buffer must constitute 2.5 percent of risk-weighted exposures out of CET1 capital; it will be phased in gradually from 2016 to 2019.
  - The countercyclical capital buffer can be set by national authorities up to 2.5 percent extra CET1 capital; in extraordinary situations it can be higher than 2.5 percent. In Denmark the MoBG will be able to trigger and set the level based on total lending trends as a percentage of GDP and other factors; triggering can be based on a recommendation from the Systemic Risk Council. The framework will be phased in gradually from 2015 to 2019. Buffer rates set in other countries where Danish institutions have exposures will be recognized up to 2.5 percent from 2015.
  - None of the Danish financial groups are identified as global SIFIs; Nordea Bank Danmark is an affiliate of Swedish Nordea Group which is identified as a global SIFI, but the G-SIFI-buffer is not relevant in Denmark.
  - Denmark has implemented a framework for domestic SIFIs; differentiated SIFI buffers comprising CET1 are imposed on Danish SIFIs, determined on basis of systemic importance and a quantitative SIFI scale. The requirement constitutes 1 to 3 percent of risk weighted exposures and will be phased in gradually from 2015 to 2019.
  - SIFI identification criteria (must exceed one of the following for two consecutive years):
    - The size of the balance sheet is equivalent to more than 6.5 percent of Denmark’s GDP.
    - Loans comprise more than 5 percent of total sector loans.
    - Deposits comprise more than 5 percent of total sector deposits.
  - SIFIs will be identified by DFSA once a year in June on the basis of the most recent financial statements. The first identification will take place in June 2014. New SIFIs must meet SIFI requirements at the end of the following year (at least 18 months after identification).
  - At present seven credit institutions (five banks and 2 MCIs) meet the criteria for Danish SIFIs.
  - From 2019, a combined capital requirement of at least 11.5–13.5 percent of risk-weighted exposures will be required of Danish SIFIs, depending on the individual institution’s systemic importance. The capital requirement will comprise both the pillar I requirement of 8 percent and a combined buffer requirement (capital conservation buffer of 2.5 percent and unique SIFI capital requirement of 1–3 percent).
  - The final level of the Danish SIFI capital requirement will be assessed no later than 2017 and adjusted to be on a par with comparable European countries (Sweden, Norway, the United Kingdom, Germany, France, the Netherlands, Austria and Switzerland) if necessary.
  - In case of non-compliance with the buffer requirements sanctions will be imposed, e.g. restrictions on distributions and submission of a capital conservation plan, section 125b.

### EC2 and EC3 — alignment with Basel standards and Pillar 2 powers
- EC2:
  - A delay in the Parliamentary process to transpose the CRR into legislation meant that at the time of the mission the application of the Basel III capital requirements had not strictly met the implementation schedule as prescribed by Basel, i.e. January 1, 2014 CET1 4 percent; T1 5.5 percent and 8 percent TC.
  - CRR/CRD rules are based on Basel standards and apply to all banks; definitions of capital, risk coverage, method of calculation and thresholds are defined in the CRR/CRD framework.
- EC3:
  - DFSA has the power to impose a Pillar 2 capital charge higher than the general own funds requirements (FBA, section 124(3)). The Pillar 2 process is well established and typically performed annually via SREP, with ICAAP as a key input.
  - DFSA evaluates ICAAPs of all credit institutions annually (except the smallest banks, where frequency is commensurate with size and risk profile). ICAAP reviews are prioritized according to DFSA’s rating (high/medium/low), which combines quantitative offsite reporting and qualitative professional judgment.
  - ICAAP review covers assumptions, components, methodology, coverage and outcome across six risk areas: earnings; growth in loans; credit risks (including credit concentration risk); market risks; liquidity risks; and operational risks. Stress-testing is part of the review.
  - DFSA has benchmarks for higher-risk activities (The Supervisory Diamond for banks, introduced June 2010); DFSA will conduct individual assessment of public risk information when banks exceed limit values. DFSA is working on a Supervisory Diamond for Mortgage credit institutions.
  - If DFSA assesses that a bank’s capital does not adequately reflect its overall risk profile, four actions can be applied depending upon circumstances (the source text indicates actions follow but does not list them in the provided excerpt).

*Source: _cr14352 - annex 1, # 7, and annex 4, # 11 in the EO.*

### 1. Impose a capital charge that is higher than the general own funds requirements,

### 1. Impose a capital charge that is higher than the general own funds requirements

### Supervisory powers and remedial measures
- DFSA powers under FBA:
  - Impose a capital charge that is higher than the general own funds requirements (FBA, section 124(3)).
  - Require the credit institution to apply a specific provisioning policy or treatment of assets in terms of own funds requirements (FBA, section 124(5)).
  - Require the credit institution to improve its internal control and risk management frameworks (FBA, section 71 (1)).
  - Order that the credit institution take the measures necessary within a time limit specified by DFSA if:
    - (1) the financial position of the undertaking has deteriorated to such a degree that the interests of the depositors, the bond owners or other investors are at risk; or
    - (2) there is a significant risk that the financial position of the undertaking will develop so that the undertaking will lose its license due to internal or external circumstances (FBA, section 350(1)).
- Scope of capital charge:
  - Can be imposed on a single credit institution or on a group of institutions with a similar risk profile to cover a specific category of risks (FBA, section 124(4)).
  - The ICAAP, and the resulting capital charge, includes all material risks, on-balance or off-balance, and all relevant transactions, including securitization transactions.

### ICAAP, SREP, and supervisory interaction
- ICAAP role:
  - Integrated component of the annual SREP; demonstrates challenge to banks’ assumptions and required capital.
  - For Group 1 banks, ICAAP results are a key input into the annual meeting with BOM (often called a Summit Meeting) where the DFSA discusses the bank’s business model, strategy, risk profile and financial adequacy in detail.
- Leverage ratio implementation:
  - DFSA will apply the Leverage ratio as per the BIII timeline with introduction of a pillar 2 requirement as of April 2014 and possibly a pillar 1 requirement in 2017, if the CRR introduces such a requirement.
  - The leverage ratio will be an explicit non risk-based measure of leverage.

### EC4 — capital requirements reflect risk profile and systemic importance
- Findings:
  - The prescribed capital requirements reflect the risk profile and systemic importance of banks in the context of the markets and macroeconomic conditions in which they operate and constrain the build-up of leverage.
  - Laws and regulations in a particular jurisdiction may set higher overall capital adequacy standards than the applicable Basel requirements.
  - The ICAAP is the main tool employed by the DFSA to ensure a bank makes an assessment of capital adequacy which takes into consideration macroeconomic circumstances and requires stress testing for forward looking analysis.
  - Explicit SIFI requirements will be implemented in the near term which will adopt a bespoke approach to assigning capital for this cohort. Currently, all of the largest banks are supervised as a portfolio in Banking Division 1.

### EC5 — use of banks’ internal assessments (models) as inputs to regulatory capital
- Supervisor approval conditions (if internal assessments are approved for regulatory use):
  - (a) such assessments adhere to rigorous qualifying standards;
  - (b) any cessation of such use, or any material modification of the bank’s processes and models for producing such internal assessments, are subject to the approval of the supervisor;
  - (c) the supervisor has the capacity to evaluate a bank’s internal assessment process in order to determine that the relevant qualifying standards are met and that the bank’s internal assessments can be relied upon as a reasonable reflection of the risks undertaken;
  - (d) the supervisor has the power to impose conditions on its approvals if the supervisor considers it prudent to do so;
  - (e) if a bank does not continue to meet the qualifying standards or the conditions imposed by the supervisor on an ongoing basis, the supervisor has the power to revoke its approval.
- DFSA arrangements and practices:
  - DFSA approves use of banks’ internal assessments prior to implementation and imposes conditions.
  - IRB model accreditation:
    - Dedicated IRB team of 6 full-time employees, most with extensive IRB experience.
    - Seven banks accredited to use the IRB approach.
    - Validation requirements set out in the EO on Capital Adequacy, Annex 8, paragraphs 223–227 (based on Article 185 in the CRR).
    - Structured approval process outlined in EO Capital Adequacy, Annex 21; material changes to IRB systems or scope require DFSA approval prior to implementation (aligned with CRR article 143 (3)).
    - DFSA attentive that RWAs do not decrease significantly unless justified by actual reductions in risk; significant reductions should not occur due to purely technical changes.
    - Ongoing monitoring includes benchmarking, Pillar 2 add-ons to address model uncertainty, annual IRB team meetings with banks, IRB inspections, and presentation of inspection conclusions to BoD and management.
  - VaR models:
    - DFSA team of 2 full-time employees with experience in VaR models.
    - Three banks approved to use internal market risk models.
  - Frequency of IRB inspections is not prescribed but determined case by case.

### EC6 — forward-looking capital management and stress testing
- Supervisor powers:
  - Require banks to adopt a forward-looking approach to capital management (including the conduct of appropriate stress testing).
  - Require banks to:
    - (a) set capital levels and manage available capital in anticipation of possible events or changes in market conditions that could have an adverse effect; and
    - (b) have feasible contingency arrangements to maintain or strengthen capital positions in times of stress, as appropriate in light of the risk profile and systemic importance of the bank.
- DFSA requirements and practices:
  - Banks required to perform stress testing as part of the ICAAP assessment (EO on Capital, Annex 1, paragraph 20).
  - ICAAP requirements described in Annex 1 of EO on Capital Adequacy and the guideline on the ICAAP framework and internal capital charge calculation; Annex 1 sets requirements on process, methodology, relevant risks included, reassessment, monitoring, reporting and documentation.
  - Assessment must be ongoing and forward looking; supervisors challenge assumptions and key inputs into stress tests; guidance is that the approach should be fair and prudent.
  - Semi-annual stress testing exercises by the Banking Analysis Division assessing capital adequacy under three scenarios: base case, downturn and worst case; results shared with supervisors as input into discussion with BOM.
  - Evidence suggests stress testing process works well in practice; supervisors use stress test input in annual risk assessment where the bank is slotted into one of five ratings.
  - IRB banks:
    - Enhanced stress testing requirements; required to perform annual stress tests including a base case and more severe recession scenarios.
    - Scenarios required for a two to three year time horizon.
    - BOD and BOM required to consider both inputs and outcomes to assess adequacy of capital.
    - IRB banks must perform a reverse stress test (Guidelines 9.3) to identify material risks that may trigger a stressed loss; objective to focus on most important risks severe enough to cause severe stress in capital adequacy.
  - ICAAP expectations:
    - Credit institutions should attach more importance to future expectations and less on historical experience (Annex 1, no. 16).
    - Assessment must include relevant stress tests of the assumptions; stress tests must include unlikely, but not unthinkable events.
    - Credit institution must have a plan for raising capital and a timeframe (Annex 1, no. 13), including:
      - General principles for capital planning;
      - Who is responsible for the process;
      - How the company expects to comply with capital requirements in the future;
      - An overall contingency plan, including specific plans for raising new capital, limitations of activities or mitigation of risks.
    - Credit institutions must at least annually report the ICAAP and the capital plan to DFSA.
    - Bespoke stress testing requirements for MCIs reflecting their individual risk profile; MCIs must specifically consider increased risk connected to parts of the loan portfolio where borrowers are exposed to an interest-rate risk which could impose increased credit risk (Guidelines part 10).

### AC1 and AC2 — consistency and intra-group capital distribution
- AC1:
  - For non-internationally active banks, capital requirements (definition of capital, risk coverage, method of calculation, scope of application and capital required) are broadly consistent with principles of applicable Basel standards relevant to internationally active banks.
  - DFSA will apply capital rules consistently across all banks; CRR/CRD rules from April 1, 2014.
- AC2:
  - Supervisor requires adequate distribution of capital within different entities of a banking group according to allocation of risks.
  - Unregulated members within a banking group are captured by capital rules (CRR Articles 11–24).
  - Rules place minimum capital adequacy requirements on parent company and require parent and subsidiaries to implement arrangements to ensure proper consolidation; groups regulated in Danish law (section 170–176 of the FBA).
  - Sections 171–174 of the FBA: individual solvency need must be calculated on consolidated basis and DFSA may lay down a higher individual solvency requirement than calculated by the group. Capital of a financial group is measured on a consolidated level; insurance companies are not included in the consolidation.
  - Alternative deduction permission under article 49 of CRR allows deduction of a proportion of the capital requirement of a subsidiary or associated insurance company, with specific reduction calculations described in the FBA clauses reproduced in the source.

### Assessment of Principle 16 (capital adequacy)
- Assessment: Compliant
- Comments:
  - The supervisor sets prudent and appropriate capital adequacy requirements reflecting individual bank risk and broader economic conditions.
  - Pillar 2 arrangements are well developed and applied through annual ICAAP including forward looking stress testing.
  - Emphasis on quality of capital to absorb losses.
  - DFSA applies capital rules consistently across all banks.

### Credit risk supervision (Principle 17) — EC1 and EC2 findings
- EC1 (bank-wide credit risk processes):
  - Laws, regulations or supervisor require banks to have appropriate credit risk management processes for a comprehensive bank-wide view consistent with risk appetite, profile, systemic importance and capital strength, taking into account market and macroeconomic conditions.
  - Findings:
    - Annex 1 to the EO-MC requires banks to have appropriate procedures for monitoring credit risks and procedures for risk management in the credit area.
    - Supervision of compliance with Annex 1 is primarily performed during onsite credit inspections.
    - Onsite credit inspections review extensive samples of credit files; coverage of loan portfolios of smaller banks sometimes above 50%; samples are extensive and focused on potential problem areas.
    - Supervisors review credit policy, procedures for individual and collective impairment, valuation of collateral, handling weak exposures, risk classification, etc., and assess compliance with bank credit policy.
    - Onsite inspections include meetings with board of management, credit department management, and IRB staff in major banks.
    - For smaller and medium-sized banks, supervisors use compliance check forms covering credit risk.
    - Examinations of MCIs’ loan portfolios are performed regularly; largest firms subject to annual examinations focusing on quality of assets supporting covered bonds, appropriate loan-to-value ratios and valuations.
    - Due to high levels of interest-only mortgages and adjustable-rate mortgages DFSA increased focus on need for impairments related to these.
- EC2 (Board and senior management responsibilities):
  - Supervisor determines that Board approves and regularly reviews credit risk management strategy and significant policies and that senior management implements the Board-approved strategy.
  - Findings:
    - Annex 1 to EO-MC requires BoD to adopt a credit policy (section 5 (1) and no. 1–3).
    - Section 4(1) of the EO requires BoD to carry out an assessment of the risks of the bank when dictated by circumstances, and in any event no less than once a year.
    - Section 4(2) requires the assessment to be based on a report on the risks of the bank prepared by the board of management.
    - Annex 1, no. 6 requires the report which the BoM needs to prepare pursuant to (text continues in source).

*Source: _cr14352 - 1. Impose a capital charge that is higher than the general own funds requirements,*

### section 4(2) must contain an account of how the credit policy is reflected in the credit risks

### _cr14352 - section 4(2) must contain an account of how the credit policy is reflected in the credit risks

### Board reporting and EO‑MC revisions
- Section 4(2) must contain an account of how the credit policy is reflected in the credit risks accepted by the bank.
- The report to the BoM must:
  - Make a reasoned assessment of whether the credit risks of the bank have been calculated fully and prudently, including whether the methods applied for classification are capable of ranking customers correctly.
  - Include a review of the internal controls carried out as well as the results from such review.
  - Include the results of the annual review of exposures not covered by the review by the BoD pursuant to Section 6(3), no. 3.
- The EO‑MC is under review. According to the draft revised Annex 1:
  - The BoD is to receive at least quarterly reporting on the credit area.
  - The reporting is to clarify compliance with the elements of the credit policy.
  - The reporting is to give the BoD a complete overview of the total credit risk and the developments in credit risk over time.
- Annex 1, no. 19: the chief risk officer shall ensure that appropriate management of credit risk takes place in the bank.

### Supervision, onsite inspections, and access to information
- Supervision of compliance with the EO‑MC is primarily performed during onsite credit inspections.
  - Supervisors read the protocol of the board of directors and the annexes to the protocol for the period since the last inspection to gain insight into board reporting and compliance with board limits.
  - Supervisors review samples of credit files to assess compliance with credit policies.
  - At onsite inspections supervisors hold a meeting with the chairman of the board of directors and the chairman of the audit committee; in major banks inspections are more frequent and the supervisors do not meet the chairman at every inspection.
- Supervisors have full access to all credit material and review samples of credit files together with relevant credit officers.
- The DFSA has ongoing offsite surveillance with regular stress tests; trends and risk identification across the banking sector and the macro economic outlook are taken into account.
- The supervisor requires that banks include their credit risk exposures into their stress testing programmes for risk management purposes.

### EC3 — Requirements for credit risk governance, policies and controls (enumerated items a–g)
- The supervisor requires, and regularly determines, that policies and processes establish an appropriate and properly controlled credit risk environment including:
  - (a) a well‑documented and effectively implemented strategy and sound policies and processes for assuming credit risk, without undue reliance on external credit assessments;
  - (b) well defined criteria and policies and processes for approving new exposures (including prudent underwriting standards) as well as for renewing and refinancing existing exposures, and identifying the appropriate approval authority for the size and complexity of the exposures;
  - (c) effective credit administration policies and processes, including continued analysis of a borrower’s ability and willingness to repay, monitoring of documentation, legal covenants, contractual requirements, collateral and other forms of credit risk mitigation; and an appropriate asset grading or classification system;
  - (d) effective information systems for accurate and timely identification, aggregation and reporting of credit risk exposures to the bank’s Board and senior management on an ongoing basis;
  - (e) prudent and appropriate credit limits, consistent with the bank’s risk appetite, risk profile and capital strength, which are understood by, and regularly communicated to, relevant staff;
  - (f) exception tracking and reporting processes that ensure prompt action at the appropriate level of the bank’s senior management or Board where necessary;
  - (g) Effective controls (including in respect of the quality, reliability and relevancy of data and in respect of validation procedures) around the use of models to identify and measure credit risk and set limits.
- Description and findings re EC3:
  - With the exception of item (f) on exception tracking, the enumerated areas are effectively covered within Annex 1 of the EO‑MC.
  - Mapping to Annex 1:
    - (a) Covered in Annex 1 to EO‑MC no. 10-18.
    - (b) Covered in Annex 1 to EO‑MC, no. 10; no 12(b); no. 5(a); no. 21.
    - (c) Covered in Annex 1 to EO‑MC, no. 10; no. 12; no. 16; no. 17; no. 18.
    - (d) Covered in Annex 1, no. 19-20 and no. 25.
    - (e) Covered in Annex 1, no. 2.
    - (f) Exception tracking is not explicitly covered.
    - (g) Covered in Annex 1, no. 16; no. 19(e); no. 22–24.
  - A review of these areas is part of the normal credit inspection program as confirmed by a sample review by the assessors.

### EC4 — Monitoring total indebtedness and risk factors
- The supervisor determines that banks have policies and processes to monitor total indebtedness of entities and risk factors that may result in default including significant unhedged foreign exchange risk.
- Description and findings re EC4:
  - Annex 1 to EO‑MC no. 10(a): procedures for approving exposures must make clear the basis for approval, including assessment of borrower’s creditworthiness.
  - Annex 1 to EO‑MC no. 12(c): procedures for regular monitoring of exposures shall contain principles for follow‑up of individual exposures, including review of accounting material, annual tax returns and budgets from borrowers.
  - The ability to determine total borrowings of a customer is largely dependent on the contents of the lending file.
  - Review of risk factors such as unhedged FX risk is a matter of examiner judgment; there are no specific requirements to include this in the assessment.

### EC5 — Arm’s length decisions and conflicts of interest
- The supervisor requires that banks make credit decisions free of conflicts of interest and on an arm’s length basis.
- Description and findings re EC5:
  - Section 78 of the FBA: banks may not establish a business exposure with or accept collateralization from members of the BoD and members of the BoM, or undertakings where those persons are members of the BoM or BoD, without BoD approval entered in the minute book.
  - These exposures shall be granted in accordance with the usual business terms of the bank and on terms based on market conditions.
  - External auditor must make a statement in the annual audit protocol on whether these requirements have been met.
  - Section 78 (3): the BoM and the BoD must monitor the appropriateness and status of the business exposures mentioned above.
  - Annex 1 to the EO‑MC no. 3(k): banks must comply with the rule of impartiality regarding employees.
  - In onsite credit inspections supervisors review all Section 78 exposures of the inspected bank.
  - Annex 1 Section 3 requires credit policies addressing decision basis, risk analyses before credit approval, and impartiality of employees involved in the credit process.

### EC6 — Board decision thresholds for major exposures
- The supervisor requires that major credit risk exposures exceeding a certain amount or percentage of the bank’s capital be decided by the Board or senior management; same for especially risky or non‑mainstream exposures.
- Description and findings re EC6:
  - EO‑MC section 6(3): the BoD may not delegate to the BoM authority which belongs to overall management duties of the BoD or which is otherwise of an unusual nature or of material significance for the bank.
  - Annex 1 requires guidelines from the BoD to the BoM on the size of exposures the BoM can approve without BoD participation.
  - Draft revised EO Annex 1: as a starting point exposures exceeding 2 percent of the banḱs core capital is to be approved by the BoD unless the BoD has prescribed a lower limit. Certain exceptions apply depending on the size of the bank and the complexity of the exposures.

### EC7 — Access to credit and investment portfolio information
- The supervisor has full access to information in the credit and investment portfolios and to bank officers involved in credit risk.
- Description and findings re EC7:
  - Supervisors have full access to all credit material and review credit file samples with relevant credit officers at onsite inspections.

### EC8 — Stress testing inclusion of credit exposures
- The supervisor requires banks to include their credit risk exposures into their stress testing programmes.
- Description and findings re EC8:
  - The DFSA conducts ongoing offsite surveillance and analysis based on reporting from banks, with regular stress tests performed.
  - Trends and risk identification across the banking sector and the macro economic outlook are taken into account.

### Assessment of Principle 17
- Assessment: Compliant
- Comment:
  - The DFSA gives very strong focus to credit risk, with much of its examination activity centered on it and extensive regulatory reporting covering it.
  - Particular emphasis is given to review (by the Board, by examiners, and by external auditors) of the largest credit exposures.
  - The DFSA is very hands‑on in its credit quality assessments.

### Principle 18 — Problem assets, provisions and reserves (EC1–EC6)
- Principle summary: The supervisor determines that banks have adequate policies and processes for early identification and management of problem assets, and maintenance of adequate provisions and reserves.
- EC1 — Policies and regular review:
  - DFSA requires banks to formulate policies and processes for identifying and managing problem assets (Annex 1 to EO‑MC).
  - EO‑FR sections 51–53: banks must regularly review problem assets at individual or portfolio level to assess objective evidence of impairment and assess the size of provisions.
  - Section 53 of the EO‑FR: DFSA issued guidance on writing down individual assets and groups of loans; DFSA issued explanatory guidelines in Annex 10 to the EO‑FR and is in the process of issuing additional guidelines on provisioning/increased charges for impairment.
  - DFSA approach: expeditious recognition of impairment; assessors caution against moving away from this approach.
  - DFSA has developed a matrix of 7,000 borrowers based on reports of largest exposures of the individual 90 banks to ensure consistency of classification where a borrower is among largest exposures of more than one bank; systematic approach could be broadened to include more observations.
- EC2 — Adequacy of grading, classification and provisioning:
  - DFSA regularly conducts onsite inspections to ensure compliance with regulation on loan classification and provisioning.
  - After inspection DFSA publicly discloses a report with major conclusions.
  - DFSA confirmed no specific standards for provisions by classification but shared regulatory requirements to regularly review poorer rated, large credits for additional provisions.
- EC3 — Off‑balance sheet exposures:
  - DFSA reviews during onsite inspections that banks take into account off‑balance sheet exposures when reviewing classification and provisioning.
- EC4 — Timely and realistic provisions and write‑offs:
  - DFSA issued explanatory guidelines in Annex 10 to the EO‑FR.
  - DFSA regularly conducts onsite inspections to determine if banks have appropriate policies and processes to ensure timely provisions and write‑offs reflecting repayment and recovery expectations, taking market and macroeconomic conditions into account.
  - DFSA loan sampling process: for small banks, coverage of approximately 50 percent of the portfolio would be expected; for larger banks, a smaller percentage would be covered but sampling would still be extensive.
  - DFSA publicly discloses a report with major conclusions after inspection.
- EC5 — Early identification, oversight, collection and testing for circumvention:
  - Annex 1 to EO‑MC sections 12 and 19 require policies and processes for early identification of deteriorating assets, ongoing oversight of problem assets, and for collecting past due obligations; banks must assess resources and expertise for adequate oversight and management of credit risk.
  - Banks are expected to array credits in buckets according to days in arrears by 30, 60, and 90 days.
  - Specialized mortgage credit institutions submit quarterly information on mortgage loans in arrears by more than 15, 105, 195 and 380 days; the supervisor benchmarks and takes appropriate follow‑up action.
  - DFSA conducts onsite inspections to test banks’ treatment of assets and identify material circumvention of classification and provisioning standards; external auditors are expected to review for this possibility.
  - DFSA publicly discloses a report with major conclusions after inspection.
- EC6 — Access to classification and provisioning documentation:
  - Extensive information on credit quality is regularly submitted to the DFSA.
  - Annex 1 EO‑MC section 12 requires banks have policies ensuring ongoing oversight of credit risk, including policies on relevant economic information on clients and clients’ assets posted as collateral.

*Source: _cr14352 - section 4(2) must contain an account of how the credit policy is reflected in the credit risks*

### Section 2 and 29 in Annex 10 to the EO-FR requires that banks have adequate

### _cr14352 - Section 2 and 29 in Annex 10 to the EO-FR requires that banks have adequate

### Asset classification, provisioning, and collateral valuation (EC7–EC12)
- EC7: Supervisor assesses whether asset classification and provisioning are adequate for prudential purposes and can require banks to:
  - adjust classifications of individual assets;
  - increase levels of provisioning, reserves or capital;
  - impose other remedial measures.
- Findings:
  - Supervisor reviews provisions/impairment losses during onsite inspections and may require adjustments under the authority of Section 344 of the FBA.
  - If provisions are deemed inadequate relative to existing or anticipated deterioration in asset quality, the supervisor may act as above.
- EC8: Supervisor requires banks to have mechanisms to regularly assess value of risk mitigants (guarantees, credit derivatives, collateral).
  - Collateral valuation reflects net realizable value, taking into account prevailing market conditions.
- Findings:
  - Value of collateral is taken into account when calculating impairment losses at conservative estimates of fair value less expenses to take over and realize the collateral, under section 52(5) of the EO-FR.
  - Specialized mortgage credit institutions submit information each half and full year on loan-to-value (LTV) for mortgage portfolios; LTV used for expected loss reflection and to calculate additional collateral for covered bonds.
  - Specialized mortgage banks submit quarterly information to the DFSA on additional collateral posted and capacity to supply extra collateral; DFSA benchmarks these banks and reviews policies/processes during onsite inspections.
- EC9: Criteria for identifying problem assets and for reclassification as performing are established.
  - Findings:
    - Criteria for objective evidence of impairment are taken from IAS 39 and prescribed in section 52(2) of EO-FR.
    - Under section 54(1) any impairment loss shall be reversed when new circumstances or information show it is no longer necessary, though EO provides no specific reclassification criteria.
- EC10: Board receives timely and appropriate information on asset portfolio condition (classification, provisions, major problem assets).
  - Findings:
    - Under section 4 of the EO-MC, BoD must assess bank risk at least once a year based on a report by the BoM; BoD must assess whether credit risks are calculated fully and prudently, including classification methods (Annex 1 to EO-MC).
    - Section 6 of Appendix I requires an annual review of exposures by BoM to BoD.
    - For banks using internal models (IRB), BoD regularly receives analysis of internal models (section 119 in Annex 8 to the Executive Order on Capital Adequacy); reporting requirements similar to Article 189 of the CRR.
    - DFSA conducts onsite inspections and reviews BoD minutes to ensure Board information flow.
    - Draft revisions to EO-MC would require BoD to make assessments based on the bank’s chief risk officer report and receive quarterly credit area reports under section 29 in Annex 1 to the revised EO-MC.
- EC11: Valuation, classification and provisioning are conducted on an individual item basis for significant exposures.
  - Findings:
    - Banks must assess objective evidence of impairment at every balance sheet date; assessment shall be made individually as a minimum for all loans of significant size, with “significant size” determined taking into account bank size (sections 51 and 52(1) of EO-FR).
- EC12: Supervisor regularly assesses trends and concentrations in risk across the banking sector and considers adequacy of provisions/reserves.
  - Findings:
    - DFSA conducts ongoing offsite surveillance and analysis based on bank reporting; takes into account sector trends and macroeconomic outlook.
    - Adequacy of provisions and capital reservations is addressed through onsite credit file reviews.

- Assessment of Principle 18: Compliant.
- Comments:
  - DFSA has a strong and conservative approach to impairment and provisioning.
  - Asset quality reports are made regularly; annual review of exposures required for BoD.
  - Data base of larger exposures used to check rating consistency could be broadened.
  - Criteria for reversals of write-downs should be detailed in the relevant EO.

### Concentration risk and large exposure limits (Principle 19; EC1–EC7; AC1)
- Principle 19 summary: Supervisor ensures banks have policies/processes to identify, measure, evaluate, monitor, report and control/mitigate concentrations of risk; supervisors set prudential limits for single counterparties or groups of connected counterparties.
- EC1: Banks required to have policies/processes for bank-wide view of concentration risks, capturing on- and off-balance sheet items.
  - Findings:
    - EO on Management and Control and EO on Capital Coverage require policies/processes for major risks including credit concentration risk, market concentration risk, and liquidity/funding concentration.
    - Annex 1 to EO on Large Exposures requires bespoke policies to identify/manage large exposures and take into account sector and geographical concentration risks.
    - Danish regulation has transposed CEBS’s guidelines of 11 December 2009; future regulation aligned with CRR art. 4 (39). EO interprets economic interconnection (Annex 1—Mutually Connected Clients paragraphs 1–17).
- EC2: Information systems must identify and aggregate timely exposures creating concentrations/large exposures.
  - Findings:
    - DFSA tests and confirms banks can manage large exposures through onsite inspections and offsite surveillance.
    - Banks report exposures per FBA (s.145) and EO on Large Exposures; exposures in banking and trading books are aggregated.
    - Quarterly reporting captures concentration by geography and industrial sector for commercial exposures.
    - Supervisory Diamond includes an upper limit of 125 percent the capital base for sum of large exposures; compliance reported quarterly; breaches prompt corrective action and public disclosure on DFSA website.
    - Onsite exams emphasize identification of connected counterparties and include samples of large exposures (exposures > 10 percent of capital and the largest loans).
    - EO on Large Exposures includes detailed guidance on identifying connected counterparties (annex 1).
- EC3: Bank risk management must establish thresholds for acceptable concentrations reflecting risk appetite/profile/capital; material concentrations must be reported to Board.
  - Findings:
    - Concentration risk procedures integrated into management and aligned with capital adequacy (EO Management and Control).
    - ICAAP and SREP require banks to assess capital needs for concentration risk and adjust capital as necessary.
    - Current regulation based on section 145 in FBA; future CRR art. 395 (1) similar: exposure to a client or group shall not exceed 25 percent of eligible capital, with special provisions where client is an institution or includes institutions and the EUR 150 million threshold.
    - DFSA requires reporting of exposures ≥ 10 percent of eligible capital.
    - Supervisory Diamond benchmark: sum of large exposures defined as exposures after deductions that exceed 10 percent of capital base; sum benchmark of 125 percent of capital base encourages reduction of aggregate large exposures.
    - Exceptions to large exposure calculation allowed under FBA (s.145) and EO on Large Exposures; examples:
      - settlement exposure exemption;
      - certain secured parts deducted (section 5 aligned with CRR article 400);
      - DFSA may permit exemptions provided amount is deducted from core capital;
      - banks allowed larger exposures to banks, mortgage credit institutions or investment funds up to DKK 1 billion or maximum 100 percent of capital base.
    - Historical: limit on sum of large exposures of 800 percent of capital base was phased out (repealed with effect from January 1, 2011).
- EC4: Supervisor regularly obtains information enabling review of sectoral, geographical and currency concentrations.
  - Findings:
    - Banks report single-name and sector concentration quarterly; concentration risks considered in ICAAP and SREP.
    - DFSA reports requirement covers exposures ≥ 10 percent of eligible capital (s.145(4)).
    - SA does not address frequency of supervisory reporting of concentration risks and some sectoral/geographic/currency dimensions.
- EC5: Definition and discretion to define “group of connected counterparties”.
  - Findings:
    - Current DFSA definition based on CEBS guidelines (Annex 1 to EO on Large Exposures), consistent with future CRR art. 4 (39).
    - Connected customers defined where control exists or economic interconnection implies single risk.
    - DFSA has a tradition of relatively strict decision-making; examples provided of DFSA exercising powers on LE rules after onsite inspections.
- EC6: Prudent requirements to control large credit exposures; senior management monitors limits and they are not exceeded.
  - Findings:
    - Banks must monitor single-name, sector, geographic concentration, collateral volatility; simple sensitivity analysis in ICAAP required.
    - Supervisory actions and Pillar II capital add-ons enforced when benchmarks breached.
    - EO on Capital Adequacy and EO on Management and Control require Boards to establish and review limits; DFSA performs onsite and offsite analyses.
    - Long Form Audit Report must include auditors’ assessment of 10 largest exposures and all exposures > 10 percent of capital base, reported annually to DFSA.
    - Onsite periodic inspections assess quality of credit risk management.
- EC7: Banks must include impact of significant risk concentrations into stress testing.
  - Findings:
    - All banks required to consider effect of risk concentrations in business conduct.
    - Smaller banks perform simpler impact studies; large banks and most mortgage institutions conduct regular stress tests including concentration risks.
    - DFSA performs stress tests twice per year at six monthly intervals; banks perform bottom-up stress test annually. Results are analyzed and followed up where risks are not managed sufficiently.

- Additional criteria AC1:
  - (a) Ten percent or more of a bank’s capital is defined as a large exposure; and (b) Twenty-five percent of a bank’s capital is the limit for an individual large exposure to a private sector nonbank counterparty or group of connected counterparties.
  - Findings:
    - FBA does not define “large exposure” per se, but banks must report exposures above 10 percent of the capital base (s.145(4) FBA) and a 25 percent threshold is applied as the upper limit (s.145).
    - Limited exemptions exist with time-based exit strategies; supervisor monitors closely where deviations permitted.
    - Examples exist (e.g., mergers) where permissions to exceed 25 percent were granted with frequent reporting and required reduction plans.

- Assessment of Principle 19: Largely Compliant.
- Comments:
  - Notification requirement for large exposures should be tightened (DFSA currently notified at end of quarter).
  - Banks generally have risk appetite for large exposures lower than 25 percent limit; Supervisory Diamond enforces aggregate concentration management.
  - DFSA sets prudential limits and provides detailed guidance on determining connected counterparties.

### Transactions with related parties (Principle 20; EC1 start)
- EC1: Definition and supervisory powers regarding “related parties”.
  - Findings:
    - FBA provides detailed prescribed treatment of related party exposures for BOD, BOM and intragroup exposures but does not provide an exhaustive definition of related parties.
    - Treatment of exposures to related parties not conforming to the three groups listed in FBA (Board, management, intragroup) is uncertain; main exception is bank’s main shareholders—FBA lacks explicit provisions for treatment of exposures to minor shareholders.
    - Board and board-related parties:
      - FBA sections 78(1) and 78(4) limit transactions with Board members and persons related to BoD/BOM (marriage, cohabitation ≥ two years, direct line kinship, siblings) and undertakings where such persons are members of BOM.
      - Section 78(1) prohibits financial undertakings from establishing business exposures with or accepting collateral from BoD/BOM members or related undertakings without BoD approval recorded in minutes.
      - Financial information must be available about groups mentioned in sections 78(1) and (4) as board of directors must monitor these exposures.

*Italic source: Excerpt from the IMF Financial Sector Assessment related material (content unit provided).*

### section 78(3) of the Financial Business Act. This does not apply, however, to fully secured

### section 78(3) of the Financial Business Act. This does not apply, however, to fully secured exposures or exposures of entirely insignificant size.

### Management: board, BOM, and employee conflict identification
- Section 78(2) requires transactions between the financial undertaking (bank) and the BOD and BOM to be based on commercial terms/market conditions.
- Section 80(3) stipulates that “the board of directors shall decide which employees have a significant risk of conflicts between the interests of the employee and those of the financial undertaking”.
- The FBA requires a bank to identify employees with potential conflicts of interest so that appropriate policies and processes can be implemented to mitigate potential risks.

### Intragroup transactions: limits, permissions, and oversight
- Sections 179 to 181 set detailed limitations for intra-group transactions addressing risks in related party exposures.
- “a financial undertaking may not have an exposure with undertakings or persons who exercise direct or indirect controlling influence in the financial undertaking or who are controlled by undertakings or persons with such influence.”
- Lending provisions add additional requirements to the 25 percent limit.
- Permission for intra-group exposures is based on the updated assessment by the FSA of the risk profile of the financial undertaking and group in question and granted on basis of offsite reports typically for one year’s duration.
- Section 182(2) states that a bank may not have an exposure with undertakings or persons who exercise direct or indirect controlling influence in the bank, or who are controlled by undertakings or persons with such an influence.
- DFSA may allow exemptions from this subsection in limited cases but where transactions are at an arm’s length.
- The EO on Intra-Group Transactions (section 3 and 4) requires intra-group transactions to be entered into on the basis of written agreements and on market-based terms and conditions; where there is no actual market, reasonable estimates shall be applied.

### EC2 — Related-party transactions not on more favorable terms
- Requirement: Laws, regulations or the supervisor require that transactions with related parties are not undertaken on more favorable terms (e.g. in credit assessment, tenor, interest rates, fees, amortization schedules, requirement for collateral) than corresponding transactions with non-related counterparties.
- Note: Footnote 52 — “An exception may be appropriate for beneficial terms that are part of overall remuneration packages (e.g. staff receiving credit at favorable rates).”

Description and findings re EC2
- Section 78(1) of the FBA: without the approval of the board of directors, which shall be entered into the minute book of the board of directors, financial undertakings may not establish a business exposure with or accept collateralisation from members of the board of directors and members of the board of management of the bank, or undertakings where the persons specified are members of the board of management or members of the board of directors.
- The FBA strictly requires transactions between Board members and BOM on an arms-length basis/market conditions (FBA s.78 (2)).
- The EO on Intra-Group Transactions regulates the terms of intra-group transactions (section 3 and 4) that state that intra-group transactions shall be entered into on the basis of written agreements and on market-based terms and conditions. Where there is no actual market, reasonable estimates shall be applied.

### EC3 — Board approval and exclusion for related-party transactions and write-offs
- Requirement: The supervisor requires that transactions with related parties and the write-off of related-party exposures exceeding specified amounts or otherwise posing special risks are subject to prior approval by the bank’s Board. The supervisor requires that Board members with conflicts of interest are excluded from the approval process of granting and managing related party transactions.

Description and findings re EC3
- There are no specific requirements in relation to the write-off of related party transactions.
- The FBA restricts exposures and transactions between the BOM and the financial undertaking.
- The EO on Management and Control emphasizes the role of the board in relation to oversight of the write off process and boards are expected to have formal procedures.

### EC4 — Preventing beneficiaries from participating in approval/management
- Requirement: The supervisor determines that banks have policies and processes to prevent persons benefiting from the transaction and/or persons related to such a person from being part of the process of granting and managing the transaction.

Description and findings re EC4
- The scope of the FBA provisions associated to related party transactions do not strictly require banks have policies and processes to prevent persons benefiting from a transactions with related persons to be excluded from approving or managing a transaction i.e. a credit officer granting a loan.

*Source: _cr14352 - section 78(3) of the Financial Business Act. This does not apply, however, to fully secured*

### Section 78 and 80 in the FBA directly apply to restrict malfeasance. Section 78(1) of the

### _cr14352 - Section 78 and 80 in the FBA directly apply to restrict malfeasance. Section 78(1) of the

### Related-party exposures, governance, and supervision (EC5, EC6, EC7, Assessment of Principle 20)
- Legal and governance provisions
  - Section 78(1) of the FBA states that without the approval of the board of directors, which shall be entered into the minute book of the BOD, financial undertakings may not establish a business exposure with or accept collateralization from related parties.
  - Financial information must be available about the group of persons mentioned in section 78(1) and (4) of the FBA, since the board of directors is required to monitor these exposures in particular, cf. section 78(3) of the FBA.
  - Exemptions: fully secured exposures or exposures of entirely insignificant size are not subject to the monitoring requirement.
  - FBA section 182(1) states that a financial undertaking may not, without prior approval from FBA, have exposures within the same group except for exposures with subsidiaries.
  - EO on Intragroup Exposures: in normal circumstances if the total intra-group weighted exposures are below the capital base minus 75 percent of the capital requirement and if the total intra-group exposures un-weighted are below the capital base, approval can be expected; in some cases no approval will be given and in other rare cases amounts exceeding these limits have been granted.
  - Permission to intra-group exposures is granted on basis of offsite reports typically for one year’s duration.
  - DFSA guidelines link permitted intra-group exposures to the updated assessment by the DFSA of the risk profile of the financial undertaking and group in question.
  - The EO on Intra-Group Transactions requires intra-group transactions to be entered into on the basis of written agreements and on market-based terms and conditions; where there is no actual market, reasoned estimates shall be applied.

- Supervisory practices and controls
  - The DFSA includes related party exposures in their onsite supervision activities to assess whether appropriate risk management has been applied to these exposures.
  - When reviewing board papers the supervisor will also test to determine whether the board has approved the exposures.
  - In sampling related party exposures, supervisors will assess the terms, interest rate and approval process to assess that the terms and conditions of the exposure align with commercial conditions.
  - During onsite inspections, DFSA examine whether the bank adheres to the relevant sections in the FBA by interviewing the board of management and by examination of the largest intra-group transactions and the intra-group lending portfolio.
  - The external auditor of the financial undertaking will also have to report on this matter annually attesting to the adequacy of policies and whether the policies have been applied.
  - Supervisors perform an annual assessment of the audit book and will meet with the external auditor in preparation for onsite reviews where related party exposures will be discussed.
  - Financial undertakings are obliged to record related party exposures.

- Limitations in the legal framework and supervisory data
  - There are no powers in the FBA to deduct related party transactions from capital when assessing capital adequacy.
  - In relation to exposures with related parties outside of intragroup exposures, the provisions within the FBA do not permit a capital adjustment.
  - Regulations for related party transactions include only BOD, BOM and intra-group transactions; this narrow definition does not cover the broader definition of related parties contemplated by this CP (e.g., does not extend to minority shareholders and key risk takers such as credit officers).
  - From a routine supervision perspective, ongoing surveillance is not sufficiently frequent. Offsite reporting for related party exposures is not reported on a quarterly basis to allow supervisors to identify and monitor trends or exceptions to policy.
  - The absence of meaningful offsite data inhibits the ability of the supervisor to identify, monitor and track related party exposures in a timely manner and act at an early stage if required. The deficiency in offsite data for related party exposures is exacerbated by the lengthy supervision cycle.
  - There are no specific requirements in relation to the write-off of related party transactions. The EO on Management and Control emphasizes the role of the BOD in relation to oversight of the write off process and boards are expected to have formal procedures.

- Assessment
  - Assessment of Principle 20: Materially Non-Compliant.

### Country risk and transfer risk framework (Principle 21; EC1–EC6)
- Legal and policy framework
  - The EO on Management and Control requires banks to have procedures or descriptions of processes for all significant areas of activity which includes country and transfer risk (section 17(1)).
  - Annex 1, paragraph 15 (point a-c) of the EO requires banks to have procedures that:
    - a) contain a description of the bank’s internal control system for the credit area;
    - b) how internal controls are to be carried out, including the scope and frequency of the internal controls; and
    - c) What reporting is to be carried out for individual exposures and at portfolio level, including the scope and frequency of reporting for all levels of the bank.
  - Section 5(1) and section 18(2) of the EO on Management and Control require Boards to develop and approve a credit policy and ensure procedures reflect board policies.
  - Annex 1, paragraph 2 (point e) requires the credit policy to contain principles for geographical exposure, including the bank’s maximum exposure within selected geographical areas.

- Supervisory assessment and practices (EC1–EC3)
  - Banks are obliged to establish and implement policies for identification, measurement, evaluation and monitoring of country and transfer risk if they are exposed to these risks.
  - In practice, banks have demonstrated capacity to respond to ad hoc information requests and report close-to real-time risk positions across banking and traded portfolios for country and transfer risks (i.e. by currency, country etc).
  - The EO requires independent internal control of all material activities in the credit area and regular internal control that the credit policy is complied with (Annex 1, paragraph 22, point a).
  - The EO requires the BoD to receive at least every quarter reports that illustrate the bank’s compliance with the credit policy, at portfolio and sub-portfolio level and containing information about the bank’s exposures with higher or special risks (Annex 1, paragraph 25).
  - Credit risk reviews are performed on an annual basis for the Group 1 banks with significant portfolios and less frequent for other group banks.
  - Country risk was assessed in detail during 2010 to 2013 where the risks were most evident.
  - The DFSA conducts offsite assessments when macroeconomic conditions indicate country risk concerns; these can lead to onsite examinations.
  - Example: during the euro crisis the DFSA asked the largest banks to report on exposures towards banks in the EU; reporting showed limited exposures to Portugal, Italy, Ireland, Greece and Spain (PIIGS) overall, but one bank was more exposed on utilization and was asked to explain monitoring and control; it was subsequently assessed that country risk did not impose a large risk to the bank.
  - Routine supervisory reporting for the largest banks involves information regarding income, exposures, and other balance sheet information for each of the Group’s subsidiaries and foreign branches on a quarterly frequency.
  - For the largest listed banks, quarterly public disclosures supplemented supervisory reporting and covered additional areas such as impairment charges, and lending and deposits for each subsidiary and foreign branch.

- Provisions, stress testing and supervisory information (EC4–EC6)
  - Provisioning approach:
    - No specific provisioning standards on country risk or transfer risk have been issued.
    - Practice (c) applies: banks assess individual loans on the basis of whether there is an impairment loss in relation to the country and transfer risk in accordance with the general rules for calculating impairment losses.
    - All information that can influence future cash flows, including country and transfer risk, has to be taken into account when calculating impairment losses.
    - The adequacy of impairment losses is judged by the external auditor and by the DFSA on onsite inspections if relevant.
  - Stress testing:
    - The DFSA requires banks to include appropriate scenarios into their stress testing programmes to reflect country and transfer risk analysis for risk management purposes.
    - The FSA performs reviews on the banks’ procedures and documentation; results of stress tests are reported to the DFSA on a six-monthly frequency.
    - Results are analyzed as part of routine supervision and can trigger supervisory activity where necessary.
  - Supervisory information powers:
    - The supervisor regularly obtains and reviews sufficient information on a timely basis on the country risk and transfer risk of banks and has the power to obtain additional information, as needed (e.g. in crisis situations).
  - Supervisory action:
    - Supervisors assess the adequacy of provisions for country and transfer risk during onsite reviews.
    - In the event of deterioration in external market or macroeconomic conditions that impact country and transfer risks, the supervisor will undertake more periodic analysis.

*Source: _cr14352 - Section 78 and 80 in the FBA directly apply to restrict malfeasance. Section 78(1) of the*

### section 347 in the FBA (also see EC5). For example, the DFSA exercised this power in the

### _cr14352 - section 347 in the FBA (also see EC5). For example, the DFSA exercised this power in the

### Assessment of Principle 21
- Overall compliance: Largely Compliant
- Findings:
  - The two largest banks in Denmark have extensive cross-border exposures, the majority of which are within the Nordic countries (Sweden, Norway, and Finland).
  - Banks take on country risk through trade finance in commercial portfolios and extension of foreign currency lending (mainly Euro and Swedish Krona).
  - Domestic banks have limited exposure to foreign currency sovereign bonds.
  - The DFSA receives quarterly data regarding cross-border exposures on a legal entity basis. The data allows the supervisor to assess the size of exposure as a percentage of total assets.
  - On an annual basis supervisors will receive more detailed information regarding the risk profile of cross-border exposures.
  - Through onsite examinations, supervisors will assess the adequacy of the risk management framework to identify and manage country and transfer risk. There was evidence to suggest this process was effective.
  - There are no specific guidelines or regulations for country or transfer risk outside of the general risk management requirements (i.e. EO Management and Control).
  - Where country and transfer risk is de minimus, banks adopt a proportionate approach and manage this risk as a subset of credit risk.
  - For the largest banks with more significant cross-border exposures, standalone reporting is implemented is used to manage and monitor this risk.
  - Offsite surveillance for the major banks where country and transfer risk is most evident is performed quarterly and supervisory reporting requirements are adjusted to enhance the level of detail for supervisors to assess the risk.
  - During the euro crisis, banks were asked to report their exposures and analysis was undertaken to assess the risk in detail.
  - Sovereign exposures has been reported by the largest banks as part of EBA exercise, most recently in the 2013 ‘EBA Transparency exercise’ covering end-2012 and mid 2013 data.
  - Outside of these exercises, country risk is assessed on an ad hoc basis and as such will occur when macroeconomic conditions indicate that country risk can pose a risk to banks.
  - No specific policies are in place to address provisioning for country and transfer risks. Instead, banks are expected to consider this risk as part of their overall provisioning framework.
  - Supervisors perform a thorough review of bank provisioning practices which incorporated country risks.

### Principle 22 — Market risk (overview)
- Principle statement:
  - The supervisor determines that banks have an adequate market risk management process that takes into account their risk appetite, risk profile, and market and macroeconomic conditions and the risk of a significant deterioration in market liquidity. This includes prudent policies and processes to identify measure, evaluate, monitor, report and control or mitigate market risks on a timely basis.

### EC1 — Laws, regulations, and required processes
- Findings:
  - The market risk standards for the Danish banks are set out in the FBA sections 70–71 and specified in the EO on Management and Control of Banks. Taken together, the FBA and EO oblige banks to have a comprehensive view of market risk.
  - FBA section 71 requires banks to have effective processes to identify, measure, monitor, control and report the market risks the bank is or can be exposed to. These include written procedures, internal controls and reporting systems as well as organizational division of responsibilities, including for risk taking, risk management, control and reporting.
  - The specific requirements for market risk management processes are specified in the EO on Management and Control of Banks and are proportional to the bank’s market risk profile, the bank’s size, the structure of the bank and the structure of any group the bank may be part.
  - Main instruments used by banks include: interest rate products, equities and equity derivatives, commodity futures and FX derivatives.
  - Banks have limited exposure to structured credit products, CDS, CDO or other types of exotic instruments.
  - The majority of instruments in the trading book are exchange traded and cleared through central clearing platforms (e.g. LCH).
  - Trading strategies vary; banks largely fulfill customer flow and act as market makers. Proprietary trading is limited to the very few larger banks which take positions in the market for an extended period.
  - Section 70 of the FBA requires the BOD to determine the bank’s market risk profile and codify it in a market risk policy. The BOD must provide the BOM with written guidelines for market risk.
  - Market risk policy and written guidelines must determine desired/acceptable level of market risk, what types of market risks the bank will accept, limits for total market risk and individual market risks, and how exposures and positions subject to limits are calculated.
  - Policies must state purposes for which securities, currency and derivative financial instruments may be traded and which types of derivative financial instruments may be traded or taken positions in.
  - EO on Management and Control of Banks requires appropriate methods for calculations of risks and gains/losses and valuations; external providers must be overseen and regularly evaluated.
  - Independent control functions must verify calculations and reporting; independent controls must cover authority observance, compliance with customer agreements, correct transaction rates/prices, and reconciliations of holdings.
  - Positions need to be valued daily on a marked to market basis according to the EO on Capital Requirements. Where marking to market is not possible, the bank must mark to model before calculating the capital requirement for trading book positions.
  - Models used to value positions need to be developed or approved independently of relevant risk taking business units and shall be independently tested (see EO Annex 2).
  - EO on Capital Requirements: banks must have systems and controls sufficient to provide prudent and reliable valuation estimates and must have procedures for valuation adjustments/reserves for positions that cannot be prudently valued, including concentrated, less liquid, and stale positions.
  - Supervisors verified valuation processes through meetings with risk management staff, assessment of documentation and analysis of external rate sourcing during onsite inspections.
  - Risk management function must be able to report directly to the BOD and at least once a year submit a report on the bank’s risk management processes to the board of directors; it must inform and warn the BOD of reservations regarding the bank’s risk management processes.
  - FBA section 124(1) requires the BOD and the BOM to ensure the bank has adequate capital base and internal procedures for risk measurement and risk management to maintain a capital base adequate to cover the risks of the institution. FBA section 124(4) requires computation of the bank’s individual solvency need.
  - For market risk, banks must assess assets, liabilities and off-balance sheet items for market risks, especially equity risk, interest risk and currency risk (see EO on Capital requirements).

### EC2 — Onsite examinations and board oversight
- Findings:
  - FBA section 70 requires the BOD to determine the bank’s market risk profile and implement it in a market risk policy; the board must provide the board of management with written guidelines on the market risk area.
  - Onsite inspections conducted by the DFSA are the main tool to verify board approval and implementation of market risk policy.
  - DFSA examinations verify that banks have internal information and reporting systems enabling senior management and the board to:
    - monitor the bank’s risk, results and positions;
    - evaluate the bank’s risk profile; and
    - make sure written guidelines for risk taking are being followed.
  - Onsite inspections examine whether reported risks/positions, gains/losses and valuations are measured correctly and controlled independently from risk taking business units.
  - A dedicated unit within the DFSA with specialist market risk skills (Operational Risk Divisions) conducts onsite inspections for larger banks (Group 1).
  - There is a four year cycle of onsite inspections for the larger banks. Supervision of market risks of other banks is placed at responsible banking divisions; the Operational Risk Division may assist them.
  - Onsite inspections for larger banks can be focused on areas/topics depending on offsite risk assessment, bank’s market risk profile, organization on market risk area, capital strength, etc.
  - A typical onsite inspection involves: examination of policy and guidelines, assessment of risk positions and exposure, review of market risk organization including segregation of duties, internal controls and valuations.
  - Onsite approach includes meetings with board members responsible for market risk, internal auditors, front office, back office, middle office, treasury, risk management, chief risk officer and chief compliance officer. The team will sample risk positions and test accuracies of valuations and sources to ensure independence.
  - Onsite inspections assess bank’s ICAAP regarding market risks; marked to market valuations are examined and DFSA verifies systems and independent controls for prudent and reliable valuation estimates for reporting and financial reports.
  - Valuation adjustments/reserves for positions that cannot be prudently valued are discussed in ICAAP examinations. Allocation of positions to trading book and banking book is discussed in ICAAP examinations.
  - DFSA examines banks’ use of models, verifies senior management and board understanding, independent control of models, and inclusion of relevant back tests.
  - In examining market risk profile, limits and management reporting, DFSA assesses consideration given to risk of a significant deterioration in market liquidity.
  - For SIFIs: A political agreement in Parliament on 13 October 2013 requires intensified supervision of SIFIs. The requirements transposing FSB guidelines will be implemented in FBA section 344(3) and expected to come into force in the first quarter of 2014.
  - Intensified supervision of SIFIs will include: more frequent inspections; benchmarking of banks of systemic importance, also in relation to foreign banks of systemic importance; enhanced focus on corporate governance and risk management; and enhanced focus on model risk and capital allocation.
  - As a result, the normal onsite cycle for SIFIs will be annual and the Operational Risk Division for market risk will increase from five staff members to six.

### EC3 — Controlled market risk environment elements
- Requirements assessed:
  - (a) effective information systems for accurate and timely identification, aggregation, monitoring and reporting of market risk exposure to the bank’s Board and senior management;
  - (b) appropriate market risk limits consistent with the bank’s risk appetite, risk profile and capital strength, and with the management’s ability to manage market risk and which are understood by, and regularly communicated to, relevant staff;
  - (c) exception tracking and reporting processes that ensure prompt action at the appropriate level of the bank’s senior management or Board, where necessary;
  - (d) effective controls around the use of models to identify and measure market risk, and set limits; and
  - (e) Sound policies and processes for allocation of exposures to the trading book.
- Findings:
  - See EC1 and EC2 for full discussion.
  - DFSA assesses adequacy of a bank’s market risk policy through onsite review and tests implementation through sample testing.
  - Review of banks’ Board minutes evaluates reporting and governance around exception reporting and adherence to limits.
  - Onsite review verifies compliance against revaluation procedures and allocation of exposures to the trading book.

### EC4 — Valuation frequency, capture, and model controls
- Requirements assessed:
  - Systems and controls to ensure marked-to-market positions are revalued frequently; transactions captured timely; valuation uses consistent and prudent practices and reliable market data verified by independent function; modeling validated independently; policies for valuation adjustments for concentrated, less liquid, and stale positions.
- Findings:
  - Please see EC2 for procedures and onsite verification practices.
  - The majority of Danish banks’ trading is order driven and market making activities are modest.
  - Small and medium banks typically have a low to medium market risk profile with no proprietary trading and with positions mainly in Danish mortgage bonds and Danish government bonds and only some listed Danish or foreign shares. Derivatives are usually only used for hedging purposes.
  - Medium and larger banks typically have a medium market risk profile with some proprietary trading and with positions in more diversified financial instruments such as listed Danish and foreign shares, Danish and foreign corporate, mortgage and government bonds, CDS’ etc.
  - Generally, market risks in Danish banks consist mainly of interest rate risk. Equity risk and currency risk is often moderate and commodity risk is very modest.
  - In supervision, DFSA examines different risk measures that banks must report to the DFSA in accordance to the DFSA’s guidelines on financial reporting to the DFSA. DFSA looks at a sample of positions in both the trading book and the banking book and examines specific and general risk.
  - DFSA benchmarking mainly compares banks to their peers.
  - Onsite inspections verify policies and processes for valuation adjustments on less liquid positions and examine marked-to-market policies and processes, cf. FBA section 346(1).
  - DFSA reviews banks’ written procedures and discusses them with relevant staff to assess whether policies and processes ensure prudent and reliable valuation estimates for reporting and financial reports.
  - DFSA takes into account any comments from internal or external auditors in the audit book.
  - DFSA will normally not engage with external experts to verify banks’ valuation policies and processes but this is a possibility, cf. FBA.

*Source: _cr14352 - section 347 in the FBA (also see EC5). For example, the DFSA exercised this power in the*

### section 344(6).

### section 344(6)

### Market risk: measurement and supervisory expectations
- Interest rate risk shall be calculated as modified duration in accordance with the DFSA’s guidelines on financial reporting to the DFSA (a parallel shift of the yield curve of 1 percentage point).
- Currency risk shall be calculated as a position (indicator 1) or for some banks as a risk measurement (indicator 2).
  - Indicator 1 shall be calculated as the largest of the greater of the sum of all the short currency positions and the sum of all long foreign currency positions.
  - Indicator 2, which is a simple VaR model, shall be calculated in accordance to the DFSA’s guidelines on financial reporting to the DFSA.
- Equity risk shall also be calculated as a sum of net position.

### EC5 — Capital and valuation adjustments
- The supervisor determines that banks hold appropriate levels of capital against unexpected losses and make appropriate valuation adjustments for uncertainties in determining the fair value of assets and liabilities.
- Description and findings:
  - On onsite inspection the DFSA examine the ICAAP to assess whether the bank allocates appropriate levels of capital against unexpected market risk losses and makes appropriate valuation adjustments for uncertainties in determining the fair value of assets and liabilities.
  - The DFSA consider the banks market risk offsite regularly and in connection with a yearly assessment of the banks ICAAPs.
  - Onsite inspections of the market risk area are conducted in accordance with a risk based approach and normally every 4-6 years for the small and smaller banks and more frequently for the larger banks.
  - As regards to SIFIs, in the future the DFSA intends to conduct onsite inspection every year for market risk.

### EC6 — Stress testing market risk exposure
- The supervisor requires banks to include market risk exposure into their stress testing programmes for risk management purposes.
- Description and findings:
  - The DFSA require that the bank’s stress testing programs include the bank’s market risk exposure such that the bank can ensure that the risk management processes is adequate relative to the risk taking on the market risk area.
  - Stress testing is required to be performed by banks annually which include market risk which is a minimum expectation.

### Assessment of Principle 22 — summary assessment and key supervisory observations
- Assessment: Largely Compliant
- Comments (findings and supervisory gaps):
  - The DFSA has a comprehensive set of market risk regulations that require banks to prudently manage market risk.
  - Majority of traded market risk activity is customer driven (flow); typical instruments include Danish mortgage bonds, equities, FX derivatives, and commodities.
  - Banks are required to implement Board approved policies and processes, regularly reviewed and adjusted according to macroeconomic conditions; segregation of duties between front, middle and back office is required; valuation of traded positions is independently verified by risk personnel.
  - Instruments in the trading book are valued using fair market values subject to IFRS.
  - Supervisory reporting of traded market risk could be expanded to capture a broader suite of risk information and results of stress testing. Current offsite reporting consists of data for specific categories: currency, interest rate, commodity and equity products; more exotic instruments will not be captured.
  - There are no minimum expectations for stress testing traded portfolios outside of the annual ICAAP; for positions subject to volatile market movements, more frequent reporting of stress testing is desirable.
- Context motivating strengthening offsite reporting:
  - Market risk for the larger banks is in some instances is not insignificant, ranging between 9.37 percent of RWAs to as high as 15.81 percent for the larger banks;
  - A four year onsite review cycle is not adequate for the larger banks given their risk profile and extent of trading; and
  - The notification regime for market risk is not strong: banks are not required to seek prior approval to commence trading in new types of instruments, or if they amend trading strategies-new products that raise their risk profile.

### Principle 23 — Interest rate risk in the banking book (IRRBB): supervisory framework
- Principle statement:
  - The supervisor determines that banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate risk in the banking book on a timely basis. These systems take into account the bank’s risk appetite, risk profile and market and macroeconomic conditions.
- EC1 — Strategy and management framework (description and findings):
  - EO no. 1325 of 1 December 2010 on Management and Control of Banks etc. requires the board of directors to detail instructions for the management of market-risk including limits on IRR.
  - DFSA guideline on capital adequacy includes IRR and introduces two approaches: a standard approach and a portfolio-based approach; banks can also use advanced internal models.
  - Banks must be able to separate IRR in the banking book from IRR in the trading book and to measure and control these factors.
  - The portfolio based approach allows for netting of positions between IRR in the trading book and IRR in the banking book when certain conditions are met.
  - Capital requirement calculated in the models is based on the level of utilization of market risk limits set by the board of management for IRR in the banking book and IRR in the trading book.
  - Netting arrangements are closely monitored by the DFSA and required conditions include:
    - Duration and size of positions are taken into consideration;
    - The bank is required to actively manage the IRRs including hedging of IRRs in TB and BB;
    - The decision to use netting is decided by senior management and procedures are in place for daily risk management;
    - The strategy and policies are clearly described in the ICAAP.
  - Supervisors review hedging between TB and BB as part of onsite review and annual ICAAP assessment.
  - Banks are required to assess their IRR on a quarterly basis and report to the DFSA through offsite reporting.
  - The supervisor performs an assessment of IRR as part of offsite monitoring; IRR is assessed every quarter with banks’ reporting and via ICAAP; assessed in quarterly analysis by Bank Analysis Division.
  - Onsite inspection frequency: smallest banks at least every sixth year; larger banks for IRR risk once every 2nd year; when SIFI arrangements introduced, SIFI banks will be assessed once a year.

- EC2 — Board approval and senior management implementation (description and findings):
  - EO 1325 requires the board to approve and regularly review a bank’s strategy, policies and processes for the management of IRR.
  - DFSA uses onsite inspections to assess board approval, regular review, and effective development and implementation by senior management.
  - Macroeconomic conditions are taken into account in banks’ stress tests.
  - IRR is managed at ALCOs of Group 1 banks where product, pricing and hedging strategies are developed and confirmed.

- EC3 — Controlled IRR environment: systems, validation, limits, exceptions, information systems (description and findings):
  - MCIs are subject to quarterly monitoring of IRR; interest rate risk is tested in scenarios of both yield curve shifts and yield curve twists.
  - MCIs subject to the ‘Balance Principle’ in the Mortgage-Credit Loans and Mortgage-Credit Bonds Act (paragraphs 19-20).
  - Analysis of IRR for MCIs is conducted by a dedicated supervisory team.
  - DFSA uses bank quarterly reporting to track and monitor IRR; routine reporting includes overview and drilldown including hedges; data compiled in graphical overview (Excel) distributed quarterly in the DFSA’s market risk team; data assessable at bank level or “top-10 level”.
  - Information from ICAAP, risk reports and onsite inspections are used to produce an assessment of IRRBB at least annually.
  - DFSA holds “track-the-market” with the largest Danish Banks annually to collect information about market trends and bank positioning.
  - Group level analysis compares individual banks’ IRR to peer levels: group 1, 2 and 3 with Group 1 being the 5 largest Danish banks.
  - ICAAP is a key annual input; IRR is specifically required to be addressed within the ICAAP.
  - Specific EC3 requirements:
    - (a) Formal requirements for banks to use IRR systems set out in EO 1325; DFSA expects such systems to measure and control IRR and calculate adequate regulatory capital.
    - (b) DFSA requires appropriate and independent controls for market-risk area; if banks outsource IRR tasks they must have independent validation processes to ensure correctness of prices, parameters, etc.
    - (c) DFSA ensures limits are appropriate, understood and regularly reported to the board via review of market risk policy, limits, use of limits, breach processes; banks must adopt market risk policies and appropriate limits under EO Management and Control of Banks; onsite examinations perform sample testing.
    - (d) EO on Management and Control requires regular written reports at all relevant management levels on compliance and utilization of all limits; reporting to the board at intervals stated in the guidelines; transgressions required to be reported at each meeting of the board of directors; incidents of exceeding authority shall normally be reported no later than the day after the incident was ascertained.
    - (e) See above responses.

- EC4 — Stress testing scenarios for IRRBB (description and findings):
  - The supervisor requires banks to include appropriate scenarios into their stress testing programmes to measure their vulnerability to loss under adverse interest rate movements.
  - Description and findings:
    - In the DFSA’s guideline on capital requirements banks must stress their positions on IRR by a standard shock of 200 bps (parallel movement) (see Guideline on adequate capital base).

*Source: _cr14352 - section 344(6).*

### section 6.3).

### _cr14352 - section 6.3)

### Interest rate risk in the banking book (IRRBB)
- Banks are encouraged to consider the effects of bends and twists of the yield curve to their portfolio in the banking book, but this is not strictly required in the guidelines.
- Other stress scenarios than the standard shock are accepted for ICAAP if banks can demonstrate to the DFSA on the basis of their portfolios that other measures are more appropriate than the default stress test of 200 bps.
- The DFSA does not require banks to stress positions in the banking book to lower rates than zero.
- Reporting and measurement requirements:
  - Banks must report quarterly the krone durations of the positions in the banking book.
  - The default interest rate shock applied is the standard shock of 200 bps, but may vary as defined in EC4 which is reflected in the capital requirements for the bank.

### AC1 — Supervisor obtains internal IRR measurement results
- Requirement: The supervisor obtains from banks the results of their internal interest rate risk measurement systems, expressed in terms of the threat to economic value, including using a standardized interest rate shock on the banking book.
- Finding: Banks report quarterly krone durations; default shock is 200 bps (subject to variation per EC4).

### AC2 — Supervisor assesses internal capital systems for IRRBB
- Requirement: The supervisor assesses whether the internal capital measurement systems of banks adequately capture interest rate risk in the banking book.
- Finding: Assessment is performed onsite and covers instruments present in the banking book, types of instruments and their respective durations; reviewed in conjunction with banks’ capital requirements to assess capital adequacy.

### Assessment of Principle 23
- Rating: Compliant
- Findings and comments:
  - Laws and regulations stipulate minimum obligations of banks to manage and mitigate IRR.
  - Supervisor assesses implementation via quarterly offsite surveillance and routine onsite inspections, taking into account bank risk appetite and market conditions.
  - A protracted low interest rate environment has increased the dimension of IRR and changes in interest rate optionality offered to customers.
  - Onsite frequency:
    - Larger banks: onsite inspections at minimum once every four years.
    - Banks with SIFI-status: assessed annually beginning in 2014.
  - Concern: Supervision cycle for medium and smaller banks of once every four to six years is considered too long given limited offsite reporting for quarterly monitoring and risk profiling.

### Principle 24 — Liquidity risk: overview
- Principle: Supervisor sets prudent and appropriate liquidity requirements that reflect liquidity needs, ensures banks have strategies enabling prudent management of liquidity risk, and requires policies/processes to identify, measure, monitor and control/mitigate liquidity risk over appropriate time horizons. For internationally active banks, liquidity requirements are not lower than applicable Basel standards.

### EC1 — Prescribed liquidity requirements and monitoring tools
- Requirement: Laws/regulations or supervisor require banks to observe prescribed liquidity requirements including thresholds; for internationally active banks requirements and monitoring tools are no less extensive than Basel standards.
- Description and findings:
  - Regulations require banks to maintain liquidity buffers above defined quantitative requirements (s.152 of the FBA).
  - Supervisory Diamond requires two liquidity metrics: an excess liquidity coverage requirement and a funding ratio requirement.
  - Quantitative minimums specified:
    - 15 percent of the debt exposures that are the liability of the bank to pay on demand or at notice of no more than one month.
    - 10 percent of the total debt and guarantee exposures of the bank, less subordinated debt that may be included in calculations of the base capital.
  - In practice, the 10 percent total debt ratio is binding for the majority of banks.
  - Liquid asset definition (s.152 of the FBA) includes:
    1) cash in hand,
    2) fully secured and liquid demand deposits with credit institutions and insurance companies,
    3) Holdings of secure, easily realizable, securities and credit funds not used as collateral for a loan.
  - Composition statistics:
    - Danish covered bonds comprise approximately 45 percent of the system’s liquid assets.
    - Sovereign debt comprises approximately 10 percent of the system’s liquid assets.
  - Committed credit facilities count towards a bank’s liquid asset portfolio for the s.152 tests.
  - Liquidity reporting frequency:
    - Banks with working capital above DKK250mn (group 1, 2 & 3) and all banks on the Faroe Islands (Group 6) report monthly.
    - Banks with working capital below DKK250mn (Group 4) report quarterly.
  - Supervisory Diamond additional metrics:
    - Excess coverage of the s.152 requirement of 50 pct.
    - Funding ratio = loans / (working capital less bond issuance with remaining maturity less than one year) — must be below 1.
  - Reporting of LCR and NSFR:
    - Five largest Danish credit institutions (Group 1) have reported monthly LCR and quarterly NSFR-equivalent data since September 2011.
    - From December 2011, LCR and NSFR reporting expanded using the BIII templates.
    - Largest banks (group 1 & 2) perform standardized monthly stress tests defined by the DFSA (EO on Management and Control Annex 4 parameters: no access to market-based funding, idiosyncratic and market-wide disruption etc.).
  - Additional monthly reporting: market-based funding details, stress tests (s.152 ratios over 12 months assuming no access to wholesale markets and interbank).
  - Mortgage Credit Institutions (MCIs) subject to the Balance Principle (Mortgage-Credit Loans and Mortgage-Credit Bonds Act paragraph 19 & 20 and EOn o.718 of June 21, 2007) to limit liquidity and funding risk.

### EC2 — Requirements reflect liquidity risk profile and market context
- Requirement: Prescribed liquidity requirements reflect on- and off-balance sheet risks in context of market and macroeconomic conditions.
- Description and findings:
  - Denmark will implement CRR/CRDIV liquidity rules commencing 1 January 2015; potential NSFR adoption depends on Council and Parliament decision in 2017.
  - Political SIFI-agreement: Ministry of Business and Growth and DFSA, with Danmarks Nationalbank, to propose specific stable funding requirements for banks for later incorporation into Danish law.
  - Supervisors adopt a forward-looking approach to liquidity risk settings.
  - Liability composition for Group 1 banks:
    - Deposits: average 40 percent of liabilities,
    - Debt issued to credit institutions and central banks: 20 percent,
    - Other liabilities: 21percent.
  - All banks report BIII liquidity requirements monthly; DFSA tracks and benchmarks these against Supervisory Diamond levels and group peers.
  - Monthly submissions include composition of liquidity buffer, market funding with original maturity over 1 year (issuance, maturity, type, currency, price), maturity profiles for short-term market funding, composition of deposits, and details of 10 largest term deposits.
  - Monthly standardized liquidity stress test designed by DFSA and DN is submitted by all institutions.
  - DFSA produces monthly bank-level and system-level reports using six liquidity metrics: the two regulatory liquidity requirements, LCR and NSFR metrics, deposit deficit development, maturity profile of market-based funding, dependence on interbank funding, and development of mandatory liquidity stress tests.
  - Banks must consider liquidity risk in annual ICAAP (Annex 1 points 60-69 of EO on Capital; Guidelines on adequate capital base paragraph 7.1).

### EC3 — Robust liquidity management framework and governance
- Requirement: Supervisor determines banks have robust liquidity management frameworks, policies/processes approved by Boards, bank-wide view, consistent with risk profile and systemic importance.
- Description and findings:
  - Requirements set by s.71 of the FBA and Annex 4 of EO Management and Control, aligned with CRD and CEBS guidelines.
  - Boards responsible for liquidity risk management; policies must be Board approved and reviewed annually.
  - Boards ensure liquidity buffers are adequate based on stress testing outcomes; scenarios and liquidity strategy reviewed/adjusted as macroeconomic or market conditions change.
  - Systemic banks have ALCOs meeting at least monthly to consider forward-looking funding requirements.
  - DFSA has a dedicated liquidity team producing monthly reports and meeting larger banks quarterly.
  - Liquidity requirements are being revised to align with CRDIV and ESRB recommendations on asset encumbrance.
  - Liquidity supervision includes group-wide cross-border considerations and coordination with host supervisors where needed.

### EC4 — Liquidity strategy, policies and processes (specific elements)
- Requirement: Supervisor determines liquidity strategy/policies/processes establish appropriate controlled environment including Board-approved risk appetite, day-to-day/intraday practices, information systems, Board oversight and annual review.
- Description and findings:
  - All elements are included in Annex 4 of EO Management and Control and form part of onsite inspections.
  - Onsite examinations typically review: liquidity policy; risk limits and risk appetite; intra-group liquidity funding; group liquidity buffers; stress testing; contingency funding plan; internal controls and risk management.
  - Scope adapts to size, scale and complexity of institution.

### EC5 — Funding strategies and monitoring of funding risk
- Requirement: Supervisor requires banks to establish and review funding strategies, monitor funding requirements and manage funding risk, considering interactions with other risks and including diversification, high-quality unencumbered liquid assets, relationship maintenance with liability holders, and capacity to sell assets.
- Description and findings:
  - Requirements part of Annex 4 of Management and Control; covered by onsite inspection process.
  - Assessors reviewed reports demonstrating onsite coverage of EC4 & EC5 requirements.

### EC6 — Contingency funding plans
- Requirement: Supervisor determines banks have robust contingency funding plans that are documented, set clear responsibilities and communication plans, are regularly tested/updated, and are feasible given risk profile and systemic importance.
- Description and findings:
  - Annex 4 EO requires banks to maintain a contingency funding plan, updated at least annually and reviewed by the Board; reviewed when market conditions change.
  - Plans consider alternative funding sources in stress and strategies to diversify funding base.
  - Danish MCIs:
    - Funding profile: 100 percent of funding from issuance of covered bonds.
    - Regulation limits liquidity risks via the ‘balance principle’.
    - New legislation imposes a soft bullet structure on short-term covered bonds ensuring an automatic 12 month term extension in case of a refinancing failure to minimize tail risk.
  - System concentration risk: high dependence on covered bond funding and covered bonds as key liquid assets represents systemic concentration risk, though the market showed resilience during the crisis; new law on automatic extension reduces probability of lender-of-last-resort reliance for MCIs.

### EC7 — Liquidity stress testing requirements
- Requirement: Supervisor requires a variety of short-term and protracted bank-specific and market-wide stress scenarios with conservative assumptions; results must be used to adjust liquidity strategies and contingency plans.
- Description and findings:
  - EO Management and Control Annex 4 requires monthly stress tests covering at least 12 months.
  - Banks submit standardized monthly stress tests to DFSA with DFSA-defined parameters including idiosyncratic and market-wide stress scenarios.
  - Stress tests are applied to banks but not to MCIs.
  - Individual liquidity stress tests in all foreign currencies are not required monthly to DFSA submission.
  - Danish institutions have limited liquidity exposure in currencies other than DKK and EUR due to DN’s policy to maintain a peg of the Danish Krone and the EUR; USD funding is limited.
  - DFSA monitors foreign currency funding developments and can impose foreign currency stress tests if warranted.

### EC8 — Foreign currency liquidity transformation
- Requirement: Supervisor identifies banks with significant foreign currency liquidity transformation and requires separate analysis/monitoring for significant currencies, stress testing, and limits on cash flow mismatches; supervisor evaluates liquidity transferability across currencies, jurisdictions and entities.
- Description and findings:
  - Monthly liquidity reporting and onsite supervision enable the supervisor to identify banks conducting significant foreign currency liquidity transformation.
  - Where necessary, DFSA imposes additional reporting and risk management requirements, e.g., reporting LCR data on a currency basis or reducing certain funding sources.
  - Upcoming CRR-based LCR monitoring on significant currencies will standardize the approach.

*Source: _cr14352 - section 6.3).*

### introduction of additional monitoring metrics following the upcoming EBA

### introduction of additional monitoring metrics following the upcoming EBA recommendations

### Asset encumbrance (Additional Criterion AC1)
- AC1: The supervisor determines that banks’ levels of encumbered balance-sheet assets are managed within acceptable limits to mitigate the risks posed by excessive levels of encumbrance in terms of the impact on the banks’ cost of funding and the implications for the sustainability of their long-term liquidity position. The supervisor requires banks to commit to adequate disclosure and to set appropriate limits to mitigate identified risks.
- Description and findings:
  - Management and reporting of asset encumbrance levels is not part of the regulation currently in place, but the ESRB recommendation regarding risk management of encumbrance levels is currently being incorporated in the EO on Management and Control, which will come into effect April 1, 2014.
  - In the future, credit institutions will be required to follow the reporting and disclosure measures regarding asset encumbrance currently being developed by the EBA, and which will come into effect in 2014.
  - The FSA’s periodic reports only contain encumbrance information for the banks and not MCIs. The DFSA confirmed anecdotally that due to the business model of the MCIs, their levels of asset encumbrance will be close to 100 percent, depending on the exact definition of encumbrance.
  - The most recent figures for asset encumbrance for banks show that as of December 2012, 29 out of 92 banks had asset encumbrance where central bank financing (including three year LTRO) was the main source for group 2 & 3 banks and for group 1 banks repo transactions was the main source of asset encumbrance.
  - Encumbrance levels were mainly present among group 1 institutions and reflect asset encumbrance from four sources: repo transactions (excluding central bank repo); three year LTRO from the central bank; other secured central bank financing; and covered bonds (SDOs).
  - Other sources of encumbrance such as derivative transactions or CCP transactions are not included as this type of data was not collected.
- Assessment:
  - AC1 is not met: the DFSA does not currently systematically assess that banks’ levels of encumbered balance-sheet assets are managed within acceptable limits to mitigate the risks posed by excessive levels of encumbrance in terms of the impact on the banks’ cost of funding and the implications for the sustainability of their long-term liquidity position.
  - Management of encumbrance levels will be incorporated in the EO on Management and Controls which will come into effect April 1, 2014, in line with ESRB recommendations.

### Liquidity framework and Principle 24 (assessment and key points)
- Assessment of Principle 24: Largely Compliant.
- Key findings:
  - The FBA prescribes two quantitative liquidity requirements that banks need to meet at all times and which are reported to the DFSA on a monthly basis for the majority of banks (very small banks are exempted to quarterly reporting).
  - The Supervisory Diamond includes two metrics which act as early warning indicators; buffers built into the Supervisory Diamond (i.e., 50 percent above s.152 prescribed minimum) act as early warning mechanisms.
  - Systemic banks are subject to reporting LCR and NSFR on a monthly basis.
  - Banks regularly submit results of liquidity stress testing and liquidity and funding positions; the DFSA requires banks to submit results of liquidity stress tests on a monthly frequency. Stress scenarios are standardized.
  - Banks are required to perform monthly stress testing based on an adverse set of assumptions shared with the supervisor and to maintain a contingency funding plan which is part of the onsite examination.
- Shortcomings and concerns:
  - The definition of eligible assets to be included in the liquid asset (HQLA) portfolios is broadly defined and approval by the DFSA is not required.
  - No haircuts are applied to the value of these assets which is not reflective of stress circumstances.
  - Under section 152 banks are given eight days to remediate the shortfall and do not have to notify the DFSA; this period is considered too long. However, if the shortfall is deemed to be of vital importance to the continuation of the conduct of the institution’s business, the DFSA must be notified immediately.
  - Currently there is no limit on own-issued mortgage covered bonds to count in the pool of HQLA to meet the two quantitative liquidity requirements. No portfolio limits are in place as to how much of one asset can be used to meet those liquidity ratios.
  - Assets in the HQLA must be unencumbered, but there are no restrictions on the inclusion of repo assets or re-used repo collateral.
  - Banks are currently transferring out of own-issued mortgage covered bonds to meet the LCR rules.

### Operational risk (Principle 25) — overall assessment
- Assessment of Principle 25: Materially Non-compliant.
- Summary comment:
  - Supervisory reporting is not sufficiently frequent and detailed to identify and monitor changes in operational risk profile. Routine reporting should be expanded to include a broader suite of risk information (e.g., by loss event type and changes in business environment and internal control factors).
  - Formal notification regimes for operational risk are materially shortcoming: no formal regulatory requirement to notify the DFSA of significant operational developments, and no formal assessment that banks are capable of migrating to more sophisticated capital approaches for operational risk.
  - Onsite operational risk examinations are performed as a subset of credit and market risk reviews rather than via comprehensive bank-wide operational risk reviews.

### Operational risk — Essential Criteria findings (EC1–EC8)
- EC1 (requirements for operational risk management strategies, policies and processes):
  - The FBA sets minimum expectations to identify, manage, monitor and report risks (including operational risk but not explicitly in FBA s.71 (iv)).
  - Specific requirements are prescribed in three EOs: EO on Management and Control (Annex 3), EO on Outsourcing Significant Areas of Activity, and EO on IT Security.
  - EO on Management and Control requires banks to implement a policy on managing operational risks including setting operational risk appetite and gathering information on operational incidents (actual and hypothetical), assessments on probability and impact, record-keeping, mitigation, management reporting.
  - No evidence that internal and external loss data was reported by banks as an input into offsite monitoring; only one Group 1 bank had access to consortia data.
  - DFSA’s onsite inspections use a risk-based approach; main source of operational risk for the sector is IT related fraud and BCP/DR.
  - Banks may use Standardized Approach (SA) or Basic Indicator Approach (BIA) for operational risk capital; no Danish banks have applied for or have approved AMA-models. DFSA assesses ICAAP for Pillar II capital adequacy but internal/external loss data and scenario analysis were not a strong focus.
- EC2 (Board approval and oversight):
  - Annex 3 of the EO on Management and Control requires the BOD to assess operational risks at least annually, including risk appetite.
  - Senior management is required to implement the operational risk policy as determined by the BOD; DFSA expects BOD oversight of implementation.
  - BOD approved policies are reviewed as part of onsite examinations.
- EC3 (effective implementation and integration):
  - DFSA supervises operational risk mainly via onsite inspections. Ongoing monitoring via quarterly analysis of loss data or qualitative information is not regularly reported to DFSA.
  - Smallest banks are subject to onsite inspections at least every sixth year (with potential for slippage beyond six years); systemic banks are reviewed more frequently (credit and market risk reviews on a two to three year individual cycle).
  - The current approach does not allow a systematic, independent evaluation of a bank’s operational risk framework bank-wide.
  - Dedicated IT specialist team can conduct 10 targeted IT Security onsite inspections annually.
- EC4 (disaster recovery and business continuity):
  - EO on Management and Control (Annex 5, IT Security) requires BOD to adopt contingency plans for serious operational problems; plans must include objectives and re-establishment procedures.
  - There is no regulatory requirement to regularly test contingency plans (e.g., full fail over to DR site).
  - Quality and comprehensiveness of plans are assessed during onsite inspections; DFSA does not use objective/quantitative measures.
- EC5 (IT policies, infrastructure):
  - Systemic banks are highly sophisticated with large internet-channel product suites.
  - DFSA has a dedicated IT-team that assesses IT strategy alignment, IT risk analysis, IT security policy, written procedures on IT-critical areas, and roles/responsibilities at Board/senior management level.
  - DFSA IT-team comprises 3 skilled IT-experts recruited from industry; the team supports inspections, tool creation, licensing, and works closely with the Central Bank.
  - DFSA may order outside experts to scrutinize IT issues under section 347 b of the FBA if necessary.
- EC6 (information systems to monitor operational risk):
  - (a) DFSA assesses banks’ ability to gather operational risk information during onsite inspections; IT-team can assess IT-security level of critical systems.
  - (b) Ability to compile and analyze gathered data is considered during onsite assessments.
  - (c) Quality of reporting mechanisms is assessed via incident reviews and sample testing of Board minutes and reports.
- EC7 (reporting mechanisms to supervisor):
  - Banks report quarterly the RWA on operational risk (Pillar I) and the ICAAP annually (Pillar II).
  - DFSA expects notification of significant developments (e.g., IT security fraud, business continuity disruption with significant customer impact) and banks typically alert the supervisor when material incidents occur; prior notification protocols are usually written into banks’ incident management procedures.
  - No formal regulatory requirement to report material changes in operational risk profile absent an actual event (e.g., failing to perform DR tests or systems failing without customer impact). Material changes could occur without DFSA notification.
  - For banks using BIA or SA, DFSA does not appear to make prior analysis to ensure preconditions for migration to more sophisticated approaches are met or to confirm sufficient data provision.
- EC8 (outsourcing policies and processes):
  - EO on Outsourcing Significant Areas of Activity sets provisions:
    - (a) Management must ensure service providers have ability and capacity and required licenses.
    - (b) Outsourcing decisions are made by the BOD; contracts must include scope, reporting provisions, chain outsourcing, DFSA access to information, etc.
    - (c) Responsibility for outsourced activities cannot be outsourced; banks must monitor and manage outsourcing risks and maintain effective control environment; DFSA supervises this during onsite inspections.
    - (e) Banks must prepare internal procedures so outsourcing does not impede contingency plans.
  - The Executive Order contains minimum requirements on outsourcing contract content and allocation of responsibilities.

### Additional operational risk criterion (AC1) — concentration and outsourcing
- AC1: The supervisor regularly identifies any common points of exposure to operational risk or potential vulnerability (e.g., outsourcing of key operations by many banks to a common service provider or disruption to outsourcing providers of payment and settlement activities).
- Description and findings:
  - Outsourcing is a key operational risk in the Danish banking sector; many larger banks outsource material IT processing to data centers.
  - Banks have established nine datacenters managed by service providers; the two largest banks own their own data centers independently.
  - According to EO on Outsourcing, DFSA shall be informed of all outsourcing activities of significant areas; through reporting DFSA becomes aware of potential concentrations and adjusts supervision accordingly.
  - DFSA performs ongoing analysis on concentration risk in certain service providers, especially in regards to IT services.

### Summary of supervisory shortcomings and implications
- Operational risk supervision:
  - Supervisory reporting frequency and detail insufficient to identify/monitor operational risk profile changes.
  - No formal regulatory notification requirement for material changes in operational risk profile absent actual incidents.
  - Onsite examinations of operational risk are often conducted as subsets of other risk reviews rather than comprehensive bank-wide assessments.
  - Limited use of thematic (horizontal) targeted reviews on operational risk.
- Liquidity and encumbrance:
  - Encumbrance reporting excludes some instruments (derivatives, CCP transactions) because data was not collected.
  - Broad definitions of eligible HQLA, lack of haircuts, unlimited inclusion of own-issued covered bonds and repo/re-used repo collateral are potential vulnerabilities.
  - Section 152 remediation period of eight days without mandatory DFSA notification (except when vital) is considered too long.

*IMF staff report excerpt: _cr14352 - introduction of additional monitoring metrics following the upcoming EBA recommendations_*

### Section  5(7)  that  the  service  provider  will  provide  the  DFSA,  the  outsourcing  undertaking,

### _cr14352 - Section  5(7)  that  the  service  provider  will  provide  the  DFSA,  the  outsourcing  undertaking,

### Internal audit, outsourcing and Executive Order (EO) references
- Section 5(7) of the Executive Order on Outsourcing Significant Areas of Activity: the service provider will provide the DFSA, the outsourcing undertaking, and its auditors with all necessary information regarding the outsourced activities.
- EO-AUD cross-references and findings:
  - Training and staffing: EO-AUD section 8, 18 and 23 addresses audit staffing and training.
  - Independence and stature: EO-AUD section 18(1), 26, 27 provide that the head of audit can only be hired or fired by the BoD; assessors were advised the head of audit is not eligible for bonuses; reporting line to Audit Committee gives the head of internal audit considerable stature.
  - Advice of material changes: DFSA referenced EO-AU section 21(1) but no explicit provision was found; assessors confirmed this would only be implicit.
  - Access to information and people: EO-AUD section 21(1) provides explicit access to information and is assessed to implicitly cover access to people.
  - Methodology covers material risks: EO-AUD section 24 does so.
  - Audit plan: EO-AUD section 23-24 covers this requirement.
  - Coverage of outsourced functions: DFSA cited EO-AUD section 21(1) but no specific charge is included; assessed that internal auditors would likely interpret their charge to include outsourced functions. Executive Order on Outsourcing Significant Areas of Activity provides Section 5(7) as noted above.

### Assessment — Principle 26
- Assessment: Largely Compliant
- Comments / findings:
  - Gap: EO does not direct that internal auditors of banks must review risk management, compliance and control function.
  - Evidence: Review of audit books and discussions with bankers show some such reviews are done (at least for the largest banks).
  - Recommendation implication: EO should be appropriately updated.
  - Additional elements suggested for revision: provisions related to dual control (or four eyes principle) and provisions on the protection of assets.

### Principle 27 — Financial reporting and external audit (overview)
- Principle statement: Supervisor determines banks and banking groups maintain adequate and reliable records, prepare financial statements in accordance with accounting policies and practices widely accepted internationally, annually publish information that fairly reflects financial condition and performance and bears an independent external auditor’s opinion; supervisor also determines banks and parent companies have adequate governance and oversight of the external audit function.

### Essential Criterion (EC) findings for Principle 27
- EC1
  - Requirement: Supervisor holds Board and management responsible for ensuring statements prepared in accordance with international accounting policies and supported by recordkeeping.
  - Findings:
    - Sections 184 and 185 of the FBA require management and the board to sign the annual financial report and make them responsible for content, including that it is in accordance with legislation and gives a true and fair view.
    - DFSA enforces requirements relating to financial information from banks and enforces for listed banks in accordance with ESMA’s standards for enforcement.
    - DFSA regularly scrutinizes a sample of published financial reports for compliance; all listed banks’ reports are quick scanned and further scrutinized if indicated; material errors/omissions can require corrective publication.

- EC2
  - Requirement: Supervisor holds Board and management responsible that annual financial statements bear an independent external auditor’s opinion from an audit in accordance with internationally accepted auditing practices and standards.
  - Findings:
    - Annual report must be audited (FBA section 193) and include full audit report (section 195(2)).
    - Auditor shall perform audit in accordance with ISA’s: Act on Approved Auditors and Audit Firms, section 16(1) and EO-AUD section 4.
    - FSA receives all annual reports and a copy of the audit book comments and reads the comments. Audit book comments are viewed as a useful source of information.

- EC3
  - Requirement: Valuation practices consistent with international accounting standards; fair value estimation subject to independent verification and validation; documentation of significant differences between valuations used for financial reporting and regulatory purposes.
  - Findings:
    - During inspections, DFSA reviews whether valuation practices are consistent with accounting standards (e.g., sample of real estate valuations).
    - There are not requirements that fair value estimates are subject to independent verification and validation.
    - For regulatory purposes different haircuts are used when assessing need for impairments and for solvency, although starting point is same valuations for financial reporting and regulatory purposes.

- EC4
  - Requirement: Laws/regulations set or supervisor has power to establish scope of external audits and standards; require risk and materiality based approach.
  - Findings:
    - Auditors must perform audits in accordance with ISA’s as described in EC3.
    - If DFSA finds material errors/omissions from generally accepted auditing standards, FSA typically files a complaint to the Disciplinary Board on Auditors. Errors/omissions can be discovered during inspections or other ways.

- EC5
  - Requirement: Supervisory guidelines/local auditing standards determine audits cover loan portfolio, loan loss provisions, non-performing assets, asset valuations, trading and securities activities, derivatives, asset securitizations, consolidation and off-balance sheet vehicles, adequacy of internal controls over financial reporting.
  - Findings:
    - Auditors shall perform audits in accordance with ISA’s and EO-AUD section 11 and 33–34.
    - DFSA receives a copy of the audit book comments.
    - DFSA added requirement for external auditors to specifically review each of the ten largest exposures of the bank.
    - DFSA mandated that solvency be reviewed under a going concern approach.
    - DFSA internal procedure: inspectors read audit book comments to identify comments, inconsistencies or other relevant information to follow-up in relation to the auditor or the bank.

- EC6
  - Requirement: Supervisor has power to reject and rescind appointment of external auditor deemed inadequate in expertise or independence or not adhering to professional standards.
  - Findings:
    - DFSA may dismiss an auditor deemed clearly unfit and instead appoint another auditor (FBA section 199(4)).
    - From January 1, 2014 signing auditors of banks under DFSA’s supervision need to be certified by DFSA before their election as external auditors of banks.
    - Certification applicants in 2014 must document at least 400 hours of audit work from at least 3 different banks. At least half of the hours performed have to be obtained from the role as signing auditor or leader of an audit team.
    - Auditor must have participated in at least 20 hours of education concerning financial undertakings within the past 3 years.
    - Auditor cannot have had a case at the Disciplinary Board of Auditors within the past 5 years which DFSA believes is relevant to assessment.
    - If auditor no longer meets criteria, DFSA can withdraw certification.
    - When DFSA finds material errors/omissions in a performed audit, DFSA typically files a complaint to the Disciplinary Board on Auditors.

- EC7
  - Requirement: Supervisor determines banks rotate their external auditors (firm or individuals) from time to time.
  - Findings:
    - Required under Danish law; supervision of rotation principle is by the Danish Business Authority, not DFSA.
    - Act on Approved Auditors and Audit Firms, section 25 requires partner rotation (replacement for a period of two years not later than seven years after the appointment of the auditor).

- EC8
  - Requirement: Supervisor meets periodically with external audit firms to discuss issues of common interest relating to bank operations.
  - Findings:
    - During ordinary inspections, supervisor always meets with the external auditor to discuss risks, management, reporting and bank status.
    - At least annually executive management of DFSA meets with management of the Danish Auditors Association (FSR—Danske Revisorer) to discuss issues of common interest.
    - DFSA meets representatives from Danish Auditors Association when developing new requirements relating to audit of banks.

- EC9
  - Requirement: Supervisor requires external auditor to report matters of material significance to supervisor; laws/regulations protect auditors who report in good faith from liability for breach of confidentiality.
  - Findings:
    - Section 200 of the FBA: reports must be made by external auditor to DFSA on “matters which are of material importance to the continued operation of the undertaking”.
    - Under section 5(4) of EO-AUD DFSA receives a copy of the audit book comments in relation to the annual report.
    - DFSA rarely receives notification according to section 200. DFSA advised audit profession offers management the choice to contact DFSA directly and, if they do not, the auditor will contact DFSA immediately; this explains low usage of section 200.
    - DFSA internal procedure: investigators read audit book comments to identify information for risk-evaluation of the bank.

- Additional Criterion AC1
  - Requirement: Supervisor has the power to access external auditors’ working papers, where necessary.
  - Findings:
    - Danish Business Authority supervises auditing firms and auditors and has the power to access working papers.
    - DFSA does not have such power.
    - Under section 5(4) of EO-AUD, DFSA receives a copy of the audit book comments in relation to the annual report.

### Assessment — Principle 27
- Assessment: Largely Compliant
- Comments / summary findings:
  - Overall program for external auditors appears sound.
  - DFSA extracts particular value from external auditor work via requirement to review the ten largest exposures and going concern solvency review.
  - Shortcomings:
    - No requirement that fair value estimates be subject to independent verification and validation.
    - DFSA does not have access to work papers of external auditors.

### Principle 28 — Disclosure and transparency (overview)
- Principle statement: Supervisor determines that banks and banking groups regularly publish information on consolidated and, where appropriate, solo basis that is easily accessible and fairly reflects financial condition, performance, risk exposures, risk management strategies and corporate governance policies and processes.

### Essential Criterion findings for Principle 28
- EC1
  - Requirement: Laws, regulations or supervisor require periodic public disclosures of information by banks on consolidated and, where appropriate, solo basis that adequately reflect true financial condition and performance and adhere to standards promoting comparability, relevance, reliability and timeliness.
  - Findings:
    - Section 60 and Annex 20 of EO-CAG: banks required to publicly disclose periodic information under Pillar 3 of the Basel II Capital Accord, including disclosure about the size and calculation of the solvency requirement and the capital base.
    - Section 64 of EO-CAG: information must be published yearly; banks required to periodically assess whether more regular publication is necessary.
    - Section 60 and Annex 20 permit consolidated disclosure under condition every entity shall publish consolidated information according to executive order rules. Quantitative information on a solo basis is also required; organization may supply risk management practices on a consolidated basis.
    - Annex 20, points 5-10 of EO-CAG: banks must publish results and methods for calculating their solvency requirement and publish fulfillment of Pillar II requirements.

- EC2
  - Requirement: Required disclosures include both qualitative and quantitative information on financial performance, position, risk management strategies and practices, risk exposures, aggregate exposures to related parties, transactions with related parties, accounting policies, basic business, management, governance and remuneration; scope and content commensurate with risk profile and systemic importance.
  - Findings:
    - DFSA does not comply with this EC.
    - DFSA does not review whether any of these requirements are met.
    - Assessors were advised only Group 1 banks have such disclosures read at all; reviews performed are for supervisors’ information purposes, not to assess completeness or accuracy.
    - Although provisions in EO-FR could require republication or imposition of a fine, these provisions have never been used.

*Source: IMF staff report content (section excerpts provided).*

### Section 63 of the EO-CAG does put an onus on the banks to have rules regarding the

### _cr14352 - Section 63 of the EO-CAG does put an onus on the banks to have rules regarding the

### Principle 28 — Disclosure and Market Discipline: Findings and Assessment
- EC2: Section 63 of the EO-CAG places an onus on banks to have rules regarding publishing of information required according to the executive order. Given the absence of policing by the DFSA, it is not clear to the assessors that banks carry out their mandate to assess whether the information provide markets participant with a correct picture of the risk profile of the institution.
- EC3: Laws, regulations or the supervisor require banks to disclose all material entities in the group structure.
  - The disclosures are generally required in sections 122, 123 and 131 (10 and 11) in the EO-FR.
- EC4: The supervisor or another government agency effectively reviews and enforces compliance with disclosure standards.
  - Assessors were advised that no review is done of these disclosures for compliance for adherence to the applicable standards.
  - No evidence was presented that anything is done to enforce compliance with the disclosure standards.
- EC5: The supervisor or other relevant bodies regularly publishes information on the banking system in aggregate.
  - The DFSA regularly publishes information on the financial sector including income statement, balance sheet, solvency etc., key figures and analyses on e.g. impairments and loss absorption capacity (semiannually and annually market development articles).
  - The information includes aggregate data as well as institutional for some figures.
- AC1: The disclosure requirements promote information on exposures during a reporting period.
  - Assessors were advised that no information on average exposures or turn-over during the reporting period is required.
- Assessment of Principle 28: Materially Non Compliant.
  - Comments: While disclosure requirements look adequate on paper, the DFSA does not review whether these disclosure requirements are met.
  - Only Group 1 and 2 banks have such disclosures read at all; reviews are for supervisors’ information, not to assess completeness or accuracy of filings.
  - Provisions in the EO-FR that could require republication or imposition of a fine have never been used.

### Principle 29 — Abuse of Financial Services (AML/CFT): Framework, Findings, and Practices
- EC1: Legal basis and supervisory powers for AML/CFT
  - DFSA responsibility provided for in the Danish Act on Measures to Prevent Money Laundering and Financing of Terrorism (no. 1022 of 13. August 2013) (“The AML/CFT Act”), implementing Directive 2005/60/EC.
  - AML/CFT Act obligations include banks’ compliance and DFSA supervision (section 25(1)).
  - Powers of the DFSA in the AML/CFT Act:
    - 34(5): banks shall provide the Danish FSA with the information necessary for supervision of compliance with the Act;
    - 34(6): the Danish FSA may at all time, on proof of identity and without a court order, gain access to banks;
    - 34(7): the Danish FSA may order banks to take the necessary measures in the event of violations of the provisions of the AML/CFT Act etc.
  - DFSA has issued comprehensive guidelines elaborating on section 25(1).
  - Enforcement powers rest with the FIU where the DFSA works closely in prosecuting cases.
  - DFSA cooperates closely and effectively with National Commissioner of Police; Police Districts; Asset Recovery Office; Danish tax authorities; Gambling Authority.
- EC2: Supervisor determines adequacy of banks’ policies and processes
  - AML/CFT supervision allocated to a dedicated team within DFSA Legal Division established in 2010 consisting of 3.5 full-time equivalents (FTE) with multi-disciplinary banking and law backgrounds.
    - Note: the 3.5 FTE are responsible for supervising compliance with the AML/CFT Act across all institutions supervised by the DFSA (banks, insurance, pension etc).
  - Prior to 2010 responsibility rested with line supervisors.
  - Legal and EO frameworks: section 43(1) of the FBA (operate in accordance with honest business principles and good practice); EO on Good Business Practice for Financial Undertakings (No. 928 of 28. June 2013).
  - Onsite examination is the main DFSA tool to verify banks’ preventative and detective AML/CFT controls; typically multiday, conducted by 2-3 DFSA staff, assessing policies, training, sample testing of customer accounts, correspondent banking, PEPs.
  - Number of onsite target AML/CFT examinations:
    - 2010: 2
    - 2011: 5
    - 2012: 5
    - 2013: 4
  - DFSA adopts a risk-based approach, prioritizing larger groups; a large proportion of banks will not be subject to an annual onsite inspection.
  - DFSA implemented a self assessment process for the top 20 banks; a review of self assessment results has not yet been performed.
  - Offsite surveillance does not typically include routine AML/CFT reporting; DFSA does not request information specific to AML/CFT as part of routine offsite supervision.
  - External auditors should generally report material compliance deficiencies to the Board; no specific provisions regarding AML/CFT controls.
  - Enforcement tools per EO:
    - Section 35: DFSA can issue orders to correct lack of good practice.
    - Section 36: fines may be imposed on persons, natural or legal, who fail to comply with such orders.
  - AML/CFT Act contains provisions on prevention, detection and reporting to the Public Prosecutor for Serious Economic Crime; subject to penalty (fines or imprisonment).
  - Section 34(7) of FBA: DFSA may order necessary measures within a time limit; administrative orders subject to follow up investigation.
  - Part 11 of the AML/CFT Act: sections subject to penalties, or in the event of particularly gross or extensive intentional violations imprisonment up to six months.
- EC3: Banks report suspicious activities and incidents of fraud when material to bank safety, soundness or reputation
  - AML/CFT Act section 6: banks required to pay special attention to customers’ activities likely associated with money laundering or financing of terrorism (complex or unusually large transactions, unusual patterns, connections to FATF-identified high-risk countries); purpose must be investigated and results recorded and kept (cf. section 23).
  - AML/CFT Act s.25(2): banks required to appoint a person at management level to ensure compliance with the Act.
  - Section 23(11) and (2): identity and control information must be stored for no less than five years after customer relationship ceases; transaction documents and records to be stored so they can be located together for at least five years; applies to information recorded pursuant to section 6(2).
  - STR reporting:
    - Reports are made to the Public Prosecutor for Serious Economic Crime, the Danish FIU (section 7(1) of the AML/CFT Act).
    - FIU located at the Public Prosecutor for Serious Economic and International Crime; total staff of approximately 21 from 2014.
    - FIU responsible for receipt, analysis, and dissemination of STRs and reports related to certain EU sanctions (WMD).
  - Section 75 of the FBA: banks obligated to immediately inform the DFSA of matters of material significance to continued operation of the bank, which may capture AML/CFT related issues; applies to board members and board of management.
  - Banks are not required to report STRs to the DFSA. The FIU submits quarterly reports to the DFSA containing the number and types of STRs reported by individual banks; DFSA uses report to benchmark volumes and input risk profiling and onsite planning.
  - AML/CFT Act contains a reporting threshold: only report STRs if the suspicion relates to offences punishable by imprisonment of more than one year and this suspicion cannot be disproved.
    - Assessors were advised by the FIU and DFSA that the threshold does not limit the number of STRs reported and that in practice banks report all STRs.
  - STR reporting progress:
    - Since 2009, reporting of STs to the FIU increased from 753 to approximately 3,000 in 2012 out of a total of 5,500 STRs reported for Denmark.
    - The third follow-up report (October 22, 2010) noted that the number of STRs filed by banks remains low by comparison with other countries; scope and quality of STRs not considered sufficient to address MER concerns.
  - Onsite inspection process will evaluate identification and handling of STRs; DFSA becomes aware of quality and effectiveness of banks’ risk management frameworks through this process.
- EC4: Supervisor informs FIU and shares information on suspicious transactions
  - During onsite and offsite inspections, DFSA has access to banks’ STRs and files on investigations that did not result in filing a report to the FIU; DFSA will discuss procedures with banks.
  - No examples of the DFSA making the FIU aware of suspicious transactions were identified.
  - Close cooperation between DFSA and FIU:
    - Danish Money Laundering Forum meets quarterly; participants include DFSA, FIU, Ministry of Taxation, Ministry of Justice, Ministry of Foreign Affairs, Gambling Association, Danish Bar and Law Society, Tax Authorities, Danish Business Authority.
    - Members have executed a formal Memorandum of Understanding to facilitate exchange of information.
  - FBA section 354(6)(2): confidential information may be divulged by DFSA to other public authorities, including prosecution and police, in connection with investigations and legal prosecution of criminal offences covered by Criminal Code or supervision legislation.
  - AML/CFT Act section 7(1): if suspicion relates to offences punishable by imprisonment of more than one year and cannot be disproved, FIU shall be informed immediately.
- EC5: CDD policies and program elements
  - Essential CDD elements listed (a) through (f) including customer acceptance policy, identification and verification (including beneficial ownership), monitoring for unusual transactions, enhanced due diligence for high-risk accounts and PEPs, record-keeping with at least five year retention.
  - Description and findings re EC5: (content truncated in source at this point).

*Source: _cr14352 - Section 63 of the EO-CAG does put an onus on the banks to have rules regarding the (IMF staff report excerpt).*

### Section 25 of the AML/CFT Act prescribes the expectations in relation to banks’ processes

### Section 25 of the AML/CFT Act prescribes the expectations in relation to banks’ processes

### DFSA supervisory framework and scope
- The DFSA issues comprehensive guidelines on the AML/CFT Act and, while conducting inspections (onsite or off site), reviews banks’ overall risk assessments which must be approved by bank management.
- The DFSA assesses whether banks’ risk assessments are appropriate to identify, assess, monitor, manage and mitigate risks of money laundering and the financing of terrorism with respect to customers.
- The DFSA determines whether banks have established policies and processes on other relevant AML/CFT areas, referencing provisions of the AML/CFT Act including:
  - Sections 25(1), 11, 12, 13, 14 (occasional customers), 15 (transactions for a third party) and 16 (transfer of funds).
  - Section 12(5).
  - Part 3: “Investigation and reporting obligations”, sections 6 and 7 and section 25(1).
  - Sections 25(1) and 19.
  - Section 19(4).
  - Section 23.
- Compliance assessment methods:
  - Onsite reviews involving face-to-face interviews, review of policies and procedures, and sample testing of transactions.
  - Typical onsite sample testing: approximately 50 accounts, split between retail and corporate customers.
  - Self-assessment questionnaire required from banks to cover training, reporting and MI systems.

### Customer due diligence (CDD) and account opening obligations (legal provisions)
- Section 25(1) requires banks to prepare adequate written internal rules about customer identification, obligation of attentiveness, investigation and recording, reporting, record-keeping and internal control.
- Section 11: Customers must identify themselves if a transaction or consultancy assignment is suspected to involve financing of terrorism or money laundering covered by section 7 reporting obligation.
- Section 12 (CDD basics):
  - Banks shall demand proof of identity when establishing business relationships, including opening of an account or a custody account.
  - For natural persons: proof of identity shall include name, address, civil registration number (CPR number) or similar documentation if no CPR number.
  - For undertakings: proof of identity shall include name, address, CVR number (business registration number) or similar documentation if no CVR number.
  - Ownership and control structure of the undertaking shall be clarified and beneficial owners provide proof of identity.
  - Information shall be obtained about each customer's objective regarding the business relationship and the intended extent.
  - Customer relationships shall be monitored on a regular basis; transactions shall be monitored for consistency with knowledge of the customer and risk profile, including source of funds where necessary.
  - Documents, data or other information about the customer shall be kept up to date; doubts about previously obtained identification data require new proof of identity.
- Section 13: Identification procedure to be completed in connection with establishment of the customer relationship and no later than before carrying out the transaction; may be deferred in line with risk assessment to avoid interrupting normal conduct of business but completed as soon as practicable.
- Section 14(1) (occasional customers): Assistance for isolated transactions may omit sections 12, 15 and 19 if transaction ≤ EUR 1,000; compliance with section 12(3), 2nd clause may be omitted on basis of a risk assessment if transaction ≤ EUR 15,000.
- Section 15: Transactions for a third party.
- Section 16: Transfer of funds.
- Section 19: Enhanced customer identification, inter alia politically exposed persons and correspondent banking relationships.
- Section 23: Information on proof of identity must be kept for a minimum of five years after termination of the business relationship; documents and records concerning transactions stored for at least five years after performance of the transactions.
- Section 26: Notifications and information disclosed in good faith about suspicious transactions incur no liability for the reporting person.

### Executive Orders and PEP / high-risk country measures
- Danish EO No 712 of 1 July 2008:
  - Provides for exemptions from the AML/CFT Act for natural and legal persons and products and contains the definition of "politically exposed persons" (see FSA Regulation 712/2008).
  - Implements Commission Directive 2006/70/EC concerning definition of “politically exposed person” and technical criteria for simplified CDD and exemptions for occasional/very limited financial activity.
  - Enhanced due diligence for PEPs requires a senior manager from the bank to approve continuation of customer relationships established before January 1, 2007 (paragraph 19(5) of the AML/CFT Act).
- EO no. 1347 of 3 December 2010:
  - Lists countries/territories considered high risk (FATF list) and requires special attention to transactions connected to those jurisdictions; lists current “black list” countries.

### Correspondent banking (EC6)
- DFSA requires banks to have specific correspondent banking policies and processes including:
  - (a) Gathering sufficient information about respondent banks to fully understand their business, customer base and supervision.
  - (b) Not establishing or continuing correspondent relationships with respondent banks that lack adequate controls against criminal activities, are not effectively supervised, or are shell banks.
- Section 19(6) of the AML/CFT Act:
  - Banks may not enter into or continue a correspondent banking relationship with a shell bank and shall take reasonable measures to avoid connections with institutions known to permit shell banks to use their accounts.
- DFSA practice:
  - Since 2011, correspondent banking relationships have been a focus in onsite reviews of the largest banks.
  - Onsite reviews assessed appropriateness of risk management for correspondent relationships, policies for existing relationships and arrangements for new relationships.
  - Reviews led to requirements for banks to investigate existing relationships and enhance policies and processes.
  - Onsite inspections include spot checks on measures taken when accepting co-respondent banks, including obtaining sufficient information to ensure adequate and effective controls.

### Internal controls, governance, training and reporting (EC7–EC11)
- EC7: DFSA verifies banks have sufficient controls and systems to prevent, identify and report potential abuses, including money laundering and terrorist financing:
  - Onsite examinations include discussions with management, review of documentation and sample testing (approximately 50 accounts).
- EC9 components and findings:
  - (a) Internal audit / external experts: Section 24 of EO no. 1224 of 21 August 2013 requires auditing in undertakings with internal audit functions to follow generally accepted auditing practice. DFSA has access to reports cf. section 347 of the FBA.
  - (b) Compliance officer: Section 22 of EO no. 1325 of 1 December 2010 requires undertakings to name an employee responsible for compliance, reporting to the board at least once a year; DFSA determines banks have policies/processes to meet this demand during inspections.
  - (c) Screening policies: No specific codified requirements for screening policies/processes to ensure high ethical and professional standards when hiring staff or entering agency/outsourcing relationships.
  - (d) Training: DFSA reviews training and instruction programmes for employees during onsite inspections to determine appropriateness and tailoring to different employee roles (section 25(1)).
- EC10: Reporting systems and MI:
  - DFSA evaluates whether banks have clear staff reporting policies and adequate MI systems during onsite inspections.
  - Board reporting via the CRO report and internal audit reports to the Audit Committee includes evidence of compliance and statistics on STRs.
  - DFSA introduced a self-assessment questionnaire to supplement onsite reviews.
- EC11: Whistleblower protection:
  - Section 26 provides that notifications and information disclosed in good faith about suspicious transactions do not incur liability.

### Cooperation, confidentiality and resources (EC12–EC13)
- EC12 (cooperation and information sharing):
  - Section 354 of the FBA allows confidential information to be divulged to several Danish public and judicial authorities and institutions, DN, foreign central banks and the European Central Bank; confidentiality duty projected to these national and foreign authorities and institutions (FBA section 354(7)).
  - DFSA participates actively in domestic and international AML/CFT fora and shares information where necessary.
  - DFSA established the Danish Money Laundering Forum with quarterly meetings including FIU, Ministry of Taxation, Ministry of Justice, Ministry of Foreign Affairs, Gambling Association, The Danish Bar and Law Society, Tax Authorities and Danish Business Authority.
  - AML/CFT Act (s.34) permits divulgence of confidential information to:
    - Other public authorities, including prosecution and police.
    - Supervisory authorities in other EU Member States or countries with EU financial area agreements responsible for AML/CFT compliance.
    - Financial supervisory authorities in countries outside the EU without an EU financial area agreement responsible for AML/CFT compliance.
- EC13 (in-house specialist expertise and resources):
  - DFSA’s Legal Division has specialist expertise on anti-money laundering obligations and participates in FATF and European Commission Expert Group meetings.
  - The Public Prosecutor for Serious Economic Crime (FIU) has specialist expertise on money laundering.
  - The dedicated DFSA team supervises compliance of approximately 971 organizations.
  - Current headcount: 3 ½ FTEs for this dedicated team, which “would seem stretched” to conduct onsite examinations for this number of organizations.

### Enforcement, penalties and trends
- DFSA administrative orders are subject to follow up investigation; penalties for breaches specified in part 11 of the AML/CFT Act and, for particularly gross or extensive intentional violations, imprisonment up to six months.
- AML prosecutions and fines in the last five years (from assessment):
  - Forex Bank A/S (2011): fined 3.7 million DKK.
  - Arbejdernes Landsbank A/S (2013): fined 5.5 million DKK.
- Reporting of STRs:
  - Banks report STRs to the FIU (not to DFSA).
  - FIU and DFSA receive statistics from SØIK on a quarterly basis on STRs received by SØIK, including sector aggregates and institutional-level numbers.
  - Increased STR reporting observed, but DFSA notes increased reporting alone is insufficient to establish effectiveness of the AML/CFT regime.

### Assessment of implementation and gaps (Principle 29)
- Assessment: Largely Compliant.
- Positive developments:
  - DFSA has developed a risk-based onsite examination program and a self-assessment questionnaire.
  - DFSA actively liaises with the FIU, increasing STR reporting and AML prosecutions.
  - Onsite examinations of the largest banks have been used to assess adequacy/effectiveness of controls and capture majority of banking system assets.
- Remaining deficiencies and concerns:
  - DFSA has not yet performed onsite examinations of all banks; greater onsite presence is required for the population of banks.
  - DFSA does not receive periodic reporting from banks regarding quality and effectiveness of risk management in relation to AML-CFT compliance.
  - DFSA does not have a range of powers to directly sanction breaches of the AML/CFT Act; this sanctioning power falls to the FIU.
  - The 3 ½ FTEs dedicated to supervising approximately 971 organizations appears insufficient to carry out necessary onsite examinations.
- Next evaluation timeline:
  - The next evaluation of Denmark’s AML/CFT framework will be conducted in late 2015 and the report will be discussed at the October 2016 FATF Plenary.
- Recommendation (implied by assessors’ comments):
  - Authorities are encouraged to address the remaining deficiencies and effectively implement the revised FATF standard.

*Source: _cr14352 - Section 25 of the AML/CFT Act prescribes the expectations in relation to banks’ processes*

---


_Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2014/_cr14352.pdf_